API tools faq
paste
Advertisement
Guest User

linux-reset

a guest
Jul 26th, 2012
1,613
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 81.60 KB | None | 0 0
raw download clone embed print report
  1. Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
  2. Arrival Time: Jul 25, 2012 14:03:12.718159000 BST
  3. Epoch Time: 1343221392.718159000 seconds
  4. [Time delta from previous captured frame: 0.000000000 seconds]
  5. [Time delta from previous displayed frame: 0.000000000 seconds]
  6. [Time since reference or first frame: 0.000000000 seconds]
  7. Frame Number: 1
  8. Frame Length: 74 bytes (592 bits)
  9. Capture Length: 74 bytes (592 bits)
  10. [Frame is marked: False]
  11. [Frame is ignored: False]
  12. [Protocols in frame: eth:ip:tcp]
  13. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  14. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  15. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  16. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  17. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  18. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  19. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  20. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  21. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  22. Type: IP (0x0800)
  23. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  24. Version: 4
  25. Header length: 20 bytes
  26. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  27. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  28. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  29. Total Length: 60
  30. Identification: 0x0001 (1)
  31. Flags: 0x02 (Don't Fragment)
  32. 0... .... = Reserved bit: Not set
  33. .1.. .... = Don't fragment: Set
  34. ..0. .... = More fragments: Not set
  35. Fragment offset: 0
  36. Time to live: 64
  37. Protocol: TCP (6)
  38. Header checksum: 0x00d5 [correct]
  39. [Good: True]
  40. [Bad: False]
  41. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  42. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  43. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 0, Len: 0
  44. Source port: 40054 (40054)
  45. Destination port: http (80)
  46. [Stream index: 0]
  47. Sequence number: 0 (relative sequence number)
  48. Header length: 40 bytes
  49. Flags: 0x002 (SYN)
  50. 000. .... .... = Reserved: Not set
  51. ...0 .... .... = Nonce: Not set
  52. .... 0... .... = Congestion Window Reduced (CWR): Not set
  53. .... .0.. .... = ECN-Echo: Not set
  54. .... ..0. .... = Urgent: Not set
  55. .... ...0 .... = Acknowledgement: Not set
  56. .... .... 0... = Push: Not set
  57. .... .... .0.. = Reset: Not set
  58. .... .... ..1. = Syn: Set
  59. [Expert Info (Chat/Sequence): Connection establish request (SYN): server port http]
  60. [Message: Connection establish request (SYN): server port http]
  61. [Severity level: Chat]
  62. [Group: Sequence]
  63. .... .... ...0 = Fin: Not set
  64. Window size value: 14360
  65. [Calculated window size: 14360]
  66. Checksum: 0x3a15 [validation disabled]
  67. [Good Checksum: False]
  68. [Bad Checksum: False]
  69. Options: (20 bytes)
  70. Maximum segment size: 1436 bytes
  71. TCP SACK Permitted Option: True
  72. Timestamps: TSval 2728990, TSecr 0
  73. Kind: Timestamp (8)
  74. Length: 10
  75. Timestamp value: 2728990
  76. Timestamp echo reply: 0
  77. No-Operation (NOP)
  78. Window scale: 4 (multiply by 16)
  79. Kind: Window Scale (3)
  80. Length: 3
  81. Shift count: 4
  82. [Multiplier: 16]
  83.  
  84. Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
  85. Arrival Time: Jul 25, 2012 14:03:12.956990000 BST
  86. Epoch Time: 1343221392.956990000 seconds
  87. [Time delta from previous captured frame: 0.238831000 seconds]
  88. [Time delta from previous displayed frame: 0.238831000 seconds]
  89. [Time since reference or first frame: 0.238831000 seconds]
  90. Frame Number: 2
  91. Frame Length: 78 bytes (624 bits)
  92. Capture Length: 78 bytes (624 bits)
  93. [Frame is marked: False]
  94. [Frame is ignored: False]
  95. [Protocols in frame: eth:ip:tcp]
  96. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  97. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  98. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  99. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  100. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  101. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  102. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  103. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  104. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  105. Type: IP (0x0800)
  106. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  107. Version: 4
  108. Header length: 20 bytes
  109. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  110. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  111. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  112. Total Length: 64
  113. Identification: 0x3bb3 (15283)
  114. Flags: 0x00
  115. 0... .... = Reserved bit: Not set
  116. .0.. .... = Don't fragment: Not set
  117. ..0. .... = More fragments: Not set
  118. Fragment offset: 0
  119. Time to live: 116
  120. Protocol: TCP (6)
  121. Header checksum: 0xd11e [correct]
  122. [Good: True]
  123. [Bad: False]
  124. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  125. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  126. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 0, Ack: 1, Len: 0
  127. Source port: http (80)
  128. Destination port: 40054 (40054)
  129. [Stream index: 0]
  130. Sequence number: 0 (relative sequence number)
  131. Acknowledgement number: 1 (relative ack number)
  132. Header length: 44 bytes
  133. Flags: 0x012 (SYN, ACK)
  134. 000. .... .... = Reserved: Not set
  135. ...0 .... .... = Nonce: Not set
  136. .... 0... .... = Congestion Window Reduced (CWR): Not set
  137. .... .0.. .... = ECN-Echo: Not set
  138. .... ..0. .... = Urgent: Not set
  139. .... ...1 .... = Acknowledgement: Set
  140. .... .... 0... = Push: Not set
  141. .... .... .0.. = Reset: Not set
  142. .... .... ..1. = Syn: Set
  143. [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
  144. [Message: Connection establish acknowledge (SYN+ACK): server port http]
  145. [Severity level: Chat]
  146. [Group: Sequence]
  147. .... .... ...0 = Fin: Not set
  148. Window size value: 16384
  149. [Calculated window size: 16384]
  150. Checksum: 0x0070 [validation disabled]
  151. [Good Checksum: False]
  152. [Bad Checksum: False]
  153. Options: (24 bytes)
  154. Maximum segment size: 1460 bytes
  155. No-Operation (NOP)
  156. Window scale: 0 (multiply by 1)
  157. Kind: Window Scale (3)
  158. Length: 3
  159. Shift count: 0
  160. [Multiplier: 1]
  161. No-Operation (NOP)
  162. No-Operation (NOP)
  163. Timestamps: TSval 0, TSecr 0
  164. Kind: Timestamp (8)
  165. Length: 10
  166. Timestamp value: 0
  167. Timestamp echo reply: 0
  168. No-Operation (NOP)
  169. No-Operation (NOP)
  170. TCP SACK Permitted Option: True
  171. [SEQ/ACK analysis]
  172. [This is an ACK to the segment in frame: 1]
  173. [The RTT to ACK the segment was: 0.238831000 seconds]
  174.  
  175. Frame 3: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  176. Arrival Time: Jul 25, 2012 14:03:12.957039000 BST
  177. Epoch Time: 1343221392.957039000 seconds
  178. [Time delta from previous captured frame: 0.000049000 seconds]
  179. [Time delta from previous displayed frame: 0.000049000 seconds]
  180. [Time since reference or first frame: 0.238880000 seconds]
  181. Frame Number: 3
  182. Frame Length: 66 bytes (528 bits)
  183. Capture Length: 66 bytes (528 bits)
  184. [Frame is marked: False]
  185. [Frame is ignored: False]
  186. [Protocols in frame: eth:ip:tcp]
  187. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  188. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  189. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  190. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  191. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  192. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  193. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  194. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  195. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  196. Type: IP (0x0800)
  197. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  198. Version: 4
  199. Header length: 20 bytes
  200. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  201. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  202. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  203. Total Length: 52
  204. Identification: 0x0002 (2)
  205. Flags: 0x02 (Don't Fragment)
  206. 0... .... = Reserved bit: Not set
  207. .1.. .... = Don't fragment: Set
  208. ..0. .... = More fragments: Not set
  209. Fragment offset: 0
  210. Time to live: 64
  211. Protocol: TCP (6)
  212. Header checksum: 0x00dc [correct]
  213. [Good: True]
  214. [Bad: False]
  215. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  216. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  217. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
  218. Source port: 40054 (40054)
  219. Destination port: http (80)
  220. [Stream index: 0]
  221. Sequence number: 1 (relative sequence number)
  222. Acknowledgement number: 1 (relative ack number)
  223. Header length: 32 bytes
  224. Flags: 0x010 (ACK)
  225. 000. .... .... = Reserved: Not set
  226. ...0 .... .... = Nonce: Not set
  227. .... 0... .... = Congestion Window Reduced (CWR): Not set
  228. .... .0.. .... = ECN-Echo: Not set
  229. .... ..0. .... = Urgent: Not set
  230. .... ...1 .... = Acknowledgement: Set
  231. .... .... 0... = Push: Not set
  232. .... .... .0.. = Reset: Not set
  233. .... .... ..0. = Syn: Not set
  234. .... .... ...0 = Fin: Not set
  235. Window size value: 898
  236. [Calculated window size: 14368]
  237. [Window size scaling factor: 16]
  238. Checksum: 0x3a0d [validation disabled]
  239. [Good Checksum: False]
  240. [Bad Checksum: False]
  241. Options: (12 bytes)
  242. No-Operation (NOP)
  243. No-Operation (NOP)
  244. Timestamps: TSval 2729050, TSecr 0
  245. Kind: Timestamp (8)
  246. Length: 10
  247. Timestamp value: 2729050
  248. Timestamp echo reply: 0
  249. [SEQ/ACK analysis]
  250. [This is an ACK to the segment in frame: 2]
  251. [The RTT to ACK the segment was: 0.000049000 seconds]
  252.  
