Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
- Arrival Time: Jul 25, 2012 14:03:12.718159000 BST
- Epoch Time: 1343221392.718159000 seconds
- [Time delta from previous captured frame: 0.000000000 seconds]
- [Time delta from previous displayed frame: 0.000000000 seconds]
- [Time since reference or first frame: 0.000000000 seconds]
- Frame Number: 1
- Frame Length: 74 bytes (592 bits)
- Capture Length: 74 bytes (592 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 60
- Identification: 0x0001 (1)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x00d5 [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 0, Len: 0
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 0 (relative sequence number)
- Header length: 40 bytes
- Flags: 0x002 (SYN)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...0 .... = Acknowledgement: Not set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..1. = Syn: Set
- [Expert Info (Chat/Sequence): Connection establish request (SYN): server port http]
- [Message: Connection establish request (SYN): server port http]
- [Severity level: Chat]
- [Group: Sequence]
- .... .... ...0 = Fin: Not set
- Window size value: 14360
- [Calculated window size: 14360]
- Checksum: 0x3a15 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (20 bytes)
- Maximum segment size: 1436 bytes
- TCP SACK Permitted Option: True
- Timestamps: TSval 2728990, TSecr 0
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2728990
- Timestamp echo reply: 0
- No-Operation (NOP)
- Window scale: 4 (multiply by 16)
- Kind: Window Scale (3)
- Length: 3
- Shift count: 4
- [Multiplier: 16]
- Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
- Arrival Time: Jul 25, 2012 14:03:12.956990000 BST
- Epoch Time: 1343221392.956990000 seconds
- [Time delta from previous captured frame: 0.238831000 seconds]
- [Time delta from previous displayed frame: 0.238831000 seconds]
- [Time since reference or first frame: 0.238831000 seconds]
- Frame Number: 2
- Frame Length: 78 bytes (624 bits)
- Capture Length: 78 bytes (624 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 64
- Identification: 0x3bb3 (15283)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0xd11e [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 0, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 0 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 44 bytes
- Flags: 0x012 (SYN, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..1. = Syn: Set
- [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
- [Message: Connection establish acknowledge (SYN+ACK): server port http]
- [Severity level: Chat]
- [Group: Sequence]
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- Checksum: 0x0070 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (24 bytes)
- Maximum segment size: 1460 bytes
- No-Operation (NOP)
- Window scale: 0 (multiply by 1)
- Kind: Window Scale (3)
- Length: 3
- Shift count: 0
- [Multiplier: 1]
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 0, TSecr 0
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 0
- Timestamp echo reply: 0
- No-Operation (NOP)
- No-Operation (NOP)
- TCP SACK Permitted Option: True
- [SEQ/ACK analysis]
- [This is an ACK to the segment in frame: 1]
- [The RTT to ACK the segment was: 0.238831000 seconds]
- Frame 3: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:12.957039000 BST
- Epoch Time: 1343221392.957039000 seconds
- [Time delta from previous captured frame: 0.000049000 seconds]
- [Time delta from previous displayed frame: 0.000049000 seconds]
- [Time since reference or first frame: 0.238880000 seconds]
- Frame Number: 3
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x0002 (2)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x00dc [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3a0d [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2729050, TSecr 0
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2729050
- Timestamp echo reply: 0
- [SEQ/ACK analysis]
- [This is an ACK to the segment in frame: 2]
- [The RTT to ACK the segment was: 0.000049000 seconds]
- Frame 4: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
- Arrival Time: Jul 25, 2012 14:03:12.957219000 BST
- Epoch Time: 1343221392.957219000 seconds
- [Time delta from previous captured frame: 0.000180000 seconds]
- [Time delta from previous displayed frame: 0.000180000 seconds]
- [Time since reference or first frame: 0.239060000 seconds]
- Frame Number: 4
- Frame Length: 227 bytes (1816 bits)
- Capture Length: 227 bytes (1816 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp:http]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 213
- Identification: 0x0003 (3)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x003a [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- [Next sequence number: 162 (relative sequence number)]
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3aae [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2729050, TSecr 0
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2729050
- Timestamp echo reply: 0