  253. Frame 4: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
  254. Arrival Time: Jul 25, 2012 14:03:12.957219000 BST
  255. Epoch Time: 1343221392.957219000 seconds
  256. [Time delta from previous captured frame: 0.000180000 seconds]
  257. [Time delta from previous displayed frame: 0.000180000 seconds]
  258. [Time since reference or first frame: 0.239060000 seconds]
  259. Frame Number: 4
  260. Frame Length: 227 bytes (1816 bits)
  261. Capture Length: 227 bytes (1816 bits)
  262. [Frame is marked: False]
  263. [Frame is ignored: False]
  264. [Protocols in frame: eth:ip:tcp:http]
  265. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  266. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  267. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  268. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  269. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  270. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  271. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  272. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  273. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  274. Type: IP (0x0800)
  275. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  276. Version: 4
  277. Header length: 20 bytes
  278. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  279. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  280. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  281. Total Length: 213
  282. Identification: 0x0003 (3)
  283. Flags: 0x02 (Don't Fragment)
  284. 0... .... = Reserved bit: Not set
  285. .1.. .... = Don't fragment: Set
  286. ..0. .... = More fragments: Not set
  287. Fragment offset: 0
  288. Time to live: 64
  289. Protocol: TCP (6)
  290. Header checksum: 0x003a [correct]
  291. [Good: True]
  292. [Bad: False]
  293. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  294. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  295. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
  296. Source port: 40054 (40054)
  297. Destination port: http (80)
  298. [Stream index: 0]
  299. Sequence number: 1 (relative sequence number)
  300. [Next sequence number: 162 (relative sequence number)]
  301. Acknowledgement number: 1 (relative ack number)
  302. Header length: 32 bytes
  303. Flags: 0x018 (PSH, ACK)
  304. 000. .... .... = Reserved: Not set
  305. ...0 .... .... = Nonce: Not set
  306. .... 0... .... = Congestion Window Reduced (CWR): Not set
  307. .... .0.. .... = ECN-Echo: Not set
  308. .... ..0. .... = Urgent: Not set
  309. .... ...1 .... = Acknowledgement: Set
  310. .... .... 1... = Push: Set
  311. .... .... .0.. = Reset: Not set
  312. .... .... ..0. = Syn: Not set
  313. .... .... ...0 = Fin: Not set
  314. Window size value: 898
  315. [Calculated window size: 14368]
  316. [Window size scaling factor: 16]
  317. Checksum: 0x3aae [validation disabled]
  318. [Good Checksum: False]
  319. [Bad Checksum: False]
  320. Options: (12 bytes)
  321. No-Operation (NOP)
  322. No-Operation (NOP)
  323. Timestamps: TSval 2729050, TSecr 0
  324. Kind: Timestamp (8)
  325. Length: 10
  326. Timestamp value: 2729050
  327. Timestamp echo reply: 0
  328. [SEQ/ACK analysis]
  329. [Bytes in flight: 161]
  330. Hypertext Transfer Protocol
  331. GET / HTTP/1.1\r\n
  332. [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
  333. [Message: GET / HTTP/1.1\r\n]
  334. [Severity level: Chat]
  335. [Group: Sequence]
  336. Request Method: GET
  337. Request URI: /
  338. Request Version: HTTP/1.1
  339. User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
  340. Host: dest.com\r\n
  341. Accept: */*\r\n
  342. \r\n
  343. [Full request URI: http://dest.com/]
  344.  
  345. Frame 5: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  346. Arrival Time: Jul 25, 2012 14:03:13.197657000 BST
  347. Epoch Time: 1343221393.197657000 seconds
  348. [Time delta from previous captured frame: 0.240438000 seconds]
  349. [Time delta from previous displayed frame: 0.240438000 seconds]
  350. [Time since reference or first frame: 0.479498000 seconds]
  351. Frame Number: 5
  352. Frame Length: 66 bytes (528 bits)
  353. Capture Length: 66 bytes (528 bits)
  354. [Frame is marked: False]
  355. [Frame is ignored: False]
  356. [Protocols in frame: eth:ip:tcp]
  357. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  358. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  359. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  360. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  361. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  362. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  363. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  364. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  365. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  366. Type: IP (0x0800)
  367. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  368. Version: 4
  369. Header length: 20 bytes
  370. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  371. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  372. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  373. Total Length: 52
  374. Identification: 0x432f (17199)
  375. Flags: 0x00
  376. 0... .... = Reserved bit: Not set
  377. .0.. .... = Don't fragment: Not set
  378. ..0. .... = More fragments: Not set
  379. Fragment offset: 0
  380. Time to live: 116
  381. Protocol: TCP (6)
  382. Header checksum: 0xc9ae [correct]
  383. [Good: True]
  384. [Bad: False]
  385. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  386. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  387. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
  388. Source port: http (80)
  389. Destination port: 40054 (40054)
  390. [Stream index: 0]
  391. Sequence number: 1 (relative sequence number)
  392. Acknowledgement number: 1 (relative ack number)
  393. Header length: 32 bytes
  394. Flags: 0x010 (ACK)
  395. 000. .... .... = Reserved: Not set
  396. ...0 .... .... = Nonce: Not set
  397. .... 0... .... = Congestion Window Reduced (CWR): Not set
  398. .... .0.. .... = ECN-Echo: Not set
  399. .... ..0. .... = Urgent: Not set
  400. .... ...1 .... = Acknowledgement: Set
  401. .... .... 0... = Push: Not set
  402. .... .... .0.. = Reset: Not set
  403. .... .... ..0. = Syn: Not set
  404. .... .... ...0 = Fin: Not set
  405. Window size value: 16384
  406. [Calculated window size: 16384]
  407. [Window size scaling factor: 1]
  408. Checksum: 0x98b1 [validation disabled]
  409. [Good Checksum: False]
  410. [Bad Checksum: False]
  411. Options: (12 bytes)
  412. No-Operation (NOP)
  413. No-Operation (NOP)
  414. Timestamps: TSval 970450, TSecr 530889220
  415. Kind: Timestamp (8)
  416. Length: 10
  417. Timestamp value: 970450
  418. Timestamp echo reply: 530889220
  419. [SEQ/ACK analysis]
  420. [TCP Analysis Flags]
  421. [This is a TCP duplicate ack]
  422. [Duplicate ACK #: 1]
  423. [Duplicate to the ACK in frame: 2]
  424. [Expert Info (Note/Sequence): Duplicate ACK (#1)]
  425. [Message: Duplicate ACK (#1)]
  426. [Severity level: Note]
  427. [Group: Sequence]
  428.  
  429. Frame 6: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
  430. Arrival Time: Jul 25, 2012 14:03:13.674849000 BST
  431. Epoch Time: 1343221393.674849000 seconds
  432. [Time delta from previous captured frame: 0.477192000 seconds]
  433. [Time delta from previous displayed frame: 0.477192000 seconds]
  434. [Time since reference or first frame: 0.956690000 seconds]
  435. Frame Number: 6
  436. Frame Length: 227 bytes (1816 bits)
  437. Capture Length: 227 bytes (1816 bits)
  438. [Frame is marked: False]
  439. [Frame is ignored: False]
  440. [Protocols in frame: eth:ip:tcp:http]
  441. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  442. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  443. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  444. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  445. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  446. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  447. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  448. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  449. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  450. Type: IP (0x0800)
  451. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  452. Version: 4
  453. Header length: 20 bytes
  454. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  455. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  456. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  457. Total Length: 213
  458. Identification: 0x0004 (4)
  459. Flags: 0x02 (Don't Fragment)
  460. 0... .... = Reserved bit: Not set
  461. .1.. .... = Don't fragment: Set
  462. ..0. .... = More fragments: Not set
  463. Fragment offset: 0
  464. Time to live: 64
  465. Protocol: TCP (6)
  466. Header checksum: 0x0039 [correct]
  467. [Good: True]
  468. [Bad: False]
  469. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  470. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  471. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
  472. Source port: 40054 (40054)
  473. Destination port: http (80)
  474. [Stream index: 0]
  475. Sequence number: 1 (relative sequence number)
  476. [Next sequence number: 162 (relative sequence number)]
  477. Acknowledgement number: 1 (relative ack number)
  478. Header length: 32 bytes
  479. Flags: 0x018 (PSH, ACK)
  480. 000. .... .... = Reserved: Not set
  481. ...0 .... .... = Nonce: Not set
  482. .... 0... .... = Congestion Window Reduced (CWR): Not set
  483. .... .0.. .... = ECN-Echo: Not set
  484. .... ..0. .... = Urgent: Not set
  485. .... ...1 .... = Acknowledgement: Set
  486. .... .... 1... = Push: Set
  487. .... .... .0.. = Reset: Not set
  488. .... .... ..0. = Syn: Not set
  489. .... .... ...0 = Fin: Not set
  490. Window size value: 898
  491. [Calculated window size: 14368]
  492. [Window size scaling factor: 16]
  493. Checksum: 0x3aae [validation disabled]
  494. [Good Checksum: False]
  495. [Bad Checksum: False]
  496. Options: (12 bytes)
  497. No-Operation (NOP)
  498. No-Operation (NOP)
  499. Timestamps: TSval 2729230, TSecr 970450
  500. Kind: Timestamp (8)
  501. Length: 10
  502. Timestamp value: 2729230
  503. Timestamp echo reply: 970450
  504. [SEQ/ACK analysis]
  505. [Bytes in flight: 161]
  506. [TCP Analysis Flags]
  507. [This frame is a (suspected) retransmission]
  508. [Expert Info (Note/Sequence): Retransmission (suspected)]
  509. [Message: Retransmission (suspected)]
  510. [Severity level: Note]
  511. [Group: Sequence]
  512. [The RTO for this segment was: 0.717630000 seconds]
  513. [RTO based on delta from frame: 4]
  514. Hypertext Transfer Protocol
  515. GET / HTTP/1.1\r\n
  516. [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
  517. [Message: GET / HTTP/1.1\r\n]
  518. [Severity level: Chat]
  519. [Group: Sequence]
  520. Request Method: GET
  521. Request URI: /
  522. Request Version: HTTP/1.1
  523. User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
  524. Host: dest.com\r\n
  525. Accept: */*\r\n
  526. \r\n
  527. [Full request URI: http://dest.com/]
  528.  
  529. Frame 7: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  530. Arrival Time: Jul 25, 2012 14:03:13.916378000 BST
  531. Epoch Time: 1343221393.916378000 seconds
  532. [Time delta from previous captured frame: 0.241529000 seconds]
  533. [Time delta from previous displayed frame: 0.241529000 seconds]
  534. [Time since reference or first frame: 1.198219000 seconds]
  535. Frame Number: 7
  536. Frame Length: 66 bytes (528 bits)
  537. Capture Length: 66 bytes (528 bits)
  538. [Frame is marked: False]
  539. [Frame is ignored: False]
  540. [Protocols in frame: eth:ip:tcp]
  541. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  542. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  543. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  544. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  545. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  546. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  547. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  548. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  549. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  550. Type: IP (0x0800)
  551. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  552. Version: 4
  553. Header length: 20 bytes
  554. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  555. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  556. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  557. Total Length: 52
  558. Identification: 0x5adb (23259)
  559. Flags: 0x00
  560. 0... .... = Reserved bit: Not set
  561. .0.. .... = Don't fragment: Not set
  562. ..0. .... = More fragments: Not set
  563. Fragment offset: 0
  564. Time to live: 116
  565. Protocol: TCP (6)
  566. Header checksum: 0xb202 [correct]
  567. [Good: True]
  568. [Bad: False]
  569. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  570. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  571. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
  572. Source port: http (80)
  573. Destination port: 40054 (40054)
  574. [Stream index: 0]
  575. Sequence number: 1 (relative sequence number)
  576. Acknowledgement number: 1 (relative ack number)
  577. Header length: 32 bytes
  578. Flags: 0x010 (ACK)
  579. 000. .... .... = Reserved: Not set
  580. ...0 .... .... = Nonce: Not set
  581. .... 0... .... = Congestion Window Reduced (CWR): Not set
  582. .... .0.. .... = ECN-Echo: Not set
  583. .... ..0. .... = Urgent: Not set
  584. .... ...1 .... = Acknowledgement: Set
  585. .... .... 0... = Push: Not set
  586. .... .... .0.. = Reset: Not set
  587. .... .... ..0. = Syn: Not set
  588. .... .... ...0 = Fin: Not set
  589. Window size value: 16384
  590. [Calculated window size: 16384]
  591. [Window size scaling factor: 1]
  592. Checksum: 0x98aa [validation disabled]
  593. [Good Checksum: False]
  594. [Bad Checksum: False]
  595. Options: (12 bytes)
  596. No-Operation (NOP)
  597. No-Operation (NOP)
  598. Timestamps: TSval 970457, TSecr 530889220
  599. Kind: Timestamp (8)
  600. Length: 10
  601. Timestamp value: 970457
  602. Timestamp echo reply: 530889220
  603. [SEQ/ACK analysis]
  604. [TCP Analysis Flags]
  605. [This is a TCP duplicate ack]
  606. [Duplicate ACK #: 2]
  607. [Duplicate to the ACK in frame: 2]
  608. [Expert Info (Note/Sequence): Duplicate ACK (#2)]
  609. [Message: Duplicate ACK (#2)]
  610. [Severity level: Note]
  611. [Group: Sequence]
  612.  
  613. Frame 8: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
  614. Arrival Time: Jul 25, 2012 14:03:15.118818000 BST
  615. Epoch Time: 1343221395.118818000 seconds
  616. [Time delta from previous captured frame: 1.202440000 seconds]
  617. [Time delta from previous displayed frame: 1.202440000 seconds]
  618. [Time since reference or first frame: 2.400659000 seconds]
  619. Frame Number: 8
  620. Frame Length: 227 bytes (1816 bits)
  621. Capture Length: 227 bytes (1816 bits)
  622. [Frame is marked: False]
  623. [Frame is ignored: False]
  624. [Protocols in frame: eth:ip:tcp:http]
  625. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  626. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  627. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  628. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  629. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  630. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  631. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  632. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  633. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  634. Type: IP (0x0800)
  635. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  636. Version: 4
  637. Header length: 20 bytes
  638. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  639. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  640. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  641. Total Length: 213
  642. Identification: 0x0005 (5)
  643. Flags: 0x02 (Don't Fragment)
  644. 0... .... = Reserved bit: Not set
  645. .1.. .... = Don't fragment: Set
  646. ..0. .... = More fragments: Not set
  647. Fragment offset: 0
  648. Time to live: 64
  649. Protocol: TCP (6)
  650. Header checksum: 0x0038 [correct]
  651. [Good: True]
  652. [Bad: False]
  653. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  654. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  655. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
  656. Source port: 40054 (40054)
  657. Destination port: http (80)
  658. [Stream index: 0]
  659. Sequence number: 1 (relative sequence number)
  660. [Next sequence number: 162 (relative sequence number)]
  661. Acknowledgement number: 1 (relative ack number)
  662. Header length: 32 bytes
  663. Flags: 0x018 (PSH, ACK)
  664. 000. .... .... = Reserved: Not set
  665. ...0 .... .... = Nonce: Not set
  666. .... 0... .... = Congestion Window Reduced (CWR): Not set
  667. .... .0.. .... = ECN-Echo: Not set
  668. .... ..0. .... = Urgent: Not set
  669. .... ...1 .... = Acknowledgement: Set
  670. .... .... 1... = Push: Set
  671. .... .... .0.. = Reset: Not set
  672. .... .... ..0. = Syn: Not set
  673. .... .... ...0 = Fin: Not set
  674. Window size value: 898
  675. [Calculated window size: 14368]
  676. [Window size scaling factor: 16]
  677. Checksum: 0x3aae [validation disabled]
  678. [Good Checksum: False]
  679. [Bad Checksum: False]
  680. Options: (12 bytes)
  681. No-Operation (NOP)
  682. No-Operation (NOP)
  683. Timestamps: TSval 2729591, TSecr 970457
  684. Kind: Timestamp (8)
  685. Length: 10
  686. Timestamp value: 2729591
  687. Timestamp echo reply: 970457
  688. [SEQ/ACK analysis]
  689. [Bytes in flight: 161]
  690. [TCP Analysis Flags]
  691. [This frame is a (suspected) retransmission]
  692. [Expert Info (Note/Sequence): Retransmission (suspected)]
  693. [Message: Retransmission (suspected)]
  694. [Severity level: Note]
  695. [Group: Sequence]
  696. [The RTO for this segment was: 2.161599000 seconds]
  697. [RTO based on delta from frame: 4]
  698. Hypertext Transfer Protocol
  699. GET / HTTP/1.1\r\n
  700. [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
  701. [Message: GET / HTTP/1.1\r\n]
  702. [Severity level: Chat]
  703. [Group: Sequence]
  704. Request Method: GET
  705. Request URI: /
  706. Request Version: HTTP/1.1
  707. User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
  708. Host: dest.com\r\n
  709. Accept: */*\r\n
  710. \r\n
  711. [Full request URI: http://dest.com/]
  712.  