- [SEQ/ACK analysis]
- [Bytes in flight: 161]
- Hypertext Transfer Protocol
- GET / HTTP/1.1\r\n
- [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
- [Message: GET / HTTP/1.1\r\n]
- [Severity level: Chat]
- [Group: Sequence]
- Request Method: GET
- Request URI: /
- Request Version: HTTP/1.1
- User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
- Host: dest.com\r\n
- Accept: */*\r\n
- \r\n
- [Full request URI: http://dest.com/]
- Frame 5: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:13.197657000 BST
- Epoch Time: 1343221393.197657000 seconds
- [Time delta from previous captured frame: 0.240438000 seconds]
- [Time delta from previous displayed frame: 0.240438000 seconds]
- [Time since reference or first frame: 0.479498000 seconds]
- Frame Number: 5
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x432f (17199)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0xc9ae [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- [Window size scaling factor: 1]
- Checksum: 0x98b1 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 970450, TSecr 530889220
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 970450
- Timestamp echo reply: 530889220
- [SEQ/ACK analysis]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 1]
- [Duplicate to the ACK in frame: 2]
- [Expert Info (Note/Sequence): Duplicate ACK (#1)]
- [Message: Duplicate ACK (#1)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 6: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
- Arrival Time: Jul 25, 2012 14:03:13.674849000 BST
- Epoch Time: 1343221393.674849000 seconds
- [Time delta from previous captured frame: 0.477192000 seconds]
- [Time delta from previous displayed frame: 0.477192000 seconds]
- [Time since reference or first frame: 0.956690000 seconds]
- Frame Number: 6
- Frame Length: 227 bytes (1816 bits)
- Capture Length: 227 bytes (1816 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp:http]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 213
- Identification: 0x0004 (4)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x0039 [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- [Next sequence number: 162 (relative sequence number)]
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3aae [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2729230, TSecr 970450
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2729230
- Timestamp echo reply: 970450
- [SEQ/ACK analysis]
- [Bytes in flight: 161]
- [TCP Analysis Flags]
- [This frame is a (suspected) retransmission]
- [Expert Info (Note/Sequence): Retransmission (suspected)]
- [Message: Retransmission (suspected)]
- [Severity level: Note]
- [Group: Sequence]
- [The RTO for this segment was: 0.717630000 seconds]
- [RTO based on delta from frame: 4]
- Hypertext Transfer Protocol
- GET / HTTP/1.1\r\n
- [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
- [Message: GET / HTTP/1.1\r\n]
- [Severity level: Chat]
- [Group: Sequence]
- Request Method: GET
- Request URI: /
- Request Version: HTTP/1.1
- User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
- Host: dest.com\r\n
- Accept: */*\r\n
- \r\n
- [Full request URI: http://dest.com/]
- Frame 7: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:13.916378000 BST
- Epoch Time: 1343221393.916378000 seconds
- [Time delta from previous captured frame: 0.241529000 seconds]
- [Time delta from previous displayed frame: 0.241529000 seconds]
- [Time since reference or first frame: 1.198219000 seconds]
- Frame Number: 7
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x5adb (23259)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0xb202 [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- [Window size scaling factor: 1]
- Checksum: 0x98aa [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 970457, TSecr 530889220
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 970457
- Timestamp echo reply: 530889220
- [SEQ/ACK analysis]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 2]
- [Duplicate to the ACK in frame: 2]
- [Expert Info (Note/Sequence): Duplicate ACK (#2)]
- [Message: Duplicate ACK (#2)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 8: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
- Arrival Time: Jul 25, 2012 14:03:15.118818000 BST
- Epoch Time: 1343221395.118818000 seconds
- [Time delta from previous captured frame: 1.202440000 seconds]
- [Time delta from previous displayed frame: 1.202440000 seconds]
- [Time since reference or first frame: 2.400659000 seconds]
- Frame Number: 8
- Frame Length: 227 bytes (1816 bits)
- Capture Length: 227 bytes (1816 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp:http]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 213
- Identification: 0x0005 (5)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x0038 [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- [Next sequence number: 162 (relative sequence number)]
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3aae [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2729591, TSecr 970457