  713. Frame 9: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
  714. Arrival Time: Jul 25, 2012 14:03:15.148365000 BST
  715. Epoch Time: 1343221395.148365000 seconds
  716. [Time delta from previous captured frame: 0.029547000 seconds]
  717. [Time delta from previous displayed frame: 0.029547000 seconds]
  718. [Time since reference or first frame: 2.430206000 seconds]
  719. Frame Number: 9
  720. Frame Length: 78 bytes (624 bits)
  721. Capture Length: 78 bytes (624 bits)
  722. [Frame is marked: False]
  723. [Frame is ignored: False]
  724. [Protocols in frame: eth:ip:tcp]
  725. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  726. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  727. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  728. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  729. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  730. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  731. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  732. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  733. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  734. Type: IP (0x0800)
  735. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  736. Version: 4
  737. Header length: 20 bytes
  738. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  739. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  740. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  741. Total Length: 64
  742. Identification: 0x01f8 (504)
  743. Flags: 0x00
  744. 0... .... = Reserved bit: Not set
  745. .0.. .... = Don't fragment: Not set
  746. ..0. .... = More fragments: Not set
  747. Fragment offset: 0
  748. Time to live: 116
  749. Protocol: TCP (6)
  750. Header checksum: 0x0ada [correct]
  751. [Good: True]
  752. [Bad: False]
  753. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  754. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  755. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 0, Ack: 1, Len: 0
  756. Source port: http (80)
  757. Destination port: 40054 (40054)
  758. [Stream index: 0]
  759. Sequence number: 0 (relative sequence number)
  760. Acknowledgement number: 1 (relative ack number)
  761. Header length: 44 bytes
  762. Flags: 0x012 (SYN, ACK)
  763. 000. .... .... = Reserved: Not set
  764. ...0 .... .... = Nonce: Not set
  765. .... 0... .... = Congestion Window Reduced (CWR): Not set
  766. .... .0.. .... = ECN-Echo: Not set
  767. .... ..0. .... = Urgent: Not set
  768. .... ...1 .... = Acknowledgement: Set
  769. .... .... 0... = Push: Not set
  770. .... .... .0.. = Reset: Not set
  771. .... .... ..1. = Syn: Set
  772. [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
  773. [Message: Connection establish acknowledge (SYN+ACK): server port http]
  774. [Severity level: Chat]
  775. [Group: Sequence]
  776. .... .... ...0 = Fin: Not set
  777. Window size value: 16384
  778. [Calculated window size: 16384]
  779. Checksum: 0x0070 [validation disabled]
  780. [Good Checksum: False]
  781. [Bad Checksum: False]
  782. Options: (24 bytes)
  783. Maximum segment size: 1460 bytes
  784. No-Operation (NOP)
  785. Window scale: 0 (multiply by 1)
  786. Kind: Window Scale (3)
  787. Length: 3
  788. Shift count: 0
  789. [Multiplier: 1]
  790. No-Operation (NOP)
  791. No-Operation (NOP)
  792. Timestamps: TSval 0, TSecr 0
  793. Kind: Timestamp (8)
  794. Length: 10
  795. Timestamp value: 0
  796. Timestamp echo reply: 0
  797. No-Operation (NOP)
  798. No-Operation (NOP)
  799. TCP SACK Permitted Option: True
  800.  
  801. Frame 10: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
  802. Arrival Time: Jul 25, 2012 14:03:15.148400000 BST
  803. Epoch Time: 1343221395.148400000 seconds
  804. [Time delta from previous captured frame: 0.000035000 seconds]
  805. [Time delta from previous displayed frame: 0.000035000 seconds]
  806. [Time since reference or first frame: 2.430241000 seconds]
  807. Frame Number: 10
  808. Frame Length: 78 bytes (624 bits)
  809. Capture Length: 78 bytes (624 bits)
  810. [Frame is marked: False]
  811. [Frame is ignored: False]
  812. [Protocols in frame: eth:ip:tcp]
  813. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  814. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  815. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  816. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  817. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  818. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  819. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  820. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  821. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  822. Type: IP (0x0800)
  823. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  824. Version: 4
  825. Header length: 20 bytes
  826. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  827. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  828. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  829. Total Length: 64
  830. Identification: 0x0006 (6)
  831. Flags: 0x02 (Don't Fragment)
  832. 0... .... = Reserved bit: Not set
  833. .1.. .... = Don't fragment: Set
  834. ..0. .... = More fragments: Not set
  835. Fragment offset: 0
  836. Time to live: 64
  837. Protocol: TCP (6)
  838. Header checksum: 0x00cc [correct]
  839. [Good: True]
  840. [Bad: False]
  841. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  842. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  843. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 162, Ack: 1, Len: 0
  844. Source port: 40054 (40054)
  845. Destination port: http (80)
  846. [Stream index: 0]
  847. Sequence number: 162 (relative sequence number)
  848. Acknowledgement number: 1 (relative ack number)
  849. Header length: 44 bytes
  850. Flags: 0x010 (ACK)
  851. 000. .... .... = Reserved: Not set
  852. ...0 .... .... = Nonce: Not set
  853. .... 0... .... = Congestion Window Reduced (CWR): Not set
  854. .... .0.. .... = ECN-Echo: Not set
  855. .... ..0. .... = Urgent: Not set
  856. .... ...1 .... = Acknowledgement: Set
  857. .... .... 0... = Push: Not set
  858. .... .... .0.. = Reset: Not set
  859. .... .... ..0. = Syn: Not set
  860. .... .... ...0 = Fin: Not set
  861. Window size value: 898
  862. [Calculated window size: 14368]
  863. [Window size scaling factor: 16]
  864. Checksum: 0x3a19 [validation disabled]
  865. [Good Checksum: False]
  866. [Bad Checksum: False]
  867. Options: (24 bytes)
  868. No-Operation (NOP)
  869. No-Operation (NOP)
  870. Timestamps: TSval 2729598, TSecr 970457
  871. Kind: Timestamp (8)
  872. Length: 10
  873. Timestamp value: 2729598
  874. Timestamp echo reply: 970457
  875. No-Operation (NOP)
  876. No-Operation (NOP)
  877. SACK: 0-1
  878. left edge = 0 (relative)
  879. right edge = 1 (relative)
  880. [SEQ/ACK analysis]
  881. [This is an ACK to the segment in frame: 9]
  882. [The RTT to ACK the segment was: 0.000035000 seconds]
  883. [TCP Analysis Flags]
  884. [This is a TCP duplicate ack]
  885. [Duplicate ACK #: 1]
  886. [Duplicate to the ACK in frame: 8]
  887. [Expert Info (Note/Sequence): Duplicate ACK (#1)]
  888. [Message: Duplicate ACK (#1)]
  889. [Severity level: Note]
  890. [Group: Sequence]
  891.  
  892. Frame 11: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  893. Arrival Time: Jul 25, 2012 14:03:15.357719000 BST
  894. Epoch Time: 1343221395.357719000 seconds
  895. [Time delta from previous captured frame: 0.209319000 seconds]
  896. [Time delta from previous displayed frame: 0.209319000 seconds]
  897. [Time since reference or first frame: 2.639560000 seconds]
  898. Frame Number: 11
  899. Frame Length: 66 bytes (528 bits)
  900. Capture Length: 66 bytes (528 bits)
  901. [Frame is marked: False]
  902. [Frame is ignored: False]
  903. [Protocols in frame: eth:ip:tcp]
  904. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  905. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  906. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  907. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  908. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  909. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  910. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  911. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  912. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  913. Type: IP (0x0800)
  914. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  915. Version: 4
  916. Header length: 20 bytes
  917. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  918. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  919. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  920. Total Length: 52
  921. Identification: 0x0906 (2310)
  922. Flags: 0x00
  923. 0... .... = Reserved bit: Not set
  924. .0.. .... = Don't fragment: Not set
  925. ..0. .... = More fragments: Not set
  926. Fragment offset: 0
  927. Time to live: 116
  928. Protocol: TCP (6)
  929. Header checksum: 0x03d8 [correct]
  930. [Good: True]
  931. [Bad: False]
  932. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  933. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  934. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
  935. Source port: http (80)
  936. Destination port: 40054 (40054)
  937. [Stream index: 0]
  938. Sequence number: 1 (relative sequence number)
  939. Acknowledgement number: 1 (relative ack number)
  940. Header length: 32 bytes
  941. Flags: 0x010 (ACK)
  942. 000. .... .... = Reserved: Not set
  943. ...0 .... .... = Nonce: Not set
  944. .... 0... .... = Congestion Window Reduced (CWR): Not set
  945. .... .0.. .... = ECN-Echo: Not set
  946. .... ..0. .... = Urgent: Not set
  947. .... ...1 .... = Acknowledgement: Set
  948. .... .... 0... = Push: Not set
  949. .... .... .0.. = Reset: Not set
  950. .... .... ..0. = Syn: Not set
  951. .... .... ...0 = Fin: Not set
  952. Window size value: 16384
  953. [Calculated window size: 16384]
  954. [Window size scaling factor: 1]
  955. Checksum: 0x989b [validation disabled]
  956. [Good Checksum: False]
  957. [Bad Checksum: False]
  958. Options: (12 bytes)
  959. No-Operation (NOP)
  960. No-Operation (NOP)
  961. Timestamps: TSval 970472, TSecr 530889220
  962. Kind: Timestamp (8)
  963. Length: 10
  964. Timestamp value: 970472
  965. Timestamp echo reply: 530889220
  966. [SEQ/ACK analysis]
  967. [TCP Analysis Flags]
  968. [This is a TCP duplicate ack]
  969. [Duplicate ACK #: 1]
  970. [Duplicate to the ACK in frame: 9]
  971. [Expert Info (Note/Sequence): Duplicate ACK (#1)]
  972. [Message: Duplicate ACK (#1)]
  973. [Severity level: Note]
  974. [Group: Sequence]
  975.  
  976. Frame 12: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  977. Arrival Time: Jul 25, 2012 14:03:15.387653000 BST
  978. Epoch Time: 1343221395.387653000 seconds
  979. [Time delta from previous captured frame: 0.029934000 seconds]
  980. [Time delta from previous displayed frame: 0.029934000 seconds]
  981. [Time since reference or first frame: 2.669494000 seconds]
  982. Frame Number: 12
  983. Frame Length: 66 bytes (528 bits)
  984. Capture Length: 66 bytes (528 bits)
  985. [Frame is marked: False]
  986. [Frame is ignored: False]
  987. [Protocols in frame: eth:ip:tcp]
  988. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  989. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  990. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  991. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  992. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  993. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  994. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  995. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  996. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  997. Type: IP (0x0800)
  998. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  999. Version: 4
  1000. Header length: 20 bytes
  1001. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1002. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1003. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1004. Total Length: 52
  1005. Identification: 0x09ec (2540)
  1006. Flags: 0x00
  1007. 0... .... = Reserved bit: Not set
  1008. .0.. .... = Don't fragment: Not set
  1009. ..0. .... = More fragments: Not set
  1010. Fragment offset: 0
  1011. Time to live: 116
  1012. Protocol: TCP (6)
  1013. Header checksum: 0x02f2 [correct]
  1014. [Good: True]
  1015. [Bad: False]
  1016. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1017. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1018. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
  1019. Source port: http (80)
  1020. Destination port: 40054 (40054)
  1021. [Stream index: 0]
  1022. Sequence number: 1 (relative sequence number)
  1023. Acknowledgement number: 1 (relative ack number)
  1024. Header length: 32 bytes
  1025. Flags: 0x010 (ACK)
  1026. 000. .... .... = Reserved: Not set
  1027. ...0 .... .... = Nonce: Not set
  1028. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1029. .... .0.. .... = ECN-Echo: Not set
  1030. .... ..0. .... = Urgent: Not set
  1031. .... ...1 .... = Acknowledgement: Set
  1032. .... .... 0... = Push: Not set
  1033. .... .... .0.. = Reset: Not set
  1034. .... .... ..0. = Syn: Not set
  1035. .... .... ...0 = Fin: Not set
  1036. Window size value: 16384
  1037. [Calculated window size: 16384]
  1038. [Window size scaling factor: 1]
  1039. Checksum: 0x989b [validation disabled]
  1040. [Good Checksum: False]
  1041. [Bad Checksum: False]
  1042. Options: (12 bytes)
  1043. No-Operation (NOP)
  1044. No-Operation (NOP)
  1045. Timestamps: TSval 970472, TSecr 530889220
  1046. Kind: Timestamp (8)
  1047. Length: 10
  1048. Timestamp value: 970472
  1049. Timestamp echo reply: 530889220
  1050. [SEQ/ACK analysis]
  1051. [TCP Analysis Flags]
  1052. [This is a TCP duplicate ack]
  1053. [Duplicate ACK #: 2]
  1054. [Duplicate to the ACK in frame: 9]
  1055. [Expert Info (Note/Sequence): Duplicate ACK (#2)]
  1056. [Message: Duplicate ACK (#2)]
  1057. [Severity level: Note]
  1058. [Group: Sequence]
  1059.  
  1060. Frame 13: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
  1061. Arrival Time: Jul 25, 2012 14:03:18.002798000 BST
  1062. Epoch Time: 1343221398.002798000 seconds
  1063. [Time delta from previous captured frame: 2.615145000 seconds]
  1064. [Time delta from previous displayed frame: 2.615145000 seconds]
  1065. [Time since reference or first frame: 5.284639000 seconds]
  1066. Frame Number: 13
  1067. Frame Length: 227 bytes (1816 bits)
  1068. Capture Length: 227 bytes (1816 bits)
  1069. [Frame is marked: False]
  1070. [Frame is ignored: False]
  1071. [Protocols in frame: eth:ip:tcp:http]
  1072. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1073. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1074. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1075. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1076. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1077. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1078. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1079. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1080. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1081. Type: IP (0x0800)
  1082. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1083. Version: 4
  1084. Header length: 20 bytes
  1085. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1086. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1087. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1088. Total Length: 213
  1089. Identification: 0x0007 (7)
  1090. Flags: 0x02 (Don't Fragment)
  1091. 0... .... = Reserved bit: Not set
  1092. .1.. .... = Don't fragment: Set
  1093. ..0. .... = More fragments: Not set
  1094. Fragment offset: 0
  1095. Time to live: 64
  1096. Protocol: TCP (6)
  1097. Header checksum: 0x0036 [correct]
  1098. [Good: True]
  1099. [Bad: False]
  1100. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1101. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1102. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
  1103. Source port: 40054 (40054)
  1104. Destination port: http (80)
  1105. [Stream index: 0]
  1106. Sequence number: 1 (relative sequence number)
  1107. [Next sequence number: 162 (relative sequence number)]
  1108. Acknowledgement number: 1 (relative ack number)
  1109. Header length: 32 bytes
  1110. Flags: 0x018 (PSH, ACK)
  1111. 000. .... .... = Reserved: Not set
  1112. ...0 .... .... = Nonce: Not set
  1113. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1114. .... .0.. .... = ECN-Echo: Not set
  1115. .... ..0. .... = Urgent: Not set
  1116. .... ...1 .... = Acknowledgement: Set
  1117. .... .... 1... = Push: Set
  1118. .... .... .0.. = Reset: Not set
  1119. .... .... ..0. = Syn: Not set
  1120. .... .... ...0 = Fin: Not set
  1121. Window size value: 898
  1122. [Calculated window size: 14368]
  1123. [Window size scaling factor: 16]
  1124. Checksum: 0x3aae [validation disabled]
  1125. [Good Checksum: False]
  1126. [Bad Checksum: False]
  1127. Options: (12 bytes)
  1128. No-Operation (NOP)
  1129. No-Operation (NOP)
  1130. Timestamps: TSval 2730312, TSecr 970472
  1131. Kind: Timestamp (8)
  1132. Length: 10
  1133. Timestamp value: 2730312
  1134. Timestamp echo reply: 970472
  1135. [SEQ/ACK analysis]
  1136. [Bytes in flight: 161]
  1137. [TCP Analysis Flags]
  1138. [This frame is a (suspected) retransmission]
  1139. [Expert Info (Note/Sequence): Retransmission (suspected)]
  1140. [Message: Retransmission (suspected)]
  1141. [Severity level: Note]
  1142. [Group: Sequence]
  1143. [The RTO for this segment was: 5.045579000 seconds]
  1144. [RTO based on delta from frame: 4]
  1145. Hypertext Transfer Protocol
  1146. GET / HTTP/1.1\r\n
  1147. [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
  1148. [Message: GET / HTTP/1.1\r\n]
  1149. [Severity level: Chat]
  1150. [Group: Sequence]
  1151. Request Method: GET
  1152. Request URI: /
  1153. Request Version: HTTP/1.1
  1154. User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
  1155. Host: dest.com\r\n
  1156. Accept: */*\r\n
  1157. \r\n
  1158. [Full request URI: http://dest.com/]
  1159.  
  1160. Frame 14: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  1161. Arrival Time: Jul 25, 2012 14:03:18.245783000 BST
  1162. Epoch Time: 1343221398.245783000 seconds
  1163. [Time delta from previous captured frame: 0.242985000 seconds]
  1164. [Time delta from previous displayed frame: 0.242985000 seconds]
  1165. [Time since reference or first frame: 5.527624000 seconds]
  1166. Frame Number: 14
  1167. Frame Length: 66 bytes (528 bits)
  1168. Capture Length: 66 bytes (528 bits)
  1169. [Frame is marked: False]
  1170. [Frame is ignored: False]
  1171. [Protocols in frame: eth:ip:tcp]
  1172. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1173. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1174. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1175. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1176. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1177. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1178. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1179. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1180. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1181. Type: IP (0x0800)
  1182. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1183. Version: 4
  1184. Header length: 20 bytes
  1185. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1186. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1187. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1188. Total Length: 52
  1189. Identification: 0x63ab (25515)
  1190. Flags: 0x00
  1191. 0... .... = Reserved bit: Not set
  1192. .0.. .... = Don't fragment: Not set
  1193. ..0. .... = More fragments: Not set
  1194. Fragment offset: 0
  1195. Time to live: 116
  1196. Protocol: TCP (6)
  1197. Header checksum: 0xa932 [correct]
  1198. [Good: True]
  1199. [Bad: False]
  1200. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1201. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1202. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
  1203. Source port: http (80)
  1204. Destination port: 40054 (40054)
  1205. [Stream index: 0]
  1206. Sequence number: 1 (relative sequence number)
  1207. Acknowledgement number: 1 (relative ack number)
  1208. Header length: 32 bytes
  1209. Flags: 0x010 (ACK)
  1210. 000. .... .... = Reserved: Not set
  1211. ...0 .... .... = Nonce: Not set
  1212. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1213. .... .0.. .... = ECN-Echo: Not set
  1214. .... ..0. .... = Urgent: Not set
  1215. .... ...1 .... = Acknowledgement: Set
  1216. .... .... 0... = Push: Not set
  1217. .... .... .0.. = Reset: Not set
  1218. .... .... ..0. = Syn: Not set
  1219. .... .... ...0 = Fin: Not set
  1220. Window size value: 16384
  1221. [Calculated window size: 16384]
  1222. [Window size scaling factor: 1]
  1223. Checksum: 0x987f [validation disabled]
  1224. [Good Checksum: False]
  1225. [Bad Checksum: False]
  1226. Options: (12 bytes)
  1227. No-Operation (NOP)
  1228. No-Operation (NOP)
  1229. Timestamps: TSval 970500, TSecr 530889220
  1230. Kind: Timestamp (8)
  1231. Length: 10
  1232. Timestamp value: 970500
  1233. Timestamp echo reply: 530889220
  1234. [SEQ/ACK analysis]
  1235. [TCP Analysis Flags]
  1236. [This is a TCP duplicate ack]
  1237. [Duplicate ACK #: 3]
  1238. [Duplicate to the ACK in frame: 9]
  1239. [Expert Info (Note/Sequence): Duplicate ACK (#3)]
  1240. [Message: Duplicate ACK (#3)]
  1241. [Severity level: Note]
  1242. [Group: Sequence]
  1243.  
  1244. Frame 15: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
  1245. Arrival Time: Jul 25, 2012 14:03:21.082394000 BST
  1246. Epoch Time: 1343221401.082394000 seconds
  1247. [Time delta from previous captured frame: 2.836611000 seconds]
  1248. [Time delta from previous displayed frame: 2.836611000 seconds]
  1249. [Time since reference or first frame: 8.364235000 seconds]
  1250. Frame Number: 15
  1251. Frame Length: 78 bytes (624 bits)
  1252. Capture Length: 78 bytes (624 bits)
  1253. [Frame is marked: False]
  1254. [Frame is ignored: False]
  1255. [Protocols in frame: eth:ip:tcp]
  1256. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1257. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1258. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1259. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1260. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1261. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1262. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1263. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1264. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1265. Type: IP (0x0800)
  1266. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1267. Version: 4
  1268. Header length: 20 bytes
  1269. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1270. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1271. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1272. Total Length: 64
  1273. Identification: 0x3c50 (15440)
  1274. Flags: 0x00
  1275. 0... .... = Reserved bit: Not set
  1276. .0.. .... = Don't fragment: Not set
  1277. ..0. .... = More fragments: Not set
  1278. Fragment offset: 0
  1279. Time to live: 116
  1280. Protocol: TCP (6)
  1281. Header checksum: 0xd081 [correct]
  1282. [Good: True]
  1283. [Bad: False]
  1284. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1285. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1286. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 0, Ack: 1, Len: 0
  1287. Source port: http (80)
  1288. Destination port: 40054 (40054)
  1289. [Stream index: 0]
  1290. Sequence number: 0 (relative sequence number)
  1291. Acknowledgement number: 1 (relative ack number)
  1292. Header length: 44 bytes
  1293. Flags: 0x012 (SYN, ACK)
  1294. 000. .... .... = Reserved: Not set
  1295. ...0 .... .... = Nonce: Not set
  1296. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1297. .... .0.. .... = ECN-Echo: Not set
  1298. .... ..0. .... = Urgent: Not set
  1299. .... ...1 .... = Acknowledgement: Set
  1300. .... .... 0... = Push: Not set
  1301. .... .... .0.. = Reset: Not set
  1302. .... .... ..1. = Syn: Set
  1303. [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
  1304. [Message: Connection establish acknowledge (SYN+ACK): server port http]
  1305. [Severity level: Chat]
  1306. [Group: Sequence]
  1307. .... .... ...0 = Fin: Not set
  1308. Window size value: 16384
  1309. [Calculated window size: 16384]
  1310. Checksum: 0x0070 [validation disabled]
  1311. [Good Checksum: False]
  1312. [Bad Checksum: False]
  1313. Options: (24 bytes)
  1314. Maximum segment size: 1460 bytes
  1315. No-Operation (NOP)
  1316. Window scale: 0 (multiply by 1)
  1317. Kind: Window Scale (3)
  1318. Length: 3
  1319. Shift count: 0
  1320. [Multiplier: 1]
  1321. No-Operation (NOP)
  1322. No-Operation (NOP)
  1323. Timestamps: TSval 0, TSecr 0
  1324. Kind: Timestamp (8)
  1325. Length: 10
  1326. Timestamp value: 0
  1327. Timestamp echo reply: 0
  1328. No-Operation (NOP)
  1329. No-Operation (NOP)
  1330. TCP SACK Permitted Option: True
  1331.  
  1332. Frame 16: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
  1333. Arrival Time: Jul 25, 2012 14:03:21.082421000 BST
  1334. Epoch Time: 1343221401.082421000 seconds
  1335. [Time delta from previous captured frame: 0.000027000 seconds]
  1336. [Time delta from previous displayed frame: 0.000027000 seconds]
  1337. [Time since reference or first frame: 8.364262000 seconds]
  1338. Frame Number: 16
  1339. Frame Length: 78 bytes (624 bits)
  1340. Capture Length: 78 bytes (624 bits)
  1341. [Frame is marked: False]
  1342. [Frame is ignored: False]
  1343. [Protocols in frame: eth:ip:tcp]
  1344. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1345. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1346. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1347. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1348. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1349. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1350. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1351. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1352. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1353. Type: IP (0x0800)
  1354. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1355. Version: 4
  1356. Header length: 20 bytes
  1357. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1358. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1359. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1360. Total Length: 64
  1361. Identification: 0x0008 (8)
  1362. Flags: 0x02 (Don't Fragment)
  1363. 0... .... = Reserved bit: Not set
  1364. .1.. .... = Don't fragment: Set
  1365. ..0. .... = More fragments: Not set
  1366. Fragment offset: 0
  1367. Time to live: 64
  1368. Protocol: TCP (6)
  1369. Header checksum: 0x00ca [correct]
  1370. [Good: True]
  1371. [Bad: False]
  1372. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1373. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1374. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 162, Ack: 1, Len: 0
  1375. Source port: 40054 (40054)
  1376. Destination port: http (80)
  1377. [Stream index: 0]
  1378. Sequence number: 162 (relative sequence number)
  1379. Acknowledgement number: 1 (relative ack number)
  1380. Header length: 44 bytes
  1381. Flags: 0x010 (ACK)
  1382. 000. .... .... = Reserved: Not set
  1383. ...0 .... .... = Nonce: Not set
  1384. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1385. .... .0.. .... = ECN-Echo: Not set
  1386. .... ..0. .... = Urgent: Not set
  1387. .... ...1 .... = Acknowledgement: Set
  1388. .... .... 0... = Push: Not set
  1389. .... .... .0.. = Reset: Not set
  1390. .... .... ..0. = Syn: Not set
  1391. .... .... ...0 = Fin: Not set
  1392. Window size value: 898
  1393. [Calculated window size: 14368]
  1394. [Window size scaling factor: 16]
  1395. Checksum: 0x3a19 [validation disabled]
  1396. [Good Checksum: False]
  1397. [Bad Checksum: False]
  1398. Options: (24 bytes)
  1399. No-Operation (NOP)
  1400. No-Operation (NOP)
  1401. Timestamps: TSval 2731081, TSecr 970500
  1402. Kind: Timestamp (8)
  1403. Length: 10
  1404. Timestamp value: 2731081
  1405. Timestamp echo reply: 970500
  1406. No-Operation (NOP)
  1407. No-Operation (NOP)
  1408. SACK: 0-1
  1409. left edge = 0 (relative)
  1410. right edge = 1 (relative)
  1411. [SEQ/ACK analysis]
  1412. [This is an ACK to the segment in frame: 15]
  1413. [The RTT to ACK the segment was: 0.000027000 seconds]
  1414. [TCP Analysis Flags]
  1415. [This is a TCP duplicate ack]
  1416. [Duplicate ACK #: 1]
  1417. [Duplicate to the ACK in frame: 13]
  1418. [Expert Info (Note/Sequence): Duplicate ACK (#1)]
  1419. [Message: Duplicate ACK (#1)]
  1420. [Severity level: Note]
  1421. [Group: Sequence]
  1422.  
  1423. Frame 17: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  1424. Arrival Time: Jul 25, 2012 14:03:21.324332000 BST
  1425. Epoch Time: 1343221401.324332000 seconds
  1426. [Time delta from previous captured frame: 0.241911000 seconds]
  1427. [Time delta from previous displayed frame: 0.241911000 seconds]
  1428. [Time since reference or first frame: 8.606173000 seconds]
  1429. Frame Number: 17
  1430. Frame Length: 66 bytes (528 bits)
  1431. Capture Length: 66 bytes (528 bits)
  1432. [Frame is marked: False]
  1433. [Frame is ignored: False]
  1434. [Protocols in frame: eth:ip:tcp]
  1435. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1436. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1437. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1438. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1439. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1440. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1441. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1442. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1443. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1444. Type: IP (0x0800)
  1445. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1446. Version: 4
  1447. Header length: 20 bytes
  1448. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1449. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1450. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1451. Total Length: 52
  1452. Identification: 0x4371 (17265)
  1453. Flags: 0x00
  1454. 0... .... = Reserved bit: Not set
  1455. .0.. .... = Don't fragment: Not set
  1456. ..0. .... = More fragments: Not set
  1457. Fragment offset: 0
  1458. Time to live: 116
  1459. Protocol: TCP (6)
  1460. Header checksum: 0xc96c [correct]
  1461. [Good: True]
  1462. [Bad: False]
  1463. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1464. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1465. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
  1466. Source port: http (80)
  1467. Destination port: 40054 (40054)
  1468. [Stream index: 0]
  1469. Sequence number: 1 (relative sequence number)
  1470. Acknowledgement number: 1 (relative ack number)
  1471. Header length: 32 bytes
  1472. Flags: 0x010 (ACK)
  1473. 000. .... .... = Reserved: Not set
  1474. ...0 .... .... = Nonce: Not set
  1475. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1476. .... .0.. .... = ECN-Echo: Not set
  1477. .... ..0. .... = Urgent: Not set
  1478. .... ...1 .... = Acknowledgement: Set
  1479. .... .... 0... = Push: Not set
  1480. .... .... .0.. = Reset: Not set
  1481. .... .... ..0. = Syn: Not set
  1482. .... .... ...0 = Fin: Not set
  1483. Window size value: 16384
  1484. [Calculated window size: 16384]
  1485. [Window size scaling factor: 1]
  1486. Checksum: 0x985f [validation disabled]
  1487. [Good Checksum: False]
  1488. [Bad Checksum: False]
  1489. Options: (12 bytes)
  1490. No-Operation (NOP)
  1491. No-Operation (NOP)
  1492. Timestamps: TSval 970532, TSecr 530889220
  1493. Kind: Timestamp (8)
  1494. Length: 10
  1495. Timestamp value: 970532
  1496. Timestamp echo reply: 530889220
  1497. [SEQ/ACK analysis]
  1498. [TCP Analysis Flags]
  1499. [This is a TCP duplicate ack]
  1500. [Duplicate ACK #: 1]
  1501. [Duplicate to the ACK in frame: 15]
  1502. [Expert Info (Note/Sequence): Duplicate ACK (#1)]
  1503. [Message: Duplicate ACK (#1)]
  1504. [Severity level: Note]
  1505. [Group: Sequence]
  1506.  
  1507. Frame 18: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
  1508. Arrival Time: Jul 25, 2012 14:03:23.778946000 BST
  1509. Epoch Time: 1343221403.778946000 seconds
  1510. [Time delta from previous captured frame: 2.454614000 seconds]
  1511. [Time delta from previous displayed frame: 2.454614000 seconds]
  1512. [Time since reference or first frame: 11.060787000 seconds]
  1513. Frame Number: 18
  1514. Frame Length: 227 bytes (1816 bits)
  1515. Capture Length: 227 bytes (1816 bits)
  1516. [Frame is marked: False]
  1517. [Frame is ignored: False]
  1518. [Protocols in frame: eth:ip:tcp:http]
  1519. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1520. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1521. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1522. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1523. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1524. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1525. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1526. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1527. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1528. Type: IP (0x0800)
  1529. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1530. Version: 4
  1531. Header length: 20 bytes
  1532. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1533. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1534. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1535. Total Length: 213
  1536. Identification: 0x0009 (9)
  1537. Flags: 0x02 (Don't Fragment)
  1538. 0... .... = Reserved bit: Not set
  1539. .1.. .... = Don't fragment: Set
  1540. ..0. .... = More fragments: Not set
  1541. Fragment offset: 0
  1542. Time to live: 64
  1543. Protocol: TCP (6)
  1544. Header checksum: 0x0034 [correct]
  1545. [Good: True]
  1546. [Bad: False]
  1547. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1548. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1549. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
  1550. Source port: 40054 (40054)
  1551. Destination port: http (80)
  1552. [Stream index: 0]
  1553. Sequence number: 1 (relative sequence number)
  1554. [Next sequence number: 162 (relative sequence number)]
  1555. Acknowledgement number: 1 (relative ack number)
  1556. Header length: 32 bytes
  1557. Flags: 0x018 (PSH, ACK)
  1558. 000. .... .... = Reserved: Not set
  1559. ...0 .... .... = Nonce: Not set
  1560. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1561. .... .0.. .... = ECN-Echo: Not set
  1562. .... ..0. .... = Urgent: Not set
  1563. .... ...1 .... = Acknowledgement: Set
  1564. .... .... 1... = Push: Set
  1565. .... .... .0.. = Reset: Not set
  1566. .... .... ..0. = Syn: Not set
  1567. .... .... ...0 = Fin: Not set
  1568. Window size value: 898
  1569. [Calculated window size: 14368]
  1570. [Window size scaling factor: 16]
  1571. Checksum: 0x3aae [validation disabled]
  1572. [Good Checksum: False]
  1573. [Bad Checksum: False]
  1574. Options: (12 bytes)
  1575. No-Operation (NOP)
  1576. No-Operation (NOP)
  1577. Timestamps: TSval 2731756, TSecr 970532
  1578. Kind: Timestamp (8)
  1579. Length: 10
  1580. Timestamp value: 2731756
  1581. Timestamp echo reply: 970532
  1582. [SEQ/ACK analysis]
  1583. [Bytes in flight: 161]
  1584. [TCP Analysis Flags]
  1585. [This frame is a (suspected) retransmission]
  1586. [Expert Info (Note/Sequence): Retransmission (suspected)]
  1587. [Message: Retransmission (suspected)]
  1588. [Severity level: Note]
  1589. [Group: Sequence]
  1590. [The RTO for this segment was: 10.821727000 seconds]
  1591. [RTO based on delta from frame: 4]
  1592. Hypertext Transfer Protocol
  1593. GET / HTTP/1.1\r\n
  1594. [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
  1595. [Message: GET / HTTP/1.1\r\n]
  1596. [Severity level: Chat]
  1597. [Group: Sequence]
  1598. Request Method: GET
  1599. Request URI: /
  1600. Request Version: HTTP/1.1
  1601. User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
  1602. Host: dest.com\r\n
  1603. Accept: */*\r\n
  1604. \r\n
  1605. [Full request URI: http://dest.com/]
  1606.  
  1607. Frame 19: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
  1608. Arrival Time: Jul 25, 2012 14:03:24.017917000 BST
  1609. Epoch Time: 1343221404.017917000 seconds
  1610. [Time delta from previous captured frame: 0.238971000 seconds]
  1611. [Time delta from previous displayed frame: 0.238971000 seconds]
  1612. [Time since reference or first frame: 11.299758000 seconds]
  1613. Frame Number: 19
  1614. Frame Length: 66 bytes (528 bits)
  1615. Capture Length: 66 bytes (528 bits)
  1616. [Frame is marked: False]
  1617. [Frame is ignored: False]
  1618. [Protocols in frame: eth:ip:tcp]
  1619. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1620. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1621. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1622. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1623. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1624. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1625. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1626. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1627. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1628. Type: IP (0x0800)
  1629. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1630. Version: 4
  1631. Header length: 20 bytes
  1632. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1633. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1634. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1635. Total Length: 52
  1636. Identification: 0x1a01 (6657)
  1637. Flags: 0x00
  1638. 0... .... = Reserved bit: Not set
  1639. .0.. .... = Don't fragment: Not set
  1640. ..0. .... = More fragments: Not set
  1641. Fragment offset: 0
  1642. Time to live: 116
  1643. Protocol: TCP (6)
  1644. Header checksum: 0xf2dc [correct]
  1645. [Good: True]
  1646. [Bad: False]
  1647. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1648. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1649. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Ack: 1, Len: 0
  1650. Source port: http (80)
  1651. Destination port: 40054 (40054)
  1652. [Stream index: 0]
  1653. Sequence number: 1 (relative sequence number)
  1654. Acknowledgement number: 1 (relative ack number)
  1655. Header length: 32 bytes
  1656. Flags: 0x010 (ACK)
  1657. 000. .... .... = Reserved: Not set
  1658. ...0 .... .... = Nonce: Not set
  1659. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1660. .... .0.. .... = ECN-Echo: Not set
  1661. .... ..0. .... = Urgent: Not set
  1662. .... ...1 .... = Acknowledgement: Set
  1663. .... .... 0... = Push: Not set
  1664. .... .... .0.. = Reset: Not set
  1665. .... .... ..0. = Syn: Not set
  1666. .... .... ...0 = Fin: Not set
  1667. Window size value: 16384
  1668. [Calculated window size: 16384]
  1669. [Window size scaling factor: 1]
  1670. Checksum: 0x9844 [validation disabled]
  1671. [Good Checksum: False]
  1672. [Bad Checksum: False]
  1673. Options: (12 bytes)
  1674. No-Operation (NOP)
  1675. No-Operation (NOP)
  1676. Timestamps: TSval 970559, TSecr 530889220
  1677. Kind: Timestamp (8)
  1678. Length: 10
  1679. Timestamp value: 970559
  1680. Timestamp echo reply: 530889220
  1681. [SEQ/ACK analysis]
  1682. [TCP Analysis Flags]
  1683. [This is a TCP duplicate ack]
  1684. [Duplicate ACK #: 2]
  1685. [Duplicate to the ACK in frame: 15]
  1686. [Expert Info (Note/Sequence): Duplicate ACK (#2)]
  1687. [Message: Duplicate ACK (#2)]
  1688. [Severity level: Note]
  1689. [Group: Sequence]
  1690.  
  1691. Frame 20: 227 bytes on wire (1816 bits), 227 bytes captured (1816 bits)
  1692. Arrival Time: Jul 25, 2012 14:03:35.314826000 BST
  1693. Epoch Time: 1343221415.314826000 seconds
  1694. [Time delta from previous captured frame: 11.296909000 seconds]
  1695. [Time delta from previous displayed frame: 11.296909000 seconds]
  1696. [Time since reference or first frame: 22.596667000 seconds]
  1697. Frame Number: 20
  1698. Frame Length: 227 bytes (1816 bits)
  1699. Capture Length: 227 bytes (1816 bits)
  1700. [Frame is marked: False]
  1701. [Frame is ignored: False]
  1702. [Protocols in frame: eth:ip:tcp:http]
  1703. Ethernet II, Src: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR), Dst: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1704. Destination: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1705. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1706. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1707. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1708. Source: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1709. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1710. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1711. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1712. Type: IP (0x0800)
  1713. Internet Protocol Version 4, Src: SR.C.IP.ADDR (SR.C.IP.ADDR), Dst: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1714. Version: 4
  1715. Header length: 20 bytes
  1716. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1717. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1718. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1719. Total Length: 213
  1720. Identification: 0x000a (10)
  1721. Flags: 0x02 (Don't Fragment)
  1722. 0... .... = Reserved bit: Not set
  1723. .1.. .... = Don't fragment: Set
  1724. ..0. .... = More fragments: Not set
  1725. Fragment offset: 0
  1726. Time to live: 64
  1727. Protocol: TCP (6)
  1728. Header checksum: 0x0033 [correct]
  1729. [Good: True]
  1730. [Bad: False]
  1731. Source: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1732. Destination: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1733. Transmission Control Protocol, Src Port: 40054 (40054), Dst Port: http (80), Seq: 1, Ack: 1, Len: 161
  1734. Source port: 40054 (40054)
  1735. Destination port: http (80)
  1736. [Stream index: 0]
  1737. Sequence number: 1 (relative sequence number)
  1738. [Next sequence number: 162 (relative sequence number)]
  1739. Acknowledgement number: 1 (relative ack number)
  1740. Header length: 32 bytes
  1741. Flags: 0x018 (PSH, ACK)
  1742. 000. .... .... = Reserved: Not set
  1743. ...0 .... .... = Nonce: Not set
  1744. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1745. .... .0.. .... = ECN-Echo: Not set
  1746. .... ..0. .... = Urgent: Not set
  1747. .... ...1 .... = Acknowledgement: Set
  1748. .... .... 1... = Push: Set
  1749. .... .... .0.. = Reset: Not set
  1750. .... .... ..0. = Syn: Not set
  1751. .... .... ...0 = Fin: Not set
  1752. Window size value: 898
  1753. [Calculated window size: 14368]
  1754. [Window size scaling factor: 16]
  1755. Checksum: 0x3aae [validation disabled]
  1756. [Good Checksum: False]
  1757. [Bad Checksum: False]
  1758. Options: (12 bytes)
  1759. No-Operation (NOP)
  1760. No-Operation (NOP)
  1761. Timestamps: TSval 2734640, TSecr 970559
  1762. Kind: Timestamp (8)
  1763. Length: 10
  1764. Timestamp value: 2734640
  1765. Timestamp echo reply: 970559
  1766. [SEQ/ACK analysis]
  1767. [Bytes in flight: 161]
  1768. [TCP Analysis Flags]
  1769. [This frame is a (suspected) retransmission]
  1770. [Expert Info (Note/Sequence): Retransmission (suspected)]
  1771. [Message: Retransmission (suspected)]
  1772. [Severity level: Note]
  1773. [Group: Sequence]
  1774. [The RTO for this segment was: 22.357607000 seconds]
  1775. [RTO based on delta from frame: 4]
  1776. Hypertext Transfer Protocol
  1777. GET / HTTP/1.1\r\n
  1778. [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
  1779. [Message: GET / HTTP/1.1\r\n]
  1780. [Severity level: Chat]
  1781. [Group: Sequence]
  1782. Request Method: GET
  1783. Request URI: /
  1784. Request Version: HTTP/1.1
  1785. User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3\r\n
  1786. Host: dest.com\r\n
  1787. Accept: */*\r\n
  1788. \r\n
  1789. [Full request URI: http://dest.com/]
  1790.  
  1791. Frame 21: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
  1792. Arrival Time: Jul 25, 2012 14:03:35.557873000 BST
  1793. Epoch Time: 1343221415.557873000 seconds
  1794. [Time delta from previous captured frame: 0.243047000 seconds]
  1795. [Time delta from previous displayed frame: 0.243047000 seconds]
  1796. [Time since reference or first frame: 22.839714000 seconds]
  1797. Frame Number: 21
  1798. Frame Length: 60 bytes (480 bits)
  1799. Capture Length: 60 bytes (480 bits)
  1800. [Frame is marked: False]
  1801. [Frame is ignored: False]
  1802. [Protocols in frame: eth:ip:tcp]
  1803. Ethernet II, Src: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR), Dst: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1804. Destination: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1805. Address: SR:C_:MA:C_:AD:DR (SR:C_:MA:C_:AD:DR)
  1806. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1807. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1808. Source: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1809. Address: DE:ST:MA:C_:AD:DR (DE:ST:MA:C_:AD:DR)
  1810. .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  1811. .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
  1812. Type: IP (0x0800)
  1813. Trailer: aaaa00003d3e
  1814. Internet Protocol Version 4, Src: DE.ST.IP.ADDR (DE.ST.IP.ADDR), Dst: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1815. Version: 4
  1816. Header length: 20 bytes
  1817. Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
  1818. 0000 00.. = Differentiated Services Codepoint: Default (0x00)
  1819. .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
  1820. Total Length: 40
  1821. Identification: 0x0085 (133)
  1822. Flags: 0x00
  1823. 0... .... = Reserved bit: Not set
  1824. .0.. .... = Don't fragment: Not set
  1825. ..0. .... = More fragments: Not set
  1826. Fragment offset: 0
  1827. Time to live: 116
  1828. Protocol: TCP (6)
  1829. Header checksum: 0x0c65 [correct]
  1830. [Good: True]
  1831. [Bad: False]
  1832. Source: DE.ST.IP.ADDR (DE.ST.IP.ADDR)
  1833. Destination: SR.C.IP.ADDR (SR.C.IP.ADDR)
  1834. Transmission Control Protocol, Src Port: http (80), Dst Port: 40054 (40054), Seq: 1, Len: 0
  1835. Source port: http (80)
  1836. Destination port: 40054 (40054)
  1837. [Stream index: 0]
  1838. Sequence number: 1 (relative sequence number)
  1839. Acknowledgement number: Broken TCP. The acknowledge field is nonzero while the ACK flag is not set
  1840. Header length: 20 bytes
  1841. Flags: 0x004 (RST)
  1842. 000. .... .... = Reserved: Not set
  1843. ...0 .... .... = Nonce: Not set
  1844. .... 0... .... = Congestion Window Reduced (CWR): Not set
  1845. .... .0.. .... = ECN-Echo: Not set
  1846. .... ..0. .... = Urgent: Not set
  1847. .... ...0 .... = Acknowledgement: Not set
  1848. .... .... 0... = Push: Not set
  1849. .... .... .1.. = Reset: Set
  1850. [Expert Info (Chat/Sequence): Connection reset (RST)]
  1851. [Message: Connection reset (RST)]
  1852. [Severity level: Chat]
  1853. [Group: Sequence]
  1854. .... .... ..0. = Syn: Not set
  1855. .... .... ...0 = Fin: Not set
  1856. Window size value: 0
  1857. [Calculated window size: 0]
  1858. [Window size scaling factor: 1]
  1859. Checksum: 0x3d3e [validation disabled]
  1860. [Good Checksum: False]
  1861. [Bad Checksum: False]
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!