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2729591
- Timestamp echo reply: 970457
- [SEQ/ACK analysis]
- [Bytes in flight: 161]
- [TCP Analysis Flags]
- [This frame is a (suspected) retransmission]
- [Expert Info (Note/Sequence): Retransmission (suspected)]
- [Message: Retransmission (suspected)]
- [Severity level: Note]
- [Group: Sequence]
- [The RTO for this segment was: 2.161599000 seconds]
- [RTO based on delta from frame: 4]
- Hypertext Transfer Protocol
- GET / HTTP/1.1\r\n
- [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
- [Message: GET / HTTP/1.1\r\n]
- [Severity level: Chat]
- [Group: Sequence]
- Request Method: GET
- Request URI: /
- Request Version: HTTP/1.1
- User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
- Host: dest.com\r\n
- Accept: */*\r\n
- \r\n
- [Full request URI: http://dest.com/]
- Frame 9: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
- Arrival Time: Jul 25, 2012 14:03:15.148365000 BST
- Epoch Time: 1343221395.148365000 seconds
- [Time delta from previous captured frame: 0.029547000 seconds]
- [Time delta from previous displayed frame: 0.029547000 seconds]
- [Time since reference or first frame: 2.430206000 seconds]
- Frame Number: 9
- Frame Length: 78 bytes (624 bits)
- Capture Length: 78 bytes (624 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 64
- Identification: 0x01f8 (504)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0x0ada [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 0, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 0 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 44 bytes
- Flags: 0x012 (SYN, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..1. = Syn: Set
- [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
- [Message: Connection establish acknowledge (SYN+ACK): server port http]
- [Severity level: Chat]
- [Group: Sequence]
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- Checksum: 0x0070 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (24 bytes)
- Maximum segment size: 1460 bytes
- No-Operation (NOP)
- Window scale: 0 (multiply by 1)
- Kind: Window Scale (3)
- Length: 3
- Shift count: 0
- [Multiplier: 1]
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 0, TSecr 0
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 0
- Timestamp echo reply: 0
- No-Operation (NOP)
- No-Operation (NOP)
- TCP SACK Permitted Option: True
- Frame 10: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
- Arrival Time: Jul 25, 2012 14:03:15.148400000 BST
- Epoch Time: 1343221395.148400000 seconds
- [Time delta from previous captured frame: 0.000035000 seconds]
- [Time delta from previous displayed frame: 0.000035000 seconds]
- [Time since reference or first frame: 2.430241000 seconds]
- Frame Number: 10
- Frame Length: 78 bytes (624 bits)
- Capture Length: 78 bytes (624 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 64
- Identification: 0x0006 (6)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x00cc [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 162, Ack: 1, Len: 0
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 162 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 44 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3a19 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (24 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2729598, TSecr 970457
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2729598
- Timestamp echo reply: 970457
- No-Operation (NOP)
- No-Operation (NOP)
- SACK: 0-1
- left edge = 0 (relative)
- right edge = 1 (relative)
- [SEQ/ACK analysis]
- [This is an ACK to the segment in frame: 9]
- [The RTT to ACK the segment was: 0.000035000 seconds]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 1]
- [Duplicate to the ACK in frame: 8]
- [Expert Info (Note/Sequence): Duplicate ACK (#1)]
- [Message: Duplicate ACK (#1)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 11: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:15.357719000 BST
- Epoch Time: 1343221395.357719000 seconds
- [Time delta from previous captured frame: 0.209319000 seconds]
- [Time delta from previous displayed frame: 0.209319000 seconds]
- [Time since reference or first frame: 2.639560000 seconds]
- Frame Number: 11
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x0906 (2310)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0x03d8 [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- [Window size scaling factor: 1]
- Checksum: 0x989b [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 970472, TSecr 530889220
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 970472
- Timestamp echo reply: 530889220
- [SEQ/ACK analysis]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 1]
- [Duplicate to the ACK in frame: 9]
- [Expert Info (Note/Sequence): Duplicate ACK (#1)]
- [Message: Duplicate ACK (#1)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 12: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:15.387653000 BST
- Epoch Time: 1343221395.387653000 seconds
- [Time delta from previous captured frame: 0.029934000 seconds]
- [Time delta from previous displayed frame: 0.029934000 seconds]
- [Time since reference or first frame: 2.669494000 seconds]
- Frame Number: 12
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x09ec (2540)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0x02f2 [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- [Window size scaling factor: 1]
- Checksum: 0x989b [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 970472, TSecr 530889220
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 970472
- Timestamp echo reply: 530889220
- [SEQ/ACK analysis]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 2]
- [Duplicate to the ACK in frame: 9]
- [Expert Info (Note/Sequence): Duplicate ACK (#2)]
- [Message: Duplicate ACK (#2)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 13: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
- Arrival Time: Jul 25, 2012 14:03:18.002798000 BST
- Epoch Time: 1343221398.002798000 seconds
- [Time delta from previous captured frame: 2.615145000 seconds]
- [Time delta from previous displayed frame: 2.615145000 seconds]
- [Time since reference or first frame: 5.284639000 seconds]
- Frame Number: 13
- Frame Length: 227 bytes (1816 bits)
- Capture Length: 227 bytes (1816 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp:http]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 213
- Identification: 0x0007 (7)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x0036 [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- [Next sequence number: 162 (relative sequence number)]
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3aae [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2730312, TSecr 970472
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2730312
- Timestamp echo reply: 970472
- [SEQ/ACK analysis]
- [Bytes in flight: 161]
- [TCP Analysis Flags]
- [This frame is a (suspected) retransmission]
- [Expert Info (Note/Sequence): Retransmission (suspected)]
- [Message: Retransmission (suspected)]
- [Severity level: Note]
- [Group: Sequence]
- [The RTO for this segment was: 5.045579000 seconds]
- [RTO based on delta from frame: 4]
- Hypertext Transfer Protocol
- GET / HTTP/1.1\r\n
- [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
- [Message: GET / HTTP/1.1\r\n]
- [Severity level: Chat]
- [Group: Sequence]
- Request Method: GET
- Request URI: /
- Request Version: HTTP/1.1
- User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
- Host: dest.com\r\n
- Accept: */*\r\n
- \r\n
- [Full request URI: http://dest.com/]
- Frame 14: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:18.245783000 BST
- Epoch Time: 1343221398.245783000 seconds
- [Time delta from previous captured frame: 0.242985000 seconds]
- [Time delta from previous displayed frame: 0.242985000 seconds]
- [Time since reference or first frame: 5.527624000 seconds]
- Frame Number: 14
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x63ab (25515)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0xa932 [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- [Window size scaling factor: 1]
- Checksum: 0x987f [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 970500, TSecr 530889220
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 970500
- Timestamp echo reply: 530889220
- [SEQ/ACK analysis]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 3]
- [Duplicate to the ACK in frame: 9]
- [Expert Info (Note/Sequence): Duplicate ACK (#3)]
- [Message: Duplicate ACK (#3)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 15: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
- Arrival Time: Jul 25, 2012 14:03:21.082394000 BST
- Epoch Time: 1343221401.082394000 seconds
- [Time delta from previous captured frame: 2.836611000 seconds]
- [Time delta from previous displayed frame: 2.836611000 seconds]
- [Time since reference or first frame: 8.364235000 seconds]
- Frame Number: 15
- Frame Length: 78 bytes (624 bits)
- Capture Length: 78 bytes (624 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 64
- Identification: 0x3c50 (15440)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0xd081 [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 0, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 0 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 44 bytes
- Flags: 0x012 (SYN, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..1. = Syn: Set
- [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
- [Message: Connection establish acknowledge (SYN+ACK): server port http]
- [Severity level: Chat]
- [Group: Sequence]
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- Checksum: 0x0070 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (24 bytes)
- Maximum segment size: 1460 bytes
- No-Operation (NOP)
- Window scale: 0 (multiply by 1)
- Kind: Window Scale (3)
- Length: 3
- Shift count: 0
- [Multiplier: 1]
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 0, TSecr 0
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 0
- Timestamp echo reply: 0
- No-Operation (NOP)
- No-Operation (NOP)
- TCP SACK Permitted Option: True
- Frame 16: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
- Arrival Time: Jul 25, 2012 14:03:21.082421000 BST
- Epoch Time: 1343221401.082421000 seconds
- [Time delta from previous captured frame: 0.000027000 seconds]
- [Time delta from previous displayed frame: 0.000027000 seconds]
- [Time since reference or first frame: 8.364262000 seconds]
- Frame Number: 16
- Frame Length: 78 bytes (624 bits)
- Capture Length: 78 bytes (624 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 64
- Identification: 0x0008 (8)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x00ca [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 162, Ack: 1, Len: 0
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 162 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 44 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3a19 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (24 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2731081, TSecr 970500
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2731081
- Timestamp echo reply: 970500
- No-Operation (NOP)
- No-Operation (NOP)
- SACK: 0-1
- left edge = 0 (relative)
- right edge = 1 (relative)
- [SEQ/ACK analysis]
- [This is an ACK to the segment in frame: 15]
- [The RTT to ACK the segment was: 0.000027000 seconds]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 1]
- [Duplicate to the ACK in frame: 13]
- [Expert Info (Note/Sequence): Duplicate ACK (#1)]
- [Message: Duplicate ACK (#1)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 17: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:21.324332000 BST
- Epoch Time: 1343221401.324332000 seconds
- [Time delta from previous captured frame: 0.241911000 seconds]
- [Time delta from previous displayed frame: 0.241911000 seconds]
- [Time since reference or first frame: 8.606173000 seconds]
- Frame Number: 17
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x4371 (17265)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0xc96c [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- [Window size scaling factor: 1]
- Checksum: 0x985f [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 970532, TSecr 530889220
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 970532
- Timestamp echo reply: 530889220
- [SEQ/ACK analysis]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 1]
- [Duplicate to the ACK in frame: 15]
- [Expert Info (Note/Sequence): Duplicate ACK (#1)]
- [Message: Duplicate ACK (#1)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 18: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
- Arrival Time: Jul 25, 2012 14:03:23.778946000 BST
- Epoch Time: 1343221403.778946000 seconds
- [Time delta from previous captured frame: 2.454614000 seconds]
- [Time delta from previous displayed frame: 2.454614000 seconds]
- [Time since reference or first frame: 11.060787000 seconds]
- Frame Number: 18
- Frame Length: 227 bytes (1816 bits)
- Capture Length: 227 bytes (1816 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp:http]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 213
- Identification: 0x0009 (9)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x0034 [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- [Next sequence number: 162 (relative sequence number)]
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3aae [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2731756, TSecr 970532
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2731756
- Timestamp echo reply: 970532
- [SEQ/ACK analysis]
- [Bytes in flight: 161]
- [TCP Analysis Flags]
- [This frame is a (suspected) retransmission]
- [Expert Info (Note/Sequence): Retransmission (suspected)]
- [Message: Retransmission (suspected)]
- [Severity level: Note]
- [Group: Sequence]
- [The RTO for this segment was: 10.821727000 seconds]
- [RTO based on delta from frame: 4]
- Hypertext Transfer Protocol
- GET / HTTP/1.1\r\n
- [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
- [Message: GET / HTTP/1.1\r\n]
- [Severity level: Chat]
- [Group: Sequence]
- Request Method: GET
- Request URI: /
- Request Version: HTTP/1.1
- User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
- Host: dest.com\r\n
- Accept: */*\r\n
- \r\n
- [Full request URI: http://dest.com/]
- Frame 19: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
- Arrival Time: Jul 25, 2012 14:03:24.017917000 BST
- Epoch Time: 1343221404.017917000 seconds
- [Time delta from previous captured frame: 0.238971000 seconds]
- [Time delta from previous displayed frame: 0.238971000 seconds]
- [Time since reference or first frame: 11.299758000 seconds]
- Frame Number: 19
- Frame Length: 66 bytes (528 bits)
- Capture Length: 66 bytes (528 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 52
- Identification: 0x1a01 (6657)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0xf2dc [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 16384
- [Calculated window size: 16384]
- [Window size scaling factor: 1]
- Checksum: 0x9844 [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 970559, TSecr 530889220
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 970559
- Timestamp echo reply: 530889220
- [SEQ/ACK analysis]
- [TCP Analysis Flags]
- [This is a TCP duplicate ack]
- [Duplicate ACK #: 2]
- [Duplicate to the ACK in frame: 15]
- [Expert Info (Note/Sequence): Duplicate ACK (#2)]
- [Message: Duplicate ACK (#2)]
- [Severity level: Note]
- [Group: Sequence]
- Frame 20: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
- Arrival Time: Jul 25, 2012 14:03:35.314826000 BST
- Epoch Time: 1343221415.314826000 seconds
- [Time delta from previous captured frame: 11.296909000 seconds]
- [Time delta from previous displayed frame: 11.296909000 seconds]
- [Time since reference or first frame: 22.596667000 seconds]
- Frame Number: 20
- Frame Length: 227 bytes (1816 bits)
- Capture Length: 227 bytes (1816 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp:http]
- Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 213
- Identification: 0x000a (10)
- Flags: 0x02 (Don't Fragment)
- 0... .... = Reserved bit: Not set
- .1.. .... = Don't fragment: Set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 64
- Protocol: TCP (6)
- Header checksum: 0x0033 [correct]
- [Good: True]
- [Bad: False]
- Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
- Source port: 40054 (40054)
- Destination port: http (80)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- [Next sequence number: 162 (relative sequence number)]
- Acknowledgement number: 1 (relative ack number)
- Header length: 32 bytes
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgement: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 898
- [Calculated window size: 14368]
- [Window size scaling factor: 16]
- Checksum: 0x3aae [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
- Options: (12 bytes)
- No-Operation (NOP)
- No-Operation (NOP)
- Timestamps: TSval 2734640, TSecr 970559
- Kind: Timestamp (8)
- Length: 10
- Timestamp value: 2734640
- Timestamp echo reply: 970559
- [SEQ/ACK analysis]
- [Bytes in flight: 161]
- [TCP Analysis Flags]
- [This frame is a (suspected) retransmission]
- [Expert Info (Note/Sequence): Retransmission (suspected)]
- [Message: Retransmission (suspected)]
- [Severity level: Note]
- [Group: Sequence]
- [The RTO for this segment was: 22.357607000 seconds]
- [RTO based on delta from frame: 4]
- Hypertext Transfer Protocol
- GET / HTTP/1.1\r\n
- [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
- [Message: GET / HTTP/1.1\r\n]
- [Severity level: Chat]
- [Group: Sequence]
- Request Method: GET
- Request URI: /
- Request Version: HTTP/1.1
- User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
- Host: dest.com\r\n
- Accept: */*\r\n
- \r\n
- [Full request URI: http://dest.com/]
- Frame 21: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
- Arrival Time: Jul 25, 2012 14:03:35.557873000 BST
- Epoch Time: 1343221415.557873000 seconds
- [Time delta from previous captured frame: 0.243047000 seconds]
- [Time delta from previous displayed frame: 0.243047000 seconds]
- [Time since reference or first frame: 22.839714000 seconds]
- Frame Number: 21
- Frame Length: 60 bytes (480 bits)
- Capture Length: 60 bytes (480 bits)
- [Frame is marked: False]
- [Frame is ignored: False]
- [Protocols in frame: eth:ip:tcp]
- Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
- .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
- .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
- Type: IP (0x0800)
- Trailer: aaaa00003d3e
- Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Version: 4
- Header length: 20 bytes
- Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
- 0000 00.. = Differentiated Services Codepoint: Default (0x00)
- .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
- Total Length: 40
- Identification: 0x0085 (133)
- Flags: 0x00
- 0... .... = Reserved bit: Not set
- .0.. .... = Don't fragment: Not set
- ..0. .... = More fragments: Not set
- Fragment offset: 0
- Time to live: 116
- Protocol: TCP (6)
- Header checksum: 0x0c65 [correct]
- [Good: True]
- [Bad: False]
- Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
- Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
- Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Len: 0
- Source port: http (80)
- Destination port: 40054 (40054)
- [Stream index: 0]
- Sequence number: 1 (relative sequence number)
- Acknowledgement number: Broken TCP. The acknowledge field is nonzero while the ACK flag is not set
- Header length: 20 bytes
- Flags: 0x004 (RST)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...0 .... = Acknowledgement: Not set
- .... .... 0... = Push: Not set
- .... .... .1.. = Reset: Set
- [Expert Info (Chat/Sequence): Connection reset (RST)]
- [Message: Connection reset (RST)]
- [Severity level: Chat]
- [Group: Sequence]
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- Window size value: 0
- [Calculated window size: 0]
- [Window size scaling factor: 1]
- Checksum: 0x3d3e [validation disabled]
- [Good Checksum: False]
- [Bad Checksum: False]
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement