From 7b7faaf02befdf1ae6cba42cce10149a7cb7f0c0 Mon Sep 17 00:00:00 2001 From: Mattias Wadman Date: Mon, 22 Nov 2021 22:08:36 +0100 Subject: [PATCH] pcap: Add pcap, pcapng, ether8023, ipv4, udp, udp --- README.md | 2 +- doc/formats.md | 8 +- doc/formats.svg | 1548 ++--- format/all/all.fqtest | 2 + format/all/all.go | 2 + format/dns/dns.go | 79 +- format/dns/testdata/cern-rsp.fqtest | 2 +- format/format.go | 6 + format/inet/ether8023.go | 113 + format/inet/ipv4.go | 73 + format/inet/protocols.go | 145 + format/inet/services.go | 1377 +++++ format/inet/tcp.go | 42 + format/inet/testdata/ether8023 | Bin 0 -> 178 bytes format/inet/testdata/ether8023.fqtest | 31 + format/inet/testdata/ipv4 | Bin 0 -> 996 bytes format/inet/testdata/ipv4.fqtest | 21 + format/inet/testdata/tcp | Bin 0 -> 44 bytes format/inet/testdata/tcp.fqtest | 24 + format/inet/testdata/udp | Bin 0 -> 144 bytes format/inet/testdata/udp.fqtest | 10 + format/inet/udp.go | 49 + format/pcap/pcap.go | 70 + format/pcap/pcapng.go | 357 ++ format/pcap/shared.go | 278 + format/pcap/testdata/dhcp_big_endian.fqtest | 202 + format/pcap/testdata/dhcp_big_endian.pcapng | Bin 0 -> 1532 bytes .../pcap/testdata/dhcp_little_endian.fqtest | 202 + .../pcap/testdata/dhcp_little_endian.pcapng | Bin 0 -> 1532 bytes format/pcap/testdata/ipv4frags.fqtest | 101 + format/pcap/testdata/ipv4frags.pcap | Bin 0 -> 2990 bytes format/pcap/testdata/many_interfaces.fqtest | 5201 +++++++++++++++++ format/pcap/testdata/many_interfaces.pcapng | Bin 0 -> 20920 bytes pkg/bitio/buffer.go | 11 +- pkg/decode/decode.go | 8 + pkg/interp/testdata/args.fqtest | 6 + 36 files changed, 9213 insertions(+), 757 deletions(-) create mode 100644 format/inet/ether8023.go create mode 100644 format/inet/ipv4.go create mode 100644 format/inet/protocols.go create mode 100644 format/inet/services.go create mode 100644 format/inet/tcp.go create mode 100644 format/inet/testdata/ether8023 create mode 100644 format/inet/testdata/ether8023.fqtest create mode 100644 format/inet/testdata/ipv4 create mode 100644 format/inet/testdata/ipv4.fqtest create mode 100644 format/inet/testdata/tcp create mode 100644 format/inet/testdata/tcp.fqtest create mode 100644 format/inet/testdata/udp create mode 100644 format/inet/testdata/udp.fqtest create mode 100644 format/inet/udp.go create mode 100644 format/pcap/pcap.go create mode 100644 format/pcap/pcapng.go create mode 100644 format/pcap/shared.go create mode 100644 format/pcap/testdata/dhcp_big_endian.fqtest create mode 100644 format/pcap/testdata/dhcp_big_endian.pcapng create mode 100644 format/pcap/testdata/dhcp_little_endian.fqtest create mode 100644 format/pcap/testdata/dhcp_little_endian.pcapng create mode 100644 format/pcap/testdata/ipv4frags.fqtest create mode 100644 format/pcap/testdata/ipv4frags.pcap create mode 100644 format/pcap/testdata/many_interfaces.fqtest create mode 100644 format/pcap/testdata/many_interfaces.pcapng diff --git a/README.md b/README.md index 31dd429d..24fb5ae5 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ cp fq /usr/local/bin [./formats_list.jq]: sh-start -aac_frame, adts, adts_frame, apev2, av1_ccr, av1_frame, av1_obu, avc_annexb, avc_au, avc_dcr, avc_nalu, avc_pps, avc_sei, avc_sps, bzip2, dns, elf, exif, flac, flac_frame, flac_metadatablock, flac_metadatablocks, flac_picture, flac_streaminfo, gif, gzip, hevc_annexb, hevc_au, hevc_dcr, hevc_nalu, icc_profile, id3v1, id3v11, id3v2, jpeg, json, matroska, mp3, mp3_frame, mp4, mpeg_asc, mpeg_es, mpeg_pes, mpeg_pes_packet, mpeg_spu, mpeg_ts, ogg, ogg_page, opus_packet, png, protobuf, protobuf_widevine, pssh_playready, raw, tar, tiff, vorbis_comment, vorbis_packet, vp8_frame, vp9_cfm, vp9_frame, vpx_ccr, wav, webp, xing, zip +aac_frame, adts, adts_frame, apev2, av1_ccr, av1_frame, av1_obu, avc_annexb, avc_au, avc_dcr, avc_nalu, avc_pps, avc_sei, avc_sps, bzip2, dns, elf, ether8023, exif, flac, flac_frame, flac_metadatablock, flac_metadatablocks, flac_picture, flac_streaminfo, gif, gzip, hevc_annexb, hevc_au, hevc_dcr, hevc_nalu, icc_profile, id3v1, id3v11, id3v2, ipv4, jpeg, json, matroska, mp3, mp3_frame, mp4, mpeg_asc, mpeg_es, mpeg_pes, mpeg_pes_packet, mpeg_spu, mpeg_ts, ogg, ogg_page, opus_packet, pcap, pcapng, png, protobuf, protobuf_widevine, pssh_playready, raw, tar, tcp, tiff, udp, vorbis_comment, vorbis_packet, vp8_frame, vp9_cfm, vp9_frame, vpx_ccr, wav, webp, xing, zip [#]: sh-end diff --git a/doc/formats.md b/doc/formats.md index 27c21833..ff1b986b 100644 --- a/doc/formats.md +++ b/doc/formats.md @@ -21,6 +21,7 @@ |`bzip2` |bzip2 compression |`probe`| |`dns` |DNS packet || |`elf` |Executable and Linkable Format || +|`ether8023` |Ethernet 802.3 |`ipv4`| |`exif` |Exchangeable Image File Format || |`flac` |Free Lossless Audio Codec file |`flac_metadatablocks` `flac_frame`| |`flac_frame` |FLAC frame || @@ -38,6 +39,7 @@ |`id3v1` |ID3v1 metadata || |`id3v11` |ID3v1.1 metadata || |`id3v2` |ID3v2 metadata |`image`| +|`ipv4` |Internet protocol v4 |`udp` `tcp`| |`jpeg` |Joint Photographic Experts Group file |`exif` `icc_profile`| |`json` |JSON || |`matroska` |Matroska file |`aac_frame` `av1_ccr` `av1_frame` `avc_au` `avc_dcr` `flac_frame` `flac_metadatablocks` `hevc_au` `hevc_dcr` `image` `mp3_frame` `mpeg_asc` `mpeg_pes_packet` `mpeg_spu` `opus_packet` `vorbis_packet` `vp8_frame` `vp9_cfm` `vp9_frame`| @@ -53,13 +55,17 @@ |`ogg` |OGG file |`ogg_page` `vorbis_packet` `opus_packet` `flac_metadatablock` `flac_frame`| |`ogg_page` |OGG page || |`opus_packet` |Opus packet |`vorbis_comment`| +|`pcap` |PCAP packet capture |`ether8023`| +|`pcapng` |PCAPNG packet capture |`ether8023`| |`png` |Portable Network Graphics file |`icc_profile` `exif`| |`protobuf` |Protobuf || |`protobuf_widevine` |Widevine protobuf |`protobuf`| |`pssh_playready` |PlayReady PSSH || |`raw` |Raw bits || |`tar` |Tar archive |`probe`| +|`tcp` |Transmission Control Protocol || |`tiff` |Tag Image File Format |`icc_profile`| +|`udp` |User datagram protocol |`dns`| |`vorbis_comment` |Vorbis comment |`flac_picture`| |`vorbis_packet` |Vorbis packet |`vorbis_comment`| |`vp8_frame` |VP8 frame || @@ -71,7 +77,7 @@ |`xing` |Xing header || |`zip` |ZIP archive |`probe`| |`image` |Group |`gif` `jpeg` `mp4` `png` `tiff` `webp`| -|`probe` |Group |`adts` `bzip2` `elf` `flac` `gif` `gzip` `jpeg` `json` `matroska` `mp3` `mp4` `mpeg_ts` `ogg` `png` `tar` `tiff` `wav` `webp` `zip`| +|`probe` |Group |`adts` `bzip2` `elf` `flac` `gif` `gzip` `jpeg` `json` `matroska` `mp3` `mp4` `mpeg_ts` `ogg` `pcap` `pcapng` `png` `tar` `tiff` `wav` `webp` `zip`| [#]: sh-end diff --git a/doc/formats.svg b/doc/formats.svg index 86e067a1..ed33569c 100644 --- a/doc/formats.svg +++ b/doc/formats.svg @@ -4,1316 +4,1412 @@ - - + + formats - + adts - -adts - -adts_frame + +adts + +adts_frame adts_frame - -adts_frame - -aac_frame + +adts_frame + +aac_frame adts:adts_frame->adts_frame - - + + aac_frame - -aac_frame + +aac_frame adts_frame:aac_frame->aac_frame - - + + apev2 - -apev2 - -image + +apev2 + +image image - -image + +image apev2:image->image - - + + - + jpeg - -jpeg - -exif - -icc_profile + +jpeg + +exif + +icc_profile - + image->jpeg:jpeg - - + + - + mp4 - -mp4 - -aac_frame - -av1_ccr - -av1_frame - -flac_frame - -flac_metadatablocks - -id3v2 - -image - -jpeg - -mp3_frame - -avc_au - -avc_dcr - -mpeg_es - -hevc_au - -hevc_dcr - -mpeg_pes_packet - -opus_packet - -protobuf_widevine - -pssh_playready - -vorbis_packet - -vp9_frame - -vpx_ccr + +mp4 + +aac_frame + +av1_ccr + +av1_frame + +flac_frame + +flac_metadatablocks + +id3v2 + +image + +jpeg + +mp3_frame + +avc_au + +avc_dcr + +mpeg_es + +hevc_au + +hevc_dcr + +mpeg_pes_packet + +opus_packet + +protobuf_widevine + +pssh_playready + +vorbis_packet + +vp9_frame + +vpx_ccr - + image->mp4:mp4 - - + + - + png - -png - -icc_profile - -exif + +png + +icc_profile + +exif - + image->png:png - - + + - + tiff - -tiff - -icc_profile + +tiff + +icc_profile - + image->tiff:tiff - - + + - + webp - -webp - -vp8_frame + +webp + +vp8_frame - + image->webp:webp - - + + - + gif - -gif + +gif - + image->gif:gif - - + + av1_frame - -av1_frame - -av1_obu + +av1_frame + +av1_obu av1_obu - -av1_obu + +av1_obu av1_frame:av1_obu->av1_obu - - + + avc_annexb - -avc_annexb - -avc_nalu + +avc_annexb + +avc_nalu avc_nalu - -avc_nalu - -avc_sps - -avc_pps - -avc_sei + +avc_nalu + +avc_sps + +avc_pps + +avc_sei avc_annexb:avc_nalu->avc_nalu - - + + avc_sps - -avc_sps + +avc_sps avc_nalu:avc_sps->avc_sps - - + + avc_pps - -avc_pps + +avc_pps avc_nalu:avc_pps->avc_pps - - + + avc_sei - -avc_sei + +avc_sei avc_nalu:avc_sei->avc_sei - - + + avc_au - -avc_au - -avc_nalu + +avc_au + +avc_nalu avc_au:avc_nalu->avc_nalu - - + + avc_dcr - -avc_dcr - -avc_nalu + +avc_dcr + +avc_nalu avc_dcr:avc_nalu->avc_nalu - - + + bzip2 - -bzip2 - -probe + +bzip2 + +probe probe - -probe + +probe bzip2:probe->probe - - + + - + probe->adts:adts - - + + - + probe->bzip2:bzip2 - - + + - + flac - -flac - -flac_metadatablocks - -flac_frame + +flac + +flac_metadatablocks + +flac_frame - + probe->flac:flac - - + + + - + gzip - -gzip - -probe + +gzip + +probe - + probe->gzip:gzip - - + + - + probe->jpeg:jpeg - - + + - + matroska - -matroska - -aac_frame - -av1_ccr - -av1_frame - -avc_au - -avc_dcr - -flac_frame - -flac_metadatablocks - -hevc_au - -hevc_dcr - -image - -mp3_frame - -mpeg_asc - -mpeg_pes_packet - -mpeg_spu - -opus_packet - -vorbis_packet - -vp8_frame - -vp9_cfm - -vp9_frame + +matroska + +aac_frame + +av1_ccr + +av1_frame + +avc_au + +avc_dcr + +flac_frame + +flac_metadatablocks + +hevc_au + +hevc_dcr + +image + +mp3_frame + +mpeg_asc + +mpeg_pes_packet + +mpeg_spu + +opus_packet + +vorbis_packet + +vp8_frame + +vp9_cfm + +vp9_frame - + probe->matroska:matroska - - + + - + mp3 - -mp3 - -id3v2 - -id3v1 - -id3v11 - -apev2 - -mp3_frame + +mp3 + +id3v2 + +id3v1 + +id3v11 + +apev2 + +mp3_frame - + probe->mp3:mp3 - - + + - + probe->mp4:mp4 - - + + - + ogg - -ogg - -ogg_page - -vorbis_packet - -opus_packet - -flac_metadatablock - -flac_frame + +ogg + +ogg_page + +vorbis_packet + +opus_packet + +flac_metadatablock + +flac_frame - + probe->ogg:ogg - - - + + + + + +pcap + +pcap + +ether8023 + + + +probe->pcap:pcap + + + + + +pcapng + +pcapng + +ether8023 + + + +probe->pcapng:pcapng + + - + probe->png:png - - - + + + - + tar - -tar - -probe + +tar + +probe - + probe->tar:tar - - + + - + probe->tiff:tiff - - + + + - + wav - -wav - -id3v2 - -id3v1 - -id3v11 + +wav + +id3v2 + +id3v1 + +id3v11 - + probe->wav:wav - - + + - + probe->webp:webp - - - + + - + zip - -zip - -probe + +zip + +probe - + probe->zip:zip - - + + - + elf - -elf + +elf - + probe->elf:elf - - + + - + probe->gif:gif - - + + - + json - -json + +json - + probe->json:json - - + + - + mpeg_ts - -mpeg_ts + +mpeg_ts - + probe->mpeg_ts:mpeg_ts - - + + + + + +ether8023 + +ether8023 + +ipv4 + + + +ipv4 + +ipv4 + +udp + +tcp + + + +ether8023:ipv4->ipv4 + + + + + +udp + +udp + +dns + + + +ipv4:udp->udp + + + + + +tcp + +tcp + + + +ipv4:tcp->tcp + + - + flac_metadatablocks - -flac_metadatablocks - -flac_metadatablock + +flac_metadatablocks + +flac_metadatablock - + flac:flac_metadatablocks->flac_metadatablocks - - + + - + flac_frame - -flac_frame + +flac_frame - + flac:flac_frame->flac_frame - - + + - + flac_metadatablock - -flac_metadatablock - -flac_streaminfo - -flac_picture - -vorbis_comment + +flac_metadatablock + +flac_streaminfo + +flac_picture + +vorbis_comment - + flac_metadatablocks:flac_metadatablock->flac_metadatablock - - + + - + flac_streaminfo - -flac_streaminfo + +flac_streaminfo - + flac_metadatablock:flac_streaminfo->flac_streaminfo - - + + - + flac_picture - -flac_picture - -image + +flac_picture + +image - + flac_metadatablock:flac_picture->flac_picture - - + + - + vorbis_comment - -vorbis_comment - -flac_picture + +vorbis_comment + +flac_picture - + flac_metadatablock:vorbis_comment->vorbis_comment - - + + - + flac_picture:image->image - - + + - + vorbis_comment:flac_picture->flac_picture - - + + - + gzip:probe->probe - - + + - + hevc_annexb - -hevc_annexb - -hevc_nalu + +hevc_annexb + +hevc_nalu - + hevc_nalu - -hevc_nalu + +hevc_nalu - + hevc_annexb:hevc_nalu->hevc_nalu - - + + - + hevc_au - -hevc_au - -hevc_nalu + +hevc_au + +hevc_nalu - + hevc_au:hevc_nalu->hevc_nalu - - + + - + hevc_dcr - -hevc_dcr - -hevc_nalu + +hevc_dcr + +hevc_nalu - + hevc_dcr:hevc_nalu->hevc_nalu - - + + - + id3v2 - -id3v2 - -image + +id3v2 + +image - + id3v2:image->image - - - + + + + + + +dns + +dns + + + +udp:dns->dns + + - + exif - -exif + +exif - + jpeg:exif->exif - - + + - + icc_profile - -icc_profile + +icc_profile - + jpeg:icc_profile->icc_profile - - + + - + matroska:aac_frame->aac_frame - - + + - + matroska:image->image - - + + - + matroska:av1_frame->av1_frame - - + + - + matroska:avc_au->avc_au - - + + - + matroska:avc_dcr->avc_dcr - - + + - + matroska:flac_metadatablocks->flac_metadatablocks - - + + - + matroska:flac_frame->flac_frame - - + + - + matroska:hevc_au->hevc_au - - + + - + matroska:hevc_dcr->hevc_dcr - - + + - + av1_ccr - -av1_ccr + +av1_ccr - + matroska:av1_ccr->av1_ccr - - + + - + mp3_frame - -mp3_frame - -xing + +mp3_frame + +xing - + matroska:mp3_frame->mp3_frame - - + + - + mpeg_asc - -mpeg_asc + +mpeg_asc - + matroska:mpeg_asc->mpeg_asc - - + + - + mpeg_pes_packet - -mpeg_pes_packet + +mpeg_pes_packet - + matroska:mpeg_pes_packet->mpeg_pes_packet - - - + + - + mpeg_spu - -mpeg_spu + +mpeg_spu - + matroska:mpeg_spu->mpeg_spu - - + + - + opus_packet - -opus_packet - -vorbis_comment + +opus_packet + +vorbis_comment - + matroska:opus_packet->opus_packet - - + + - + vorbis_packet - -vorbis_packet - -vorbis_comment + +vorbis_packet + +vorbis_comment - + matroska:vorbis_packet->vorbis_packet - - + + - + vp8_frame - -vp8_frame + +vp8_frame - + matroska:vp8_frame->vp8_frame - - + + - + vp9_cfm - -vp9_cfm + +vp9_cfm - + matroska:vp9_cfm->vp9_cfm - - + + - + vp9_frame - -vp9_frame + +vp9_frame - + matroska:vp9_frame->vp9_frame - - + + - + xing - -xing + +xing - + mp3_frame:xing->xing - - + + - + opus_packet:vorbis_comment->vorbis_comment - - + + - + vorbis_packet:vorbis_comment->vorbis_comment - - + + - + mp3:apev2->apev2 - - + + - + mp3:id3v2->id3v2 - - + - + mp3:mp3_frame->mp3_frame - - + + - + id3v1 - -id3v1 + +id3v1 - + mp3:id3v1->id3v1 - - + + - + id3v11 - -id3v11 + +id3v11 - + mp3:id3v11->id3v11 - - + + - + mp4:aac_frame->aac_frame - - + + - + mp4:image->image - - + + - + mp4:av1_frame->av1_frame - - + + - + mp4:avc_au->avc_au - - + + - + mp4:avc_dcr->avc_dcr - - + + - + mp4:flac_metadatablocks->flac_metadatablocks - - + + - + mp4:flac_frame->flac_frame - - + + - + mp4:hevc_au->hevc_au - - + + - + mp4:hevc_dcr->hevc_dcr - - + + - + mp4:id3v2->id3v2 - - + + - + mp4:jpeg->jpeg - - + + - + mp4:av1_ccr->av1_ccr - - + + - + mp4:mp3_frame->mp3_frame - - + + - + mp4:mpeg_pes_packet->mpeg_pes_packet - - + + - + mp4:opus_packet->opus_packet - - + + - + mp4:vorbis_packet->vorbis_packet - - + + - + mp4:vp9_frame->vp9_frame - - + + - + mpeg_es - -mpeg_es - -mpeg_asc - -vorbis_packet + +mpeg_es + +mpeg_asc + +vorbis_packet - + mp4:mpeg_es->mpeg_es - - + + - + protobuf_widevine - -protobuf_widevine - -protobuf + +protobuf_widevine + +protobuf - + mp4:protobuf_widevine->protobuf_widevine - - + + - + pssh_playready - -pssh_playready + +pssh_playready - + mp4:pssh_playready->pssh_playready - - + + - + vpx_ccr - -vpx_ccr + +vpx_ccr - + mp4:vpx_ccr->vpx_ccr - - + + - + mpeg_es:mpeg_asc->mpeg_asc - - + + - + mpeg_es:vorbis_packet->vorbis_packet - - + + - + protobuf - -protobuf + +protobuf - + protobuf_widevine:protobuf->protobuf - - + + - + mpeg_pes - -mpeg_pes - -mpeg_pes_packet - -mpeg_spu + +mpeg_pes + +mpeg_pes_packet + +mpeg_spu - + mpeg_pes:mpeg_pes_packet->mpeg_pes_packet - + + - + mpeg_pes:mpeg_spu->mpeg_spu - - + + - + ogg:flac_frame->flac_frame - - + + - + ogg:flac_metadatablock->flac_metadatablock - - + + - + ogg:opus_packet->opus_packet - - + + - + ogg:vorbis_packet->vorbis_packet - - + + - + ogg_page ogg_page - + ogg:ogg_page->ogg_page - - + + + + + +pcap:ether8023->ether8023 + + + + + +pcapng:ether8023->ether8023 + + - + png:exif->exif - - + + - + png:icc_profile->icc_profile - - - + + + - + tar:probe->probe - - + + - + tiff:icc_profile->icc_profile - + - + wav:id3v2->id3v2 - - + + + - + wav:id3v1->id3v1 - - + + - + wav:id3v11->id3v11 - - + + - + webp:vp8_frame->vp8_frame - - + + - + zip:probe->probe - - - - - -dns - -dns + + - + raw - -raw + +raw diff --git a/format/all/all.fqtest b/format/all/all.fqtest index 1c2a99ae..5e4c7177 100644 --- a/format/all/all.fqtest +++ b/format/all/all.fqtest @@ -10,6 +10,8 @@ $ fq -n _registry.groups.probe "matroska", "mp4", "ogg", + "pcap", + "pcapng", "png", "tar", "tiff", diff --git a/format/all/all.go b/format/all/all.go index eba75d06..86d5801c 100644 --- a/format/all/all.go +++ b/format/all/all.go @@ -13,6 +13,7 @@ import ( _ "github.com/wader/fq/format/gzip" _ "github.com/wader/fq/format/icc" _ "github.com/wader/fq/format/id3" + _ "github.com/wader/fq/format/inet" _ "github.com/wader/fq/format/jpeg" _ "github.com/wader/fq/format/json" _ "github.com/wader/fq/format/matroska" @@ -21,6 +22,7 @@ import ( _ "github.com/wader/fq/format/mpeg" _ "github.com/wader/fq/format/ogg" _ "github.com/wader/fq/format/opus" + _ "github.com/wader/fq/format/pcap" _ "github.com/wader/fq/format/png" _ "github.com/wader/fq/format/protobuf" _ "github.com/wader/fq/format/raw" diff --git a/format/dns/dns.go b/format/dns/dns.go index 6a8174b3..b4c3e332 100644 --- a/format/dns/dns.go +++ b/format/dns/dns.go @@ -40,8 +40,12 @@ var classNames = map[[2]uint64]decode.Scalar{ const ( typeA = 1 - typeAAAA = 28 + typeNS = 2 typeCNAME = 5 + typeSOA = 6 + typePTR = 12 + typeTXT = 16 + typeAAAA = 28 ) var typeNames = decode.UToStr{ @@ -70,24 +74,24 @@ var typeNames = decode.UToStr{ 29: "LOC", 15: "MX", 35: "NAPTR", - 2: "NS", + typeNS: "NS", 47: "NSEC", 50: "NSEC3", 51: "NSEC3PARAM", 61: "OPENPGPKEY", - 12: "PTR", + typePTR: "PTR", 46: "RRSIG", 17: "RP", 24: "SIG", 53: "SMIMEA", - 6: "SOA", + typeSOA: "SOA", 33: "SRV", 44: "SSHFP", 32768: "TA", 249: "TKEY", 52: "TLSA", 250: "TSIG", - 16: "TXT", + typeTXT: "TXT", 256: "URI", 63: "ZONEMD", 64: "SVCB", @@ -124,7 +128,7 @@ func decodeAAAAStr(d *decode.D) string { return net.IP(d.BytesLen(16)).String() } -func fieldFormatLabel(d *decode.D, name string) { +func fieldDecodeLabel(d *decode.D, name string) { var endPos int64 const maxJumps = 100 jumpCount := 0 @@ -165,26 +169,51 @@ func fieldFormatLabel(d *decode.D, name string) { } } -func fieldFormatRR(d *decode.D, count uint64, name string, structName string) { +func dnsDecodeRR(d *decode.D, count uint64, name string, structName string) { d.FieldArray(name, func(d *decode.D) { for i := uint64(0); i < count; i++ { d.FieldStruct(structName, func(d *decode.D) { - fieldFormatLabel(d, "name") + fieldDecodeLabel(d, "name") typ := d.FieldU16("type", d.MapUToStrSym(typeNames)) class := d.FieldU16("class", d.MapURangeToScalar(classNames)) d.FieldU32("ttl") rdLength := d.FieldU16("rdlength") - switch { - case typ == typeCNAME: - fieldFormatLabel(d, "cname") - case class == classIN && typ == typeA: - d.FieldStrFn("address", decodeAStr) - case class == classIN && typ == typeAAAA: - d.FieldStrFn("address", decodeAAAAStr) - default: - d.FieldUTF8("rdata", int(rdLength)) - } + d.LenFn(int64(rdLength)*8, func(d *decode.D) { + // TODO: all only for classIN? + switch { + case class == classIN && typ == typeA: + d.FieldStrFn("address", decodeAStr) + case typ == typeNS: + fieldDecodeLabel(d, "ns") + case typ == typeCNAME: + fieldDecodeLabel(d, "cname") + case typ == typeSOA: + fieldDecodeLabel(d, "mname") + fieldDecodeLabel(d, "rname") + d.FieldU32("serial") + d.FieldU32("refresh") + d.FieldU32("retry") + d.FieldU32("expire") + d.FieldU32("minimum") + case typ == typePTR: + fieldDecodeLabel(d, "ptr") + case typ == typeTXT: + var ss []string + d.FieldStruct("txt", func(d *decode.D) { + d.FieldArray("strings", func(d *decode.D) { + for !d.End() { + ss = append(ss, d.FieldUTF8ShortString("string")) + } + }) + d.FieldValueStr("value", strings.Join(ss, "")) + }) + case class == classIN && typ == typeAAAA: + d.FieldStrFn("address", decodeAAAAStr) + default: + d.FieldUTF8("rdata", int(rdLength)) + } + }) }) } }) @@ -193,9 +222,9 @@ func fieldFormatRR(d *decode.D, count uint64, name string, structName string) { func dnsDecode(d *decode.D, in interface{}) interface{} { d.FieldStruct("header", func(d *decode.D) { d.FieldU16("id") - d.FieldBool("query", d.MapBoolToStrSym(decode.BoolToStr{ - true: "Query", - false: "Response", + d.FieldU1("qr", d.MapUToStrSym(decode.UToStr{ + 0: "query", + 1: "response", })) d.FieldU4("opcode", d.MapUToStrSym(decode.UToStr{ 0: "Query", @@ -220,16 +249,16 @@ func dnsDecode(d *decode.D, in interface{}) interface{} { d.FieldArray("questions", func(d *decode.D) { for i := uint64(0); i < qdCount; i++ { d.FieldStruct("question", func(d *decode.D) { - fieldFormatLabel(d, "name") + fieldDecodeLabel(d, "name") d.FieldU16("type", d.MapUToStrSym(typeNames)) d.FieldU16("class", d.MapURangeToScalar(classNames)) }) } }) - fieldFormatRR(d, anCount, "answers", "answer") - fieldFormatRR(d, nsCount, "nameservers", "nameserver") - fieldFormatRR(d, arCount, "additionals", "additional") + dnsDecodeRR(d, anCount, "answers", "answer") + dnsDecodeRR(d, nsCount, "nameservers", "nameserver") + dnsDecodeRR(d, arCount, "additionals", "additional") return nil } diff --git a/format/dns/testdata/cern-rsp.fqtest b/format/dns/testdata/cern-rsp.fqtest index 5171de3e..b466baf2 100644 --- a/format/dns/testdata/cern-rsp.fqtest +++ b/format/dns/testdata/cern-rsp.fqtest @@ -2,7 +2,7 @@ $ fq -d dns verbose /cern-rsp |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: {} /cern-rsp (dns) 0x0-0x4f.7 (80) | | | header: {} 0x0-0x3.7 (4) 0x00|71 02 |q. | id: 28930 0x0-0x1.7 (2) -0x00| 81 | . | query: "Query" (true) 0x2-0x2 (0.1) +0x00| 81 | . | qr: "response" (1) 0x2-0x2 (0.1) 0x00| 81 | . | opcode: "Query" (0) 0x2.1-0x2.4 (0.4) 0x00| 81 | . | authoritative_answer: false 0x2.5-0x2.5 (0.1) 0x00| 81 | . | truncation: false 0x2.6-0x2.6 (0.1) diff --git a/format/format.go b/format/format.go index d4c692be..6948ae49 100644 --- a/format/format.go +++ b/format/format.go @@ -26,6 +26,10 @@ const ( BZIP2 = "bzip2" DNS = "dns" ELF = "elf" + ETHER8023 = "ether8023" + IPV4 = "ipv4" + UDP = "udp" + TCP = "tcp" EXIF = "exif" FLAC = "flac" FLAC_FRAME = "flac_frame" @@ -66,6 +70,8 @@ const ( OGG = "ogg" OGG_PAGE = "ogg_page" OPUS_PACKET = "opus_packet" + PCAP = "pcap" + PCAPNG = "pcapng" PNG = "png" PROTOBUF = "protobuf" PROTOBUF_WIDEVINE = "protobuf_widevine" diff --git a/format/inet/ether8023.go b/format/inet/ether8023.go new file mode 100644 index 00000000..05cd8c41 --- /dev/null +++ b/format/inet/ether8023.go @@ -0,0 +1,113 @@ +package inet + +// TODO: move to own package? + +import ( + "encoding/binary" + "fmt" + + "github.com/wader/fq/format" + "github.com/wader/fq/format/registry" + "github.com/wader/fq/pkg/decode" +) + +var ipv4Format decode.Group + +func init() { + registry.MustRegister(decode.Format{ + Name: format.ETHER8023, + Description: "Ethernet 802.3", + Dependencies: []decode.Dependency{ + {Names: []string{format.IPV4}, Group: &ipv4Format}, + }, + DecodeFn: decodeEthernet, + }) +} + +const ( + etherTypeIPv4 = 0x0800 +) + +// from https://en.wikipedia.org/wiki/EtherType +// TODO: cleanup +var etherTypeMap = decode.UToScalar{ + etherTypeIPv4: {Sym: "ipv4", Description: `Internet Protocol version 4`}, + 0x0806: {Sym: "arp", Description: `Address Resolution Protocol`}, + 0x0842: {Sym: "wake", Description: `Wake-on-LAN[9]`}, + 0x22f0: {Sym: "audio", Description: `Audio Video Transport Protocol`}, + 0x22f3: {Sym: "trill", Description: `IETF TRILL Protocol`}, + 0x22ea: {Sym: "srp", Description: `Stream Reservation Protocol`}, + 0x6002: {Sym: "dec", Description: `DEC MOP RC`}, + 0x6003: {Sym: "decnet", Description: `DECnet Phase IV, DNA Routing`}, + 0x6004: {Sym: "declat", Description: `DEC LAT`}, + 0x8035: {Sym: "Reverse", Description: `Reverse Address Resolution Protocol`}, + 0x809b: {Sym: "appletalk", Description: `AppleTalk`}, + 0x80f3: {Sym: "appletalk_arp", Description: `AppleTalk Address Resolution Protocol`}, + 0x8100: {Sym: "vlan", Description: `VLAN-tagged (IEEE 802.1Q)`}, + 0x8102: {Sym: "slpp", Description: `Simple Loop Prevention Protocol`}, + 0x8103: {Sym: "vlacp", Description: `Virtual Link Aggregation Control Protocol`}, + 0x8137: {Sym: "ipx", Description: `IPX`}, + 0x8204: {Sym: "qnx", Description: `QNX Qnet`}, + 0x86dd: {Sym: "ipv6", Description: `Internet Protocol Version 6`}, + 0x8808: {Sym: "flow_control", Description: `Ethernet flow control`}, + 0x8809: {Sym: "lacp", Description: `Ethernet Slow Protocols] such as the Link Aggregation Control Protocol`}, + 0x8819: {Sym: "cobranet", Description: `CobraNet`}, + 0x8847: {Sym: "mpls", Description: `MPLS unicast`}, + 0x8848: {Sym: "mpls", Description: `MPLS multicast`}, + 0x8863: {Sym: "pppoe_discovery", Description: `PPPoE Discovery Stage`}, + 0x8864: {Sym: "pppoe_session", Description: `PPPoE Session Stage`}, + 0x887b: {Sym: "homeplug", Description: `HomePlug 1.0 MME`}, + 0x888e: {Sym: "eap", Description: `EAP over LAN (IEEE 802.1X)`}, + 0x8892: {Sym: "profinet", Description: `PROFINET Protocol`}, + 0x889a: {Sym: "hyperscsi", Description: `HyperSCSI (SCSI over Ethernet)`}, + 0x88a2: {Sym: "ata", Description: `ATA over Ethernet`}, + 0x88a4: {Sym: "ethercat", Description: `EtherCAT Protocol`}, + 0x88a8: {Sym: "service", Description: `Service VLAN tag identifier (S-Tag) on Q-in-Q tunnel.`}, + 0x88ab: {Sym: "ethernet", Description: `Ethernet Powerlink`}, + 0x88b8: {Sym: "goose", Description: `GOOSE (Generic Object Oriented Substation event)`}, + 0x88b9: {Sym: "gse", Description: `GSE (Generic Substation Events) Management Services`}, + 0x88ba: {Sym: "sv", Description: `SV (Sampled Value Transmission)`}, + 0x88bf: {Sym: "mikrotik", Description: `MikroTik RoMON (unofficial)`}, + 0x88cc: {Sym: "link", Description: `Link Layer Discovery Protocol (LLDP)`}, + 0x88cd: {Sym: "sercos", Description: `SERCOS III`}, + 0x88e1: {Sym: "homeplug", Description: `HomePlug Green PHY`}, + 0x88e3: {Sym: "media", Description: `Media Redundancy Protocol (IEC62439-2)`}, + 0x88e5: {Sym: "ieee", Description: `IEEE 802.1AE MAC security (MACsec)`}, + 0x88e7: {Sym: "provider", Description: `Provider Backbone Bridges (PBB) (IEEE 802.1ah)`}, + 0x88f7: {Sym: "precision", Description: `Precision Time Protocol (PTP) over IEEE 802.3 Ethernet`}, + 0x88f8: {Sym: "nc", Description: `NC-SI`}, + 0x88fb: {Sym: "parallel", Description: `Parallel Redundancy Protocol (PRP)`}, + 0x8902: {Sym: "ieee", Description: `IEEE 802.1ag Connectivity Fault Management (CFM) Protocol / ITU-T Recommendation Y.1731 (OAM)`}, + 0x8906: {Sym: "fibre", Description: `Fibre Channel over Ethernet (FCoE)`}, + 0x8914: {Sym: "fcoe", Description: `FCoE Initialization Protocol`}, + 0x8915: {Sym: "rdma", Description: `RDMA over Converged Ethernet (RoCE)`}, + 0x891d: {Sym: "ttethernet", Description: `TTEthernet Protocol Control Frame (TTE)`}, + 0x893a: {Sym: "1905", Description: `1905.1 IEEE Protocol`}, + 0x892f: {Sym: "high", Description: `High-availability Seamless Redundancy (HSR)`}, + 0x9000: {Sym: "ethernet", Description: `Ethernet Configuration Testing Protocol[12]`}, + 0xf1c1: {Sym: "redundancy", Description: `Redundancy Tag (IEEE 802.1CB Frame Replication and Elimination for Reliability)`}, +} + +var etherTypeFormat = map[uint64]*decode.Group{ + etherTypeIPv4: &ipv4Format, +} + +func mapUToEtherSym(s decode.Scalar) (decode.Scalar, error) { + var b [8]byte + binary.BigEndian.PutUint64(b[:], s.ActualU()) + s.Sym = fmt.Sprintf("%.2x:%.2x:%.2x:%.2x:%.2x:%.2x", b[2], b[3], b[4], b[5], b[6], b[7]) + return s, nil +} + +func decodeEthernet(d *decode.D, in interface{}) interface{} { + d.FieldU("destination", 48, mapUToEtherSym, d.Hex) + d.FieldU("source", 48, mapUToEtherSym, d.Hex) + etherType := d.FieldU16("ether_type", d.MapUToScalar(etherTypeMap), d.Hex) + if g, ok := etherTypeFormat[etherType]; ok { + d.FieldFormatLen("packet", d.BitsLeft(), *g, nil) + } else { + d.FieldRawLen("data", d.BitsLeft()) + } + + return nil +} diff --git a/format/inet/ipv4.go b/format/inet/ipv4.go new file mode 100644 index 00000000..4754e140 --- /dev/null +++ b/format/inet/ipv4.go @@ -0,0 +1,73 @@ +package inet + +import ( + "encoding/binary" + "net" + + "github.com/wader/fq/format" + "github.com/wader/fq/format/registry" + "github.com/wader/fq/pkg/decode" +) + +var udpFormat decode.Group +var tcpFormat decode.Group + +func init() { + registry.MustRegister(decode.Format{ + Name: format.IPV4, + Description: "Internet protocol v4", + Dependencies: []decode.Dependency{ + {Names: []string{format.UDP}, Group: &udpFormat}, + {Names: []string{format.TCP}, Group: &tcpFormat}, + }, + DecodeFn: decodeIPv4, + }) +} + +const ( + ipv4ProtocolTCP = 6 + ipv4ProtocolUDP = 17 +) + +var ipv4ProtocolFormat = map[uint64]*decode.Group{ + ipv4ProtocolUDP: &udpFormat, + ipv4ProtocolTCP: &tcpFormat, +} + +func mapUToIPv4Sym(s decode.Scalar) (decode.Scalar, error) { + var b [4]byte + binary.BigEndian.PutUint32(b[:], uint32(s.ActualU())) + s.Sym = net.IP(b[:]).String() + return s, nil +} + +func decodeIPv4(d *decode.D, in interface{}) interface{} { + d.FieldU4("version") + ihl := d.FieldU4("ihl") + d.FieldU6("dscp") + d.FieldU2("ecn") + totalLength := d.FieldU16("total_length") + d.FieldU16("identification") + d.FieldU1("reserved") + d.FieldBool("dont_fragment") + moreFragments := d.FieldBool("more_fragments") + fragmentOffset := d.FieldU13("fragment_offset") + d.FieldU8("ttl") + protocol := d.FieldU8("protocol", d.MapUToScalar(ipv4ProtocolMap)) + d.FieldU16("header_checksum", d.Hex) + d.FieldU32("source_ip", mapUToIPv4Sym, d.Hex) + d.FieldU32("destination_ip", mapUToIPv4Sym, d.Hex) + if ihl > 5 { + d.FieldRawLen("options", (int64(ihl)-5)*8*4) + } + + dataLen := int64(totalLength-(ihl*4)) * 8 + g, ok := ipv4ProtocolFormat[protocol] + if !ok || moreFragments || fragmentOffset > 0 { + d.FieldRawLen("data", dataLen) + } else { + d.FieldFormatLen("data", dataLen, *g, nil) + } + + return nil +} diff --git a/format/inet/protocols.go b/format/inet/protocols.go new file mode 100644 index 00000000..197c02de --- /dev/null +++ b/format/inet/protocols.go @@ -0,0 +1,145 @@ +package inet + +import "github.com/wader/fq/pkg/decode" + +// based on etc/services from Darwin/FreeBSD +// cat /etc/protocols | grep -v '^#' | jq -rR 'capture("(?[\\w\\d-]+)\\s+(?\\d+)\\s+.*#\\s+(?.*)") | "\(.nr): {Sym: \(.name|tojson), Description: \(.desc|tojson)},"' + +var ipv4ProtocolMap = decode.UToScalar{ + 0: {Sym: "ip", Description: "internet protocol, pseudo protocol number"}, + 1: {Sym: "icmp", Description: "internet control message protocol"}, + 2: {Sym: "igmp", Description: "internet group management protocol"}, + 3: {Sym: "ggp", Description: "gateway-gateway protocol"}, + 4: {Sym: "ipencap", Description: "IP encapsulated in IP"}, + 5: {Sym: "st2", Description: "ST2 datagram mode"}, + 6: {Sym: "tcp", Description: "transmission control protocol"}, + 7: {Sym: "cbt"}, + 8: {Sym: "egp", Description: "exterior gateway protocol"}, + 9: {Sym: "igp", Description: "any private interior gateway"}, + 10: {Sym: "bbn-rcc", Description: "BBN RCC Monitoring"}, + 11: {Sym: "nvp", Description: "Network Voice Protocol"}, + 12: {Sym: "pup", Description: "PARC universal packet protocol"}, + 13: {Sym: "argus", Description: "ARGUS"}, + 14: {Sym: "emcon", Description: "EMCON"}, + 15: {Sym: "xnet", Description: "Cross Net Debugger"}, + 16: {Sym: "chaos", Description: "Chaos"}, + 17: {Sym: "udp", Description: "user datagram protocol"}, + 18: {Sym: "mux", Description: "Multiplexing protocol"}, + 19: {Sym: "dcn", Description: "DCN Measurement Subsystems"}, + 20: {Sym: "hmp", Description: "host monitoring protocol"}, + 21: {Sym: "prm", Description: "packet radio measurement protocol"}, + 22: {Sym: "xns-idp", Description: "Xerox NS IDP"}, + 23: {Sym: "trunk-1", Description: "Trunk-1"}, + 24: {Sym: "trunk-2", Description: "Trunk-2"}, + 25: {Sym: "leaf-1", Description: "Leaf-1"}, + 26: {Sym: "leaf-2", Description: "Leaf-2"}, + 27: {Sym: "rdp", Description: "reliable datagram protocol"}, + 28: {Sym: "irtp", Description: "Internet Reliable Transaction Protocol"}, + 29: {Sym: "iso-tp4", Description: "ISO Transport Protocol Class 4"}, + 30: {Sym: "netblt", Description: "Bulk Data Transfer Protocol"}, + 31: {Sym: "mfe-nsp", Description: "MFE Network Services Protocol"}, + 32: {Sym: "merit-inp", Description: "MERIT Internodal Protocol"}, + 33: {Sym: "dccp", Description: "Datagram Congestion Control Protocol"}, + 34: {Sym: "3pc", Description: "Third Party Connect Protocol"}, + 35: {Sym: "idpr", Description: "Inter-Domain Policy Routing Protocol"}, + 36: {Sym: "xtp", Description: "Xpress Tranfer Protocol"}, + 37: {Sym: "ddp", Description: "Datagram Delivery Protocol"}, + 38: {Sym: "idpr-cmtp", Description: "IDPR Control Message Transport Proto"}, + 40: {Sym: "il", Description: "IL Transport Protocol"}, + 41: {Sym: "ipv6", Description: "ipv6"}, + 42: {Sym: "sdrp", Description: "Source Demand Routing Protocol"}, + 43: {Sym: "ipv6-route", Description: "routing header for ipv6"}, + 44: {Sym: "ipv6-frag", Description: "fragment header for ipv6"}, + 45: {Sym: "idrp", Description: "Inter-Domain Routing Protocol"}, + 46: {Sym: "rsvp", Description: "Resource ReSerVation Protocol"}, + 47: {Sym: "gre", Description: "Generic Routing Encapsulation"}, + 48: {Sym: "dsr", Description: "Dynamic Source Routing Protocol"}, + 49: {Sym: "bna", Description: "BNA"}, + 50: {Sym: "esp", Description: "encapsulating security payload"}, + 51: {Sym: "ah", Description: "authentication header"}, + 52: {Sym: "i-nlsp", Description: "Integrated Net Layer Security TUBA"}, + 53: {Sym: "swipe", Description: "IP with Encryption"}, + 54: {Sym: "narp", Description: "NBMA Address Resolution Protocol"}, + 55: {Sym: "mobile", Description: "IP Mobility"}, + 56: {Sym: "tlsp", Description: "Transport Layer Security Protocol"}, + 57: {Sym: "skip", Description: "SKIP"}, + 58: {Sym: "ipv6-icmp", Description: "ICMP for IPv6"}, + 59: {Sym: "ipv6-nonxt", Description: "no next header for ipv6"}, + 60: {Sym: "ipv6-opts", Description: "destination options for ipv6"}, + 62: {Sym: "cftp", Description: "CFTP"}, + 64: {Sym: "sat-expak", Description: "SATNET and Backroom EXPAK"}, + 65: {Sym: "kryptolan", Description: "Kryptolan"}, + 66: {Sym: "rvd", Description: "MIT Remote Virtual Disk Protocol"}, + 67: {Sym: "ippc", Description: "Internet Pluribus Packet Core"}, + 69: {Sym: "sat-mon", Description: "SATNET Monitoring"}, + 70: {Sym: "visa", Description: "VISA Protocol"}, + 71: {Sym: "ipcv", Description: "Internet Packet Core Utility"}, + 72: {Sym: "cpnx", Description: "Computer Protocol Network Executive"}, + 73: {Sym: "cphb", Description: "Computer Protocol Heart Beat"}, + 74: {Sym: "wsn", Description: "Wang Span Network"}, + 75: {Sym: "pvp", Description: "Packet Video Protocol"}, + 76: {Sym: "br-sat-mon", Description: "Backroom SATNET Monitoring"}, + 77: {Sym: "sun-nd", Description: "SUN ND PROTOCOL-Temporary"}, + 78: {Sym: "wb-mon", Description: "WIDEBAND Monitoring"}, + 79: {Sym: "wb-expak", Description: "WIDEBAND EXPAK"}, + 80: {Sym: "iso-ip", Description: "ISO Internet Protocol"}, + 81: {Sym: "vmtp", Description: "Versatile Message Transport"}, + 82: {Sym: "secure-vmtp", Description: "SECURE-VMTP"}, + 83: {Sym: "vines", Description: "VINES"}, + 84: {Sym: "ttp", Description: "TTP"}, + 85: {Sym: "nsfnet-igp", Description: "NSFNET-IGP"}, + 86: {Sym: "dgp", Description: "Dissimilar Gateway Protocol"}, + 87: {Sym: "tcf", Description: "TCF"}, + 88: {Sym: "eigrp", Description: "Enhanced Interior Routing Protocol (Cisco)"}, + 89: {Sym: "ospf", Description: "Open Shortest Path First IGP"}, + 90: {Sym: "sprite-rpc", Description: "Sprite RPC Protocol"}, + 91: {Sym: "larp", Description: "Locus Address Resolution Protocol"}, + 92: {Sym: "mtp", Description: "Multicast Transport Protocol"}, + 93: {Sym: "25", Description: "AX.25 Frames"}, + 94: {Sym: "ipip", Description: "Yet Another IP encapsulation"}, + 95: {Sym: "micp", Description: "Mobile Internetworking Control Pro."}, + 96: {Sym: "scc-sp", Description: "Semaphore Communications Sec. Pro."}, + 97: {Sym: "etherip", Description: "Ethernet-within-IP Encapsulation"}, + 98: {Sym: "encap", Description: "Yet Another IP encapsulation"}, + 100: {Sym: "gmtp", Description: "GMTP"}, + 101: {Sym: "ifmp", Description: "Ipsilon Flow Management Protocol"}, + 102: {Sym: "pnni", Description: "PNNI over IP"}, + 103: {Sym: "pim", Description: "Protocol Independent Multicast"}, + 104: {Sym: "aris", Description: "ARIS"}, + 105: {Sym: "scps", Description: "SCPS"}, + 106: {Sym: "qnx", Description: "QNX"}, + 107: {Sym: "n", Description: "Active Networks"}, + 108: {Sym: "ipcomp", Description: "IP Payload Compression Protocol"}, + 109: {Sym: "snp", Description: "Sitara Networks Protocol"}, + 110: {Sym: "compaq-peer", Description: "Compaq Peer Protocol"}, + 111: {Sym: "ipx-in-ip", Description: "IPX in IP"}, + 112: {Sym: "carp", Description: "Common Address Redundancy Protocol"}, + 113: {Sym: "pgm", Description: "PGM Reliable Transport Protocol"}, + 115: {Sym: "l2tp", Description: "Layer Two Tunneling Protocol"}, + 116: {Sym: "ddx", Description: "D-II Data Exchange"}, + 117: {Sym: "iatp", Description: "Interactive Agent Transfer Protocol"}, + 118: {Sym: "stp", Description: "Schedule Transfer Protocol"}, + 119: {Sym: "srp", Description: "SpectraLink Radio Protocol"}, + 120: {Sym: "uti", Description: "UTI"}, + 121: {Sym: "smp", Description: "Simple Message Protocol"}, + 122: {Sym: "sm", Description: "SM"}, + 123: {Sym: "ptp", Description: "Performance Transparency Protocol"}, + 124: {Sym: "isis", Description: "ISIS over IPv4"}, + 126: {Sym: "crtp", Description: "Combat Radio Transport Protocol"}, + 127: {Sym: "crudp", Description: "Combat Radio User Datagram"}, + 130: {Sym: "sps", Description: "Secure Packet Shield"}, + 131: {Sym: "pipe", Description: "Private IP Encapsulation within IP"}, + 132: {Sym: "sctp", Description: "Stream Control Transmission Protocol"}, + 133: {Sym: "fc", Description: "Fibre Channel"}, + 134: {Sym: "rsvp-e2e-ignore", Description: "Aggregation of RSVP for IP reservations"}, + 135: {Sym: "mobility-header", Description: "Mobility Support in IPv6"}, + 136: {Sym: "udplite", Description: "The UDP-Lite Protocol"}, + 137: {Sym: "mpls-in-ip", Description: "Encapsulating MPLS in IP"}, + 138: {Sym: "manet", Description: "MANET Protocols (RFC5498)"}, + 139: {Sym: "hip", Description: "Host Identity Protocol (RFC5201)"}, + 140: {Sym: "shim6", Description: "Shim6 Protocol (RFC5533)"}, + 141: {Sym: "wesp", Description: "Wrapped Encapsulating Security Payload (RFC5840)"}, + 142: {Sym: "rohc", Description: "Robust Header Compression (RFC5858)"}, + 240: {Sym: "pfsync", Description: "PF Synchronization"}, + 258: {Sym: "divert", Description: "Divert pseudo-protocol [non IANA]"}, +} diff --git a/format/inet/services.go b/format/inet/services.go new file mode 100644 index 00000000..baaf4e49 --- /dev/null +++ b/format/inet/services.go @@ -0,0 +1,1377 @@ +package inet + +import "github.com/wader/fq/pkg/decode" + +// based on etc/services from Darwin/FreeBSD +// cat /etc/services | grep -v '^#' | jq -rR 'capture("(?[\\w\\d-]+)\\s+(?\\d+)/(?\\w+)\\s+.*#\\s+(?.*)") | select(.proto=="udp") | "\(.port): {Sym: \(.name|tojson), Description: \(.desc|tojson)},"' +// current truncated to < 1024 + +var udpPortMap = decode.UToScalar{ + 1: {Sym: "tcpmux", Description: "TCP Port Service Multiplexer"}, + 2: {Sym: "compressnet", Description: "Management Utility"}, + 3: {Sym: "compressnet", Description: "Compression Process"}, + 5: {Sym: "rje", Description: "Remote Job Entry"}, + 7: {Sym: "echo", Description: "Echo"}, + 9: {Sym: "discard", Description: "Discard"}, + 11: {Sym: "systat", Description: "Active Users"}, + 13: {Sym: "daytime", Description: "Daytime (RFC 867)"}, + 17: {Sym: "qotd", Description: "Quote of the Day"}, + 18: {Sym: "msp", Description: "Message Send Protocol"}, + 19: {Sym: "chargen", Description: "Character Generator"}, + 20: {Sym: "ftp-data", Description: "File Transfer [Default Data]"}, + 21: {Sym: "ftp", Description: "File Transfer [Control]"}, + 22: {Sym: "ssh", Description: "SSH Remote Login Protocol"}, + 23: {Sym: "telnet", Description: "Telnet"}, + 25: {Sym: "smtp", Description: "Simple Mail Transfer"}, + 27: {Sym: "nsw-fe", Description: "NSW User System FE"}, + 29: {Sym: "msg-icp", Description: "MSG ICP"}, + 31: {Sym: "msg-auth", Description: "MSG Authentication"}, + 33: {Sym: "dsp", Description: "Display Support Protocol"}, + 37: {Sym: "time", Description: "Time"}, + 38: {Sym: "rap", Description: "Route Access Protocol"}, + 39: {Sym: "rlp", Description: "Resource Location Protocol"}, + 41: {Sym: "graphics", Description: "Graphics"}, + 42: {Sym: "name", Description: "Host Name Server"}, + 44: {Sym: "mpm-flags", Description: "MPM FLAGS Protocol"}, + 45: {Sym: "mpm", Description: "Message Processing Module [recv]"}, + 46: {Sym: "mpm-snd", Description: "MPM [default send]"}, + 47: {Sym: "ni-ftp", Description: "NI FTP"}, + 48: {Sym: "auditd", Description: "Digital Audit Daemon"}, + 49: {Sym: "tacacs", Description: "Login Host Protocol (TACACS)"}, + 50: {Sym: "re-mail-ck", Description: "Remote Mail Checking Protocol"}, + 51: {Sym: "la-maint", Description: "IMP Logical Address Maintenance"}, + 52: {Sym: "xns-time", Description: "XNS Time Protocol"}, + 53: {Sym: "domain", Description: "Domain Name Server"}, + 54: {Sym: "xns-ch", Description: "XNS Clearinghouse"}, + 55: {Sym: "isi-gl", Description: "ISI Graphics Language"}, + 56: {Sym: "xns-auth", Description: "XNS Authentication"}, + 58: {Sym: "xns-mail", Description: "XNS Mail"}, + 61: {Sym: "ni-mail", Description: "NI MAIL"}, + 62: {Sym: "acas", Description: "ACA Services"}, + 64: {Sym: "covia", Description: "Communications Integrator (CI)"}, + 65: {Sym: "tacacs-ds", Description: "TACACS-Database Service"}, + 66: {Sym: "net", Description: "Oracle SQL*NET"}, + 67: {Sym: "bootps", Description: "Bootstrap Protocol Server"}, + 68: {Sym: "bootpc", Description: "Bootstrap Protocol Client"}, + 69: {Sym: "tftp", Description: "Trivial File Transfer"}, + 70: {Sym: "gopher", Description: "Gopher"}, + 71: {Sym: "netrjs-1", Description: "Remote Job Service"}, + 72: {Sym: "netrjs-2", Description: "Remote Job Service"}, + 73: {Sym: "netrjs-3", Description: "Remote Job Service"}, + 74: {Sym: "netrjs-4", Description: "Remote Job Service"}, + 76: {Sym: "deos", Description: "Distributed External Object Store"}, + 78: {Sym: "vettcp", Description: "vettcp"}, + 79: {Sym: "finger", Description: "Finger"}, + 80: {Sym: "http", Description: "World Wide Web HTTP"}, + 81: {Sym: "hosts2-ns", Description: "HOSTS2 Name Server"}, + 82: {Sym: "xfer", Description: "XFER Utility"}, + 83: {Sym: "mit-ml-dev", Description: "MIT ML Device"}, + 84: {Sym: "ctf", Description: "Common Trace Facility"}, + 85: {Sym: "mit-ml-dev", Description: "MIT ML Device"}, + 86: {Sym: "mfcobol", Description: "Micro Focus Cobol"}, + 88: {Sym: "kerberos", Description: "Kerberos"}, + 89: {Sym: "su-mit-tg", Description: "SU/MIT Telnet Gateway"}, + 90: {Sym: "dnsix", Description: "DNSIX Securit Attribute Token Map"}, + 91: {Sym: "mit-dov", Description: "MIT Dover Spooler"}, + 92: {Sym: "npp", Description: "Network Printing Protocol"}, + 93: {Sym: "dcp", Description: "Device Control Protocol"}, + 94: {Sym: "objcall", Description: "Tivoli Object Dispatcher"}, + 95: {Sym: "supdup", Description: "SUPDUP"}, + 96: {Sym: "dixie", Description: "DIXIE Protocol Specification"}, + 97: {Sym: "swift-rvf", Description: "Swift Remote Virtural File Protocol"}, + 98: {Sym: "tacnews", Description: "TAC News"}, + 99: {Sym: "metagram", Description: "Metagram Relay"}, + 101: {Sym: "hostname", Description: "NIC Host Name Server"}, + 102: {Sym: "iso-tsap", Description: "ISO-TSAP Class 0"}, + 103: {Sym: "gppitnp", Description: "Genesis Point-to-Point Trans Net"}, + 104: {Sym: "acr-nema", Description: "ACR-NEMA Digital Imag. & Comm. 300"}, + 105: {Sym: "cso", Description: "CCSO name server protocol"}, + // 105: {Sym: "csnet-ns", Description: "Mailbox Name Nameserver"}, + 106: {Sym: "3com-tsmux", Description: "3COM-TSMUX"}, + 107: {Sym: "rtelnet", Description: "Remote Telnet Service"}, + 108: {Sym: "snagas", Description: "SNA Gateway Access Server"}, + 109: {Sym: "pop2", Description: "Post Office Protocol - Version 2"}, + 110: {Sym: "pop3", Description: "Post Office Protocol - Version 3"}, + 111: {Sym: "sunrpc", Description: "SUN Remote Procedure Call"}, + 112: {Sym: "mcidas", Description: "McIDAS Data Transmission Protocol"}, + 113: {Sym: "auth", Description: "Authentication Service"}, + 114: {Sym: "audionews", Description: "Audio News Multicast"}, + 115: {Sym: "sftp", Description: "Simple File Transfer Protocol"}, + 116: {Sym: "ansanotify", Description: "ANSA REX Notify"}, + 117: {Sym: "uucp-path", Description: "UUCP Path Service"}, + 118: {Sym: "sqlserv", Description: "SQL Services"}, + 119: {Sym: "nntp", Description: "Network News Transfer Protocol"}, + 120: {Sym: "cfdptkt", Description: "CFDPTKT"}, + 121: {Sym: "erpc", Description: "Encore Expedited Remote Pro.Call"}, + 122: {Sym: "smakynet", Description: "SMAKYNET"}, + 123: {Sym: "ntp", Description: "Network Time Protocol"}, + 124: {Sym: "ansatrader", Description: "ANSA REX Trader"}, + 125: {Sym: "locus-map", Description: "Locus PC-Interface Net Map Ser"}, + 126: {Sym: "nxedit", Description: "NXEdit"}, + 127: {Sym: "locus-con", Description: "Locus PC-Interface Conn Server"}, + 128: {Sym: "gss-xlicen", Description: "GSS X License Verification"}, + 129: {Sym: "pwdgen", Description: "Password Generator Protocol"}, + 130: {Sym: "cisco-fna", Description: "cisco FNATIVE"}, + 131: {Sym: "cisco-tna", Description: "cisco TNATIVE"}, + 132: {Sym: "cisco-sys", Description: "cisco SYSMAINT"}, + 133: {Sym: "statsrv", Description: "Statistics Service"}, + 134: {Sym: "ingres-net", Description: "INGRES-NET Service"}, + 135: {Sym: "epmap", Description: "DCE endpoint resolution"}, + 136: {Sym: "profile", Description: "PROFILE Naming System"}, + 137: {Sym: "netbios-ns", Description: "NETBIOS Name Service"}, + 138: {Sym: "netbios-dgm", Description: "NETBIOS Datagram Service"}, + 139: {Sym: "netbios-ssn", Description: "NETBIOS Session Service"}, + 140: {Sym: "emfis-data", Description: "EMFIS Data Service"}, + 141: {Sym: "emfis-cntl", Description: "EMFIS Control Service"}, + 142: {Sym: "bl-idm", Description: "Britton-Lee IDM"}, + 143: {Sym: "imap", Description: "Internet Message Access Protocol"}, + 144: {Sym: "uma", Description: "Universal Management Architecture"}, + 145: {Sym: "uaac", Description: "UAAC Protocol"}, + 146: {Sym: "iso-tp0", Description: "ISO-IP0"}, + 147: {Sym: "iso-ip", Description: "ISO-IP"}, + 148: {Sym: "jargon", Description: "Jargon"}, + 149: {Sym: "aed-512", Description: "AED 512 Emulation Service"}, + 150: {Sym: "sql-net", Description: "SQL-NET"}, + 151: {Sym: "hems", Description: "HEMS"}, + 152: {Sym: "bftp", Description: "Background File Transfer Program"}, + 153: {Sym: "sgmp", Description: "SGMP"}, + 154: {Sym: "netsc-prod", Description: "NETSC"}, + 155: {Sym: "netsc-dev", Description: "NETSC"}, + 156: {Sym: "sqlsrv", Description: "SQL Service"}, + 157: {Sym: "knet-cmp", Description: "KNET/VM Command/Message Protocol"}, + 158: {Sym: "pcmail-srv", Description: "PCMail Server"}, + 159: {Sym: "nss-routing", Description: "NSS-Routing"}, + 160: {Sym: "sgmp-traps", Description: "SGMP-TRAPS"}, + 161: {Sym: "snmp", Description: "SNMP"}, + 162: {Sym: "snmptrap", Description: "SNMPTRAP"}, + 163: {Sym: "cmip-man", Description: "CMIP/TCP Manager"}, + 164: {Sym: "cmip-agent", Description: "CMIP/TCP Agent"}, + 165: {Sym: "xns-courier", Description: "Xerox"}, + 166: {Sym: "s-net", Description: "Sirius Systems"}, + 167: {Sym: "namp", Description: "NAMP"}, + 168: {Sym: "rsvd", Description: "RSVD"}, + 169: {Sym: "send", Description: "SEND"}, + 170: {Sym: "print-srv", Description: "Network PostScript"}, + 171: {Sym: "multiplex", Description: "Network Innovations Multiplex"}, + 172: {Sym: "1", Description: "Network Innovations CL/1"}, + 173: {Sym: "xyplex-mux", Description: "Xyplex"}, + 174: {Sym: "mailq", Description: "MAILQ"}, + 175: {Sym: "vmnet", Description: "VMNET"}, + 176: {Sym: "genrad-mux", Description: "GENRAD-MUX"}, + 177: {Sym: "xdmcp", Description: "X Display Manager Control Protocol"}, + 178: {Sym: "nextstep", Description: "NextStep Window Server"}, + 179: {Sym: "bgp", Description: "Border Gateway Protocol"}, + 180: {Sym: "ris", Description: "Intergraph"}, + 181: {Sym: "unify", Description: "Unify"}, + 182: {Sym: "audit", Description: "Unisys Audit SITP"}, + 183: {Sym: "ocbinder", Description: "OCBinder"}, + 184: {Sym: "ocserver", Description: "OCServer"}, + 185: {Sym: "remote-kis", Description: "Remote-KIS"}, + 186: {Sym: "kis", Description: "KIS Protocol"}, + 187: {Sym: "aci", Description: "Application Communication Interface"}, + 188: {Sym: "mumps", Description: "Plus Five's MUMPS"}, + 189: {Sym: "qft", Description: "Queued File Transport"}, + 190: {Sym: "gacp", Description: "Gateway Access Control Protocol"}, + 191: {Sym: "prospero", Description: "Prospero Directory Service"}, + 192: {Sym: "osu-nms", Description: "OSU Network Monitoring System"}, + 193: {Sym: "srmp", Description: "Spider Remote Monitoring Protocol"}, + 194: {Sym: "irc", Description: "Internet Relay Chat Protocol"}, + 195: {Sym: "dn6-nlm-aud", Description: "DNSIX Network Level Module Audit"}, + 196: {Sym: "dn6-smm-red", Description: "DNSIX Session Mgt Module Audit Redir"}, + 197: {Sym: "dls", Description: "Directory Location Service"}, + 198: {Sym: "dls-mon", Description: "Directory Location Service Monitor"}, + 199: {Sym: "smux", Description: "SMUX"}, + 200: {Sym: "src", Description: "IBM System Resource Controller"}, + 201: {Sym: "at-rtmp", Description: "AppleTalk Routing Maintenance"}, + 202: {Sym: "at-nbp", Description: "AppleTalk Name Binding"}, + 203: {Sym: "at-3", Description: "AppleTalk Unused"}, + 204: {Sym: "at-echo", Description: "AppleTalk Echo"}, + 205: {Sym: "at-5", Description: "AppleTalk Unused"}, + 206: {Sym: "at-zis", Description: "AppleTalk Zone Information"}, + 207: {Sym: "at-7", Description: "AppleTalk Unused"}, + 208: {Sym: "at-8", Description: "AppleTalk Unused"}, + 209: {Sym: "qmtp", Description: "The Quick Mail Transfer Protocol"}, + 210: {Sym: "50", Description: "ANSI Z39.50"}, + 211: {Sym: "g", Description: "Texas Instruments 914C/G Terminal"}, + 212: {Sym: "anet", Description: "ATEXSSTR"}, + 213: {Sym: "ipx", Description: "IPX"}, + 214: {Sym: "vmpwscs", Description: "VM PWSCS"}, + 215: {Sym: "softpc", Description: "Insignia Solutions"}, + 216: {Sym: "CAIlic", Description: "Computer Associates Int'l License Server"}, + 217: {Sym: "dbase", Description: "dBASE Unix"}, + 218: {Sym: "mpp", Description: "Netix Message Posting Protocol"}, + 219: {Sym: "uarps", Description: "Unisys ARPs"}, + 220: {Sym: "imap3", Description: "Interactive Mail Access Protocol v3"}, + 221: {Sym: "fln-spx", Description: "Berkeley rlogind with SPX auth"}, + 222: {Sym: "rsh-spx", Description: "Berkeley rshd with SPX auth"}, + 223: {Sym: "cdc", Description: "Certificate Distribution Center"}, + 224: {Sym: "masqdialer", Description: "masqdialer"}, + 242: {Sym: "direct", Description: "Direct"}, + 243: {Sym: "sur-meas", Description: "Survey Measurement"}, + 244: {Sym: "inbusiness", Description: "inbusiness"}, + 245: {Sym: "link", Description: "LINK"}, + 246: {Sym: "dsp3270", Description: "Display Systems Protocol"}, + 247: {Sym: "subntbcst_tftp", Description: "SUBNTBCST_TFTP"}, + 248: {Sym: "bhfhs", Description: "bhfhs"}, + 256: {Sym: "rap", Description: "RAP"}, + 257: {Sym: "set", Description: "Secure Electronic Transaction"}, + 258: {Sym: "yak-chat", Description: "Yak Winsock Personal Chat"}, + 259: {Sym: "esro-gen", Description: "Efficient Short Remote Operations"}, + 260: {Sym: "openport", Description: "Openport"}, + 261: {Sym: "nsiiops", Description: "IIOP Name Service over TLS/SSL"}, + 262: {Sym: "arcisdms", Description: "Arcisdms"}, + 263: {Sym: "hdap", Description: "HDAP"}, + 264: {Sym: "bgmp", Description: "BGMP"}, + 265: {Sym: "x-bone-ctl", Description: "X-Bone CTL"}, + 266: {Sym: "sst", Description: "SCSI on ST"}, + 267: {Sym: "td-service", Description: "Tobit David Service Layer"}, + 268: {Sym: "td-replica", Description: "Tobit David Replica"}, + 280: {Sym: "http-mgmt", Description: "http-mgmt"}, + 281: {Sym: "personal-link", Description: "Personal Link"}, + 282: {Sym: "cableport-ax", Description: "Cable Port A/X"}, + 283: {Sym: "rescap", Description: "rescap"}, + 284: {Sym: "corerjd", Description: "corerjd"}, + 286: {Sym: "fxp-1", Description: "FXP-1"}, + 287: {Sym: "k-block", Description: "K-BLOCK"}, + 308: {Sym: "novastorbakcup", Description: "Novastor Backup"}, + 309: {Sym: "entrusttime", Description: "EntrustTime"}, + 310: {Sym: "bhmds", Description: "bhmds"}, + 311: {Sym: "asip-webadmin", Description: "AppleShare IP WebAdmin"}, + 312: {Sym: "vslmp", Description: "VSLMP"}, + 313: {Sym: "magenta-logic", Description: "Magenta Logic"}, + 314: {Sym: "opalis-robot", Description: "Opalis Robot"}, + 315: {Sym: "dpsi", Description: "DPSI"}, + 316: {Sym: "decauth", Description: "decAuth"}, + 317: {Sym: "zannet", Description: "Zannet"}, + 318: {Sym: "pkix-timestamp", Description: "PKIX TimeStamp"}, + 319: {Sym: "ptp-event", Description: "PTP Event"}, + 320: {Sym: "ptp-general", Description: "PTP General"}, + 321: {Sym: "pip", Description: "PIP"}, + 322: {Sym: "rtsps", Description: "RTSPS"}, + 333: {Sym: "texar", Description: "Texar Security Port"}, + 344: {Sym: "pdap", Description: "Prospero Data Access Protocol"}, + 345: {Sym: "pawserv", Description: "Perf Analysis Workbench"}, + 346: {Sym: "zserv", Description: "Zebra server"}, + 347: {Sym: "fatserv", Description: "Fatmen Server"}, + 348: {Sym: "csi-sgwp", Description: "Cabletron Management Protocol"}, + 349: {Sym: "mftp", Description: "mftp"}, + 350: {Sym: "matip-type-a", Description: "MATIP Type A"}, + 351: {Sym: "matip-type-b", Description: "MATIP Type B"}, + // 351: {Sym: "bhoetty", Description: "bhoetty"}, + 352: {Sym: "dtag-ste-sb", Description: "DTAG"}, + // 352: {Sym: "bhoedap4", Description: "bhoedap4"}, + 353: {Sym: "ndsauth", Description: "NDSAUTH"}, + 354: {Sym: "bh611", Description: "bh611"}, + 355: {Sym: "datex-asn", Description: "DATEX-ASN"}, + 356: {Sym: "cloanto-net-1", Description: "Cloanto Net 1"}, + 357: {Sym: "bhevent", Description: "bhevent"}, + 358: {Sym: "shrinkwrap", Description: "Shrinkwrap"}, + 359: {Sym: "nsrmp", Description: "Network Security Risk Management Protocol"}, + 360: {Sym: "scoi2odialog", Description: "scoi2odialog"}, + 361: {Sym: "semantix", Description: "Semantix"}, + 362: {Sym: "srssend", Description: "SRS Send"}, + 363: {Sym: "rsvp_tunnel", Description: "RSVP Tunnel"}, + 364: {Sym: "aurora-cmgr", Description: "Aurora CMGR"}, + 365: {Sym: "dtk", Description: "DTK"}, + 366: {Sym: "odmr", Description: "ODMR"}, + 367: {Sym: "mortgageware", Description: "MortgageWare"}, + 368: {Sym: "qbikgdp", Description: "QbikGDP"}, + 369: {Sym: "rpc2portmap", Description: "rpc2portmap"}, + 370: {Sym: "codaauth2", Description: "codaauth2"}, + 371: {Sym: "clearcase", Description: "Clearcase"}, + 372: {Sym: "ulistproc", Description: "ListProcessor"}, + 373: {Sym: "legent-1", Description: "Legent Corporation"}, + 374: {Sym: "legent-2", Description: "Legent Corporation"}, + 375: {Sym: "hassle", Description: "Hassle"}, + 376: {Sym: "nip", Description: "Amiga Envoy Network Inquiry Proto"}, + 377: {Sym: "tnETOS", Description: "NEC Corporation"}, + 378: {Sym: "dsETOS", Description: "NEC Corporation"}, + 379: {Sym: "is99c", Description: "TIA/EIA/IS-99 modem client"}, + 380: {Sym: "is99s", Description: "TIA/EIA/IS-99 modem server"}, + 381: {Sym: "hp-collector", Description: "hp performance data collector"}, + 382: {Sym: "hp-managed-node", Description: "hp performance data managed node"}, + 383: {Sym: "hp-alarm-mgr", Description: "hp performance data alarm manager"}, + 384: {Sym: "arns", Description: "A Remote Network Server System"}, + 385: {Sym: "ibm-app", Description: "IBM Application"}, + 386: {Sym: "asa", Description: "ASA Message Router Object Def."}, + 387: {Sym: "aurp", Description: "Appletalk Update-Based Routing Pro."}, + 388: {Sym: "unidata-ldm", Description: "Unidata LDM"}, + 389: {Sym: "ldap", Description: "Lightweight Directory Access Protocol"}, + 390: {Sym: "uis", Description: "UIS"}, + 391: {Sym: "synotics-relay", Description: "SynOptics SNMP Relay Port"}, + 392: {Sym: "synotics-broker", Description: "SynOptics Port Broker Port"}, + 393: {Sym: "meta5", Description: "Meta5"}, + 394: {Sym: "embl-ndt", Description: "EMBL Nucleic Data Transfer"}, + 395: {Sym: "netcp", Description: "NETscout Control Protocol"}, + 396: {Sym: "netware-ip", Description: "Novell Netware over IP"}, + 397: {Sym: "mptn", Description: "Multi Protocol Trans. Net."}, + 398: {Sym: "kryptolan", Description: "Kryptolan"}, + 399: {Sym: "iso-tsap-c2", Description: "ISO Transport Class 2 Non-Control over UDP"}, + 400: {Sym: "work-sol", Description: "Workstation Solutions"}, + 401: {Sym: "ups", Description: "Uninterruptible Power Supply"}, + 402: {Sym: "genie", Description: "Genie Protocol"}, + 403: {Sym: "decap", Description: "decap"}, + 404: {Sym: "nced", Description: "nced"}, + 405: {Sym: "ncld", Description: "ncld"}, + 406: {Sym: "imsp", Description: "Interactive Mail Support Protocol"}, + 407: {Sym: "timbuktu", Description: "Timbuktu"}, + 408: {Sym: "prm-sm", Description: "Prospero Resource Manager Sys. Man."}, + 409: {Sym: "prm-nm", Description: "Prospero Resource Manager Node Man."}, + 410: {Sym: "decladebug", Description: "DECLadebug Remote Debug Protocol"}, + 411: {Sym: "rmt", Description: "Remote MT Protocol"}, + 412: {Sym: "synoptics-trap", Description: "Trap Convention Port"}, + 413: {Sym: "smsp", Description: "Storage Management Services Protocol"}, + 414: {Sym: "infoseek", Description: "InfoSeek"}, + 415: {Sym: "bnet", Description: "BNet"}, + 416: {Sym: "silverplatter", Description: "Silverplatter"}, + 417: {Sym: "onmux", Description: "Onmux"}, + 418: {Sym: "hyper-g", Description: "Hyper-G"}, + 419: {Sym: "ariel1", Description: "Ariel 1"}, + 420: {Sym: "smpte", Description: "SMPTE"}, + 421: {Sym: "ariel2", Description: "Ariel 2"}, + 422: {Sym: "ariel3", Description: "Ariel 3"}, + 423: {Sym: "opc-job-start", Description: "IBM Operations Planning and Control Start"}, + 424: {Sym: "opc-job-track", Description: "IBM Operations Planning and Control Track"}, + 425: {Sym: "icad-el", Description: "ICAD"}, + 426: {Sym: "smartsdp", Description: "smartsdp"}, + 427: {Sym: "svrloc", Description: "Server Location"}, + 428: {Sym: "ocs_cmu", Description: "OCS_CMU"}, + 429: {Sym: "ocs_amu", Description: "OCS_AMU"}, + 430: {Sym: "utmpsd", Description: "UTMPSD"}, + 431: {Sym: "utmpcd", Description: "UTMPCD"}, + 432: {Sym: "iasd", Description: "IASD"}, + 433: {Sym: "nnsp", Description: "NNSP"}, + 434: {Sym: "mobileip-agent", Description: "MobileIP-Agent"}, + 435: {Sym: "mobilip-mn", Description: "MobilIP-MN"}, + 436: {Sym: "dna-cml", Description: "DNA-CML"}, + 437: {Sym: "comscm", Description: "comscm"}, + 438: {Sym: "dsfgw", Description: "dsfgw"}, + 439: {Sym: "dasp", Description: "dasp"}, + 440: {Sym: "sgcp", Description: "sgcp"}, + 441: {Sym: "decvms-sysmgt", Description: "decvms-sysmgt"}, + 442: {Sym: "cvc_hostd", Description: "cvc_hostd"}, + 443: {Sym: "https", Description: "http protocol over TLS/SSL"}, + 444: {Sym: "snpp", Description: "Simple Network Paging Protocol"}, + 445: {Sym: "microsoft-ds", Description: "Microsoft-DS"}, + 446: {Sym: "ddm-rdb", Description: "DDM-RDB"}, + 447: {Sym: "ddm-dfm", Description: "DDM-RFM"}, + 448: {Sym: "ddm-ssl", Description: "DDM-SSL"}, + 449: {Sym: "as-servermap", Description: "AS Server Mapper"}, + 450: {Sym: "tserver", Description: "Computer Supported Telecomunication Applications"}, + 451: {Sym: "sfs-smp-net", Description: "Cray Network Semaphore server"}, + 452: {Sym: "sfs-config", Description: "Cray SFS config server"}, + 453: {Sym: "creativeserver", Description: "CreativeServer"}, + 454: {Sym: "contentserver", Description: "ContentServer"}, + 455: {Sym: "creativepartnr", Description: "CreativePartnr"}, + 456: {Sym: "macon-udp", Description: "macon-udp"}, + 457: {Sym: "scohelp", Description: "scohelp"}, + 458: {Sym: "appleqtc", Description: "apple quick time"}, + 459: {Sym: "ampr-rcmd", Description: "ampr-rcmd"}, + 460: {Sym: "skronk", Description: "skronk"}, + 461: {Sym: "datasurfsrv", Description: "DataRampSrv"}, + 462: {Sym: "datasurfsrvsec", Description: "DataRampSrvSec"}, + 463: {Sym: "alpes", Description: "alpes"}, + 464: {Sym: "kpasswd", Description: "kpasswd"}, + 465: {Sym: "igmpv3lite", Description: "IGMP over UDP for SSM"}, + 466: {Sym: "digital-vrc", Description: "digital-vrc"}, + 467: {Sym: "mylex-mapd", Description: "mylex-mapd"}, + 468: {Sym: "photuris", Description: "proturis"}, + 469: {Sym: "rcp", Description: "Radio Control Protocol"}, + 470: {Sym: "scx-proxy", Description: "scx-proxy"}, + 471: {Sym: "mondex", Description: "Mondex"}, + 472: {Sym: "ljk-login", Description: "ljk-login"}, + 473: {Sym: "hybrid-pop", Description: "hybrid-pop"}, + 474: {Sym: "tn-tl-w2", Description: "tn-tl-w2"}, + 475: {Sym: "tcpnethaspsrv", Description: "tcpnethaspsrv"}, + 476: {Sym: "tn-tl-fd1", Description: "tn-tl-fd1"}, + 477: {Sym: "ss7ns", Description: "ss7ns"}, + 478: {Sym: "spsc", Description: "spsc"}, + 479: {Sym: "iafserver", Description: "iafserver"}, + 480: {Sym: "iafdbase", Description: "iafdbase"}, + 481: {Sym: "ph", Description: "Ph service"}, + 482: {Sym: "bgs-nsi", Description: "bgs-nsi"}, + 483: {Sym: "ulpnet", Description: "ulpnet"}, + 484: {Sym: "integra-sme", Description: "Integra Software Management Environment"}, + 485: {Sym: "powerburst", Description: "Air Soft Power Burst"}, + 486: {Sym: "avian", Description: "avian"}, + 487: {Sym: "saft", Description: "saft Simple Asynchronous File Transfer"}, + 488: {Sym: "gss-http", Description: "gss-http"}, + 489: {Sym: "nest-protocol", Description: "nest-protocol"}, + 490: {Sym: "micom-pfs", Description: "micom-pfs"}, + 491: {Sym: "go-login", Description: "go-login"}, + 492: {Sym: "ticf-1", Description: "Transport Independent Convergence for FNA"}, + 493: {Sym: "ticf-2", Description: "Transport Independent Convergence for FNA"}, + 494: {Sym: "pov-ray", Description: "POV-Ray"}, + 495: {Sym: "intecourier", Description: "intecourier"}, + 496: {Sym: "pim-rp-disc", Description: "PIM-RP-DISC"}, + 497: {Sym: "dantz", Description: "dantz"}, + 498: {Sym: "siam", Description: "siam"}, + 499: {Sym: "iso-ill", Description: "ISO ILL Protocol"}, + 500: {Sym: "isakmp", Description: "isakmp"}, + 501: {Sym: "stmf", Description: "STMF"}, + 502: {Sym: "asa-appl-proto", Description: "asa-appl-proto"}, + 503: {Sym: "intrinsa", Description: "Intrinsa"}, + 504: {Sym: "citadel", Description: "citadel"}, + 505: {Sym: "mailbox-lm", Description: "mailbox-lm"}, + 506: {Sym: "ohimsrv", Description: "ohimsrv"}, + 507: {Sym: "crs", Description: "crs"}, + 508: {Sym: "xvttp", Description: "xvttp"}, + 509: {Sym: "snare", Description: "snare"}, + 510: {Sym: "fcp", Description: "FirstClass Protocol"}, + 511: {Sym: "passgo", Description: "PassGo"}, + 512: {Sym: "comsat"}, + 513: {Sym: "who", Description: "maintains data bases showing who's"}, + 514: {Sym: "syslog"}, + 515: {Sym: "printer", Description: "spooler"}, + 516: {Sym: "videotex", Description: "videotex"}, + 517: {Sym: "talk", Description: "like tenex link, but across"}, + 518: {Sym: "ntalk"}, + 519: {Sym: "utime", Description: "unixtime"}, + 520: {Sym: "router", Description: "local routing process (on site);"}, + 521: {Sym: "ripng", Description: "ripng"}, + 522: {Sym: "ulp", Description: "ULP"}, + 523: {Sym: "ibm-db2", Description: "IBM-DB2"}, + 524: {Sym: "ncp", Description: "NCP"}, + 525: {Sym: "timed", Description: "timeserver"}, + 526: {Sym: "tempo", Description: "newdate"}, + 527: {Sym: "stx", Description: "Stock IXChange"}, + 528: {Sym: "custix", Description: "Customer IXChange"}, + 529: {Sym: "irc-serv", Description: "IRC-SERV"}, + 530: {Sym: "courier", Description: "rpc"}, + 531: {Sym: "conference", Description: "chat"}, + 532: {Sym: "netnews", Description: "readnews"}, + 533: {Sym: "netwall", Description: "for emergency broadcasts"}, + 534: {Sym: "mm-admin", Description: "MegaMedia Admin"}, + 535: {Sym: "iiop", Description: "iiop"}, + 536: {Sym: "opalis-rdv", Description: "opalis-rdv"}, + 537: {Sym: "nmsp", Description: "Networked Media Streaming Protocol"}, + 538: {Sym: "gdomap", Description: "gdomap"}, + 539: {Sym: "apertus-ldp", Description: "Apertus Technologies Load Determination"}, + 540: {Sym: "uucp", Description: "uucpd\t\t"}, + 541: {Sym: "uucp-rlogin", Description: "uucp-rlogin"}, + 542: {Sym: "commerce", Description: "commerce"}, + 543: {Sym: "klogin"}, + 544: {Sym: "kshell", Description: "krcmd"}, + 545: {Sym: "appleqtcsrvr", Description: "appleqtcsrvr"}, + 546: {Sym: "dhcpv6-client", Description: "DHCPv6 Client"}, + 547: {Sym: "dhcpv6-server", Description: "DHCPv6 Server"}, + 548: {Sym: "afpovertcp", Description: "AFP over TCP"}, + 549: {Sym: "idfp", Description: "IDFP"}, + 550: {Sym: "new-rwho", Description: "new-who"}, + 551: {Sym: "cybercash", Description: "cybercash"}, + 552: {Sym: "devshr-nts", Description: "DeviceShare"}, + 553: {Sym: "pirp", Description: "pirp"}, + 554: {Sym: "rtsp", Description: "Real Time Stream Control Protocol"}, + 555: {Sym: "dsf"}, + 556: {Sym: "remotefs", Description: "rfs server"}, + 557: {Sym: "openvms-sysipc", Description: "openvms-sysipc"}, + 558: {Sym: "sdnskmp", Description: "SDNSKMP"}, + 559: {Sym: "teedtap", Description: "TEEDTAP"}, + 560: {Sym: "rmonitor", Description: "rmonitord"}, + 561: {Sym: "monitor"}, + 562: {Sym: "chshell", Description: "chcmd"}, + 563: {Sym: "nntps", Description: "nntp protocol over TLS/SSL (was snntp)"}, + 564: {Sym: "9pfs", Description: "plan 9 file service"}, + 565: {Sym: "whoami", Description: "whoami"}, + 566: {Sym: "streettalk", Description: "streettalk"}, + 567: {Sym: "banyan-rpc", Description: "banyan-rpc"}, + 568: {Sym: "ms-shuttle", Description: "microsoft shuttle"}, + 569: {Sym: "ms-rome", Description: "microsoft rome"}, + 570: {Sym: "meter", Description: "demon"}, + 571: {Sym: "meter", Description: "udemon"}, + 572: {Sym: "sonar", Description: "sonar"}, + 573: {Sym: "banyan-vip", Description: "banyan-vip"}, + 574: {Sym: "ftp-agent", Description: "FTP Software Agent System"}, + 575: {Sym: "vemmi", Description: "VEMMI"}, + 576: {Sym: "ipcd", Description: "ipcd"}, + 577: {Sym: "vnas", Description: "vnas"}, + 578: {Sym: "ipdd", Description: "ipdd"}, + 579: {Sym: "decbsrv", Description: "decbsrv"}, + 580: {Sym: "sntp-heartbeat", Description: "SNTP HEARTBEAT"}, + 581: {Sym: "bdp", Description: "Bundle Discovery Protocol"}, + 582: {Sym: "scc-security", Description: "SCC Security"}, + 583: {Sym: "philips-vc", Description: "Philips Video-Conferencing"}, + 584: {Sym: "keyserver", Description: "Key Server"}, + 585: {Sym: "imap4-ssl", Description: "IMAP4+SSL (use 993 instead)"}, + 586: {Sym: "password-chg", Description: "Password Change"}, + 587: {Sym: "submission", Description: "Submission"}, + 588: {Sym: "cal", Description: "CAL"}, + 589: {Sym: "eyelink", Description: "EyeLink"}, + 590: {Sym: "tns-cml", Description: "TNS CML"}, + 591: {Sym: "http-alt", Description: "FileMaker, Inc. - HTTP Alternate (see Port 80)"}, + 592: {Sym: "eudora-set", Description: "Eudora Set"}, + 593: {Sym: "http-rpc-epmap", Description: "HTTP RPC Ep Map"}, + 594: {Sym: "tpip", Description: "TPIP"}, + 595: {Sym: "cab-protocol", Description: "CAB Protocol"}, + 596: {Sym: "smsd", Description: "SMSD"}, + 597: {Sym: "ptcnameservice", Description: "PTC Name Service"}, + 598: {Sym: "sco-websrvrmg3", Description: "SCO Web Server Manager 3"}, + 599: {Sym: "acp", Description: "Aeolon Core Protocol"}, + 600: {Sym: "ipcserver", Description: "Sun IPC server"}, + 601: {Sym: "syslog-conn", Description: "Reliable Syslog Service"}, + 602: {Sym: "xmlrpc-beep", Description: "XML-RPC over BEEP"}, + 603: {Sym: "idxp", Description: "IDXP"}, + 604: {Sym: "tunnel", Description: "TUNNEL"}, + 605: {Sym: "soap-beep", Description: "SOAP over BEEP"}, + 606: {Sym: "urm", Description: "Cray Unified Resource Manager"}, + 607: {Sym: "nqs", Description: "nqs"}, + 608: {Sym: "sift-uft", Description: "Sender-Initiated/Unsolicited File Transfer"}, + 609: {Sym: "npmp-trap", Description: "npmp-trap"}, + 610: {Sym: "npmp-local", Description: "npmp-local"}, + 611: {Sym: "npmp-gui", Description: "npmp-gui"}, + 612: {Sym: "hmmp-ind", Description: "HMMP Indication"}, + 613: {Sym: "hmmp-op", Description: "HMMP Operation"}, + 614: {Sym: "sshell", Description: "SSLshell"}, + 615: {Sym: "sco-inetmgr", Description: "Internet Configuration Manager"}, + 616: {Sym: "sco-sysmgr", Description: "SCO System Administration Server"}, + 617: {Sym: "sco-dtmgr", Description: "SCO Desktop Administration Server"}, + 618: {Sym: "dei-icda", Description: "DEI-ICDA"}, + 619: {Sym: "compaq-evm", Description: "Compaq EVM"}, + 620: {Sym: "sco-websrvrmgr", Description: "SCO WebServer Manager"}, + 621: {Sym: "escp-ip", Description: "ESCP"}, + 622: {Sym: "collaborator", Description: "Collaborator"}, + 623: {Sym: "asf-rmcp", Description: "ASF Remote Management and Control Protocol"}, + 624: {Sym: "cryptoadmin", Description: "Crypto Admin"}, + 625: {Sym: "dec_dlm", Description: "DEC DLM"}, + 626: {Sym: "asia", Description: "ASIA"}, + 627: {Sym: "passgo-tivoli", Description: "PassGo Tivoli"}, + 628: {Sym: "qmqp", Description: "QMQP"}, + 629: {Sym: "3com-amp3", Description: "3Com AMP3"}, + 630: {Sym: "rda", Description: "RDA"}, + 631: {Sym: "ipp", Description: "IPP (Internet Printing Protocol)"}, + 632: {Sym: "bmpp", Description: "bmpp"}, + 633: {Sym: "servstat", Description: "Service Status update (Sterling Software)"}, + 634: {Sym: "ginad", Description: "ginad"}, + 635: {Sym: "rlzdbase", Description: "RLZ DBase"}, + 636: {Sym: "ldaps", Description: "ldap protocol over TLS/SSL (was sldap)"}, + 637: {Sym: "lanserver", Description: "lanserver"}, + 638: {Sym: "mcns-sec", Description: "mcns-sec"}, + 639: {Sym: "msdp", Description: "MSDP"}, + 640: {Sym: "entrust-sps", Description: "entrust-sps"}, + 641: {Sym: "repcmd", Description: "repcmd"}, + 642: {Sym: "esro-emsdp", Description: "ESRO-EMSDP V1.3"}, + 643: {Sym: "sanity", Description: "SANity"}, + 644: {Sym: "dwr", Description: "dwr"}, + 645: {Sym: "pssc", Description: "PSSC"}, + 646: {Sym: "ldp", Description: "LDP"}, + 647: {Sym: "dhcp-failover", Description: "DHCP Failover"}, + 648: {Sym: "rrp", Description: "Registry Registrar Protocol (RRP)"}, + 649: {Sym: "cadview-3d", Description: "Cadview-3d - streaming 3d models over the internet"}, + 650: {Sym: "obex", Description: "OBEX"}, + 651: {Sym: "ieee-mms", Description: "IEEE MMS"}, + 652: {Sym: "hello-port", Description: "HELLO_PORT\t"}, + 653: {Sym: "repscmd", Description: "RepCmd"}, + 654: {Sym: "aodv", Description: "AODV"}, + 655: {Sym: "tinc", Description: "TINC"}, + 656: {Sym: "spmp", Description: "SPMP"}, + 657: {Sym: "rmc", Description: "RMC"}, + 658: {Sym: "tenfold", Description: "TenFold"}, + 660: {Sym: "mac-srvr-admin", Description: "MacOS Server Admin"}, + 661: {Sym: "hap", Description: "HAP"}, + 662: {Sym: "pftp", Description: "PFTP"}, + 663: {Sym: "purenoise", Description: "PureNoise"}, + 664: {Sym: "asf-secure-rmcp", Description: "ASF Secure Remote Management and Control Protocol"}, + 665: {Sym: "sun-dr", Description: "Sun DR"}, + 666: {Sym: "mdqs"}, + 667: {Sym: "disclose", Description: "campaign contribution disclosures - SDR Technologies"}, + 668: {Sym: "mecomm", Description: "MeComm"}, + 669: {Sym: "meregister", Description: "MeRegister"}, + 670: {Sym: "vacdsm-sws", Description: "VACDSM-SWS"}, + 671: {Sym: "vacdsm-app", Description: "VACDSM-APP"}, + 672: {Sym: "vpps-qua", Description: "VPPS-QUA"}, + 673: {Sym: "cimplex", Description: "CIMPLEX"}, + 674: {Sym: "acap", Description: "ACAP"}, + 675: {Sym: "dctp", Description: "DCTP"}, + 676: {Sym: "vpps-via", Description: "VPPS Via"}, + 677: {Sym: "vpp", Description: "Virtual Presence Protocol"}, + 678: {Sym: "ggf-ncp", Description: "GNU Generation Foundation NCP"}, + 679: {Sym: "mrm", Description: "MRM"}, + 680: {Sym: "entrust-aaas", Description: "entrust-aaas"}, + 681: {Sym: "entrust-aams", Description: "entrust-aams"}, + 682: {Sym: "xfr", Description: "XFR"}, + 683: {Sym: "corba-iiop", Description: "CORBA IIOP"}, + 684: {Sym: "corba-iiop-ssl", Description: "CORBA IIOP SSL"}, + 685: {Sym: "mdc-portmapper", Description: "MDC Port Mapper"}, + 686: {Sym: "hcp-wismar", Description: "Hardware Control Protocol Wismar"}, + 687: {Sym: "asipregistry", Description: "asipregistry"}, + 688: {Sym: "realm-rusd", Description: "REALM-RUSD"}, + 689: {Sym: "nmap", Description: "NMAP"}, + 690: {Sym: "vatp", Description: "VATP"}, + 691: {Sym: "msexch-routing", Description: "MS Exchange Routing"}, + 692: {Sym: "hyperwave-isp", Description: "Hyperwave-ISP"}, + 693: {Sym: "connendp", Description: "connendp"}, + 694: {Sym: "ha-cluster", Description: "ha-cluster"}, + 695: {Sym: "ieee-mms-ssl", Description: "IEEE-MMS-SSL"}, + 696: {Sym: "rushd", Description: "RUSHD"}, + 697: {Sym: "uuidgen", Description: "UUIDGEN"}, + 698: {Sym: "olsr", Description: "OLSR"}, + 699: {Sym: "accessnetwork", Description: "Access Network"}, + 700: {Sym: "epp", Description: "Extensible Provisioning Protocol"}, + 701: {Sym: "lmp", Description: "Link Management Protocol (LMP)"}, + 702: {Sym: "iris-beep", Description: "IRIS over BEEP"}, + 704: {Sym: "elcsd", Description: "errlog copy/server daemon"}, + 705: {Sym: "agentx", Description: "AgentX"}, + 706: {Sym: "silc", Description: "SILC"}, + 707: {Sym: "borland-dsj", Description: "Borland DSJ"}, + 709: {Sym: "entrust-kmsh", Description: "Entrust Key Management Service Handler"}, + 710: {Sym: "entrust-ash", Description: "Entrust Administration Service Handler"}, + 711: {Sym: "cisco-tdp", Description: "Cisco TDP"}, + 712: {Sym: "tbrpf", Description: "TBRPF"}, + 729: {Sym: "netviewdm1", Description: "IBM NetView DM/6000 Server/Client"}, + 730: {Sym: "netviewdm2", Description: "IBM NetView DM/6000 send/tcp"}, + 731: {Sym: "netviewdm3", Description: "IBM NetView DM/6000 receive/tcp"}, + 741: {Sym: "netgw", Description: "netGW"}, + 742: {Sym: "netrcs", Description: "Network based Rev. Cont. Sys."}, + 744: {Sym: "flexlm", Description: "Flexible License Manager"}, + 747: {Sym: "fujitsu-dev", Description: "Fujitsu Device Control"}, + 748: {Sym: "ris-cm", Description: "Russell Info Sci Calendar Manager"}, + 749: {Sym: "kerberos-adm", Description: "kerberos administration"}, + 750: {Sym: "loadav"}, + 751: {Sym: "pump"}, + 752: {Sym: "qrh"}, + 753: {Sym: "rrh"}, + 754: {Sym: "tell", Description: "send"}, + 758: {Sym: "nlogin"}, + 759: {Sym: "con"}, + 760: {Sym: "ns"}, + 761: {Sym: "rxe"}, + 762: {Sym: "quotad"}, + 763: {Sym: "cycleserv"}, + 764: {Sym: "omserv"}, + 765: {Sym: "webster"}, + 767: {Sym: "phonebook", Description: "phone"}, + 769: {Sym: "vid"}, + 770: {Sym: "cadlock"}, + 771: {Sym: "rtip"}, + 772: {Sym: "cycleserv2"}, + 773: {Sym: "notify"}, + 774: {Sym: "acmaint_dbd"}, + 775: {Sym: "acmaint_transd"}, + 776: {Sym: "wpages"}, + 777: {Sym: "multiling-http", Description: "Multiling HTTP"}, + 780: {Sym: "wpgs"}, + 800: {Sym: "mdbs_daemon"}, + 801: {Sym: "device"}, + 810: {Sym: "fcp-udp", Description: "FCP Datagram"}, + 828: {Sym: "itm-mcell-s", Description: "itm-mcell-s"}, + 829: {Sym: "pkix-3-ca-ra", Description: "PKIX-3 CA/RA"}, + 830: {Sym: "netconf-ssh", Description: "NETCONF over SSH"}, + 831: {Sym: "netconf-beep", Description: "NETCONF over BEEP"}, + 832: {Sym: "netconfsoaphttp", Description: "NETCONF for SOAP over HTTPS"}, + 833: {Sym: "netconfsoapbeep", Description: "NETCONF for SOAP over BEEP"}, + 847: {Sym: "dhcp-failover2", Description: "dhcp-failover 2"}, + 848: {Sym: "gdoi", Description: "GDOI"}, + 860: {Sym: "iscsi", Description: "iSCSI"}, + 861: {Sym: "owamp-control", Description: "OWAMP-Control"}, + 873: {Sym: "rsync", Description: "rsync"}, + 886: {Sym: "iclcnet-locate", Description: "ICL coNETion locate server"}, + 887: {Sym: "iclcnet_svinfo", Description: "ICL coNETion server info"}, + 888: {Sym: "accessbuilder", Description: "AccessBuilder"}, + 900: {Sym: "omginitialrefs", Description: "OMG Initial Refs"}, + 901: {Sym: "smpnameres", Description: "SMPNAMERES"}, + 902: {Sym: "ideafarm-chat", Description: "IDEAFARM-CHAT"}, + 903: {Sym: "ideafarm-catch", Description: "IDEAFARM-CATCH"}, + 910: {Sym: "kink", Description: "Kerberized Internet Negotiation of Keys (KINK)"}, + 911: {Sym: "xact-backup", Description: "xact-backup"}, + 912: {Sym: "apex-mesh", Description: "APEX relay-relay service"}, + 913: {Sym: "apex-edge", Description: "APEX endpoint-relay service"}, + 989: {Sym: "ftps-data", Description: "ftp protocol, data, over TLS/SSL"}, + 990: {Sym: "ftps", Description: "ftp protocol, control, over TLS/SSL"}, + 991: {Sym: "nas", Description: "Netnews Administration System"}, + 992: {Sym: "telnets", Description: "telnet protocol over TLS/SSL"}, + 993: {Sym: "imaps", Description: "imap4 protocol over TLS/SSL"}, + 994: {Sym: "ircs", Description: "irc protocol over TLS/SSL"}, + 995: {Sym: "pop3s", Description: "pop3 protocol over TLS/SSL (was spop3)"}, + 996: {Sym: "vsinet", Description: "vsinet"}, + 997: {Sym: "maitrd"}, + 998: {Sym: "puparp"}, + 999: {Sym: "applix", Description: "Applix ac"}, + 1000: {Sym: "cadlock2"}, + 1010: {Sym: "surf", Description: "surf"}, +} + +var tcpPortMap = decode.UToScalar{ + 1: {Sym: "tcpmux", Description: "TCP Port Service Multiplexer"}, + 2: {Sym: "compressnet", Description: "Management Utility"}, + 3: {Sym: "compressnet", Description: "Compression Process"}, + 5: {Sym: "rje", Description: "Remote Job Entry"}, + 7: {Sym: "echo", Description: "Echo"}, + 9: {Sym: "discard", Description: "Discard"}, + 11: {Sym: "systat", Description: "Active Users"}, + 13: {Sym: "daytime", Description: "Daytime (RFC 867)"}, + 17: {Sym: "qotd", Description: "Quote of the Day"}, + 18: {Sym: "msp", Description: "Message Send Protocol"}, + 19: {Sym: "chargen", Description: "Character Generator"}, + 20: {Sym: "ftp-data", Description: "File Transfer [Default Data]"}, + 21: {Sym: "ftp", Description: "File Transfer [Control]"}, + 22: {Sym: "ssh", Description: "SSH Remote Login Protocol"}, + 23: {Sym: "telnet", Description: "Telnet"}, + 25: {Sym: "smtp", Description: "Simple Mail Transfer"}, + 27: {Sym: "nsw-fe", Description: "NSW User System FE"}, + 29: {Sym: "msg-icp", Description: "MSG ICP"}, + 31: {Sym: "msg-auth", Description: "MSG Authentication"}, + 33: {Sym: "dsp", Description: "Display Support Protocol"}, + 37: {Sym: "time", Description: "Time"}, + 38: {Sym: "rap", Description: "Route Access Protocol"}, + 39: {Sym: "rlp", Description: "Resource Location Protocol"}, + 41: {Sym: "graphics", Description: "Graphics"}, + 42: {Sym: "name", Description: "Host Name Server"}, + 44: {Sym: "mpm-flags", Description: "MPM FLAGS Protocol"}, + 45: {Sym: "mpm", Description: "Message Processing Module [recv]"}, + 46: {Sym: "mpm-snd", Description: "MPM [default send]"}, + 47: {Sym: "ni-ftp", Description: "NI FTP"}, + 48: {Sym: "auditd", Description: "Digital Audit Daemon"}, + 49: {Sym: "tacacs", Description: "Login Host Protocol (TACACS)"}, + 50: {Sym: "re-mail-ck", Description: "Remote Mail Checking Protocol"}, + 51: {Sym: "la-maint", Description: "IMP Logical Address Maintenance"}, + 52: {Sym: "xns-time", Description: "XNS Time Protocol"}, + 53: {Sym: "domain", Description: "Domain Name Server"}, + 54: {Sym: "xns-ch", Description: "XNS Clearinghouse"}, + 55: {Sym: "isi-gl", Description: "ISI Graphics Language"}, + 56: {Sym: "xns-auth", Description: "XNS Authentication"}, + 58: {Sym: "xns-mail", Description: "XNS Mail"}, + 61: {Sym: "ni-mail", Description: "NI MAIL"}, + 62: {Sym: "acas", Description: "ACA Services"}, + 64: {Sym: "covia", Description: "Communications Integrator (CI)"}, + 65: {Sym: "tacacs-ds", Description: "TACACS-Database Service"}, + 66: {Sym: "net", Description: "Oracle SQL*NET"}, + 67: {Sym: "bootps", Description: "Bootstrap Protocol Server"}, + 68: {Sym: "bootpc", Description: "Bootstrap Protocol Client"}, + 69: {Sym: "tftp", Description: "Trivial File Transfer"}, + 70: {Sym: "gopher", Description: "Gopher"}, + 71: {Sym: "netrjs-1", Description: "Remote Job Service"}, + 72: {Sym: "netrjs-2", Description: "Remote Job Service"}, + 73: {Sym: "netrjs-3", Description: "Remote Job Service"}, + 74: {Sym: "netrjs-4", Description: "Remote Job Service"}, + 76: {Sym: "deos", Description: "Distributed External Object Store"}, + 78: {Sym: "vettcp", Description: "vettcp"}, + 79: {Sym: "finger", Description: "Finger"}, + 80: {Sym: "http", Description: "World Wide Web HTTP"}, + 81: {Sym: "hosts2-ns", Description: "HOSTS2 Name Server"}, + 82: {Sym: "xfer", Description: "XFER Utility"}, + 83: {Sym: "mit-ml-dev", Description: "MIT ML Device"}, + 84: {Sym: "ctf", Description: "Common Trace Facility"}, + 85: {Sym: "mit-ml-dev", Description: "MIT ML Device"}, + 86: {Sym: "mfcobol", Description: "Micro Focus Cobol"}, + 88: {Sym: "kerberos", Description: "Kerberos"}, + 89: {Sym: "su-mit-tg", Description: "SU/MIT Telnet Gateway"}, + 90: {Sym: "dnsix", Description: "DNSIX Securit Attribute Token Map"}, + 91: {Sym: "mit-dov", Description: "MIT Dover Spooler"}, + 92: {Sym: "npp", Description: "Network Printing Protocol"}, + 93: {Sym: "dcp", Description: "Device Control Protocol"}, + 94: {Sym: "objcall", Description: "Tivoli Object Dispatcher"}, + 95: {Sym: "supdup", Description: "SUPDUP"}, + 96: {Sym: "dixie", Description: "DIXIE Protocol Specification"}, + 97: {Sym: "swift-rvf", Description: "Swift Remote Virtural File Protocol"}, + 98: {Sym: "tacnews", Description: "TAC News"}, + 99: {Sym: "metagram", Description: "Metagram Relay"}, + 100: {Sym: "newacct", Description: "[unauthorized use]"}, + 101: {Sym: "hostname", Description: "NIC Host Name Server"}, + 102: {Sym: "iso-tsap", Description: "ISO-TSAP Class 0"}, + 103: {Sym: "gppitnp", Description: "Genesis Point-to-Point Trans Net"}, + 104: {Sym: "acr-nema", Description: "ACR-NEMA Digital Imag. & Comm. 300"}, + 105: {Sym: "cso", Description: "CCSO name server protocol"}, + // 105: {Sym: "csnet-ns", Description: "Mailbox Name Nameserver"}, + 106: {Sym: "3com-tsmux", Description: "3COM-TSMUX"}, + 107: {Sym: "rtelnet", Description: "Remote Telnet Service"}, + 108: {Sym: "snagas", Description: "SNA Gateway Access Server"}, + 109: {Sym: "pop2", Description: "Post Office Protocol - Version 2"}, + 110: {Sym: "pop3", Description: "Post Office Protocol - Version 3"}, + 111: {Sym: "sunrpc", Description: "SUN Remote Procedure Call"}, + 112: {Sym: "mcidas", Description: "McIDAS Data Transmission Protocol"}, + 113: {Sym: "auth"}, + 114: {Sym: "audionews", Description: "Audio News Multicast"}, + 115: {Sym: "sftp", Description: "Simple File Transfer Protocol"}, + 116: {Sym: "ansanotify", Description: "ANSA REX Notify"}, + 117: {Sym: "uucp-path", Description: "UUCP Path Service"}, + 118: {Sym: "sqlserv", Description: "SQL Services"}, + 119: {Sym: "nntp", Description: "Network News Transfer Protocol"}, + 120: {Sym: "cfdptkt", Description: "CFDPTKT"}, + 121: {Sym: "erpc", Description: "Encore Expedited Remote Pro.Call"}, + 122: {Sym: "smakynet", Description: "SMAKYNET"}, + 123: {Sym: "ntp", Description: "Network Time Protocol"}, + 124: {Sym: "ansatrader", Description: "ANSA REX Trader"}, + 125: {Sym: "locus-map", Description: "Locus PC-Interface Net Map Ser"}, + 126: {Sym: "nxedit", Description: "NXEdit"}, + 127: {Sym: "locus-con", Description: "Locus PC-Interface Conn Server"}, + 128: {Sym: "gss-xlicen", Description: "GSS X License Verification"}, + 129: {Sym: "pwdgen", Description: "Password Generator Protocol"}, + 130: {Sym: "cisco-fna", Description: "cisco FNATIVE"}, + 131: {Sym: "cisco-tna", Description: "cisco TNATIVE"}, + 132: {Sym: "cisco-sys", Description: "cisco SYSMAINT"}, + 133: {Sym: "statsrv", Description: "Statistics Service"}, + 134: {Sym: "ingres-net", Description: "INGRES-NET Service"}, + 135: {Sym: "epmap", Description: "DCE endpoint resolution"}, + 136: {Sym: "profile", Description: "PROFILE Naming System"}, + 137: {Sym: "netbios-ns", Description: "NETBIOS Name Service"}, + 138: {Sym: "netbios-dgm", Description: "NETBIOS Datagram Service"}, + 139: {Sym: "netbios-ssn", Description: "NETBIOS Session Service"}, + 140: {Sym: "emfis-data", Description: "EMFIS Data Service"}, + 141: {Sym: "emfis-cntl", Description: "EMFIS Control Service"}, + 142: {Sym: "bl-idm", Description: "Britton-Lee IDM"}, + 143: {Sym: "imap", Description: "Internet Message Access Protocol"}, + 144: {Sym: "uma", Description: "Universal Management Architecture"}, + 145: {Sym: "uaac", Description: "UAAC Protocol"}, + 146: {Sym: "iso-tp0", Description: "ISO-IP0"}, + 147: {Sym: "iso-ip", Description: "ISO-IP"}, + 148: {Sym: "jargon", Description: "Jargon"}, + 149: {Sym: "aed-512", Description: "AED 512 Emulation Service"}, + 150: {Sym: "sql-net", Description: "SQL-NET"}, + 151: {Sym: "hems", Description: "HEMS"}, + 152: {Sym: "bftp", Description: "Background File Transfer Program"}, + 153: {Sym: "sgmp", Description: "SGMP"}, + 154: {Sym: "netsc-prod", Description: "NETSC"}, + 155: {Sym: "netsc-dev", Description: "NETSC"}, + 156: {Sym: "sqlsrv", Description: "SQL Service"}, + 157: {Sym: "knet-cmp", Description: "KNET/VM Command/Message Protocol"}, + 158: {Sym: "pcmail-srv", Description: "PCMail Server"}, + 159: {Sym: "nss-routing", Description: "NSS-Routing"}, + 160: {Sym: "sgmp-traps", Description: "SGMP-TRAPS"}, + 161: {Sym: "snmp", Description: "SNMP"}, + 162: {Sym: "snmptrap", Description: "SNMPTRAP"}, + 163: {Sym: "cmip-man", Description: "CMIP/TCP Manager"}, + 164: {Sym: "cmip-agent", Description: "CMIP/TCP Agent"}, + 165: {Sym: "xns-courier", Description: "Xerox"}, + 166: {Sym: "s-net", Description: "Sirius Systems"}, + 167: {Sym: "namp", Description: "NAMP"}, + 168: {Sym: "rsvd", Description: "RSVD"}, + 169: {Sym: "send", Description: "SEND"}, + 170: {Sym: "print-srv", Description: "Network PostScript"}, + 171: {Sym: "multiplex", Description: "Network Innovations Multiplex"}, + 172: {Sym: "1", Description: "Network Innovations CL/1"}, + 173: {Sym: "xyplex-mux", Description: "Xyplex"}, + 174: {Sym: "mailq", Description: "MAILQ"}, + 175: {Sym: "vmnet", Description: "VMNET"}, + 176: {Sym: "genrad-mux", Description: "GENRAD-MUX"}, + 177: {Sym: "xdmcp", Description: "X Display Manager Control Protocol"}, + 178: {Sym: "nextstep", Description: "NextStep Window Server"}, + 179: {Sym: "bgp", Description: "Border Gateway Protocol"}, + 180: {Sym: "ris", Description: "Intergraph"}, + 181: {Sym: "unify", Description: "Unify"}, + 182: {Sym: "audit", Description: "Unisys Audit SITP"}, + 183: {Sym: "ocbinder", Description: "OCBinder"}, + 184: {Sym: "ocserver", Description: "OCServer"}, + 185: {Sym: "remote-kis", Description: "Remote-KIS"}, + 186: {Sym: "kis", Description: "KIS Protocol"}, + 187: {Sym: "aci", Description: "Application Communication Interface"}, + 188: {Sym: "mumps", Description: "Plus Five's MUMPS"}, + 189: {Sym: "qft", Description: "Queued File Transport"}, + 190: {Sym: "gacp", Description: "Gateway Access Control Protocol"}, + 191: {Sym: "prospero", Description: "Prospero Directory Service"}, + 192: {Sym: "osu-nms", Description: "OSU Network Monitoring System"}, + 193: {Sym: "srmp", Description: "Spider Remote Monitoring Protocol"}, + 194: {Sym: "irc", Description: "Internet Relay Chat Protocol"}, + 195: {Sym: "dn6-nlm-aud", Description: "DNSIX Network Level Module Audit"}, + 196: {Sym: "dn6-smm-red", Description: "DNSIX Session Mgt Module Audit Redir"}, + 197: {Sym: "dls", Description: "Directory Location Service"}, + 198: {Sym: "dls-mon", Description: "Directory Location Service Monitor"}, + 199: {Sym: "smux", Description: "SMUX"}, + 200: {Sym: "src", Description: "IBM System Resource Controller"}, + 201: {Sym: "at-rtmp", Description: "AppleTalk Routing Maintenance"}, + 202: {Sym: "at-nbp", Description: "AppleTalk Name Binding"}, + 203: {Sym: "at-3", Description: "AppleTalk Unused"}, + 204: {Sym: "at-echo", Description: "AppleTalk Echo"}, + 205: {Sym: "at-5", Description: "AppleTalk Unused"}, + 206: {Sym: "at-zis", Description: "AppleTalk Zone Information"}, + 207: {Sym: "at-7", Description: "AppleTalk Unused"}, + 208: {Sym: "at-8", Description: "AppleTalk Unused"}, + 209: {Sym: "qmtp", Description: "The Quick Mail Transfer Protocol"}, + 210: {Sym: "50", Description: "ANSI Z39.50"}, + 211: {Sym: "g", Description: "Texas Instruments 914C/G Terminal"}, + 212: {Sym: "anet", Description: "ATEXSSTR"}, + 213: {Sym: "ipx", Description: "IPX \t"}, + 214: {Sym: "vmpwscs", Description: "VM PWSCS"}, + 215: {Sym: "softpc", Description: "Insignia Solutions"}, + 216: {Sym: "CAIlic", Description: "Computer Associates Int'l License Server"}, + 217: {Sym: "dbase", Description: "dBASE Unix"}, + 218: {Sym: "mpp", Description: "Netix Message Posting Protocol"}, + 219: {Sym: "uarps", Description: "Unisys ARPs"}, + 220: {Sym: "imap3", Description: "Interactive Mail Access Protocol v3"}, + 221: {Sym: "fln-spx", Description: "Berkeley rlogind with SPX auth"}, + 222: {Sym: "rsh-spx", Description: "Berkeley rshd with SPX auth"}, + 223: {Sym: "cdc", Description: "Certificate Distribution Center"}, + 224: {Sym: "masqdialer", Description: "masqdialer"}, + 242: {Sym: "direct", Description: "Direct"}, + 243: {Sym: "sur-meas", Description: "Survey Measurement"}, + 244: {Sym: "inbusiness", Description: "inbusiness"}, + 245: {Sym: "link", Description: "LINK"}, + 246: {Sym: "dsp3270", Description: "Display Systems Protocol"}, + 247: {Sym: "subntbcst_tftp", Description: "SUBNTBCST_TFTP"}, + 248: {Sym: "bhfhs", Description: "bhfhs"}, + 256: {Sym: "rap", Description: "RAP"}, + 257: {Sym: "set", Description: "Secure Electronic Transaction"}, + 258: {Sym: "yak-chat", Description: "Yak Winsock Personal Chat"}, + 259: {Sym: "esro-gen", Description: "Efficient Short Remote Operations"}, + 260: {Sym: "openport", Description: "Openport"}, + 261: {Sym: "nsiiops", Description: "IIOP Name Service over TLS/SSL"}, + 262: {Sym: "arcisdms", Description: "Arcisdms"}, + 263: {Sym: "hdap", Description: "HDAP"}, + 264: {Sym: "bgmp", Description: "BGMP"}, + 265: {Sym: "x-bone-ctl", Description: "X-Bone CTL"}, + 266: {Sym: "sst", Description: "SCSI on ST"}, + 267: {Sym: "td-service", Description: "Tobit David Service Layer"}, + 268: {Sym: "td-replica", Description: "Tobit David Replica"}, + 280: {Sym: "http-mgmt", Description: "http-mgmt"}, + 281: {Sym: "personal-link", Description: "Personal Link"}, + 282: {Sym: "cableport-ax", Description: "Cable Port A/X"}, + 283: {Sym: "rescap", Description: "rescap"}, + 284: {Sym: "corerjd", Description: "corerjd"}, + 286: {Sym: "fxp-1", Description: "FXP-1"}, + 287: {Sym: "k-block", Description: "K-BLOCK"}, + 308: {Sym: "novastorbakcup", Description: "Novastor Backup"}, + 309: {Sym: "entrusttime", Description: "EntrustTime"}, + 310: {Sym: "bhmds", Description: "bhmds"}, + 311: {Sym: "asip-webadmin", Description: "AppleShare IP WebAdmin"}, + 312: {Sym: "vslmp", Description: "VSLMP"}, + 313: {Sym: "magenta-logic", Description: "Magenta Logic"}, + 314: {Sym: "opalis-robot", Description: "Opalis Robot"}, + 315: {Sym: "dpsi", Description: "DPSI"}, + 316: {Sym: "decauth", Description: "decAuth"}, + 317: {Sym: "zannet", Description: "Zannet"}, + 318: {Sym: "pkix-timestamp", Description: "PKIX TimeStamp"}, + 319: {Sym: "ptp-event", Description: "PTP Event"}, + 320: {Sym: "ptp-general", Description: "PTP General"}, + 321: {Sym: "pip", Description: "PIP"}, + 322: {Sym: "rtsps", Description: "RTSPS"}, + 333: {Sym: "texar", Description: "Texar Security Port"}, + 344: {Sym: "pdap", Description: "Prospero Data Access Protocol"}, + 345: {Sym: "pawserv", Description: "Perf Analysis Workbench"}, + 346: {Sym: "zserv", Description: "Zebra server"}, + 347: {Sym: "fatserv", Description: "Fatmen Server"}, + 348: {Sym: "csi-sgwp", Description: "Cabletron Management Protocol"}, + 349: {Sym: "mftp", Description: "mftp"}, + 350: {Sym: "matip-type-a", Description: "MATIP Type A"}, + 351: {Sym: "matip-type-b", Description: "MATIP Type B"}, + // 351: {Sym: "bhoetty", Description: "bhoetty (added 5/21/97)"}, + 352: {Sym: "dtag-ste-sb", Description: "DTAG (assigned long ago)"}, + // 352: {Sym: "bhoedap4", Description: "bhoedap4 (added 5/21/97)"}, + 353: {Sym: "ndsauth", Description: "NDSAUTH"}, + 354: {Sym: "bh611", Description: "bh611"}, + 355: {Sym: "datex-asn", Description: "DATEX-ASN"}, + 356: {Sym: "cloanto-net-1", Description: "Cloanto Net 1"}, + 357: {Sym: "bhevent", Description: "bhevent"}, + 358: {Sym: "shrinkwrap", Description: "Shrinkwrap"}, + 359: {Sym: "nsrmp", Description: "Network Security Risk Management Protocol"}, + 360: {Sym: "scoi2odialog", Description: "scoi2odialog"}, + 361: {Sym: "semantix", Description: "Semantix"}, + 362: {Sym: "srssend", Description: "SRS Send"}, + 363: {Sym: "rsvp_tunnel", Description: "RSVP Tunnel"}, + 364: {Sym: "aurora-cmgr", Description: "Aurora CMGR"}, + 365: {Sym: "dtk", Description: "DTK"}, + 366: {Sym: "odmr", Description: "ODMR"}, + 367: {Sym: "mortgageware", Description: "MortgageWare"}, + 368: {Sym: "qbikgdp", Description: "QbikGDP"}, + 369: {Sym: "rpc2portmap", Description: "rpc2portmap"}, + 370: {Sym: "codaauth2", Description: "codaauth2"}, + 371: {Sym: "clearcase", Description: "Clearcase"}, + 372: {Sym: "ulistproc", Description: "ListProcessor"}, + 373: {Sym: "legent-1", Description: "Legent Corporation"}, + 374: {Sym: "legent-2", Description: "Legent Corporation"}, + 375: {Sym: "hassle", Description: "Hassle"}, + 376: {Sym: "nip", Description: "Amiga Envoy Network Inquiry Proto"}, + 377: {Sym: "tnETOS", Description: "NEC Corporation"}, + 378: {Sym: "dsETOS", Description: "NEC Corporation"}, + 379: {Sym: "is99c", Description: "TIA/EIA/IS-99 modem client"}, + 380: {Sym: "is99s", Description: "TIA/EIA/IS-99 modem server"}, + 381: {Sym: "hp-collector", Description: "hp performance data collector"}, + 382: {Sym: "hp-managed-node", Description: "hp performance data managed node"}, + 383: {Sym: "hp-alarm-mgr", Description: "hp performance data alarm manager"}, + 384: {Sym: "arns", Description: "A Remote Network Server System"}, + 385: {Sym: "ibm-app", Description: "IBM Application"}, + 386: {Sym: "asa", Description: "ASA Message Router Object Def."}, + 387: {Sym: "aurp", Description: "Appletalk Update-Based Routing Pro."}, + 388: {Sym: "unidata-ldm", Description: "Unidata LDM"}, + 389: {Sym: "ldap", Description: "Lightweight Directory Access Protocol"}, + 390: {Sym: "uis", Description: "UIS"}, + 391: {Sym: "synotics-relay", Description: "SynOptics SNMP Relay Port"}, + 392: {Sym: "synotics-broker", Description: "SynOptics Port Broker Port"}, + 393: {Sym: "meta5", Description: "Meta5"}, + 394: {Sym: "embl-ndt", Description: "EMBL Nucleic Data Transfer"}, + 395: {Sym: "netcp", Description: "NETscout Control Protocol"}, + 396: {Sym: "netware-ip", Description: "Novell Netware over IP"}, + 397: {Sym: "mptn", Description: "Multi Protocol Trans. Net."}, + 398: {Sym: "kryptolan", Description: "Kryptolan"}, + 399: {Sym: "iso-tsap-c2", Description: "ISO Transport Class 2 Non-Control over TCP"}, + 400: {Sym: "work-sol", Description: "Workstation Solutions"}, + 401: {Sym: "ups", Description: "Uninterruptible Power Supply"}, + 402: {Sym: "genie", Description: "Genie Protocol"}, + 403: {Sym: "decap", Description: "decap"}, + 404: {Sym: "nced", Description: "nced"}, + 405: {Sym: "ncld", Description: "ncld"}, + 406: {Sym: "imsp", Description: "Interactive Mail Support Protocol"}, + 407: {Sym: "timbuktu", Description: "Timbuktu"}, + 408: {Sym: "prm-sm", Description: "Prospero Resource Manager Sys. Man."}, + 409: {Sym: "prm-nm", Description: "Prospero Resource Manager Node Man."}, + 410: {Sym: "decladebug", Description: "DECLadebug Remote Debug Protocol"}, + 411: {Sym: "rmt", Description: "Remote MT Protocol"}, + 412: {Sym: "synoptics-trap", Description: "Trap Convention Port"}, + 413: {Sym: "smsp", Description: "Storage Management Services Protocol"}, + 414: {Sym: "infoseek", Description: "InfoSeek"}, + 415: {Sym: "bnet", Description: "BNet"}, + 416: {Sym: "silverplatter", Description: "Silverplatter"}, + 417: {Sym: "onmux", Description: "Onmux"}, + 418: {Sym: "hyper-g", Description: "Hyper-G"}, + 419: {Sym: "ariel1", Description: "Ariel 1"}, + 420: {Sym: "smpte", Description: "SMPTE"}, + 421: {Sym: "ariel2", Description: "Ariel 2"}, + 422: {Sym: "ariel3", Description: "Ariel 3"}, + 423: {Sym: "opc-job-start", Description: "IBM Operations Planning and Control Start"}, + 424: {Sym: "opc-job-track", Description: "IBM Operations Planning and Control Track"}, + 425: {Sym: "icad-el", Description: "ICAD"}, + 426: {Sym: "smartsdp", Description: "smartsdp"}, + 427: {Sym: "svrloc", Description: "Server Location"}, + 428: {Sym: "ocs_cmu", Description: "OCS_CMU"}, + 429: {Sym: "ocs_amu", Description: "OCS_AMU"}, + 430: {Sym: "utmpsd", Description: "UTMPSD"}, + 431: {Sym: "utmpcd", Description: "UTMPCD"}, + 432: {Sym: "iasd", Description: "IASD"}, + 433: {Sym: "nnsp", Description: "NNSP"}, + 434: {Sym: "mobileip-agent", Description: "MobileIP-Agent"}, + 435: {Sym: "mobilip-mn", Description: "MobilIP-MN"}, + 436: {Sym: "dna-cml", Description: "DNA-CML"}, + 437: {Sym: "comscm", Description: "comscm"}, + 438: {Sym: "dsfgw", Description: "dsfgw"}, + 439: {Sym: "dasp", Description: "dasp Thomas Obermair"}, + 440: {Sym: "sgcp", Description: "sgcp"}, + 441: {Sym: "decvms-sysmgt", Description: "decvms-sysmgt"}, + 442: {Sym: "cvc_hostd", Description: "cvc_hostd"}, + 443: {Sym: "https", Description: "http protocol over TLS/SSL"}, + 444: {Sym: "snpp", Description: "Simple Network Paging Protocol"}, + 445: {Sym: "microsoft-ds", Description: "Microsoft-DS"}, + 446: {Sym: "ddm-rdb", Description: "DDM-RDB"}, + 447: {Sym: "ddm-dfm", Description: "DDM-RFM"}, + 448: {Sym: "ddm-ssl", Description: "DDM-SSL"}, + 449: {Sym: "as-servermap", Description: "AS Server Mapper"}, + 450: {Sym: "tserver", Description: "Computer Supported Telecomunication Applications"}, + 451: {Sym: "sfs-smp-net", Description: "Cray Network Semaphore server"}, + 452: {Sym: "sfs-config", Description: "Cray SFS config server"}, + 453: {Sym: "creativeserver", Description: "CreativeServer"}, + 454: {Sym: "contentserver", Description: "ContentServer"}, + 455: {Sym: "creativepartnr", Description: "CreativePartnr"}, + 456: {Sym: "macon-tcp", Description: "macon-tcp"}, + 457: {Sym: "scohelp", Description: "scohelp"}, + 458: {Sym: "appleqtc", Description: "apple quick time"}, + 459: {Sym: "ampr-rcmd", Description: "ampr-rcmd"}, + 460: {Sym: "skronk", Description: "skronk"}, + 461: {Sym: "datasurfsrv", Description: "DataRampSrv"}, + 462: {Sym: "datasurfsrvsec", Description: "DataRampSrvSec"}, + 463: {Sym: "alpes", Description: "alpes"}, + 464: {Sym: "kpasswd", Description: "kpasswd"}, + 465: {Sym: "urd", Description: "URL Rendesvous Directory for SSM"}, + 466: {Sym: "digital-vrc", Description: "digital-vrc"}, + 467: {Sym: "mylex-mapd", Description: "mylex-mapd"}, + 468: {Sym: "photuris", Description: "proturis"}, + 469: {Sym: "rcp", Description: "Radio Control Protocol"}, + 470: {Sym: "scx-proxy", Description: "scx-proxy"}, + 471: {Sym: "mondex", Description: "Mondex"}, + 472: {Sym: "ljk-login", Description: "ljk-login"}, + 473: {Sym: "hybrid-pop", Description: "hybrid-pop"}, + 474: {Sym: "tn-tl-w1", Description: "tn-tl-w1"}, + 475: {Sym: "tcpnethaspsrv", Description: "tcpnethaspsrv"}, + 476: {Sym: "tn-tl-fd1", Description: "tn-tl-fd1"}, + 477: {Sym: "ss7ns", Description: "ss7ns"}, + 478: {Sym: "spsc", Description: "spsc"}, + 479: {Sym: "iafserver", Description: "iafserver"}, + 480: {Sym: "iafdbase", Description: "iafdbase"}, + 481: {Sym: "ph", Description: "Ph service"}, + 482: {Sym: "bgs-nsi", Description: "bgs-nsi"}, + 483: {Sym: "ulpnet", Description: "ulpnet"}, + 484: {Sym: "integra-sme", Description: "Integra Software Management Environment"}, + 485: {Sym: "powerburst", Description: "Air Soft Power Burst"}, + 486: {Sym: "avian", Description: "avian"}, + 487: {Sym: "saft", Description: "saft Simple Asynchronous File Transfer"}, + 488: {Sym: "gss-http", Description: "gss-http"}, + 489: {Sym: "nest-protocol", Description: "nest-protocol"}, + 490: {Sym: "micom-pfs", Description: "micom-pfs"}, + 491: {Sym: "go-login", Description: "go-login"}, + 492: {Sym: "ticf-1", Description: "Transport Independent Convergence for FNA"}, + 493: {Sym: "ticf-2", Description: "Transport Independent Convergence for FNA"}, + 494: {Sym: "pov-ray", Description: "POV-Ray"}, + 495: {Sym: "intecourier", Description: "intecourier"}, + 496: {Sym: "pim-rp-disc", Description: "PIM-RP-DISC"}, + 497: {Sym: "dantz", Description: "dantz"}, + 498: {Sym: "siam", Description: "siam"}, + 499: {Sym: "iso-ill", Description: "ISO ILL Protocol"}, + 500: {Sym: "isakmp", Description: "isakmp"}, + 501: {Sym: "stmf", Description: "STMF"}, + 502: {Sym: "asa-appl-proto", Description: "asa-appl-proto"}, + 503: {Sym: "intrinsa", Description: "Intrinsa"}, + 504: {Sym: "citadel", Description: "citadel"}, + 505: {Sym: "mailbox-lm", Description: "mailbox-lm"}, + 506: {Sym: "ohimsrv", Description: "ohimsrv"}, + 507: {Sym: "crs", Description: "crs"}, + 508: {Sym: "xvttp", Description: "xvttp"}, + 509: {Sym: "snare", Description: "snare"}, + 510: {Sym: "fcp", Description: "FirstClass Protocol"}, + 511: {Sym: "passgo", Description: "PassGo"}, + 512: {Sym: "exec", Description: "remote process execution;"}, + 513: {Sym: "login", Description: "remote login a la telnet;"}, + 514: {Sym: "shell", Description: "cmd"}, + 515: {Sym: "printer", Description: "spooler"}, + 516: {Sym: "videotex", Description: "videotex"}, + 517: {Sym: "talk", Description: "like tenex link, but across"}, + 518: {Sym: "ntalk"}, + 519: {Sym: "utime", Description: "unixtime"}, + 520: {Sym: "efs", Description: "extended file name server"}, + 521: {Sym: "ripng", Description: "ripng"}, + 522: {Sym: "ulp", Description: "ULP"}, + 523: {Sym: "ibm-db2", Description: "IBM-DB2"}, + 524: {Sym: "ncp", Description: "NCP"}, + 525: {Sym: "timed", Description: "timeserver"}, + 526: {Sym: "tempo", Description: "newdate"}, + 527: {Sym: "stx", Description: "Stock IXChange"}, + 528: {Sym: "custix", Description: "Customer IXChange"}, + 529: {Sym: "irc-serv", Description: "IRC-SERV"}, + 530: {Sym: "courier", Description: "rpc"}, + 531: {Sym: "conference", Description: "chat"}, + 532: {Sym: "netnews", Description: "readnews"}, + 533: {Sym: "netwall", Description: "for emergency broadcasts"}, + 534: {Sym: "mm-admin", Description: "MegaMedia Admin"}, + 535: {Sym: "iiop", Description: "iiop"}, + 536: {Sym: "opalis-rdv", Description: "opalis-rdv"}, + 537: {Sym: "nmsp", Description: "Networked Media Streaming Protocol"}, + 538: {Sym: "gdomap", Description: "gdomap"}, + 539: {Sym: "apertus-ldp", Description: "Apertus Technologies Load Determination"}, + 540: {Sym: "uucp", Description: "uucpd\t\t"}, + 541: {Sym: "uucp-rlogin", Description: "uucp-rlogin"}, + 542: {Sym: "commerce", Description: "commerce"}, + 543: {Sym: "klogin"}, + 544: {Sym: "kshell", Description: "krcmd"}, + 545: {Sym: "appleqtcsrvr", Description: "appleqtcsrvr"}, + 546: {Sym: "dhcpv6-client", Description: "DHCPv6 Client"}, + 547: {Sym: "dhcpv6-server", Description: "DHCPv6 Server"}, + 548: {Sym: "afpovertcp", Description: "AFP over TCP"}, + 549: {Sym: "idfp", Description: "IDFP"}, + 550: {Sym: "new-rwho", Description: "new-who"}, + 551: {Sym: "cybercash", Description: "cybercash"}, + 552: {Sym: "devshr-nts", Description: "DeviceShare"}, + 553: {Sym: "pirp", Description: "pirp"}, + 554: {Sym: "rtsp", Description: "Real Time Stream Control Protocol"}, + 555: {Sym: "dsf"}, + 556: {Sym: "remotefs", Description: "rfs server"}, + 557: {Sym: "openvms-sysipc", Description: "openvms-sysipc"}, + 558: {Sym: "sdnskmp", Description: "SDNSKMP"}, + 559: {Sym: "teedtap", Description: "TEEDTAP"}, + 560: {Sym: "rmonitor", Description: "rmonitord"}, + 561: {Sym: "monitor"}, + 562: {Sym: "chshell", Description: "chcmd"}, + 563: {Sym: "nntps", Description: "nntp protocol over TLS/SSL (was snntp)"}, + 564: {Sym: "9pfs", Description: "plan 9 file service"}, + 565: {Sym: "whoami", Description: "whoami"}, + 566: {Sym: "streettalk", Description: "streettalk"}, + 567: {Sym: "banyan-rpc", Description: "banyan-rpc"}, + 568: {Sym: "ms-shuttle", Description: "microsoft shuttle"}, + 569: {Sym: "ms-rome", Description: "microsoft rome"}, + 570: {Sym: "meter", Description: "demon"}, + 571: {Sym: "meter", Description: "udemon"}, + 572: {Sym: "sonar", Description: "sonar"}, + 573: {Sym: "banyan-vip", Description: "banyan-vip"}, + 574: {Sym: "ftp-agent", Description: "FTP Software Agent System"}, + 575: {Sym: "vemmi", Description: "VEMMI"}, + 576: {Sym: "ipcd", Description: "ipcd"}, + 577: {Sym: "vnas", Description: "vnas"}, + 578: {Sym: "ipdd", Description: "ipdd"}, + 579: {Sym: "decbsrv", Description: "decbsrv"}, + 580: {Sym: "sntp-heartbeat", Description: "SNTP HEARTBEAT"}, + 581: {Sym: "bdp", Description: "Bundle Discovery Protocol"}, + 582: {Sym: "scc-security", Description: "SCC Security"}, + 583: {Sym: "philips-vc", Description: "Philips Video-Conferencing"}, + 584: {Sym: "keyserver", Description: "Key Server"}, + 585: {Sym: "imap4-ssl", Description: "IMAP4+SSL (use 993 instead)"}, + 586: {Sym: "password-chg", Description: "Password Change"}, + 587: {Sym: "submission", Description: "Submission"}, + 588: {Sym: "cal", Description: "CAL"}, + 589: {Sym: "eyelink", Description: "EyeLink"}, + 590: {Sym: "tns-cml", Description: "TNS CML"}, + 591: {Sym: "http-alt", Description: "FileMaker, Inc. - HTTP Alternate (see Port 80)"}, + 592: {Sym: "eudora-set", Description: "Eudora Set"}, + 593: {Sym: "http-rpc-epmap", Description: "HTTP RPC Ep Map"}, + 594: {Sym: "tpip", Description: "TPIP"}, + 595: {Sym: "cab-protocol", Description: "CAB Protocol"}, + 596: {Sym: "smsd", Description: "SMSD"}, + 597: {Sym: "ptcnameservice", Description: "PTC Name Service"}, + 598: {Sym: "sco-websrvrmg3", Description: "SCO Web Server Manager 3"}, + 599: {Sym: "acp", Description: "Aeolon Core Protocol"}, + 600: {Sym: "ipcserver", Description: "Sun IPC server"}, + 601: {Sym: "syslog-conn", Description: "Reliable Syslog Service"}, + 602: {Sym: "xmlrpc-beep", Description: "XML-RPC over BEEP"}, + 603: {Sym: "idxp", Description: "IDXP"}, + 604: {Sym: "tunnel", Description: "TUNNEL"}, + 605: {Sym: "soap-beep", Description: "SOAP over BEEP"}, + 606: {Sym: "urm", Description: "Cray Unified Resource Manager"}, + 607: {Sym: "nqs", Description: "nqs"}, + 608: {Sym: "sift-uft", Description: "Sender-Initiated/Unsolicited File Transfer"}, + 609: {Sym: "npmp-trap", Description: "npmp-trap"}, + 610: {Sym: "npmp-local", Description: "npmp-local"}, + 611: {Sym: "npmp-gui", Description: "npmp-gui"}, + 612: {Sym: "hmmp-ind", Description: "HMMP Indication"}, + 613: {Sym: "hmmp-op", Description: "HMMP Operation"}, + 614: {Sym: "sshell", Description: "SSLshell"}, + 615: {Sym: "sco-inetmgr", Description: "Internet Configuration Manager"}, + 616: {Sym: "sco-sysmgr", Description: "SCO System Administration Server"}, + 617: {Sym: "sco-dtmgr", Description: "SCO Desktop Administration Server"}, + 618: {Sym: "dei-icda", Description: "DEI-ICDA"}, + 619: {Sym: "compaq-evm", Description: "Compaq EVM"}, + 620: {Sym: "sco-websrvrmgr", Description: "SCO WebServer Manager"}, + 621: {Sym: "escp-ip", Description: "ESCP"}, + 622: {Sym: "collaborator", Description: "Collaborator"}, + 623: {Sym: "asf-rmcp", Description: "ASF Remote Management and Control Protocol"}, + 624: {Sym: "cryptoadmin", Description: "Crypto Admin"}, + 625: {Sym: "dec_dlm", Description: "DEC DLM"}, + 626: {Sym: "asia", Description: "ASIA"}, + 627: {Sym: "passgo-tivoli", Description: "PassGo Tivoli"}, + 628: {Sym: "qmqp", Description: "QMQP"}, + 629: {Sym: "3com-amp3", Description: "3Com AMP3"}, + 630: {Sym: "rda", Description: "RDA"}, + 631: {Sym: "ipp", Description: "IPP (Internet Printing Protocol)"}, + 632: {Sym: "bmpp", Description: "bmpp"}, + 633: {Sym: "servstat", Description: "Service Status update (Sterling Software)"}, + 634: {Sym: "ginad", Description: "ginad"}, + 635: {Sym: "rlzdbase", Description: "RLZ DBase"}, + 636: {Sym: "ldaps", Description: "ldap protocol over TLS/SSL (was sldap)"}, + 637: {Sym: "lanserver", Description: "lanserver"}, + 638: {Sym: "mcns-sec", Description: "mcns-sec"}, + 639: {Sym: "msdp", Description: "MSDP"}, + 640: {Sym: "entrust-sps", Description: "entrust-sps"}, + 641: {Sym: "repcmd", Description: "repcmd"}, + 642: {Sym: "esro-emsdp", Description: "ESRO-EMSDP V1.3"}, + 643: {Sym: "sanity", Description: "SANity"}, + 644: {Sym: "dwr", Description: "dwr"}, + 645: {Sym: "pssc", Description: "PSSC"}, + 646: {Sym: "ldp", Description: "LDP"}, + 647: {Sym: "dhcp-failover", Description: "DHCP Failover"}, + 648: {Sym: "rrp", Description: "Registry Registrar Protocol (RRP)"}, + 649: {Sym: "cadview-3d", Description: "Cadview-3d - streaming 3d models over the internet"}, + 650: {Sym: "obex", Description: "OBEX"}, + 651: {Sym: "ieee-mms", Description: "IEEE MMS"}, + 652: {Sym: "hello-port", Description: "HELLO_PORT"}, + 653: {Sym: "repscmd", Description: "RepCmd"}, + 654: {Sym: "aodv", Description: "AODV"}, + 655: {Sym: "tinc", Description: "TINC"}, + 656: {Sym: "spmp", Description: "SPMP"}, + 657: {Sym: "rmc", Description: "RMC"}, + 658: {Sym: "tenfold", Description: "TenFold"}, + 660: {Sym: "mac-srvr-admin", Description: "MacOS Server Admin"}, + 661: {Sym: "hap", Description: "HAP"}, + 662: {Sym: "pftp", Description: "PFTP"}, + 663: {Sym: "purenoise", Description: "PureNoise"}, + 664: {Sym: "asf-secure-rmcp", Description: "ASF Secure Remote Management and Control Protocol"}, + 665: {Sym: "sun-dr", Description: "Sun DR"}, + 666: {Sym: "mdqs"}, + 667: {Sym: "disclose", Description: "campaign contribution disclosures - SDR Technologies"}, + 668: {Sym: "mecomm", Description: "MeComm"}, + 669: {Sym: "meregister", Description: "MeRegister"}, + 670: {Sym: "vacdsm-sws", Description: "VACDSM-SWS"}, + 671: {Sym: "vacdsm-app", Description: "VACDSM-APP"}, + 672: {Sym: "vpps-qua", Description: "VPPS-QUA"}, + 673: {Sym: "cimplex", Description: "CIMPLEX"}, + 674: {Sym: "acap", Description: "ACAP"}, + 675: {Sym: "dctp", Description: "DCTP"}, + 676: {Sym: "vpps-via", Description: "VPPS Via"}, + 677: {Sym: "vpp", Description: "Virtual Presence Protocol"}, + 678: {Sym: "ggf-ncp", Description: "GNU Generation Foundation NCP"}, + 679: {Sym: "mrm", Description: "MRM"}, + 680: {Sym: "entrust-aaas", Description: "entrust-aaas"}, + 681: {Sym: "entrust-aams", Description: "entrust-aams"}, + 682: {Sym: "xfr", Description: "XFR"}, + 683: {Sym: "corba-iiop", Description: "CORBA IIOP"}, + 684: {Sym: "corba-iiop-ssl", Description: "CORBA IIOP SSL"}, + 685: {Sym: "mdc-portmapper", Description: "MDC Port Mapper"}, + 686: {Sym: "hcp-wismar", Description: "Hardware Control Protocol Wismar"}, + 687: {Sym: "asipregistry", Description: "asipregistry"}, + 688: {Sym: "realm-rusd", Description: "REALM-RUSD"}, + 689: {Sym: "nmap", Description: "NMAP"}, + 690: {Sym: "vatp", Description: "VATP"}, + 691: {Sym: "msexch-routing", Description: "MS Exchange Routing"}, + 692: {Sym: "hyperwave-isp", Description: "Hyperwave-ISP"}, + 693: {Sym: "connendp", Description: "connendp"}, + 694: {Sym: "ha-cluster", Description: "ha-cluster"}, + 695: {Sym: "ieee-mms-ssl", Description: "IEEE-MMS-SSL"}, + 696: {Sym: "rushd", Description: "RUSHD"}, + 697: {Sym: "uuidgen", Description: "UUIDGEN"}, + 698: {Sym: "olsr", Description: "OLSR"}, + 699: {Sym: "accessnetwork", Description: "Access Network"}, + 700: {Sym: "epp", Description: "Extensible Provisioning Protocol"}, + 701: {Sym: "lmp", Description: "Link Management Protocol (LMP)"}, + 702: {Sym: "iris-beep", Description: "IRIS over BEEP"}, + 704: {Sym: "elcsd", Description: "errlog copy/server daemon"}, + 705: {Sym: "agentx", Description: "AgentX"}, + 706: {Sym: "silc", Description: "SILC"}, + 707: {Sym: "borland-dsj", Description: "Borland DSJ"}, + 709: {Sym: "entrust-kmsh", Description: "Entrust Key Management Service Handler"}, + 710: {Sym: "entrust-ash", Description: "Entrust Administration Service Handler"}, + 711: {Sym: "cisco-tdp", Description: "Cisco TDP"}, + 712: {Sym: "tbrpf", Description: "TBRPF"}, + 729: {Sym: "netviewdm1", Description: "IBM NetView DM/6000 Server/Client"}, + 730: {Sym: "netviewdm2", Description: "IBM NetView DM/6000 send/tcp"}, + 731: {Sym: "netviewdm3", Description: "IBM NetView DM/6000 receive/tcp"}, + 741: {Sym: "netgw", Description: "netGW"}, + 742: {Sym: "netrcs", Description: "Network based Rev. Cont. Sys."}, + 744: {Sym: "flexlm", Description: "Flexible License Manager"}, + 747: {Sym: "fujitsu-dev", Description: "Fujitsu Device Control"}, + 748: {Sym: "ris-cm", Description: "Russell Info Sci Calendar Manager"}, + 749: {Sym: "kerberos-adm", Description: "kerberos administration"}, + 750: {Sym: "rfile"}, + 751: {Sym: "pump"}, + 752: {Sym: "qrh"}, + 753: {Sym: "rrh"}, + 754: {Sym: "tell", Description: "send"}, + 758: {Sym: "nlogin"}, + 759: {Sym: "con"}, + 760: {Sym: "ns"}, + 761: {Sym: "rxe"}, + 762: {Sym: "quotad"}, + 763: {Sym: "cycleserv"}, + 764: {Sym: "omserv"}, + 765: {Sym: "webster"}, + 767: {Sym: "phonebook", Description: "phone"}, + 769: {Sym: "vid"}, + 770: {Sym: "cadlock"}, + 771: {Sym: "rtip"}, + 772: {Sym: "cycleserv2"}, + 773: {Sym: "submit"}, + 774: {Sym: "rpasswd"}, + 775: {Sym: "entomb"}, + 776: {Sym: "wpages"}, + 777: {Sym: "multiling-http", Description: "Multiling HTTP"}, + 780: {Sym: "wpgs"}, + 800: {Sym: "mdbs_daemon"}, + 801: {Sym: "device"}, + 810: {Sym: "fcp-udp", Description: "FCP"}, + 828: {Sym: "itm-mcell-s", Description: "itm-mcell-s"}, + 829: {Sym: "pkix-3-ca-ra", Description: "PKIX-3 CA/RA"}, + 830: {Sym: "netconf-ssh", Description: "NETCONF over SSH"}, + 831: {Sym: "netconf-beep", Description: "NETCONF over BEEP"}, + 832: {Sym: "netconfsoaphttp", Description: "NETCONF for SOAP over HTTPS"}, + 833: {Sym: "netconfsoapbeep", Description: "NETCONF for SOAP over BEEP"}, + 847: {Sym: "dhcp-failover2", Description: "dhcp-failover 2"}, + 848: {Sym: "gdoi", Description: "GDOI"}, + 860: {Sym: "iscsi", Description: "iSCSI"}, + 861: {Sym: "owamp-control", Description: "OWAMP-Control"}, + 873: {Sym: "rsync", Description: "rsync"}, + 886: {Sym: "iclcnet-locate", Description: "ICL coNETion locate server"}, + 887: {Sym: "iclcnet_svinfo", Description: "ICL coNETion server info"}, + 888: {Sym: "accessbuilder", Description: "AccessBuilder"}, + // 888: {Sym: "cddbp", Description: "CD Database Protocol"}, + 900: {Sym: "omginitialrefs", Description: "OMG Initial Refs"}, + 901: {Sym: "smpnameres", Description: "SMPNAMERES"}, + 902: {Sym: "ideafarm-chat", Description: "IDEAFARM-CHAT"}, + 903: {Sym: "ideafarm-catch", Description: "IDEAFARM-CATCH"}, + 910: {Sym: "kink", Description: "Kerberized Internet Negotiation of Keys (KINK)"}, + 911: {Sym: "xact-backup", Description: "xact-backup"}, + 912: {Sym: "apex-mesh", Description: "APEX relay-relay service"}, + 913: {Sym: "apex-edge", Description: "APEX endpoint-relay service"}, + 989: {Sym: "ftps-data", Description: "ftp protocol, data, over TLS/SSL"}, + 990: {Sym: "ftps", Description: "ftp protocol, control, over TLS/SSL"}, + 991: {Sym: "nas", Description: "Netnews Administration System"}, + 992: {Sym: "telnets", Description: "telnet protocol over TLS/SSL"}, + 993: {Sym: "imaps", Description: "imap4 protocol over TLS/SSL"}, + 994: {Sym: "ircs", Description: "irc protocol over TLS/SSL"}, + 995: {Sym: "pop3s", Description: "pop3 protocol over TLS/SSL (was spop3)"}, + 996: {Sym: "vsinet", Description: "vsinet"}, + 997: {Sym: "maitrd"}, + 998: {Sym: "busboy"}, + 999: {Sym: "garcon"}, + 1000: {Sym: "cadlock2"}, + 1010: {Sym: "surf", Description: "surf"}, +} diff --git a/format/inet/tcp.go b/format/inet/tcp.go new file mode 100644 index 00000000..8327d1b4 --- /dev/null +++ b/format/inet/tcp.go @@ -0,0 +1,42 @@ +package inet + +import ( + "github.com/wader/fq/format" + "github.com/wader/fq/format/registry" + "github.com/wader/fq/pkg/decode" +) + +func init() { + registry.MustRegister(decode.Format{ + Name: format.TCP, + Description: "Transmission Control Protocol", + DecodeFn: decodeTCP, + }) +} + +func decodeTCP(d *decode.D, in interface{}) interface{} { + d.FieldU16("source_port", d.MapUToScalar(tcpPortMap)) + d.FieldU16("destination_port", d.MapUToScalar(tcpPortMap)) + d.FieldU32("sequence_number") + d.FieldU32("acknowledgment_number") + dataOffset := d.FieldU4("data_offset") + d.FieldU3("reserved") + d.FieldBool("ns") + d.FieldBool("cwr") + d.FieldBool("ece") + d.FieldBool("urg") + d.FieldBool("ack") + d.FieldBool("psh") + d.FieldBool("rst") + d.FieldBool("syn") + d.FieldBool("fin") + d.FieldU16("window_size") + d.FieldU16("checksum", d.Hex) + d.FieldU16("urgent_pointer") + if dataOffset > 5 { + d.FieldRawLen("options", (int64(dataOffset)-5)*8*4) + } + d.FieldRawLen("data", d.BitsLeft()) + + return nil +} diff --git a/format/inet/testdata/ether8023 b/format/inet/testdata/ether8023 new file mode 100644 index 0000000000000000000000000000000000000000..d69f8b0b7c5190e3e3cbff7ddb867646ac0d42c4 GIT binary patch literal 178 zcmezW9|V@fC48)%%)#Kwz_8@lIR*v?!H@0-RxoyhG%>L-)=^L@OD!tS%+CV~M;q!WSi}N_QZkDRauO@^5_405!b(a&p@RG( zkWNE$Qv(Aa7bI0&keHlW4AN(0U}|JyWNNOXU}kJ-YHVp>ZUkc*8^c9SO-*BK0oM;X Ao&W#< literal 0 HcmV?d00001 diff --git a/format/inet/testdata/ether8023.fqtest b/format/inet/testdata/ether8023.fqtest new file mode 100644 index 00000000..c8599afd --- /dev/null +++ b/format/inet/testdata/ether8023.fqtest @@ -0,0 +1,31 @@ +# fq 'first(.. | select(format=="ether8023")) | tobytes' many_interfaces.pcapng > ether8023 +$ fq -d ether8023 verbose /ether8023 + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: {} /ether8023 (ether8023) 0x0-0xb1.7 (178) +0x00|ff ff ff ff ff ff |...... | destination: "ff:ff:ff:ff:ff:ff" (0xffffffffffff) 0x0-0x5.7 (6) +0x00| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x6-0xb.7 (6) +0x00| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xc-0xd.7 (2) + | | | packet: {} (ipv4) 0xe-0xb1.7 (164) +0x00| 45 | E | version: 4 0xe-0xe.3 (0.4) +0x00| 45 | E | ihl: 5 0xe.4-0xe.7 (0.4) +0x00| 00| .| dscp: 0 0xf-0xf.5 (0.6) +0x00| 00| .| ecn: 0 0xf.6-0xf.7 (0.2) +0x10|00 a4 |.. | total_length: 164 0x10-0x11.7 (2) +0x10| c6 ce | .. | identification: 50894 0x12-0x13.7 (2) +0x10| 00 | . | reserved: 0 0x14-0x14 (0.1) +0x10| 00 | . | dont_fragment: false 0x14.1-0x14.1 (0.1) +0x10| 00 | . | more_fragments: false 0x14.2-0x14.2 (0.1) +0x10| 00 00 | .. | fragment_offset: 0 0x14.3-0x15.7 (1.5) +0x10| 40 | @ | ttl: 64 0x16-0x16.7 (1) +0x10| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x17-0x17.7 (1) +0x10| f1 47 | .G | header_checksum: 0xf147 0x18-0x19.7 (2) +0x10| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x1a-0x1d.7 (4) +0x10| ff ff| ..| destination_ip: "255.255.255.255" (0xffffffff) 0x1e-0x21.7 (4) +0x20|ff ff |.. | + | | | data: {} (udp) 0x22-0xb1.7 (144) +0x20| 44 5c | D\ | source_port: 17500 0x22-0x23.7 (2) +0x20| 44 5c | D\ | destination_port: 17500 0x24-0x25.7 (2) +0x20| 00 90 | .. | length: 144 0x26-0x27.7 (2) +0x20| ba 03 | .. | checksum: 0xba03 0x28-0x29.7 (2) +0x20| 7b 22 68 6f 73 74| {"host| data: raw bits 0x2a-0xb1.7 (136) +0x30|5f 69 6e 74 22 3a 20 34 30 39 34 35 31 34 34 38|_int": 409451448| +* |until 0xb1.7 (end) (136) | | diff --git a/format/inet/testdata/ipv4 b/format/inet/testdata/ipv4 new file mode 100644 index 0000000000000000000000000000000000000000..6a1858acb6c103a04f2b0293964cddcbe191e1a5 GIT binary patch literal 996 zcmZ=|V1Baof&zmB<7^iuMn)zeX5?V-EfhY)z$l`9DUtyQY_&K*6oY`Ekg$lTn7D+b zl(dYjoVqnoxOvjle3Gfo4bdnm$#3v zpMOALP;f|SSa?KaRCG*iTzo=eQgTXaT6#uiR(4KqUVcGgQE^FWS$RceRdr2mU427i zQ*%peTYE=mS9ecuU;l)OlO|7@I&J!lnX_iknLBU(f`y9~FIl>5`HGdRRKIRx^4T8ox67L*}HH5frEz*A31vL_=%IJPM`HPpYUcY(!?)`_4pFV&2`tAFVpTB ipv4 +$ fq -d ipv4 verbose /ipv4 + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: {} /ipv4 (ipv4) 0x0-0x3e3.7 (996) +0x000|45 |E | version: 4 0x0-0x0.3 (0.4) +0x000|45 |E | ihl: 5 0x0.4-0x0.7 (0.4) +0x000| 00 | . | dscp: 0 0x1-0x1.5 (0.6) +0x000| 00 | . | ecn: 0 0x1.6-0x1.7 (0.2) +0x000| 03 e4 | .. | total_length: 996 0x2-0x3.7 (2) +0x000| b5 d0 | .. | identification: 46544 0x4-0x5.7 (2) +0x000| 20 | | reserved: 0 0x6-0x6 (0.1) +0x000| 20 | | dont_fragment: false 0x6.1-0x6.1 (0.1) +0x000| 20 | | more_fragments: true 0x6.2-0x6.2 (0.1) +0x000| 20 00 | . | fragment_offset: 0 0x6.3-0x7.7 (1.5) +0x000| 40 | @ | ttl: 64 0x8-0x8.7 (1) +0x000| 01 | . | protocol: "icmp" (1) (internet control message protocol) 0x9-0x9.7 (1) +0x000| 9b 44 | .D | header_checksum: 0x9b44 0xa-0xb.7 (2) +0x000| 02 01 01 02| ....| source_ip: "2.1.1.2" (0x2010102) 0xc-0xf.7 (4) +0x010|02 01 01 01 |.... | destination_ip: "2.1.1.1" (0x2010101) 0x10-0x13.7 (4) +0x010| 08 00 4d 71 13 c2 00 01 14 2b d2 59| ..Mq.....+.Y| data: raw bits 0x14-0x3e3.7 (976) +0x020|00 00 00 00 3d 2a 08 00 00 00 00 00 10 11 12 13|....=*..........| +* |until 0x3e3.7 (end) (976) | | diff --git a/format/inet/testdata/tcp b/format/inet/testdata/tcp new file mode 100644 index 0000000000000000000000000000000000000000..c22aeca4ab55def23d15130022f090651e7755be GIT binary patch literal 44 wcmX@E%D7wmoL(0L5Nu%j|KIfq0|OHa>lQ|4W>!W<4lZx4iHaaO7A6J;02Uw#KL7v# literal 0 HcmV?d00001 diff --git a/format/inet/testdata/tcp.fqtest b/format/inet/testdata/tcp.fqtest new file mode 100644 index 00000000..6e486219 --- /dev/null +++ b/format/inet/testdata/tcp.fqtest @@ -0,0 +1,24 @@ +# fq 'first(.. | select(format=="tcp")) | tobytes' many_interfaces.pcapng > tcp +$ fq -d tcp verbose /tcp + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: {} /tcp (tcp) 0x0-0x2b.7 (44) +0x00|c7 25 |.% | source_port: 50981 0x0-0x1.7 (2) +0x00| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2-0x3.7 (2) +0x00| 2b ce 2e 8a | +... | sequence_number: 734932618 0x4-0x7.7 (4) +0x00| 00 00 00 00 | .... | acknowledgment_number: 0 0x8-0xb.7 (4) +0x00| b0 | . | data_offset: 11 0xc-0xc.3 (0.4) +0x00| b0 | . | reserved: 0 0xc.4-0xc.6 (0.3) +0x00| b0 | . | ns: false 0xc.7-0xc.7 (0.1) +0x00| 02 | . | cwr: false 0xd-0xd (0.1) +0x00| 02 | . | ece: false 0xd.1-0xd.1 (0.1) +0x00| 02 | . | urg: false 0xd.2-0xd.2 (0.1) +0x00| 02 | . | ack: false 0xd.3-0xd.3 (0.1) +0x00| 02 | . | psh: false 0xd.4-0xd.4 (0.1) +0x00| 02 | . | rst: false 0xd.5-0xd.5 (0.1) +0x00| 02 | . | syn: true 0xd.6-0xd.6 (0.1) +0x00| 02 | . | fin: false 0xd.7-0xd.7 (0.1) +0x00| ff ff| ..| window_size: 65535 0xe-0xf.7 (2) +0x10|45 e4 |E. | checksum: 0x45e4 0x10-0x11.7 (2) +0x10| 00 00 | .. | urgent_pointer: 0 0x12-0x13.7 (2) +0x10| 02 04 05 b4 01 03 03 05 01 01 08 0a| ............| options: raw bits 0x14-0x2b.7 (24) +0x20|4b 2a 91 21 00 00 00 00 04 02 00 00| |K*.!........| | + | | | data: raw bits 0x2c-NA (0) diff --git a/format/inet/testdata/udp b/format/inet/testdata/udp new file mode 100644 index 0000000000000000000000000000000000000000..5bc3e09fe0ecd0084d5d8d920f0f3e5136aa046f GIT binary patch literal 144 zcmZ>XafxA=u#34`DI>qQBtA2*M9E6Q#K6+T)X>Dl!dOQ^sVudqI5R&FC>(95qhJvW z6iUe~F33r&%uCEo1qv%E0fh?ki$FRJ%}osqfLxGNaY15oYB5Nkk%6g^iIJ(fj)Ix7 WrKz!{fw>WkX>1G^H8nMjtpxy(T_!^S literal 0 HcmV?d00001 diff --git a/format/inet/testdata/udp.fqtest b/format/inet/testdata/udp.fqtest new file mode 100644 index 00000000..53e2111d --- /dev/null +++ b/format/inet/testdata/udp.fqtest @@ -0,0 +1,10 @@ +# fq 'first(.. | select(format=="udp")) | tobytes' many_interfaces.pcapng > udp +$ fq -d udp verbose /udp + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: {} /udp (udp) 0x0-0x8f.7 (144) +0x00|44 5c |D\ | source_port: 17500 0x0-0x1.7 (2) +0x00| 44 5c | D\ | destination_port: 17500 0x2-0x3.7 (2) +0x00| 00 90 | .. | length: 144 0x4-0x5.7 (2) +0x00| ba 03 | .. | checksum: 0xba03 0x6-0x7.7 (2) +0x00| 7b 22 68 6f 73 74 5f 69| {"host_i| data: raw bits 0x8-0x8f.7 (136) +0x10|6e 74 22 3a 20 34 30 39 34 35 31 34 34 38 33 2c|nt": 4094514483,| +* |until 0x8f.7 (end) (136) | | diff --git a/format/inet/udp.go b/format/inet/udp.go new file mode 100644 index 00000000..e87b7ea7 --- /dev/null +++ b/format/inet/udp.go @@ -0,0 +1,49 @@ +package inet + +import ( + "github.com/wader/fq/format" + "github.com/wader/fq/format/registry" + "github.com/wader/fq/pkg/decode" +) + +var udpDNSFormat decode.Group + +func init() { + registry.MustRegister(decode.Format{ + Name: format.UDP, + Description: "User datagram protocol", + Dependencies: []decode.Dependency{ + {Names: []string{format.DNS}, Group: &udpDNSFormat}, + }, + DecodeFn: decodeUDP, + }) +} + +const ( + udpPortDNS = 53 +) + +var udpPortFormat = map[uint64]*decode.Group{ + udpPortDNS: &udpDNSFormat, +} + +func decodeUDP(d *decode.D, in interface{}) interface{} { + soucePort := d.FieldU16("source_port", d.MapUToScalar(udpPortMap)) + destPort := d.FieldU16("destination_port", d.MapUToScalar(udpPortMap)) + length := d.FieldU16("length") + d.FieldU16("checksum", d.Hex) + + // TODO: prio? src/dst map? + g := udpPortFormat[soucePort] + if g == nil { + g = udpPortFormat[destPort] + } + dataLen := int64(length-8) * 8 + if g != nil { + d.FieldFormatLen("data", dataLen, *g, nil) + } else { + d.FieldRawLen("data", dataLen) + } + + return nil +} diff --git a/format/pcap/pcap.go b/format/pcap/pcap.go new file mode 100644 index 00000000..c57dd79c --- /dev/null +++ b/format/pcap/pcap.go @@ -0,0 +1,70 @@ +package pcap + +// https://wiki.wireshark.org/Development/LibpcapFileFormat + +import ( + "github.com/wader/fq/format" + "github.com/wader/fq/format/registry" + "github.com/wader/fq/pkg/decode" +) + +var pcapEther8023Format decode.Group + +const ( + bigEndian = 0xa1b2c3d4 + littleEndian = 0xd4c3b2a1 +) + +var endianMap = decode.UToStr{ + bigEndian: "big_endian", + littleEndian: "little_endian", +} + +func init() { + registry.MustRegister(decode.Format{ + Name: format.PCAP, + Description: "PCAP packet capture", + Groups: []string{format.PROBE}, + Dependencies: []decode.Dependency{ + {Names: []string{format.ETHER8023}, Group: &pcapEther8023Format}, + }, + DecodeFn: decodePcap, + }) +} + +func decodePcap(d *decode.D, in interface{}) interface{} { + endian := d.FieldU32("magic", d.AssertU(bigEndian, littleEndian), d.MapUToStrSym(endianMap), d.Hex) + switch endian { + case bigEndian: + d.Endian = decode.BigEndian + case littleEndian: + d.Endian = decode.LittleEndian + default: + d.Fatalf("unknown endian %d", endian) + } + d.FieldU16("version_major") + d.FieldU16("version_minor") + d.FieldS32("thiszone") + d.FieldU32("sigfigs") + d.FieldU32("snaplen") + linkType := int(d.FieldU32("network", d.MapUToScalar(linkTypeMap))) + + d.FieldArray("packets", func(d *decode.D) { + for !d.End() { + d.FieldStruct("packet", func(d *decode.D) { + d.FieldU32("ts_sec") + d.FieldU32("ts_usec") + inclLen := d.FieldU32("incl_len") + origLen := d.FieldU32("orig_len") + if g, ok := linkToFormat[linkType]; ok { + d.FieldFormatLen("packet", int64(origLen)*8, *g, nil) + } else { + d.FieldRawLen("packet", int64(origLen)*8) + } + d.FieldRawLen("capture_padding", int64(inclLen-origLen)*8) + }) + } + }) + + return nil +} diff --git a/format/pcap/pcapng.go b/format/pcap/pcapng.go new file mode 100644 index 00000000..a5b16436 --- /dev/null +++ b/format/pcap/pcapng.go @@ -0,0 +1,357 @@ +package pcap + +// https://pcapng.github.io/pcapng/draft-ietf-opsawg-pcapng.html + +import ( + "encoding/binary" + "net" + + "github.com/wader/fq/format" + "github.com/wader/fq/format/registry" + "github.com/wader/fq/pkg/decode" +) + +var pcapngEther8023Format decode.Group + +func init() { + registry.MustRegister(decode.Format{ + Name: format.PCAPNG, + Description: "PCAPNG packet capture", + RootArray: true, + Groups: []string{format.PROBE}, + Dependencies: []decode.Dependency{ + {Names: []string{format.ETHER8023}, Group: &pcapngEther8023Format}, + }, + DecodeFn: decodePcapng, + }) +} + +const ( + ngBigEndian = 0x1a2b3c4d + ngLittleEndian = 0x4d3c2b1a +) + +var ngEndianMap = decode.UToStr{ + ngBigEndian: "big_endian", + ngLittleEndian: "little_endian", +} + +const ( + blockTypeSectionHeader = 0x0a0d0d0a + blockTypeInterfaceDescription = 0x00000001 + blockTypeNameResolution = 0x00000004 + blockTypeInterfaceStatistics = 0x00000005 + blockTypeEnhancedPacketBlock = 0x00000006 +) + +// from https://pcapng.github.io/pcapng/draft-ietf-opsawg-pcapng.html#section_block_code_registry +var blockTypeMap = decode.UToScalar{ + blockTypeInterfaceDescription: {Sym: "interface_description", Description: "Interface Description Block"}, + 0x00000002: {Description: "Packet Block"}, + 0x00000003: {Description: "Simple Packet Block"}, + blockTypeNameResolution: {Sym: "name_resolution", Description: "Name Resolution Block"}, + blockTypeInterfaceStatistics: {Sym: "interface_statistics", Description: "Interface Statistics Block"}, + blockTypeEnhancedPacketBlock: {Sym: "enhanced_packet", Description: "Enhanced Packet Block"}, + 0x00000007: {Description: "IRIG Timestamp Block"}, + 0x00000008: {Description: "ARINC 429 in AFDX Encapsulation Information Block"}, + 0x00000009: {Description: "systemd Journal Export Block"}, + 0x0000000a: {Description: "Decryption Secrets Block"}, + 0x00000101: {Description: "Hone Project Machine Info Block"}, + 0x00000102: {Description: "Hone Project Connection Event Block"}, + 0x00000201: {Description: "Sysdig Machine Info Block"}, + 0x00000202: {Description: "Sysdig Process Info Block, version 1"}, + 0x00000203: {Description: "Sysdig FD List Block"}, + 0x00000204: {Description: "Sysdig Event Block"}, + 0x00000205: {Description: "Sysdig Interface List Block"}, + 0x00000206: {Description: "Sysdig User List Block"}, + 0x00000207: {Description: "Sysdig Process Info Block, version 2"}, + 0x00000208: {Description: "Sysdig Event Block with flags"}, + 0x00000209: {Description: "Sysdig Process Info Block, version 3"}, + 0x00000210: {Description: "Sysdig Process Info Block, version 4"}, + 0x00000211: {Description: "Sysdig Process Info Block, version 5"}, + 0x00000212: {Description: "Sysdig Process Info Block, version 6"}, + 0x00000213: {Description: "Sysdig Process Info Block, version 7"}, + 0x00000bad: {Description: "Custom Block that rewriters can copy into new files"}, + 0x40000bad: {Description: "Custom Block that rewriters should not copy into new files"}, + blockTypeSectionHeader: {Sym: "section_header", Description: "Section Header Block"}, +} + +const ( + optionEnd = 0 + optionComment = 1 + + sectionHeaderOptionHardware = 2 + sectionHeaderOptionOS = 3 + sectionHeaderOptionUserAppl = 4 + + interfaceDescriptionName = 2 + interfaceDescriptionDescription = 3 + interfaceDescriptionIPv4addr = 4 + interfaceDescriptionMACaddr = 6 + interfaceDescriptionEUIaddr = 7 + interfaceDescriptionSpeed = 8 + interfaceDescriptionTsresol = 9 + interfaceDescriptionTzone = 10 + interfaceDescriptionFilter = 11 + interfaceDescriptionOS = 12 + interfaceDescriptionFcslen = 13 + interfaceDescriptionTsoffset = 14 + + enhancedPacketFlags = 2 + enhancedPacketHash = 3 + enhancedPacketDropcount = 4 + + nameResolutionDNSName = 2 + nameResolutionDNSIP4addr = 3 + nameResolutionDNSIP6addr = 4 + + interfaceStatisticsStarttime = 2 + interfaceStatisticsEndtime = 3 + interfaceStatisticsIfRecv = 4 + interfaceStatisticsIfDrop = 5 + interfaceStatisticsFilterAccept = 6 + interfaceStatisticsOSDrop = 7 + interfaceStatisticsUsrdeliv = 8 +) + +var sectionHeaderOptionsMap = decode.UToScalar{ + optionEnd: {Sym: "end", Description: "End of options"}, + optionComment: {Sym: "comment", Description: "Comment"}, + sectionHeaderOptionHardware: {Sym: "hardware"}, + sectionHeaderOptionOS: {Sym: "os"}, + sectionHeaderOptionUserAppl: {Sym: "userappl"}, +} + +var interfaceDescriptionOptionsMap = decode.UToScalar{ + optionEnd: {Sym: "end", Description: "End of options"}, + optionComment: {Sym: "comment", Description: "Comment"}, + interfaceDescriptionName: {Sym: "name"}, + interfaceDescriptionDescription: {Sym: "description"}, + interfaceDescriptionIPv4addr: {Sym: "ipv4addr"}, + interfaceDescriptionMACaddr: {Sym: "macaddr"}, + interfaceDescriptionEUIaddr: {Sym: "euiaddr"}, + interfaceDescriptionSpeed: {Sym: "speed"}, + interfaceDescriptionTsresol: {Sym: "tsresol"}, + interfaceDescriptionTzone: {Sym: "tzone"}, + interfaceDescriptionFilter: {Sym: "filter"}, + interfaceDescriptionOS: {Sym: "os"}, + interfaceDescriptionFcslen: {Sym: "fcslen"}, + interfaceDescriptionTsoffset: {Sym: "tsoffset"}, +} + +var enhancedPacketOptionsMap = decode.UToScalar{ + optionEnd: {Sym: "end", Description: "End of options"}, + optionComment: {Sym: "comment", Description: "Comment"}, + enhancedPacketFlags: {Sym: "flags"}, + enhancedPacketHash: {Sym: "hash"}, + enhancedPacketDropcount: {Sym: "dropcount"}, +} + +var nameResolutionOptionsMap = decode.UToScalar{ + optionEnd: {Sym: "end", Description: "End of options"}, + optionComment: {Sym: "comment", Description: "Comment"}, + nameResolutionDNSName: {Sym: "dnsname"}, + nameResolutionDNSIP4addr: {Sym: "dnsip4addr"}, + nameResolutionDNSIP6addr: {Sym: "dnsip6addr"}, +} + +var interfaceStatisticsOptionsMap = decode.UToScalar{ + optionEnd: {Sym: "end", Description: "End of options"}, + optionComment: {Sym: "comment", Description: "Comment"}, + interfaceStatisticsStarttime: {Sym: "starttime"}, + interfaceStatisticsEndtime: {Sym: "endtime"}, + interfaceStatisticsIfRecv: {Sym: "ifrecv"}, + interfaceStatisticsIfDrop: {Sym: "ifdrop"}, + interfaceStatisticsFilterAccept: {Sym: "filteraccept"}, + interfaceStatisticsOSDrop: {Sym: "osdrop"}, + interfaceStatisticsUsrdeliv: {Sym: "usrdeliv"}, +} + +const ( + nameResolutionRecordEnd = 0x0000 + nameResolutionRecordIpv4 = 0x0001 + nameResolutionRecordIpv6 = 0x0002 +) + +var nameResolutionRecordMap = decode.UToStr{ + nameResolutionRecordEnd: "end", + nameResolutionRecordIpv4: "ipv4", + nameResolutionRecordIpv6: "ipv6", +} + +type decodeContext struct { + sectionHeaderFound bool + interfaceTypes map[int]int +} + +func decoodeOptions(d *decode.D, opts decode.UToScalar) { + if d.BitsLeft() < 32 { + return + } + seenEnd := false + for !seenEnd { + d.FieldStruct("option", func(d *decode.D) { + code := d.FieldU16("code", d.MapUToScalar(opts)) + length := d.FieldU16("length") + if code == optionEnd { + seenEnd = true + return + } + d.FieldUTF8NullFixedLen("value", int(length)) + d.FieldRawLen("padding", int64(d.AlignBits(32))) + }) + } +} + +// TODO: share +func mapUToIPv4Sym(s decode.Scalar) (decode.Scalar, error) { + var b [4]byte + binary.BigEndian.PutUint32(b[:], uint32(s.ActualU())) + s.Sym = net.IP(b[:]).String() + return s, nil +} + +var blockFns = map[uint64]func(d *decode.D, dc *decodeContext){ + blockTypeInterfaceDescription: func(d *decode.D, dc *decodeContext) { + typ := d.FieldU16("link_type", d.MapUToScalar(linkTypeMap)) + d.FieldU16("reserved") + d.FieldU32("snap_len") + d.FieldArray("options", func(d *decode.D) { decoodeOptions(d, interfaceDescriptionOptionsMap) }) + + dc.interfaceTypes[len(dc.interfaceTypes)] = int(typ) + }, + blockTypeEnhancedPacketBlock: func(d *decode.D, dc *decodeContext) { + interfaceID := d.FieldU32("interface_id") + d.FieldU32("timestamp_high") + d.FieldU32("timestamp_low") + capturedLength := d.FieldU32("capture_packet_length") + originalLength := d.FieldU32("original_packet_length") + + if g, ok := linkToFormat[dc.interfaceTypes[int(interfaceID)]]; ok { + d.FieldFormatLen("packet", int64(originalLength)*8, *g, nil) + } else { + d.FieldRawLen("packet", int64(originalLength)*8) + } + + d.FieldRawLen("capture_padding", int64(capturedLength-originalLength)*8) + d.FieldRawLen("padding", int64(d.AlignBits(32))) + d.FieldArray("options", func(d *decode.D) { decoodeOptions(d, enhancedPacketOptionsMap) }) + }, + blockTypeNameResolution: func(d *decode.D, _ *decodeContext) { + seenEnd := false + d.FieldArray("records", func(d *decode.D) { + for !seenEnd { + d.FieldStruct("record", func(d *decode.D) { + typ := d.FieldU16("type", d.MapUToStrSym(nameResolutionRecordMap)) + length := d.FieldU16("length") + if typ == nameResolutionRecordEnd { + seenEnd = true + return + } + d.LenFn(int64(length)*8, func(d *decode.D) { + switch typ { + case nameResolutionRecordIpv4: + d.FieldU32BE("address", mapUToIPv4Sym, d.Hex) + d.FieldArray("entries", func(d *decode.D) { + for !d.End() { + d.FieldUTF8Null("string") + } + }) + default: + d.FieldUTF8NullFixedLen("value", int(d.BitsLeft()/8)) + } + }) + d.FieldRawLen("padding", int64(d.AlignBits(32))) + }) + } + }) + d.FieldArray("options", func(d *decode.D) { decoodeOptions(d, nameResolutionOptionsMap) }) + }, + blockTypeInterfaceStatistics: func(d *decode.D, _ *decodeContext) { + d.FieldU32("interface_id") + d.FieldU32("timestamp_high") + d.FieldU32("timestamp_low") + d.FieldRawLen("padding", int64(d.AlignBits(32))) + d.FieldArray("options", func(d *decode.D) { decoodeOptions(d, interfaceStatisticsOptionsMap) }) + }, +} + +func decodeBlock(d *decode.D, dc *decodeContext) { + typ := d.FieldU32("type", d.MapUToScalar(blockTypeMap), d.Hex) + length := d.FieldU32("length") - 8 + const footerLengthSize = 32 + d.LenFn(int64(length)*8-footerLengthSize, func(d *decode.D) { + if fn, ok := blockFns[typ]; ok { + fn(d, dc) + } else { + d.FieldRawLen("data", d.BitsLeft()) + } + }) + d.FieldU32("footer_length") +} + +func decodeSection(d *decode.D, dc *decodeContext) { + d.FieldArray("blocks", func(d *decode.D) { + sectionLength := int64(-1) + sectionD := d + sectionStart := d.Pos() + + // treat header block differently as it has endian info + d.FieldStruct("block", func(d *decode.D) { + d.FieldU32("type", d.AssertU(blockTypeSectionHeader), d.MapUToScalar(blockTypeMap), d.Hex) + + d.SeekRel(32) + endian := d.FieldU32("byte_order_magic", d.MapUToStrSym(ngEndianMap), d.Hex) + // peeks length and byte-order magic and marks away length + switch endian { + case ngBigEndian: + d.Endian = decode.BigEndian + case ngLittleEndian: + d.Endian = decode.LittleEndian + default: + d.Fatalf("unknown endian %d", endian) + } + sectionD.Endian = d.Endian + d.SeekRel(-64) + length := d.FieldU32("length") - 8 - 4 + d.SeekRel(32) + + d.LenFn(int64(length)*8, func(d *decode.D) { + d.FieldU16("major_version") + d.FieldU16("minor_version") + sectionLength = d.FieldS64("section_length") + d.LenFn(d.BitsLeft()-32, func(d *decode.D) { + d.FieldArray("options", func(d *decode.D) { decoodeOptions(d, sectionHeaderOptionsMap) }) + }) + d.FieldU32("footer_total_length") + }) + + dc.sectionHeaderFound = true + }) + + for (sectionLength == -1 && !d.End()) || (sectionLength != -1 && d.Pos()-sectionStart < sectionLength*8) { + d.FieldStruct("block", func(d *decode.D) { decodeBlock(d, dc) }) + } + }) +} + +func decodePcapng(d *decode.D, in interface{}) interface{} { + sectionHeaders := 0 + for !d.End() { + dc := decodeContext{ + interfaceTypes: map[int]int{}, + } + d.FieldStruct("section", func(d *decode.D) { + decodeSection(d, &dc) + }) + if dc.sectionHeaderFound { + sectionHeaders++ + } + } + + if sectionHeaders == 0 { + d.Fatalf("no section headers found") + } + + return nil +} diff --git a/format/pcap/shared.go b/format/pcap/shared.go new file mode 100644 index 00000000..a1038519 --- /dev/null +++ b/format/pcap/shared.go @@ -0,0 +1,278 @@ +package pcap + +import "github.com/wader/fq/pkg/decode" + +//nolint:revive +const ( + LINKTYPE_NULL = 0 + LINKTYPE_ETHERNET = 1 + LINKTYPE_AX25 = 3 + LINKTYPE_IEEE802_5 = 6 + LINKTYPE_ARCNET_BSD = 7 + LINKTYPE_SLIP = 8 + LINKTYPE_PPP = 9 + LINKTYPE_FDDI = 10 + LINKTYPE_PPP_HDLC = 50 + LINKTYPE_PPP_ETHER = 51 + LINKTYPE_ATM_RFC1483 = 100 + LINKTYPE_RAW = 101 + LINKTYPE_C_HDLC = 104 + LINKTYPE_IEEE802_11 = 105 + LINKTYPE_FRELAY = 107 + LINKTYPE_LOOP = 108 + LINKTYPE_LINUX_SLL = 113 + LINKTYPE_LTALK = 114 + LINKTYPE_PFLOG = 117 + LINKTYPE_IEEE802_11_PRISM = 119 + LINKTYPE_IP_OVER_FC = 122 + LINKTYPE_SUNATM = 123 + LINKTYPE_IEEE802_11_RADIOTAP = 127 + LINKTYPE_ARCNET_LINUX = 129 + LINKTYPE_APPLE_IP_OVER_IEEE1394 = 138 + LINKTYPE_MTP2_WITH_PHDR = 139 + LINKTYPE_MTP2 = 140 + LINKTYPE_MTP3 = 141 + LINKTYPE_SCCP = 142 + LINKTYPE_DOCSIS = 143 + LINKTYPE_LINUX_IRDA = 144 + LINKTYPE_USER0 = 147 + LINKTYPE_USER1 = 148 + LINKTYPE_USER2 = 149 + LINKTYPE_USER3 = 150 + LINKTYPE_USER4 = 151 + LINKTYPE_USER5 = 152 + LINKTYPE_USER6 = 153 + LINKTYPE_USER7 = 154 + LINKTYPE_USER8 = 155 + LINKTYPE_USER9 = 156 + LINKTYPE_USER10 = 157 + LINKTYPE_USER11 = 158 + LINKTYPE_USER12 = 159 + LINKTYPE_USER13 = 160 + LINKTYPE_USER14 = 161 + LINKTYPE_USER15 = 162 + LINKTYPE_IEEE802_11_AVS = 163 + LINKTYPE_BACNET_MS_TP = 165 + LINKTYPE_PPP_PPPD = 166 + LINKTYPE_GPRS_LLC = 169 + LINKTYPE_GPF_T = 170 + LINKTYPE_GPF_F = 171 + LINKTYPE_LINUX_LAPD = 177 + LINKTYPE_MFR = 182 + LINKTYPE_BLUETOOTH_HCI_H4 = 187 + LINKTYPE_USB_LINUX = 189 + LINKTYPE_PPI = 192 + LINKTYPE_IEEE802_15_4_WITHFCS = 195 + LINKTYPE_SITA = 196 + LINKTYPE_ERF = 197 + LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR = 201 + LINKTYPE_AX25_KISS = 202 + LINKTYPE_LAPD = 203 + LINKTYPE_PPP_WITH_DIR = 204 + LINKTYPE_C_HDLC_WITH_DIR = 205 + LINKTYPE_FRELAY_WITH_DIR = 206 + LINKTYPE_LAPB_WITH_DIR = 207 + LINKTYPE_IPMB_LINUX = 209 + LINKTYPE_FLEXRAY = 210 + LINKTYPE_LIN = 212 + LINKTYPE_IEEE802_15_4_NONASK_PHY = 215 + LINKTYPE_USB_LINUX_MMAPPED = 220 + LINKTYPE_FC_2 = 224 + LINKTYPE_FC_2_WITH_FRAME_DELIMS = 225 + LINKTYPE_IPNET = 226 + LINKTYPE_CAN_SOCKETCAN = 227 + LINKTYPE_IPV4 = 228 + LINKTYPE_IPV6 = 229 + LINKTYPE_IEEE802_15_4_NOFCS = 230 + LINKTYPE_DBUS = 231 + LINKTYPE_DVB_CI = 235 + LINKTYPE_MUX27010 = 236 + LINKTYPE_STANAG_5066_D_PDU = 237 + LINKTYPE_NFLOG = 239 + LINKTYPE_NETANALYZER = 240 + LINKTYPE_NETANALYZER_TRANSPARENT = 241 + LINKTYPE_IPOIB = 242 + LINKTYPE_MPEG_2_TS = 243 + LINKTYPE_NG40 = 244 + LINKTYPE_NFC_LLCP = 245 + LINKTYPE_INFINIBAND = 247 + LINKTYPE_SCTP = 248 + LINKTYPE_USBPCAP = 249 + LINKTYPE_RTAC_SERIAL = 250 + LINKTYPE_BLUETOOTH_LE_LL = 251 + LINKTYPE_NETLINK = 253 + LINKTYPE_BLUETOOTH_LINUX_MONITOR = 254 + LINKTYPE_BLUETOOTH_BREDR_BB = 255 + LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR = 256 + LINKTYPE_PROFIBUS_DL = 257 + LINKTYPE_PKTAP = 258 + LINKTYPE_EPON = 259 + LINKTYPE_IPMI_HPM_2 = 260 + LINKTYPE_ZWAVE_R1_R2 = 261 + LINKTYPE_ZWAVE_R3 = 262 + LINKTYPE_WATTSTOPPER_DLM = 263 + LINKTYPE_ISO_14443 = 264 + LINKTYPE_RDS = 265 + LINKTYPE_USB_DARWIN = 266 + LINKTYPE_SDLC = 268 + LINKTYPE_LORATAP = 270 + LINKTYPE_VSOCK = 271 + LINKTYPE_NORDIC_BLE = 272 + LINKTYPE_DOCSIS31_XRA31 = 273 + LINKTYPE_ETHERNET_MPACKET = 274 + LINKTYPE_DISPLAYPORT_AUX = 275 + LINKTYPE_LINUX_SLL2 = 276 + LINKTYPE_OPENVIZSLA = 278 + LINKTYPE_EBHSCR = 279 + LINKTYPE_VPP_DISPATCH = 280 + LINKTYPE_DSA_TAG_BRCM = 281 + LINKTYPE_DSA_TAG_BRCM_PREPEND = 282 + LINKTYPE_IEEE802_15_4_TAP = 283 + LINKTYPE_DSA_TAG_DSA = 284 + LINKTYPE_DSA_TAG_EDSA = 285 + LINKTYPE_ELEE = 286 + LINKTYPE_Z_WAVE_SERIAL = 287 + LINKTYPE_USB_2_0 = 288 + LINKTYPE_ATSC_ALP = 289 + LINKTYPE_ETW = 290 +) + +// from https://www.tcpdump.org/linktypes.html +// TODO cleanup +var linkTypeMap = decode.UToScalar{ + LINKTYPE_NULL: {Sym: "null", Description: `BSD loopback encapsulation`}, + LINKTYPE_ETHERNET: {Sym: "ethernet", Description: `IEEE 802.3 Ethernet`}, + LINKTYPE_AX25: {Sym: "ax25", Description: `AX.25 packet, with nothing preceding it.`}, + LINKTYPE_IEEE802_5: {Sym: "ieee802_5", Description: `IEEE 802.5 Token Ring`}, + LINKTYPE_ARCNET_BSD: {Sym: "arcnet_bsd", Description: `ARCNET Data Packets`}, + LINKTYPE_SLIP: {Sym: "slip", Description: `SLIP, encapsulated with a LINKTYPE_SLIP header.`}, + LINKTYPE_PPP: {Sym: "ppp", Description: `PPP`}, + LINKTYPE_FDDI: {Sym: "fddi", Description: `FDDI`}, + LINKTYPE_PPP_HDLC: {Sym: "ppp_hdlc", Description: `PPP in HDLC-like framing`}, + LINKTYPE_PPP_ETHER: {Sym: "ppp_ether", Description: `PPPoE`}, + LINKTYPE_ATM_RFC1483: {Sym: "atm_rfc1483", Description: `RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an ISO 8802-2 (formerly known as IEEE 802.2) LLC header.`}, + LINKTYPE_RAW: {Sym: "raw", Description: `Raw IP; the packet begins with an IPv4 or IPv6 header, with the "version" field of the header indicating whether it's an IPv4 or IPv6 header.`}, + LINKTYPE_C_HDLC: {Sym: "c_hdlc", Description: `Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.`}, + LINKTYPE_IEEE802_11: {Sym: "ieee802_11", Description: `IEEE 802.11 wireless LAN.`}, + LINKTYPE_FRELAY: {Sym: "frelay", Description: `Frame Relay LAPF frames, beginning with a ITU-T Recommendation Q.922 LAPF header starting with the address field, and without an FCS at the end of the frame.`}, + LINKTYPE_LOOP: {Sym: "loop", Description: `OpenBSD loopback encapsulation; the link-layer header is a 4-byte field, in network byte order, containing a value of 2 for IPv4 packets, a value of either 24, 28, or 30 for IPv6 packets, a value of 7 for OSI packets, or a value of 23 for IPX packets. All of the IPv6 values correspond to IPv6 packets; code reading files should check for all of them.`}, + LINKTYPE_LINUX_SLL: {Sym: "linux_sll", Description: `Linux "cooked" capture encapsulation.`}, + LINKTYPE_LTALK: {Sym: "ltalk", Description: `Apple LocalTalk; the packet begins with an AppleTalk LocalTalk Link Access Protocol header, as described in chapter 1 of Inside AppleTalk, Second Edition.`}, + LINKTYPE_PFLOG: {Sym: "pflog", Description: `OpenBSD pflog; the link-layer header contains a "struct pfloghdr" structure, as defined by the host on which the file was saved. (This differs from operating system to operating system and release to release; there is nothing in the file to indicate what the layout of that structure is.)`}, + LINKTYPE_IEEE802_11_PRISM: {Sym: "ieee802_11_prism", Description: `Prism monitor mode information followed by an 802.11 header.`}, + LINKTYPE_IP_OVER_FC: {Sym: "ip_over_fc", Description: `RFC 2625 IP-over-Fibre Channel, with the link-layer header being the Network_Header as described in that RFC.`}, + LINKTYPE_SUNATM: {Sym: "sunatm", Description: `ATM traffic, encapsulated as per the scheme used by SunATM devices.`}, + LINKTYPE_IEEE802_11_RADIOTAP: {Sym: "ieee802_11_radiotap", Description: `Radiotap link-layer information followed by an 802.11 header.`}, + LINKTYPE_ARCNET_LINUX: {Sym: "arcnet_linux", Description: `ARCNET Data Packets, as described by the ARCNET Trade Association standard ATA 878.1-1999, but without the Starting Delimiter, Information Length, or Frame Check Sequence fields, with only the first ISU of the Destination Identifier, and with an extra two-ISU "offset" field following the Destination Identifier. For most packet types, ARCNET Trade Association draft standard ATA 878.2 is also used; however, no exception frames are supplied, and reassembled frames, rather than fragments, are supplied. See also RFC 1051 and RFC 1201; for RFC 1051 frames, ATA 878.2 is not used.`}, + LINKTYPE_APPLE_IP_OVER_IEEE1394: {Sym: "apple_ip_over_ieee1394", Description: `Apple IP-over-IEEE 1394 cooked header.`}, + LINKTYPE_MTP2_WITH_PHDR: {Sym: "mtp2_with_phdr", Description: `Signaling System 7 Message Transfer Part Level 2, as specified by ITU-T Recommendation Q.703, preceded by a pseudo-header.`}, + LINKTYPE_MTP2: {Sym: "mtp2", Description: `Signaling System 7 Message Transfer Part Level 2, as specified by ITU-T Recommendation Q.703.`}, + LINKTYPE_MTP3: {Sym: "mtp3", Description: `Signaling System 7 Message Transfer Part Level 3, as specified by ITU-T Recommendation Q.704, with no MTP2 header preceding the MTP3 packet.`}, + LINKTYPE_SCCP: {Sym: "sccp", Description: `Signaling System 7 Signalling Connection Control Part, as specified by ITU-T Recommendation Q.711, ITU-T Recommendation Q.712, ITU-T Recommendation Q.713, and ITU-T Recommendation Q.714, with no MTP3 or MTP2 headers preceding the SCCP packet.`}, + LINKTYPE_DOCSIS: {Sym: "docsis", Description: `DOCSIS MAC frames, as described by the DOCSIS 3.1 MAC and Upper Layer Protocols Interface Specification or earlier specifications for MAC frames.`}, + LINKTYPE_LINUX_IRDA: {Sym: "linux_irda", Description: `Linux-IrDA packets, with a LINKTYPE_LINUX_IRDA header, with the payload for IrDA frames beginning with by the IrLAP header as defined by IrDA Data Specifications, including the IrDA Link Access Protocol specification.`}, + LINKTYPE_USER0: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER1: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER2: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER3: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER4: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER5: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER6: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER7: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER8: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER9: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER10: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER11: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER12: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER13: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER14: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_USER15: {Sym: "user0", Description: `Reserved for private use`}, + LINKTYPE_IEEE802_11_AVS: {Sym: "ieee802_11_avs", Description: `AVS monitor mode information followed by an 802.11 header.`}, + LINKTYPE_BACNET_MS_TP: {Sym: "bacnet_ms_tp", Description: `BACnet MS/TP frames, as specified by section 9.3 MS/TP Frame Format of ANSI/ASHRAE Standard 135, BACnet® - A Data Communication Protocol for Building Automation and Control Networks, including the preamble and, if present, the Data CRC.`}, + LINKTYPE_PPP_PPPD: {Sym: "ppp_pppd", Description: `PPP in HDLC-like encapsulation, like LINKTYPE_PPP_HDLC, but with the 0xff address byte replaced by a direction indication - 0x00 for incoming and 0x01 for outgoing.`}, + LINKTYPE_GPRS_LLC: {Sym: "gprs_llc", Description: `General Packet Radio Service Logical Link Control, as defined by 3GPP TS 04.64.`}, + LINKTYPE_GPF_T: {Sym: "gpf_t", Description: `Transparent-mapped generic framing procedure, as specified by ITU-T Recommendation G.7041/Y.1303.`}, + LINKTYPE_GPF_F: {Sym: "gpf_f", Description: `Frame-mapped generic framing procedure, as specified by ITU-T Recommendation G.7041/Y.1303.`}, + LINKTYPE_LINUX_LAPD: {Sym: "linux_lapd", Description: `Link Access Procedures on the D Channel (LAPD) frames, as specified by ITU-T Recommendation Q.920 and ITU-T Recommendation Q.921, captured via vISDN, with a LINKTYPE_LINUX_LAPD header, followed by the Q.921 frame, starting with the address field.`}, + LINKTYPE_MFR: {Sym: "mfr", Description: `FRF.16.1 Multi-Link Frame Relay frames, beginning with an FRF.12 Interface fragmentation format fragmentation header.`}, + LINKTYPE_BLUETOOTH_HCI_H4: {Sym: "bluetooth_hci_h4", Description: `Bluetooth HCI UART transport layer; the frame contains an HCI packet indicator byte, as specified by the UART Transport Layer portion of the most recent Bluetooth Core specification, followed by an HCI packet of the specified packet type, as specified by the Host Controller Interface Functional Specification portion of the most recent Bluetooth Core Specification.`}, + LINKTYPE_USB_LINUX: {Sym: "usb_linux", Description: `USB packets, beginning with a Linux USB header, as specified by the struct usbmon_packet in the Documentation/usb/usbmon.txt file in the Linux source tree. Only the first 48 bytes of that header are present. All fields in the header are in host byte order. When performing a live capture, the host byte order is the byte order of the machine on which the packets are captured. When reading a pcap file, the byte order is the byte order for the file, as specified by the file's magic number; when reading a pcapng file, the byte order is the byte order for the section of the pcapng file, as specified by the Section Header Block.`}, + LINKTYPE_PPI: {Sym: "ppi", Description: `Per-Packet Information information, as specified by the Per-Packet Information Header Specification, followed by a packet with the LINKTYPE_ value specified by the pph_dlt field of that header.`}, + LINKTYPE_IEEE802_15_4_WITHFCS: {Sym: "ieee802_15_4_withfcs", Description: `IEEE 802.15.4 Low-Rate Wireless Networks, with each packet having the FCS at the end of the frame.`}, + LINKTYPE_SITA: {Sym: "sita", Description: `Various link-layer types, with a pseudo-header, for SITA.`}, + LINKTYPE_ERF: {Sym: "erf", Description: `Various link-layer types, with a pseudo-header, for Endace DAG cards; encapsulates Endace ERF records.`}, + LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR: {Sym: "bluetooth_hci_h4_with_phdr", Description: `Bluetooth HCI UART transport layer; the frame contains a 4-byte direction field, in network byte order (big-endian), the low-order bit of which is set if the frame was sent from the host to the controller and clear if the frame was received by the host from the controller, followed by an HCI packet indicator byte, as specified by the UART Transport Layer portion of the most recent Bluetooth Core specification, followed by an HCI packet of the specified packet type, as specified by the Host Controller Interface Functional Specification portion of the most recent Bluetooth Core Specification.`}, + LINKTYPE_AX25_KISS: {Sym: "ax25_kiss", Description: `AX.25 packet, with a 1-byte KISS header containing a type indicator.`}, + LINKTYPE_LAPD: {Sym: "lapd", Description: `Link Access Procedures on the D Channel (LAPD) frames, as specified by ITU-T Recommendation Q.920 and ITU-T Recommendation Q.921, starting with the address field, with no pseudo-header.`}, + LINKTYPE_PPP_WITH_DIR: {Sym: "ppp_with_dir", Description: `PPP, as per RFC 1661 and RFC 1662, preceded with a one-byte pseudo-header with a zero value meaning "received by this host" and a non-zero value meaning "sent by this host"; if the first 2 bytes are 0xff and 0x03, it's PPP in HDLC-like framing, with the PPP header following those two bytes, otherwise it's PPP without framing, and the packet begins with the PPP header. The data in the frame is not octet-stuffed or bit-stuffed.`}, + LINKTYPE_C_HDLC_WITH_DIR: {Sym: "c_hdlc_with_dir", Description: `Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547, preceded with a one-byte pseudo-header with a zero value meaning "received by this host" and a non-zero value meaning "sent by this host".`}, + LINKTYPE_FRELAY_WITH_DIR: {Sym: "frelay_with_dir", Description: `Frame Relay LAPF frames, beginning with a one-byte pseudo-header with a zero value meaning "received by this host" (DCE->DTE) and a non-zero value meaning "sent by this host" (DTE->DCE), followed by an ITU-T Recommendation Q.922 LAPF header starting with the address field, and without an FCS at the end of the frame.`}, + LINKTYPE_LAPB_WITH_DIR: {Sym: "lapb_with_dir", Description: `Link Access Procedure, Balanced (LAPB), as specified by ITU-T Recommendation X.25, preceded with a one-byte pseudo-header with a zero value meaning "received by this host" (DCE->DTE) and a non-zero value meaning "sent by this host" (DTE->DCE).`}, + LINKTYPE_IPMB_LINUX: {Sym: "ipmb_linux", Description: `IPMB over an I2C circuit, with a Linux-specific pseudo-header.`}, + LINKTYPE_FLEXRAY: {Sym: "flexray", Description: `FlexRay automotive bus frames or symbols, preceded by a pseudo-header.`}, + LINKTYPE_LIN: {Sym: "lin", Description: `Local Interconnect Network (LIN) automotive bus, preceded by a pseudo-header.`}, + LINKTYPE_IEEE802_15_4_NONASK_PHY: {Sym: "ieee802_15_4_nonask_phy", Description: `IEEE 802.15.4 Low-Rate Wireless Networks, with each packet having the FCS at the end of the frame, and with the PHY-level data for the O-QPSK, BPSK, GFSK, MSK, and RCC DSS BPSK PHYs (4 octets of 0 as preamble, one octet of SFD, one octet of frame length + reserved bit) preceding the MAC-layer data (starting with the frame control field).`}, + LINKTYPE_USB_LINUX_MMAPPED: {Sym: "usb_linux_mmapped", Description: `USB packets, beginning with a Linux USB header, as specified by the struct usbmon_packet in the Documentation/usb/usbmon.txt file in the Linux source tree. All 64 bytes of the header are present. All fields in the header are in host byte order. When performing a live capture, the host byte order is the byte order of the machine on which the packets are captured. When reading a pcap file, the byte order is the byte order for the file, as specified by the file's magic number; when reading a pcapng file, the byte order is the byte order for the section of the pcapng file, as specified by the Section Header Block. For isochronous transfers, the ndesc field specifies the number of isochronous descriptors that follow.`}, + LINKTYPE_FC_2: {Sym: "fc_2", Description: `Fibre Channel FC-2 frames, beginning with a Frame_Header.`}, + LINKTYPE_FC_2_WITH_FRAME_DELIMS: {Sym: "fc_2_with_frame_delims", Description: `Fibre Channel FC-2 frames, beginning an encoding of the SOF, followed by a Frame_Header, and ending with an encoding of the SOF.`}, + LINKTYPE_IPNET: {Sym: "ipnet", Description: `Solaris ipnet pseudo-header, followed by an IPv4 or IPv6 datagram.`}, + LINKTYPE_CAN_SOCKETCAN: {Sym: "can_socketcan", Description: `CAN (Controller Area Network) frames, with a pseudo-header followed by the frame payload.`}, + LINKTYPE_IPV4: {Sym: "ipv4", Description: `Raw IPv4; the packet begins with an IPv4 header.`}, + LINKTYPE_IPV6: {Sym: "ipv6", Description: `Raw IPv6; the packet begins with an IPv6 header.`}, + LINKTYPE_IEEE802_15_4_NOFCS: {Sym: "ieee802_15_4_nofcs", Description: `IEEE 802.15.4 Low-Rate Wireless Network, without the FCS at the end of the frame.`}, + LINKTYPE_DBUS: {Sym: "dbus", Description: `Raw D-Bus messages, starting with the endianness flag, followed by the message type, etc., but without the authentication handshake before the message sequence.`}, + LINKTYPE_DVB_CI: {Sym: "dvb_ci", Description: `DVB-CI (DVB Common Interface for communication between a PC Card module and a DVB receiver), with the message format specified by the PCAP format for DVB-CI specification.`}, + LINKTYPE_MUX27010: {Sym: "mux27010", Description: `Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but not the same as, 27.010).`}, + LINKTYPE_STANAG_5066_D_PDU: {Sym: "stanag_5066_d_pdu", Description: `D_PDUs as described by NATO standard STANAG 5066, starting with the synchronization sequence, and including both header and data CRCs. The current version of STANAG 5066 is backwards-compatible with the 1.0.2 version, although newer versions are classified.`}, + LINKTYPE_NFLOG: {Sym: "nflog", Description: `Linux netlink NETLINK NFLOG socket log messages.`}, + LINKTYPE_NETANALYZER: {Sym: "netanalyzer", Description: `Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an Ethernet frame, beginning with the MAC header and ending with the FCS.`}, + LINKTYPE_NETANALYZER_TRANSPARENT: {Sym: "netanalyzer_transparent", Description: `Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an Ethernet frame, beginning with the preamble, SFD, and MAC header, and ending with the FCS.`}, + LINKTYPE_IPOIB: {Sym: "ipoib", Description: `IP-over-InfiniBand, as specified by RFC 4391 section 6.`}, + LINKTYPE_MPEG_2_TS: {Sym: "mpeg_2_ts", Description: `MPEG-2 Transport Stream transport packets, as specified by ISO 13818-1/ITU-T Recommendation H.222.0 (see table 2-2 of section 2.4.3.2 "Transport Stream packet layer").`}, + LINKTYPE_NG40: {Sym: "ng40", Description: `Pseudo-header for ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as used by their ng40 protocol tester, followed by frames for the Frame Protocol as specified by 3GPP TS 25.427 for dedicated channels and 3GPP TS 25.435 for common/shared channels in the case of ATM AAL2 or UDP traffic, by SSCOP packets as specified by ITU-T Recommendation Q.2110 for ATM AAL5 traffic, and by NBAP packets for SCTP traffic.`}, + LINKTYPE_NFC_LLCP: {Sym: "nfc_llcp", Description: `Pseudo-header for NFC LLCP packet captures, followed by frame data for the LLCP Protocol as specified by NFCForum-TS-LLCP_1.1.`}, + LINKTYPE_INFINIBAND: {Sym: "infiniband", Description: `Raw InfiniBand frames, starting with the Local Routing Header, as specified in Chapter 5 "Data packet format" of InfiniBand™ Architectural Specification Release 1.2.1 Volume 1 - General Specifications.`}, + LINKTYPE_SCTP: {Sym: "sctp", Description: `SCTP packets, as defined by RFC 4960, with no lower-level protocols such as IPv4 or IPv6.`}, + LINKTYPE_USBPCAP: {Sym: "usbpcap", Description: `USB packets, beginning with a USBPcap header.`}, + LINKTYPE_RTAC_SERIAL: {Sym: "rtac_serial", Description: `Serial-line packet header for the Schweitzer Engineering Laboratories "RTAC" product, followed by a payload for one of a number of industrial control protocols.`}, + LINKTYPE_BLUETOOTH_LE_LL: {Sym: "bluetooth_le_ll", Description: `Bluetooth Low Energy air interface Link Layer packets, in the format described in section 2.1 "PACKET FORMAT" of volume 6 of the Bluetooth Specification Version 4.0 (see PDF page 2200), but without the Preamble.`}, + LINKTYPE_NETLINK: {Sym: "netlink", Description: `Linux Netlink capture encapsulation.`}, + LINKTYPE_BLUETOOTH_LINUX_MONITOR: {Sym: "bluetooth_linux_monitor", Description: `Bluetooth Linux Monitor encapsulation of traffic for the BlueZ stack.`}, + LINKTYPE_BLUETOOTH_BREDR_BB: {Sym: "bluetooth_bredr_bb", Description: `Bluetooth Basic Rate and Enhanced Data Rate baseband packets.`}, + LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR: {Sym: "bluetooth_le_ll_with_phdr", Description: `Bluetooth Low Energy link-layer packets.`}, + LINKTYPE_PROFIBUS_DL: {Sym: "profibus_dl", Description: `PROFIBUS data link layer packets, as specified by IEC standard 61158-4-3, beginning with the start delimiter, ending with the end delimiter, and including all octets between them.`}, + LINKTYPE_PKTAP: {Sym: "pktap", Description: `Apple PKTAP capture encapsulation.`}, + LINKTYPE_EPON: {Sym: "epon", Description: `Ethernet-over-passive-optical-network packets, starting with the last 6 octets of the modified preamble as specified by 65.1.3.2 "Transmit" in Clause 65 of Section 5 of IEEE 802.3, followed immediately by an Ethernet frame.`}, + LINKTYPE_IPMI_HPM_2: {Sym: "ipmi_hpm_2", Description: `IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" in the PICMG HPM.2 specification. The time stamps for packets in this format must match the time stamps in the Trace Data Blocks.`}, + LINKTYPE_ZWAVE_R1_R2: {Sym: "zwave_r1_r2", Description: `Z-Wave RF profile R1 and R2 packets, as specified by ITU-T Recommendation G.9959, with some MAC layer fields moved.`}, + LINKTYPE_ZWAVE_R3: {Sym: "zwave_r3", Description: `Z-Wave RF profile R3 packets, as specified by ITU-T Recommendation G.9959, with some MAC layer fields moved.`}, + LINKTYPE_WATTSTOPPER_DLM: {Sym: "wattstopper_dlm", Description: `Formats for WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol common packet structure captures.`}, + LINKTYPE_ISO_14443: {Sym: "iso_14443", Description: `Messages between ISO 14443 contactless smartcards (Proximity Integrated Circuit Card, PICC) and card readers (Proximity Coupling Device, PCD), with the message format specified by the PCAP format for ISO14443 specification.`}, + LINKTYPE_RDS: {Sym: "rds", Description: `Radio data system (RDS) groups, as per IEC 62106, encapsulated in this form.`}, + LINKTYPE_USB_DARWIN: {Sym: "usb_darwin", Description: `USB packets, beginning with a Darwin (macOS, etc.) USB header.`}, + LINKTYPE_SDLC: {Sym: "sdlc", Description: `SDLC packets, as specified by Chapter 1, "DLC Links", section "Synchronous Data Link Control (SDLC)" of Systems Network Architecture Formats, GA27-3136-20, without the flag fields, zero-bit insertion, or Frame Check Sequence field, containing SNA path information units (PIUs) as the payload.`}, + LINKTYPE_LORATAP: {Sym: "loratap", Description: `LoRaTap pseudo-header, followed by the payload, which is typically the PHYPayload from the LoRaWan specification.`}, + LINKTYPE_VSOCK: {Sym: "vsock", Description: `Protocol for communication between host and guest machines in VMware and KVM hypervisors.`}, + LINKTYPE_NORDIC_BLE: {Sym: "nordic_ble", Description: `Messages to and from a Nordic Semiconductor nRF Sniffer for Bluetooth LE packets, beginning with a pseudo-header.`}, + LINKTYPE_DOCSIS31_XRA31: {Sym: "docsis31_xra31", Description: `DOCSIS packets and bursts, preceded by a pseudo-header giving metadata about the packet.`}, + LINKTYPE_ETHERNET_MPACKET: {Sym: "ethernet_mpacket", Description: `mPackets, as specified by IEEE 802.3br Figure 99-4, starting with the preamble and always ending with a CRC field.`}, + LINKTYPE_DISPLAYPORT_AUX: {Sym: "displayport_aux", Description: `DisplayPort AUX channel monitoring data as specified by VESA DisplayPort(DP) Standard preceded by a pseudo-header.`}, + LINKTYPE_LINUX_SLL2: {Sym: "linux_sll2", Description: `Linux "cooked" capture encapsulation v2.`}, + LINKTYPE_OPENVIZSLA: {Sym: "openvizsla", Description: `Openvizsla FPGA-based USB sniffer.`}, + LINKTYPE_EBHSCR: {Sym: "ebhscr", Description: `Elektrobit High Speed Capture and Replay (EBHSCR) format.`}, + LINKTYPE_VPP_DISPATCH: {Sym: "vpp_dispatch", Description: `Records in traces from the http://fd.io VPP graph dispatch tracer, in the the graph dispatcher trace format.`}, + LINKTYPE_DSA_TAG_BRCM: {Sym: "dsa_tag_brcm", Description: `Ethernet frames, with a switch tag inserted between the source address field and the type/length field in the Ethernet header.`}, + LINKTYPE_DSA_TAG_BRCM_PREPEND: {Sym: "dsa_tag_brcm_prepend", Description: `Ethernet frames, with a switch tag inserted before the destination address in the Ethernet header.`}, + LINKTYPE_IEEE802_15_4_TAP: {Sym: "ieee802_15_4_tap", Description: `IEEE 802.15.4 Low-Rate Wireless Networks, with a pseudo-header containing TLVs with metadata preceding the 802.15.4 header.`}, + LINKTYPE_DSA_TAG_DSA: {Sym: "dsa_tag_dsa", Description: `Ethernet frames, with a switch tag inserted between the source address field and the type/length field in the Ethernet header.`}, + LINKTYPE_DSA_TAG_EDSA: {Sym: "dsa_tag_edsa", Description: `Ethernet frames, with a programmable Ethernet type switch tag inserted between the source address field and the type/length field in the Ethernet header.`}, + LINKTYPE_ELEE: {Sym: "elee", Description: `Payload of lawful intercept packets using the ELEE protocol. The packet begins with the ELEE header; it does not include any transport-layer or lower-layer headers for protcols used to transport ELEE packets.`}, + LINKTYPE_Z_WAVE_SERIAL: {Sym: "z_wave_serial", Description: `Serial frames transmitted between a host and a Z-Wave chip over an RS-232 or USB serial connection, as described in section 5 of the Z-Wave Serial API Host Application Programming Guide.`}, + LINKTYPE_USB_2_0: {Sym: "usb_2_0", Description: `USB 2.0, 1.1, or 1.0 packet, beginning with a PID, as described by Chapter 8 "Protocol Layer" of the the Universal Serial Bus Specification Revision 2.0.`}, + LINKTYPE_ATSC_ALP: {Sym: "atsc_alp", Description: `ATSC Link-Layer Protocol frames, as described in section 5 of the A/330 Link-Layer Protocol specification, found at the ATSC 3.0 standards page, beginning with a Base Header.`}, + LINKTYPE_ETW: {Sym: "etw", Description: `Event Tracing for Windows messages, beginning with a pseudo-header.`}, +} + +var linkToFormat = map[int]*decode.Group{ + LINKTYPE_ETHERNET: &pcapngEther8023Format, +} diff --git a/format/pcap/testdata/dhcp_big_endian.fqtest b/format/pcap/testdata/dhcp_big_endian.fqtest new file mode 100644 index 00000000..e220a025 --- /dev/null +++ b/format/pcap/testdata/dhcp_big_endian.fqtest @@ -0,0 +1,202 @@ +# from https://wiki.wireshark.org/Development/PcapNg +$ fq -d pcapng verbose /dhcp_big_endian.pcapng + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: [1] /dhcp_big_endian.pcapng (pcapng) 0x0-0x5fb.7 (1532) + | | | [0]: section {} 0x0-0x5fb.7 (1532) + | | | blocks: [7] 0x0-0x5fb.7 (1532) + | | | [0]: block {} 0x0-0x1b.7 (28) +0x000|0a 0d 0d 0a |.... | type: "section_header" (0xa0d0d0a) (Section Header Block) 0x0-0x3.7 (4) +0x000| 00 00 00 1c | .... | length: 28 0x4-0x7.7 (4) +0x000| 1a 2b 3c 4d | .+g{vV33j0w((_PWMKFY1t2jX28u9XagTvN?#g&1fL6CvrzzPONAm(ClW^iFNQ8H#i z3tNyJNDbJkVHvhej4YtEWd#gab`EPG$>V1XB>4o)SU?^}4rFj3pc3HlMoH7+5}gU4 z^bEpS(zH1^O?QDzL8R&Vd!cDs4%KuhZ&-#qGg6ucr7}oxBd2W4G%YS0`~gpzcEgsY c@85=|X?WOzY=ejMunb#PT&Wq7)(NI*0Q$g$QUCw| literal 0 HcmV?d00001 diff --git a/format/pcap/testdata/dhcp_little_endian.fqtest b/format/pcap/testdata/dhcp_little_endian.fqtest new file mode 100644 index 00000000..e2d9c3f4 --- /dev/null +++ b/format/pcap/testdata/dhcp_little_endian.fqtest @@ -0,0 +1,202 @@ +# from https://wiki.wireshark.org/Development/PcapNg +$ fq -d pcapng verbose /dhcp_little_endian.pcapng + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: [1] /dhcp_little_endian.pcapng (pcapng) 0x0-0x5fb.7 (1532) + | | | [0]: section {} 0x0-0x5fb.7 (1532) + | | | blocks: [7] 0x0-0x5fb.7 (1532) + | | | [0]: block {} 0x0-0x1b.7 (28) +0x000|0a 0d 0d 0a |.... | type: "section_header" (0xa0d0d0a) (Section Header Block) 0x0-0x3.7 (4) +0x000| 1c 00 00 00 | .... | length: 28 0x4-0x7.7 (4) +0x000| 4d 3c 2b 1a | M<+. | byte_order_magic: "little_endian" (0x4d3c2b1a) 0x8-0xb.7 (4) +0x000| 01 00 | .. | major_version: 1 0xc-0xd.7 (2) +0x000| 00 00| ..| minor_version: 0 0xe-0xf.7 (2) +0x010|ff ff ff ff ff ff ff ff |........ | section_length: -1 0x10-0x17.7 (8) + | | | options: [0] 0x18-NA (0) +0x010| 1c 00 00 00 | .... | footer_total_length: 28 0x18-0x1b.7 (4) + | | | [1]: block {} 0x1c-0x2f.7 (20) +0x010| 01 00 00 00| ....| type: "interface_description" (0x1) (Interface Description Block) 0x1c-0x1f.7 (4) +0x020|14 00 00 00 |.... | length: 20 0x20-0x23.7 (4) +0x020| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x24-0x25.7 (2) +0x020| 00 00 | .. | reserved: 0 0x26-0x27.7 (2) +0x020| 00 00 04 00 | .... | snap_len: 262144 0x28-0x2b.7 (4) + | | | options: [0] 0x2c-NA (0) +0x020| 14 00 00 00| ....| footer_length: 20 0x2c-0x2f.7 (4) + | | | [2]: block {} 0x30-0x53.7 (36) +0x030|04 00 00 00 |.... | type: "name_resolution" (0x4) (Name Resolution Block) 0x30-0x33.7 (4) +0x030| 24 00 00 00 | $... | length: 36 0x34-0x37.7 (4) + | | | records: [2] 0x38-0x4f.7 (24) + | | | [0]: record {} 0x38-0x4b.7 (20) +0x030| 01 00 | .. | type: "ipv4" (1) 0x38-0x39.7 (2) +0x030| 0e 00 | .. | length: 14 0x3a-0x3b.7 (2) +0x030| 7f 00 00 01| ....| address: "127.0.0.1" (0x7f000001) 0x3c-0x3f.7 (4) + | | | entries: [1] 0x40-0x49.7 (10) +0x040|6c 6f 63 61 6c 68 6f 73 74 00 |localhost. | [0]: string "localhost" 0x40-0x49.7 (10) +0x040| 00 00 | .. | padding: raw bits 0x4a-0x4b.7 (2) + | | | [1]: record {} 0x4c-0x4f.7 (4) +0x040| 00 00 | .. | type: "end" (0) 0x4c-0x4d.7 (2) +0x040| 00 00| ..| length: 0 0x4e-0x4f.7 (2) + | | | options: [0] 0x50-NA (0) +0x050|24 00 00 00 |$... | footer_length: 36 0x50-0x53.7 (4) + | | | [3]: block {} 0x54-0x1af.7 (348) +0x050| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x54-0x57.7 (4) +0x050| 5c 01 00 00 | \... | length: 348 0x58-0x5b.7 (4) +0x050| 00 00 00 00| ....| interface_id: 0 0x5c-0x5f.7 (4) +0x060|88 5e b3 41 |.^.A | timestamp_high: 1102274184 0x60-0x63.7 (4) +0x060| c8 f2 eb 12 | .... | timestamp_low: 317453000 0x64-0x67.7 (4) +0x060| 3a 01 00 00 | :... | capture_packet_length: 314 0x68-0x6b.7 (4) +0x060| 3a 01 00 00| :...| original_packet_length: 314 0x6c-0x6f.7 (4) + | | | packet: {} (ether8023) 0x70-0x1a9.7 (314) +0x070|ff ff ff ff ff ff |...... | destination: "ff:ff:ff:ff:ff:ff" (0xffffffffffff) 0x70-0x75.7 (6) +0x070| 00 0b 82 01 fc 42 | .....B | source: "00:0b:82:01:fc:42" (0xb8201fc42) 0x76-0x7b.7 (6) +0x070| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x7c-0x7d.7 (2) + | | | packet: {} (ipv4) 0x7e-0x1a9.7 (300) +0x070| 45 | E | version: 4 0x7e-0x7e.3 (0.4) +0x070| 45 | E | ihl: 5 0x7e.4-0x7e.7 (0.4) +0x070| 00| .| dscp: 0 0x7f-0x7f.5 (0.6) +0x070| 00| .| ecn: 0 0x7f.6-0x7f.7 (0.2) +0x080|01 2c |., | total_length: 300 0x80-0x81.7 (2) +0x080| a8 36 | .6 | identification: 43062 0x82-0x83.7 (2) +0x080| 00 | . | reserved: 0 0x84-0x84 (0.1) +0x080| 00 | . | dont_fragment: false 0x84.1-0x84.1 (0.1) +0x080| 00 | . | more_fragments: false 0x84.2-0x84.2 (0.1) +0x080| 00 00 | .. | fragment_offset: 0 0x84.3-0x85.7 (1.5) +0x080| fa | . | ttl: 250 0x86-0x86.7 (1) +0x080| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x87-0x87.7 (1) +0x080| 17 8b | .. | header_checksum: 0x178b 0x88-0x89.7 (2) +0x080| 00 00 00 00 | .... | source_ip: "0.0.0.0" (0x0) 0x8a-0x8d.7 (4) +0x080| ff ff| ..| destination_ip: "255.255.255.255" (0xffffffff) 0x8e-0x91.7 (4) +0x090|ff ff |.. | + | | | data: {} (udp) 0x92-0x1a9.7 (280) +0x090| 00 44 | .D | source_port: "bootpc" (68) (Bootstrap Protocol Client) 0x92-0x93.7 (2) +0x090| 00 43 | .C | destination_port: "bootps" (67) (Bootstrap Protocol Server) 0x94-0x95.7 (2) +0x090| 01 18 | .. | length: 280 0x96-0x97.7 (2) +0x090| 59 1f | Y. | checksum: 0x591f 0x98-0x99.7 (2) +0x090| 01 01 06 00 00 00| ......| data: raw bits 0x9a-0x1a9.7 (272) +0x0a0|3d 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00|=...............| +* |until 0x1a9.7 (272) | | + | | | capture_padding: raw bits 0x1aa-NA (0) +0x1a0| 00 00 | .. | padding: raw bits 0x1aa-0x1ab.7 (2) + | | | options: [0] 0x1ac-NA (0) +0x1a0| 5c 01 00 00| \...| footer_length: 348 0x1ac-0x1af.7 (4) + | | | [4]: block {} 0x1b0-0x327.7 (376) +0x1b0|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1b0-0x1b3.7 (4) +0x1b0| 78 01 00 00 | x... | length: 376 0x1b4-0x1b7.7 (4) +0x1b0| 00 00 00 00 | .... | interface_id: 0 0x1b8-0x1bb.7 (4) +0x1b0| 88 5e b3 41| .^.A| timestamp_high: 1102274184 0x1bc-0x1bf.7 (4) +0x1c0|20 73 f0 12 | s.. | timestamp_low: 317748000 0x1c0-0x1c3.7 (4) +0x1c0| 56 01 00 00 | V... | capture_packet_length: 342 0x1c4-0x1c7.7 (4) +0x1c0| 56 01 00 00 | V... | original_packet_length: 342 0x1c8-0x1cb.7 (4) + | | | packet: {} (ether8023) 0x1cc-0x321.7 (342) +0x1c0| 00 0b 82 01| ....| destination: "00:0b:82:01:fc:42" (0xb8201fc42) 0x1cc-0x1d1.7 (6) +0x1d0|fc 42 |.B | +0x1d0| 00 08 74 ad f1 9b | ..t... | source: "00:08:74:ad:f1:9b" (0x874adf19b) 0x1d2-0x1d7.7 (6) +0x1d0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1d8-0x1d9.7 (2) + | | | packet: {} (ipv4) 0x1da-0x321.7 (328) +0x1d0| 45 | E | version: 4 0x1da-0x1da.3 (0.4) +0x1d0| 45 | E | ihl: 5 0x1da.4-0x1da.7 (0.4) +0x1d0| 00 | . | dscp: 0 0x1db-0x1db.5 (0.6) +0x1d0| 00 | . | ecn: 0 0x1db.6-0x1db.7 (0.2) +0x1d0| 01 48 | .H | total_length: 328 0x1dc-0x1dd.7 (2) +0x1d0| 04 45| .E| identification: 1093 0x1de-0x1df.7 (2) +0x1e0|00 |. | reserved: 0 0x1e0-0x1e0 (0.1) +0x1e0|00 |. | dont_fragment: false 0x1e0.1-0x1e0.1 (0.1) +0x1e0|00 |. | more_fragments: false 0x1e0.2-0x1e0.2 (0.1) +0x1e0|00 00 |.. | fragment_offset: 0 0x1e0.3-0x1e1.7 (1.5) +0x1e0| 80 | . | ttl: 128 0x1e2-0x1e2.7 (1) +0x1e0| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x1e3-0x1e3.7 (1) +0x1e0| 00 00 | .. | header_checksum: 0x0 0x1e4-0x1e5.7 (2) +0x1e0| c0 a8 00 01 | .... | source_ip: "192.168.0.1" (0xc0a80001) 0x1e6-0x1e9.7 (4) +0x1e0| c0 a8 00 0a | .... | destination_ip: "192.168.0.10" (0xc0a8000a) 0x1ea-0x1ed.7 (4) + | | | data: {} (udp) 0x1ee-0x321.7 (308) +0x1e0| 00 43| .C| source_port: "bootps" (67) (Bootstrap Protocol Server) 0x1ee-0x1ef.7 (2) +0x1f0|00 44 |.D | destination_port: "bootpc" (68) (Bootstrap Protocol Client) 0x1f0-0x1f1.7 (2) +0x1f0| 01 34 | .4 | length: 308 0x1f2-0x1f3.7 (2) +0x1f0| 22 33 | "3 | checksum: 0x2233 0x1f4-0x1f5.7 (2) +0x1f0| 02 01 06 00 00 00 3d 1d 00 00| ......=...| data: raw bits 0x1f6-0x321.7 (300) +0x200|00 00 00 00 00 00 c0 a8 00 0a c0 a8 00 01 00 00|................| +* |until 0x321.7 (300) | | + | | | capture_padding: raw bits 0x322-NA (0) +0x320| 00 00 | .. | padding: raw bits 0x322-0x323.7 (2) + | | | options: [0] 0x324-NA (0) +0x320| 78 01 00 00 | x... | footer_length: 376 0x324-0x327.7 (4) + | | | [5]: block {} 0x328-0x483.7 (348) +0x320| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x328-0x32b.7 (4) +0x320| 5c 01 00 00| \...| length: 348 0x32c-0x32f.7 (4) +0x330|00 00 00 00 |.... | interface_id: 0 0x330-0x333.7 (4) +0x330| 88 5e b3 41 | .^.A | timestamp_high: 1102274184 0x334-0x337.7 (4) +0x330| 60 89 18 17 | `... | timestamp_low: 387484000 0x338-0x33b.7 (4) +0x330| 3a 01 00 00| :...| capture_packet_length: 314 0x33c-0x33f.7 (4) +0x340|3a 01 00 00 |:... | original_packet_length: 314 0x340-0x343.7 (4) + | | | packet: {} (ether8023) 0x344-0x47d.7 (314) +0x340| ff ff ff ff ff ff | ...... | destination: "ff:ff:ff:ff:ff:ff" (0xffffffffffff) 0x344-0x349.7 (6) +0x340| 00 0b 82 01 fc 42| .....B| source: "00:0b:82:01:fc:42" (0xb8201fc42) 0x34a-0x34f.7 (6) +0x350|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x350-0x351.7 (2) + | | | packet: {} (ipv4) 0x352-0x47d.7 (300) +0x350| 45 | E | version: 4 0x352-0x352.3 (0.4) +0x350| 45 | E | ihl: 5 0x352.4-0x352.7 (0.4) +0x350| 00 | . | dscp: 0 0x353-0x353.5 (0.6) +0x350| 00 | . | ecn: 0 0x353.6-0x353.7 (0.2) +0x350| 01 2c | ., | total_length: 300 0x354-0x355.7 (2) +0x350| a8 37 | .7 | identification: 43063 0x356-0x357.7 (2) +0x350| 00 | . | reserved: 0 0x358-0x358 (0.1) +0x350| 00 | . | dont_fragment: false 0x358.1-0x358.1 (0.1) +0x350| 00 | . | more_fragments: false 0x358.2-0x358.2 (0.1) +0x350| 00 00 | .. | fragment_offset: 0 0x358.3-0x359.7 (1.5) +0x350| fa | . | ttl: 250 0x35a-0x35a.7 (1) +0x350| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x35b-0x35b.7 (1) +0x350| 17 8a | .. | header_checksum: 0x178a 0x35c-0x35d.7 (2) +0x350| 00 00| ..| source_ip: "0.0.0.0" (0x0) 0x35e-0x361.7 (4) +0x360|00 00 |.. | +0x360| ff ff ff ff | .... | destination_ip: "255.255.255.255" (0xffffffff) 0x362-0x365.7 (4) + | | | data: {} (udp) 0x366-0x47d.7 (280) +0x360| 00 44 | .D | source_port: "bootpc" (68) (Bootstrap Protocol Client) 0x366-0x367.7 (2) +0x360| 00 43 | .C | destination_port: "bootps" (67) (Bootstrap Protocol Server) 0x368-0x369.7 (2) +0x360| 01 18 | .. | length: 280 0x36a-0x36b.7 (2) +0x360| 9f bd | .. | checksum: 0x9fbd 0x36c-0x36d.7 (2) +0x360| 01 01| ..| data: raw bits 0x36e-0x47d.7 (272) +0x370|06 00 00 00 3d 1e 00 00 00 00 00 00 00 00 00 00|....=...........| +* |until 0x47d.7 (272) | | + | | | capture_padding: raw bits 0x47e-NA (0) +0x470| 00 00| ..| padding: raw bits 0x47e-0x47f.7 (2) + | | | options: [0] 0x480-NA (0) +0x480|5c 01 00 00 |\... | footer_length: 348 0x480-0x483.7 (4) + | | | [6]: block {} 0x484-0x5fb.7 (376) +0x480| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x484-0x487.7 (4) +0x480| 78 01 00 00 | x... | length: 376 0x488-0x48b.7 (4) +0x480| 00 00 00 00| ....| interface_id: 0 0x48c-0x48f.7 (4) +0x490|88 5e b3 41 |.^.A | timestamp_high: 1102274184 0x490-0x493.7 (4) +0x490| f0 53 1d 17 | .S.. | timestamp_low: 387798000 0x494-0x497.7 (4) +0x490| 56 01 00 00 | V... | capture_packet_length: 342 0x498-0x49b.7 (4) +0x490| 56 01 00 00| V...| original_packet_length: 342 0x49c-0x49f.7 (4) + | | | packet: {} (ether8023) 0x4a0-0x5f5.7 (342) +0x4a0|00 0b 82 01 fc 42 |.....B | destination: "00:0b:82:01:fc:42" (0xb8201fc42) 0x4a0-0x4a5.7 (6) +0x4a0| 00 08 74 ad f1 9b | ..t... | source: "00:08:74:ad:f1:9b" (0x874adf19b) 0x4a6-0x4ab.7 (6) +0x4a0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x4ac-0x4ad.7 (2) + | | | packet: {} (ipv4) 0x4ae-0x5f5.7 (328) +0x4a0| 45 | E | version: 4 0x4ae-0x4ae.3 (0.4) +0x4a0| 45 | E | ihl: 5 0x4ae.4-0x4ae.7 (0.4) +0x4a0| 00| .| dscp: 0 0x4af-0x4af.5 (0.6) +0x4a0| 00| .| ecn: 0 0x4af.6-0x4af.7 (0.2) +0x4b0|01 48 |.H | total_length: 328 0x4b0-0x4b1.7 (2) +0x4b0| 04 46 | .F | identification: 1094 0x4b2-0x4b3.7 (2) +0x4b0| 00 | . | reserved: 0 0x4b4-0x4b4 (0.1) +0x4b0| 00 | . | dont_fragment: false 0x4b4.1-0x4b4.1 (0.1) +0x4b0| 00 | . | more_fragments: false 0x4b4.2-0x4b4.2 (0.1) +0x4b0| 00 00 | .. | fragment_offset: 0 0x4b4.3-0x4b5.7 (1.5) +0x4b0| 80 | . | ttl: 128 0x4b6-0x4b6.7 (1) +0x4b0| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x4b7-0x4b7.7 (1) +0x4b0| 00 00 | .. | header_checksum: 0x0 0x4b8-0x4b9.7 (2) +0x4b0| c0 a8 00 01 | .... | source_ip: "192.168.0.1" (0xc0a80001) 0x4ba-0x4bd.7 (4) +0x4b0| c0 a8| ..| destination_ip: "192.168.0.10" (0xc0a8000a) 0x4be-0x4c1.7 (4) +0x4c0|00 0a |.. | + | | | data: {} (udp) 0x4c2-0x5f5.7 (308) +0x4c0| 00 43 | .C | source_port: "bootps" (67) (Bootstrap Protocol Server) 0x4c2-0x4c3.7 (2) +0x4c0| 00 44 | .D | destination_port: "bootpc" (68) (Bootstrap Protocol Client) 0x4c4-0x4c5.7 (2) +0x4c0| 01 34 | .4 | length: 308 0x4c6-0x4c7.7 (2) +0x4c0| df db | .. | checksum: 0xdfdb 0x4c8-0x4c9.7 (2) +0x4c0| 02 01 06 00 00 00| ......| data: raw bits 0x4ca-0x5f5.7 (300) +0x4d0|3d 1e 00 00 00 00 00 00 00 00 c0 a8 00 0a 00 00|=...............| +* |until 0x5f5.7 (300) | | + | | | capture_padding: raw bits 0x5f6-NA (0) +0x5f0| 00 00 | .. | padding: raw bits 0x5f6-0x5f7.7 (2) + | | | options: [0] 0x5f8-NA (0) +0x5f0| 78 01 00 00| | x...| | footer_length: 376 0x5f8-0x5fb.7 (4) diff --git a/format/pcap/testdata/dhcp_little_endian.pcapng b/format/pcap/testdata/dhcp_little_endian.pcapng new file mode 100644 index 0000000000000000000000000000000000000000..4294ef096e5edc1f7e00ba9193ec6508282d315f GIT binary patch literal 1532 zcmd<$<>iuLU|{gI(UxKa(*L0VBnIM(KxqaB7BHIy$X5Z2@iEi`mE`0nC+1}27ncCV zKma7i2E;KS%|Or*x7qQ;r`JMOKt2dVjA!6(V*KO8!QjfksI$V1f#H{+csEEjNS48c z!I@DaQl60!WR9&YNE`!z^<#(*S%KuH;AB%qMq749NXQt0f|p$FApfCl6 zNd;2aDinVZ3Ip;%7^0Vfqh#&J+2FACU~y$&Xb@yzIIx0&5s0}MoEcmgO_Yq8(83lZ z2T}vJYFLIX6C(>KZCL>WmYu^INb>j@14%vsGZv7?5rGU3Z3F`p-sovMp;JN}PntFd zr|B+`8HhAJe=jsm%OT80Vhzi1XGTiXpi~A4ZbZt)mZm=h%ZlSk({9+(^!?k=Gz|}1 VkZthL9hPCsiYqlk(mKI34FDE+gi-(i literal 0 HcmV?d00001 diff --git a/format/pcap/testdata/ipv4frags.fqtest b/format/pcap/testdata/ipv4frags.fqtest new file mode 100644 index 00000000..2c9ca1c9 --- /dev/null +++ b/format/pcap/testdata/ipv4frags.fqtest @@ -0,0 +1,101 @@ +# from https://wiki.wireshark.org/SampleCaptures +$ fq -d pcap verbose /ipv4frags.pcap + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: {} /ipv4frags.pcap (pcap) 0x0-0xbad.7 (2990) +0x000|d4 c3 b2 a1 |.... | magic: "little_endian" (0xd4c3b2a1) (valid) 0x0-0x3.7 (4) +0x000| 02 00 | .. | version_major: 2 0x4-0x5.7 (2) +0x000| 04 00 | .. | version_minor: 4 0x6-0x7.7 (2) +0x000| 00 00 00 00 | .... | thiszone: 0 0x8-0xb.7 (4) +0x000| 00 00 00 00| ....| sigfigs: 0 0xc-0xf.7 (4) +0x010|d0 07 00 00 |.... | snaplen: 2000 0x10-0x13.7 (4) +0x010| 01 00 00 00 | .... | network: "ethernet" (1) (IEEE 802.3 Ethernet) 0x14-0x17.7 (4) + | | | packets: [3] 0x18-0xbad.7 (2966) + | | | [0]: packet {} 0x18-0x419.7 (1026) +0x010| 14 2b d2 59 | .+.Y | ts_sec: 1506945812 0x18-0x1b.7 (4) +0x010| 5c 2a 08 00| \*..| ts_usec: 535132 0x1c-0x1f.7 (4) +0x020|f2 03 00 00 |.... | incl_len: 1010 0x20-0x23.7 (4) +0x020| f2 03 00 00 | .... | orig_len: 1010 0x24-0x27.7 (4) + | | | packet: {} (ether8023) 0x28-0x419.7 (1010) +0x020| 08 00 27 e2 9f a6 | ..'... | destination: "08:00:27:e2:9f:a6" (0x80027e29fa6) 0x28-0x2d.7 (6) +0x020| 08 00| ..| source: "08:00:27:fc:6a:c9" (0x80027fc6ac9) 0x2e-0x33.7 (6) +0x030|27 fc 6a c9 |'.j. | +0x030| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x34-0x35.7 (2) + | | | packet: {} (ipv4) 0x36-0x419.7 (996) +0x030| 45 | E | version: 4 0x36-0x36.3 (0.4) +0x030| 45 | E | ihl: 5 0x36.4-0x36.7 (0.4) +0x030| 00 | . | dscp: 0 0x37-0x37.5 (0.6) +0x030| 00 | . | ecn: 0 0x37.6-0x37.7 (0.2) +0x030| 03 e4 | .. | total_length: 996 0x38-0x39.7 (2) +0x030| b5 d0 | .. | identification: 46544 0x3a-0x3b.7 (2) +0x030| 20 | | reserved: 0 0x3c-0x3c (0.1) +0x030| 20 | | dont_fragment: false 0x3c.1-0x3c.1 (0.1) +0x030| 20 | | more_fragments: true 0x3c.2-0x3c.2 (0.1) +0x030| 20 00 | . | fragment_offset: 0 0x3c.3-0x3d.7 (1.5) +0x030| 40 | @ | ttl: 64 0x3e-0x3e.7 (1) +0x030| 01| .| protocol: "icmp" (1) (internet control message protocol) 0x3f-0x3f.7 (1) +0x040|9b 44 |.D | header_checksum: 0x9b44 0x40-0x41.7 (2) +0x040| 02 01 01 02 | .... | source_ip: "2.1.1.2" (0x2010102) 0x42-0x45.7 (4) +0x040| 02 01 01 01 | .... | destination_ip: "2.1.1.1" (0x2010101) 0x46-0x49.7 (4) +0x040| 08 00 4d 71 13 c2| ..Mq..| data: raw bits 0x4a-0x419.7 (976) +0x050|00 01 14 2b d2 59 00 00 00 00 3d 2a 08 00 00 00|...+.Y....=*....| +* |until 0x419.7 (976) | | + | | | capture_padding: raw bits 0x41a-NA (0) + | | | [1]: packet {} 0x41a-0x5fb.7 (482) +0x410| 14 2b d2 59 | .+.Y | ts_sec: 1506945812 0x41a-0x41d.7 (4) +0x410| 9d 2a| .*| ts_usec: 535197 0x41e-0x421.7 (4) +0x420|08 00 |.. | +0x420| d2 01 00 00 | .... | incl_len: 466 0x422-0x425.7 (4) +0x420| d2 01 00 00 | .... | orig_len: 466 0x426-0x429.7 (4) + | | | packet: {} (ether8023) 0x42a-0x5fb.7 (466) +0x420| 08 00 27 e2 9f a6| ..'...| destination: "08:00:27:e2:9f:a6" (0x80027e29fa6) 0x42a-0x42f.7 (6) +0x430|08 00 27 fc 6a c9 |..'.j. | source: "08:00:27:fc:6a:c9" (0x80027fc6ac9) 0x430-0x435.7 (6) +0x430| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x436-0x437.7 (2) + | | | packet: {} (ipv4) 0x438-0x5fb.7 (452) +0x430| 45 | E | version: 4 0x438-0x438.3 (0.4) +0x430| 45 | E | ihl: 5 0x438.4-0x438.7 (0.4) +0x430| 00 | . | dscp: 0 0x439-0x439.5 (0.6) +0x430| 00 | . | ecn: 0 0x439.6-0x439.7 (0.2) +0x430| 01 c4 | .. | total_length: 452 0x43a-0x43b.7 (2) +0x430| b5 d0 | .. | identification: 46544 0x43c-0x43d.7 (2) +0x430| 00 | . | reserved: 0 0x43e-0x43e (0.1) +0x430| 00 | . | dont_fragment: false 0x43e.1-0x43e.1 (0.1) +0x430| 00 | . | more_fragments: false 0x43e.2-0x43e.2 (0.1) +0x430| 00 7a| .z| fragment_offset: 122 0x43e.3-0x43f.7 (1.5) +0x440|40 |@ | ttl: 64 0x440-0x440.7 (1) +0x440| 01 | . | protocol: "icmp" (1) (internet control message protocol) 0x441-0x441.7 (1) +0x440| bc ea | .. | header_checksum: 0xbcea 0x442-0x443.7 (2) +0x440| 02 01 01 02 | .... | source_ip: "2.1.1.2" (0x2010102) 0x444-0x447.7 (4) +0x440| 02 01 01 01 | .... | destination_ip: "2.1.1.1" (0x2010101) 0x448-0x44b.7 (4) +0x440| c8 c9 ca cb| ....| data: raw bits 0x44c-0x5fb.7 (432) +0x450|cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db|................| +* |until 0x5fb.7 (432) | | + | | | capture_padding: raw bits 0x5fc-NA (0) + | | | [2]: packet {} 0x5fc-0xbad.7 (1458) +0x5f0| 14 2b d2 59| .+.Y| ts_sec: 1506945812 0x5fc-0x5ff.7 (4) +0x600|59 2c 08 00 |Y,.. | ts_usec: 535641 0x600-0x603.7 (4) +0x600| a2 05 00 00 | .... | incl_len: 1442 0x604-0x607.7 (4) +0x600| a2 05 00 00 | .... | orig_len: 1442 0x608-0x60b.7 (4) + | | | packet: {} (ether8023) 0x60c-0xbad.7 (1442) +0x600| 08 00 27 fc| ..'.| destination: "08:00:27:fc:6a:c9" (0x80027fc6ac9) 0x60c-0x611.7 (6) +0x610|6a c9 |j. | +0x610| 08 00 27 e2 9f a6 | ..'... | source: "08:00:27:e2:9f:a6" (0x80027e29fa6) 0x612-0x617.7 (6) +0x610| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x618-0x619.7 (2) + | | | packet: {} (ipv4) 0x61a-0xbad.7 (1428) +0x610| 45 | E | version: 4 0x61a-0x61a.3 (0.4) +0x610| 45 | E | ihl: 5 0x61a.4-0x61a.7 (0.4) +0x610| 00 | . | dscp: 0 0x61b-0x61b.5 (0.6) +0x610| 00 | . | ecn: 0 0x61b.6-0x61b.7 (0.2) +0x610| 05 94 | .. | total_length: 1428 0x61c-0x61d.7 (2) +0x610| 83 f6| ..| identification: 33782 0x61e-0x61f.7 (2) +0x620|00 |. | reserved: 0 0x620-0x620 (0.1) +0x620|00 |. | dont_fragment: false 0x620.1-0x620.1 (0.1) +0x620|00 |. | more_fragments: false 0x620.2-0x620.2 (0.1) +0x620|00 00 |.. | fragment_offset: 0 0x620.3-0x621.7 (1.5) +0x620| 40 | @ | ttl: 64 0x622-0x622.7 (1) +0x620| 01 | . | protocol: "icmp" (1) (internet control message protocol) 0x623-0x623.7 (1) +0x620| eb 6e | .n | header_checksum: 0xeb6e 0x624-0x625.7 (2) +0x620| 02 01 01 01 | .... | source_ip: "2.1.1.1" (0x2010101) 0x626-0x629.7 (4) +0x620| 02 01 01 02 | .... | destination_ip: "2.1.1.2" (0x2010102) 0x62a-0x62d.7 (4) +0x620| 00 00| ..| data: raw bits 0x62e-0xbad.7 (1408) +0x630|55 71 13 c2 00 01 14 2b d2 59 00 00 00 00 3d 2a|Uq.....+.Y....=*| +* |until 0xbad.7 (end) (1408) | | + | | | capture_padding: raw bits 0xbae-NA (0) diff --git a/format/pcap/testdata/ipv4frags.pcap b/format/pcap/testdata/ipv4frags.pcap new file mode 100644 index 0000000000000000000000000000000000000000..5a6e4d20ac82dc86750b7b2184a6b335c39aae39 GIT binary patch literal 2990 zcmca|c+)~A1{MYwxWLZ9zzF1sXkUtq(c)nE#LNK391QA@<}U-1f3i+;Ft{=>KiPUg zfx&@swhI#@BNGraaxnN73Lj!%1nC5sW((8}0s?|U!Xlz#;u4Zl(lWAg@(PMd$||aA z>Kd9_+B&*=`UZwZ#wMm_<`$M#);6|w_709t&MvNQ?jD|A-afv5{sDnO!6Bhx;SrHh z(J`@c@d=4Z$tkI6=^2?>**Up+`2~eV#U-U>ECr+L^edg@B^A|2&x_ss8wd*%--nxC~?!EgD9zJ^flG{`&pr@4x>Hj7-cdtZeKYoLt;IynOtl{vVD1p_u+b`FJic z4_^Wn2Ox}I0x%xgdV!(JfpO0(SP3wiV}@3V0gB;B9S(*?tPEfbE8QU_y(? iz%u@I9;kc=#WDj!=x7-~TE>soaiewoXd7n$+IRrLgku8$ literal 0 HcmV?d00001 diff --git a/format/pcap/testdata/many_interfaces.fqtest b/format/pcap/testdata/many_interfaces.fqtest new file mode 100644 index 00000000..07aac997 --- /dev/null +++ b/format/pcap/testdata/many_interfaces.fqtest @@ -0,0 +1,5201 @@ +# from https://wiki.wireshark.org/Development/PcapNg +$ fq -d pcapng verbose /many_interfaces.pcapng + |00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.: [1] /many_interfaces.pcapng (pcapng) 0x0-0x51b7.7 (20920) + | | | [0]: section {} 0x0-0x51b7.7 (20920) + | | | blocks: [88] 0x0-0x51b7.7 (20920) + | | | [0]: block {} 0x0-0x8b.7 (140) +0x0000|0a 0d 0d 0a |.... | type: "section_header" (0xa0d0d0a) (Section Header Block) 0x0-0x3.7 (4) +0x0000| 8c 00 00 00 | .... | length: 140 0x4-0x7.7 (4) +0x0000| 4d 3c 2b 1a | M<+. | byte_order_magic: "little_endian" (0x4d3c2b1a) 0x8-0xb.7 (4) +0x0000| 01 00 | .. | major_version: 1 0xc-0xd.7 (2) +0x0000| 00 00| ..| minor_version: 0 0xe-0xf.7 (2) +0x0010|ff ff ff ff ff ff ff ff |........ | section_length: -1 0x10-0x17.7 (8) + | | | options: [3] 0x18-0x87.7 (112) + | | | [0]: option {} 0x18-0x4b.7 (52) +0x0010| 03 00 | .. | code: "os" (3) 0x18-0x19.7 (2) +0x0010| 2d 00 | -. | length: 45 0x1a-0x1b.7 (2) +0x0010| 4d 61 63 20| Mac | value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x1c-0x48.7 (45) +0x0020|4f 53 20 58 20 31 30 2e 31 30 2e 34 2c 20 62 75|OS X 10.10.4, bu| +* |until 0x48.7 (45) | | +0x0040| 00 00 00 | ... | padding: raw bits 0x49-0x4b.7 (3) + | | | [1]: option {} 0x4c-0x83.7 (56) +0x0040| 04 00 | .. | code: "userappl" (4) 0x4c-0x4d.7 (2) +0x0040| 34 00| 4.| length: 52 0x4e-0x4f.7 (2) +0x0050|44 75 6d 70 63 61 70 20 31 2e 31 32 2e 36 20 28|Dumpcap 1.12.6 (| value: "Dumpcap 1.12.6 (v1.12.6-0-gee1fce6 from master-1.1"... 0x50-0x83.7 (52) +* |until 0x83.7 (52) | | + | | | padding: raw bits 0x84-NA (0) + | | | [2]: option {} 0x84-0x87.7 (4) +0x0080| 00 00 | .. | code: "end" (0) (End of options) 0x84-0x85.7 (2) +0x0080| 00 00 | .. | length: 0 0x86-0x87.7 (2) +0x0080| 8c 00 00 00 | .... | footer_total_length: 140 0x88-0x8b.7 (4) + | | | [1]: block {} 0x8c-0xff.7 (116) +0x0080| 01 00 00 00| ....| type: "interface_description" (0x1) (Interface Description Block) 0x8c-0x8f.7 (4) +0x0090|74 00 00 00 |t... | length: 116 0x90-0x93.7 (4) +0x0090| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x94-0x95.7 (2) +0x0090| 00 00 | .. | reserved: 0 0x96-0x97.7 (2) +0x0090| 00 00 04 00 | .... | snap_len: 262144 0x98-0x9b.7 (4) + | | | options: [5] 0x9c-0xfb.7 (96) + | | | [0]: option {} 0x9c-0xa3.7 (8) +0x0090| 02 00 | .. | code: "name" (2) 0x9c-0x9d.7 (2) +0x0090| 03 00| ..| length: 3 0x9e-0x9f.7 (2) +0x00a0|65 6e 30 |en0 | value: "en0" 0xa0-0xa2.7 (3) +0x00a0| 00 | . | padding: raw bits 0xa3-0xa3.7 (1) + | | | [1]: option {} 0xa4-0xab.7 (8) +0x00a0| 09 00 | .. | code: "tsresol" (9) 0xa4-0xa5.7 (2) +0x00a0| 01 00 | .. | length: 1 0xa6-0xa7.7 (2) +0x00a0| 06 | . | value: "\x06" 0xa8-0xa8.7 (1) +0x00a0| 00 00 00 | ... | padding: raw bits 0xa9-0xab.7 (3) + | | | [2]: option {} 0xac-0xc3.7 (24) +0x00a0| 0b 00 | .. | code: "filter" (11) 0xac-0xad.7 (2) +0x00a0| 13 00| ..| length: 19 0xae-0xaf.7 (2) +0x00b0|00 68 6f 73 74 20 31 39 32 2e 31 36 38 2e 31 2e|.host 192.168.1.| value: "" 0xb0-0xc2.7 (19) +0x00c0|31 33 39 |139 | +0x00c0| 00 | . | padding: raw bits 0xc3-0xc3.7 (1) + | | | [3]: option {} 0xc4-0xf7.7 (52) +0x00c0| 0c 00 | .. | code: "os" (12) 0xc4-0xc5.7 (2) +0x00c0| 2d 00 | -. | length: 45 0xc6-0xc7.7 (2) +0x00c0| 4d 61 63 20 4f 53 20 58| Mac OS X| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0xc8-0xf4.7 (45) +0x00d0|20 31 30 2e 31 30 2e 34 2c 20 62 75 69 6c 64 20| 10.10.4, build | +* |until 0xf4.7 (45) | | +0x00f0| 00 00 00 | ... | padding: raw bits 0xf5-0xf7.7 (3) + | | | [4]: option {} 0xf8-0xfb.7 (4) +0x00f0| 00 00 | .. | code: "end" (0) (End of options) 0xf8-0xf9.7 (2) +0x00f0| 00 00 | .. | length: 0 0xfa-0xfb.7 (2) +0x00f0| 74 00 00 00| t...| footer_length: 116 0xfc-0xff.7 (4) + | | | [2]: block {} 0x100-0x177.7 (120) +0x0100|01 00 00 00 |.... | type: "interface_description" (0x1) (Interface Description Block) 0x100-0x103.7 (4) +0x0100| 78 00 00 00 | x... | length: 120 0x104-0x107.7 (4) +0x0100| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x108-0x109.7 (2) +0x0100| 00 00 | .. | reserved: 0 0x10a-0x10b.7 (2) +0x0100| 00 00 04 00| ....| snap_len: 262144 0x10c-0x10f.7 (4) + | | | options: [5] 0x110-0x173.7 (100) + | | | [0]: option {} 0x110-0x11b.7 (12) +0x0110|02 00 |.. | code: "name" (2) 0x110-0x111.7 (2) +0x0110| 05 00 | .. | length: 5 0x112-0x113.7 (2) +0x0110| 61 77 64 6c 30 | awdl0 | value: "awdl0" 0x114-0x118.7 (5) +0x0110| 00 00 00 | ... | padding: raw bits 0x119-0x11b.7 (3) + | | | [1]: option {} 0x11c-0x123.7 (8) +0x0110| 09 00 | .. | code: "tsresol" (9) 0x11c-0x11d.7 (2) +0x0110| 01 00| ..| length: 1 0x11e-0x11f.7 (2) +0x0120|06 |. | value: "\x06" 0x120-0x120.7 (1) +0x0120| 00 00 00 | ... | padding: raw bits 0x121-0x123.7 (3) + | | | [2]: option {} 0x124-0x13b.7 (24) +0x0120| 0b 00 | .. | code: "filter" (11) 0x124-0x125.7 (2) +0x0120| 13 00 | .. | length: 19 0x126-0x127.7 (2) +0x0120| 00 68 6f 73 74 20 31 39| .host 19| value: "" 0x128-0x13a.7 (19) +0x0130|32 2e 31 36 38 2e 31 2e 31 33 39 |2.168.1.139 | +0x0130| 00 | . | padding: raw bits 0x13b-0x13b.7 (1) + | | | [3]: option {} 0x13c-0x16f.7 (52) +0x0130| 0c 00 | .. | code: "os" (12) 0x13c-0x13d.7 (2) +0x0130| 2d 00| -.| length: 45 0x13e-0x13f.7 (2) +0x0140|4d 61 63 20 4f 53 20 58 20 31 30 2e 31 30 2e 34|Mac OS X 10.10.4| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x140-0x16c.7 (45) +* |until 0x16c.7 (45) | | +0x0160| 00 00 00| ...| padding: raw bits 0x16d-0x16f.7 (3) + | | | [4]: option {} 0x170-0x173.7 (4) +0x0170|00 00 |.. | code: "end" (0) (End of options) 0x170-0x171.7 (2) +0x0170| 00 00 | .. | length: 0 0x172-0x173.7 (2) +0x0170| 78 00 00 00 | x... | footer_length: 120 0x174-0x177.7 (4) + | | | [3]: block {} 0x178-0x1ef.7 (120) +0x0170| 01 00 00 00 | .... | type: "interface_description" (0x1) (Interface Description Block) 0x178-0x17b.7 (4) +0x0170| 78 00 00 00| x...| length: 120 0x17c-0x17f.7 (4) +0x0180|01 00 |.. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x180-0x181.7 (2) +0x0180| 00 00 | .. | reserved: 0 0x182-0x183.7 (2) +0x0180| 00 00 04 00 | .... | snap_len: 262144 0x184-0x187.7 (4) + | | | options: [5] 0x188-0x1eb.7 (100) + | | | [0]: option {} 0x188-0x193.7 (12) +0x0180| 02 00 | .. | code: "name" (2) 0x188-0x189.7 (2) +0x0180| 07 00 | .. | length: 7 0x18a-0x18b.7 (2) +0x0180| 62 72 69 64| brid| value: "bridge0" 0x18c-0x192.7 (7) +0x0190|67 65 30 |ge0 | +0x0190| 00 | . | padding: raw bits 0x193-0x193.7 (1) + | | | [1]: option {} 0x194-0x19b.7 (8) +0x0190| 09 00 | .. | code: "tsresol" (9) 0x194-0x195.7 (2) +0x0190| 01 00 | .. | length: 1 0x196-0x197.7 (2) +0x0190| 06 | . | value: "\x06" 0x198-0x198.7 (1) +0x0190| 00 00 00 | ... | padding: raw bits 0x199-0x19b.7 (3) + | | | [2]: option {} 0x19c-0x1b3.7 (24) +0x0190| 0b 00 | .. | code: "filter" (11) 0x19c-0x19d.7 (2) +0x0190| 13 00| ..| length: 19 0x19e-0x19f.7 (2) +0x01a0|00 68 6f 73 74 20 31 39 32 2e 31 36 38 2e 31 2e|.host 192.168.1.| value: "" 0x1a0-0x1b2.7 (19) +0x01b0|31 33 39 |139 | +0x01b0| 00 | . | padding: raw bits 0x1b3-0x1b3.7 (1) + | | | [3]: option {} 0x1b4-0x1e7.7 (52) +0x01b0| 0c 00 | .. | code: "os" (12) 0x1b4-0x1b5.7 (2) +0x01b0| 2d 00 | -. | length: 45 0x1b6-0x1b7.7 (2) +0x01b0| 4d 61 63 20 4f 53 20 58| Mac OS X| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x1b8-0x1e4.7 (45) +0x01c0|20 31 30 2e 31 30 2e 34 2c 20 62 75 69 6c 64 20| 10.10.4, build | +* |until 0x1e4.7 (45) | | +0x01e0| 00 00 00 | ... | padding: raw bits 0x1e5-0x1e7.7 (3) + | | | [4]: option {} 0x1e8-0x1eb.7 (4) +0x01e0| 00 00 | .. | code: "end" (0) (End of options) 0x1e8-0x1e9.7 (2) +0x01e0| 00 00 | .. | length: 0 0x1ea-0x1eb.7 (2) +0x01e0| 78 00 00 00| x...| footer_length: 120 0x1ec-0x1ef.7 (4) + | | | [4]: block {} 0x1f0-0x267.7 (120) +0x01f0|01 00 00 00 |.... | type: "interface_description" (0x1) (Interface Description Block) 0x1f0-0x1f3.7 (4) +0x01f0| 78 00 00 00 | x... | length: 120 0x1f4-0x1f7.7 (4) +0x01f0| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x1f8-0x1f9.7 (2) +0x01f0| 00 00 | .. | reserved: 0 0x1fa-0x1fb.7 (2) +0x01f0| 00 00 04 00| ....| snap_len: 262144 0x1fc-0x1ff.7 (4) + | | | options: [5] 0x200-0x263.7 (100) + | | | [0]: option {} 0x200-0x20b.7 (12) +0x0200|02 00 |.. | code: "name" (2) 0x200-0x201.7 (2) +0x0200| 08 00 | .. | length: 8 0x202-0x203.7 (2) +0x0200| 76 62 6f 78 6e 65 74 30 | vboxnet0 | value: "vboxnet0" 0x204-0x20b.7 (8) + | | | padding: raw bits 0x20c-NA (0) + | | | [1]: option {} 0x20c-0x213.7 (8) +0x0200| 09 00 | .. | code: "tsresol" (9) 0x20c-0x20d.7 (2) +0x0200| 01 00| ..| length: 1 0x20e-0x20f.7 (2) +0x0210|06 |. | value: "\x06" 0x210-0x210.7 (1) +0x0210| 00 00 00 | ... | padding: raw bits 0x211-0x213.7 (3) + | | | [2]: option {} 0x214-0x22b.7 (24) +0x0210| 0b 00 | .. | code: "filter" (11) 0x214-0x215.7 (2) +0x0210| 13 00 | .. | length: 19 0x216-0x217.7 (2) +0x0210| 00 68 6f 73 74 20 31 39| .host 19| value: "" 0x218-0x22a.7 (19) +0x0220|32 2e 31 36 38 2e 31 2e 31 33 39 |2.168.1.139 | +0x0220| 00 | . | padding: raw bits 0x22b-0x22b.7 (1) + | | | [3]: option {} 0x22c-0x25f.7 (52) +0x0220| 0c 00 | .. | code: "os" (12) 0x22c-0x22d.7 (2) +0x0220| 2d 00| -.| length: 45 0x22e-0x22f.7 (2) +0x0230|4d 61 63 20 4f 53 20 58 20 31 30 2e 31 30 2e 34|Mac OS X 10.10.4| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x230-0x25c.7 (45) +* |until 0x25c.7 (45) | | +0x0250| 00 00 00| ...| padding: raw bits 0x25d-0x25f.7 (3) + | | | [4]: option {} 0x260-0x263.7 (4) +0x0260|00 00 |.. | code: "end" (0) (End of options) 0x260-0x261.7 (2) +0x0260| 00 00 | .. | length: 0 0x262-0x263.7 (2) +0x0260| 78 00 00 00 | x... | footer_length: 120 0x264-0x267.7 (4) + | | | [5]: block {} 0x268-0x2df.7 (120) +0x0260| 01 00 00 00 | .... | type: "interface_description" (0x1) (Interface Description Block) 0x268-0x26b.7 (4) +0x0260| 78 00 00 00| x...| length: 120 0x26c-0x26f.7 (4) +0x0270|00 00 |.. | link_type: "null" (0) (BSD loopback encapsulation) 0x270-0x271.7 (2) +0x0270| 00 00 | .. | reserved: 0 0x272-0x273.7 (2) +0x0270| 00 00 04 00 | .... | snap_len: 262144 0x274-0x277.7 (4) + | | | options: [5] 0x278-0x2db.7 (100) + | | | [0]: option {} 0x278-0x283.7 (12) +0x0270| 02 00 | .. | code: "name" (2) 0x278-0x279.7 (2) +0x0270| 05 00 | .. | length: 5 0x27a-0x27b.7 (2) +0x0270| 75 74 75 6e| utun| value: "utun0" 0x27c-0x280.7 (5) +0x0280|30 |0 | +0x0280| 00 00 00 | ... | padding: raw bits 0x281-0x283.7 (3) + | | | [1]: option {} 0x284-0x28b.7 (8) +0x0280| 09 00 | .. | code: "tsresol" (9) 0x284-0x285.7 (2) +0x0280| 01 00 | .. | length: 1 0x286-0x287.7 (2) +0x0280| 06 | . | value: "\x06" 0x288-0x288.7 (1) +0x0280| 00 00 00 | ... | padding: raw bits 0x289-0x28b.7 (3) + | | | [2]: option {} 0x28c-0x2a3.7 (24) +0x0280| 0b 00 | .. | code: "filter" (11) 0x28c-0x28d.7 (2) +0x0280| 13 00| ..| length: 19 0x28e-0x28f.7 (2) +0x0290|00 68 6f 73 74 20 31 39 32 2e 31 36 38 2e 31 2e|.host 192.168.1.| value: "" 0x290-0x2a2.7 (19) +0x02a0|31 33 39 |139 | +0x02a0| 00 | . | padding: raw bits 0x2a3-0x2a3.7 (1) + | | | [3]: option {} 0x2a4-0x2d7.7 (52) +0x02a0| 0c 00 | .. | code: "os" (12) 0x2a4-0x2a5.7 (2) +0x02a0| 2d 00 | -. | length: 45 0x2a6-0x2a7.7 (2) +0x02a0| 4d 61 63 20 4f 53 20 58| Mac OS X| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x2a8-0x2d4.7 (45) +0x02b0|20 31 30 2e 31 30 2e 34 2c 20 62 75 69 6c 64 20| 10.10.4, build | +* |until 0x2d4.7 (45) | | +0x02d0| 00 00 00 | ... | padding: raw bits 0x2d5-0x2d7.7 (3) + | | | [4]: option {} 0x2d8-0x2db.7 (4) +0x02d0| 00 00 | .. | code: "end" (0) (End of options) 0x2d8-0x2d9.7 (2) +0x02d0| 00 00 | .. | length: 0 0x2da-0x2db.7 (2) +0x02d0| 78 00 00 00| x...| footer_length: 120 0x2dc-0x2df.7 (4) + | | | [6]: block {} 0x2e0-0x353.7 (116) +0x02e0|01 00 00 00 |.... | type: "interface_description" (0x1) (Interface Description Block) 0x2e0-0x2e3.7 (4) +0x02e0| 74 00 00 00 | t... | length: 116 0x2e4-0x2e7.7 (4) +0x02e0| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x2e8-0x2e9.7 (2) +0x02e0| 00 00 | .. | reserved: 0 0x2ea-0x2eb.7 (2) +0x02e0| 00 00 04 00| ....| snap_len: 262144 0x2ec-0x2ef.7 (4) + | | | options: [5] 0x2f0-0x34f.7 (96) + | | | [0]: option {} 0x2f0-0x2f7.7 (8) +0x02f0|02 00 |.. | code: "name" (2) 0x2f0-0x2f1.7 (2) +0x02f0| 03 00 | .. | length: 3 0x2f2-0x2f3.7 (2) +0x02f0| 65 6e 31 | en1 | value: "en1" 0x2f4-0x2f6.7 (3) +0x02f0| 00 | . | padding: raw bits 0x2f7-0x2f7.7 (1) + | | | [1]: option {} 0x2f8-0x2ff.7 (8) +0x02f0| 09 00 | .. | code: "tsresol" (9) 0x2f8-0x2f9.7 (2) +0x02f0| 01 00 | .. | length: 1 0x2fa-0x2fb.7 (2) +0x02f0| 06 | . | value: "\x06" 0x2fc-0x2fc.7 (1) +0x02f0| 00 00 00| ...| padding: raw bits 0x2fd-0x2ff.7 (3) + | | | [2]: option {} 0x300-0x317.7 (24) +0x0300|0b 00 |.. | code: "filter" (11) 0x300-0x301.7 (2) +0x0300| 13 00 | .. | length: 19 0x302-0x303.7 (2) +0x0300| 00 68 6f 73 74 20 31 39 32 2e 31 36| .host 192.16| value: "" 0x304-0x316.7 (19) +0x0310|38 2e 31 2e 31 33 39 |8.1.139 | +0x0310| 00 | . | padding: raw bits 0x317-0x317.7 (1) + | | | [3]: option {} 0x318-0x34b.7 (52) +0x0310| 0c 00 | .. | code: "os" (12) 0x318-0x319.7 (2) +0x0310| 2d 00 | -. | length: 45 0x31a-0x31b.7 (2) +0x0310| 4d 61 63 20| Mac | value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x31c-0x348.7 (45) +0x0320|4f 53 20 58 20 31 30 2e 31 30 2e 34 2c 20 62 75|OS X 10.10.4, bu| +* |until 0x348.7 (45) | | +0x0340| 00 00 00 | ... | padding: raw bits 0x349-0x34b.7 (3) + | | | [4]: option {} 0x34c-0x34f.7 (4) +0x0340| 00 00 | .. | code: "end" (0) (End of options) 0x34c-0x34d.7 (2) +0x0340| 00 00| ..| length: 0 0x34e-0x34f.7 (2) +0x0350|74 00 00 00 |t... | footer_length: 116 0x350-0x353.7 (4) + | | | [7]: block {} 0x354-0x3cb.7 (120) +0x0350| 01 00 00 00 | .... | type: "interface_description" (0x1) (Interface Description Block) 0x354-0x357.7 (4) +0x0350| 78 00 00 00 | x... | length: 120 0x358-0x35b.7 (4) +0x0350| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x35c-0x35d.7 (2) +0x0350| 00 00| ..| reserved: 0 0x35e-0x35f.7 (2) +0x0360|00 00 04 00 |.... | snap_len: 262144 0x360-0x363.7 (4) + | | | options: [5] 0x364-0x3c7.7 (100) + | | | [0]: option {} 0x364-0x36f.7 (12) +0x0360| 02 00 | .. | code: "name" (2) 0x364-0x365.7 (2) +0x0360| 08 00 | .. | length: 8 0x366-0x367.7 (2) +0x0360| 76 62 6f 78 6e 65 74 31| vboxnet1| value: "vboxnet1" 0x368-0x36f.7 (8) + | | | padding: raw bits 0x370-NA (0) + | | | [1]: option {} 0x370-0x377.7 (8) +0x0370|09 00 |.. | code: "tsresol" (9) 0x370-0x371.7 (2) +0x0370| 01 00 | .. | length: 1 0x372-0x373.7 (2) +0x0370| 06 | . | value: "\x06" 0x374-0x374.7 (1) +0x0370| 00 00 00 | ... | padding: raw bits 0x375-0x377.7 (3) + | | | [2]: option {} 0x378-0x38f.7 (24) +0x0370| 0b 00 | .. | code: "filter" (11) 0x378-0x379.7 (2) +0x0370| 13 00 | .. | length: 19 0x37a-0x37b.7 (2) +0x0370| 00 68 6f 73| .hos| value: "" 0x37c-0x38e.7 (19) +0x0380|74 20 31 39 32 2e 31 36 38 2e 31 2e 31 33 39 |t 192.168.1.139 | +0x0380| 00| .| padding: raw bits 0x38f-0x38f.7 (1) + | | | [3]: option {} 0x390-0x3c3.7 (52) +0x0390|0c 00 |.. | code: "os" (12) 0x390-0x391.7 (2) +0x0390| 2d 00 | -. | length: 45 0x392-0x393.7 (2) +0x0390| 4d 61 63 20 4f 53 20 58 20 31 30 2e| Mac OS X 10.| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x394-0x3c0.7 (45) +0x03a0|31 30 2e 34 2c 20 62 75 69 6c 64 20 31 34 45 34|10.4, build 14E4| +* |until 0x3c0.7 (45) | | +0x03c0| 00 00 00 | ... | padding: raw bits 0x3c1-0x3c3.7 (3) + | | | [4]: option {} 0x3c4-0x3c7.7 (4) +0x03c0| 00 00 | .. | code: "end" (0) (End of options) 0x3c4-0x3c5.7 (2) +0x03c0| 00 00 | .. | length: 0 0x3c6-0x3c7.7 (2) +0x03c0| 78 00 00 00 | x... | footer_length: 120 0x3c8-0x3cb.7 (4) + | | | [8]: block {} 0x3cc-0x43f.7 (116) +0x03c0| 01 00 00 00| ....| type: "interface_description" (0x1) (Interface Description Block) 0x3cc-0x3cf.7 (4) +0x03d0|74 00 00 00 |t... | length: 116 0x3d0-0x3d3.7 (4) +0x03d0| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x3d4-0x3d5.7 (2) +0x03d0| 00 00 | .. | reserved: 0 0x3d6-0x3d7.7 (2) +0x03d0| 00 00 04 00 | .... | snap_len: 262144 0x3d8-0x3db.7 (4) + | | | options: [5] 0x3dc-0x43b.7 (96) + | | | [0]: option {} 0x3dc-0x3e3.7 (8) +0x03d0| 02 00 | .. | code: "name" (2) 0x3dc-0x3dd.7 (2) +0x03d0| 03 00| ..| length: 3 0x3de-0x3df.7 (2) +0x03e0|65 6e 32 |en2 | value: "en2" 0x3e0-0x3e2.7 (3) +0x03e0| 00 | . | padding: raw bits 0x3e3-0x3e3.7 (1) + | | | [1]: option {} 0x3e4-0x3eb.7 (8) +0x03e0| 09 00 | .. | code: "tsresol" (9) 0x3e4-0x3e5.7 (2) +0x03e0| 01 00 | .. | length: 1 0x3e6-0x3e7.7 (2) +0x03e0| 06 | . | value: "\x06" 0x3e8-0x3e8.7 (1) +0x03e0| 00 00 00 | ... | padding: raw bits 0x3e9-0x3eb.7 (3) + | | | [2]: option {} 0x3ec-0x403.7 (24) +0x03e0| 0b 00 | .. | code: "filter" (11) 0x3ec-0x3ed.7 (2) +0x03e0| 13 00| ..| length: 19 0x3ee-0x3ef.7 (2) +0x03f0|00 68 6f 73 74 20 31 39 32 2e 31 36 38 2e 31 2e|.host 192.168.1.| value: "" 0x3f0-0x402.7 (19) +0x0400|31 33 39 |139 | +0x0400| 00 | . | padding: raw bits 0x403-0x403.7 (1) + | | | [3]: option {} 0x404-0x437.7 (52) +0x0400| 0c 00 | .. | code: "os" (12) 0x404-0x405.7 (2) +0x0400| 2d 00 | -. | length: 45 0x406-0x407.7 (2) +0x0400| 4d 61 63 20 4f 53 20 58| Mac OS X| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x408-0x434.7 (45) +0x0410|20 31 30 2e 31 30 2e 34 2c 20 62 75 69 6c 64 20| 10.10.4, build | +* |until 0x434.7 (45) | | +0x0430| 00 00 00 | ... | padding: raw bits 0x435-0x437.7 (3) + | | | [4]: option {} 0x438-0x43b.7 (4) +0x0430| 00 00 | .. | code: "end" (0) (End of options) 0x438-0x439.7 (2) +0x0430| 00 00 | .. | length: 0 0x43a-0x43b.7 (2) +0x0430| 74 00 00 00| t...| footer_length: 116 0x43c-0x43f.7 (4) + | | | [9]: block {} 0x440-0x4b3.7 (116) +0x0440|01 00 00 00 |.... | type: "interface_description" (0x1) (Interface Description Block) 0x440-0x443.7 (4) +0x0440| 74 00 00 00 | t... | length: 116 0x444-0x447.7 (4) +0x0440| 0c 00 | .. | link_type: 12 0x448-0x449.7 (2) +0x0440| 00 00 | .. | reserved: 0 0x44a-0x44b.7 (2) +0x0440| 00 00 04 00| ....| snap_len: 262144 0x44c-0x44f.7 (4) + | | | options: [5] 0x450-0x4af.7 (96) + | | | [0]: option {} 0x450-0x457.7 (8) +0x0450|02 00 |.. | code: "name" (2) 0x450-0x451.7 (2) +0x0450| 04 00 | .. | length: 4 0x452-0x453.7 (2) +0x0450| 70 32 70 30 | p2p0 | value: "p2p0" 0x454-0x457.7 (4) + | | | padding: raw bits 0x458-NA (0) + | | | [1]: option {} 0x458-0x45f.7 (8) +0x0450| 09 00 | .. | code: "tsresol" (9) 0x458-0x459.7 (2) +0x0450| 01 00 | .. | length: 1 0x45a-0x45b.7 (2) +0x0450| 06 | . | value: "\x06" 0x45c-0x45c.7 (1) +0x0450| 00 00 00| ...| padding: raw bits 0x45d-0x45f.7 (3) + | | | [2]: option {} 0x460-0x477.7 (24) +0x0460|0b 00 |.. | code: "filter" (11) 0x460-0x461.7 (2) +0x0460| 13 00 | .. | length: 19 0x462-0x463.7 (2) +0x0460| 00 68 6f 73 74 20 31 39 32 2e 31 36| .host 192.16| value: "" 0x464-0x476.7 (19) +0x0470|38 2e 31 2e 31 33 39 |8.1.139 | +0x0470| 00 | . | padding: raw bits 0x477-0x477.7 (1) + | | | [3]: option {} 0x478-0x4ab.7 (52) +0x0470| 0c 00 | .. | code: "os" (12) 0x478-0x479.7 (2) +0x0470| 2d 00 | -. | length: 45 0x47a-0x47b.7 (2) +0x0470| 4d 61 63 20| Mac | value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x47c-0x4a8.7 (45) +0x0480|4f 53 20 58 20 31 30 2e 31 30 2e 34 2c 20 62 75|OS X 10.10.4, bu| +* |until 0x4a8.7 (45) | | +0x04a0| 00 00 00 | ... | padding: raw bits 0x4a9-0x4ab.7 (3) + | | | [4]: option {} 0x4ac-0x4af.7 (4) +0x04a0| 00 00 | .. | code: "end" (0) (End of options) 0x4ac-0x4ad.7 (2) +0x04a0| 00 00| ..| length: 0 0x4ae-0x4af.7 (2) +0x04b0|74 00 00 00 |t... | footer_length: 116 0x4b0-0x4b3.7 (4) + | | | [10]: block {} 0x4b4-0x52b.7 (120) +0x04b0| 01 00 00 00 | .... | type: "interface_description" (0x1) (Interface Description Block) 0x4b4-0x4b7.7 (4) +0x04b0| 78 00 00 00 | x... | length: 120 0x4b8-0x4bb.7 (4) +0x04b0| 01 00 | .. | link_type: "ethernet" (1) (IEEE 802.3 Ethernet) 0x4bc-0x4bd.7 (2) +0x04b0| 00 00| ..| reserved: 0 0x4be-0x4bf.7 (2) +0x04c0|00 00 04 00 |.... | snap_len: 262144 0x4c0-0x4c3.7 (4) + | | | options: [5] 0x4c4-0x527.7 (100) + | | | [0]: option {} 0x4c4-0x4cf.7 (12) +0x04c0| 02 00 | .. | code: "name" (2) 0x4c4-0x4c5.7 (2) +0x04c0| 08 00 | .. | length: 8 0x4c6-0x4c7.7 (2) +0x04c0| 76 62 6f 78 6e 65 74 32| vboxnet2| value: "vboxnet2" 0x4c8-0x4cf.7 (8) + | | | padding: raw bits 0x4d0-NA (0) + | | | [1]: option {} 0x4d0-0x4d7.7 (8) +0x04d0|09 00 |.. | code: "tsresol" (9) 0x4d0-0x4d1.7 (2) +0x04d0| 01 00 | .. | length: 1 0x4d2-0x4d3.7 (2) +0x04d0| 06 | . | value: "\x06" 0x4d4-0x4d4.7 (1) +0x04d0| 00 00 00 | ... | padding: raw bits 0x4d5-0x4d7.7 (3) + | | | [2]: option {} 0x4d8-0x4ef.7 (24) +0x04d0| 0b 00 | .. | code: "filter" (11) 0x4d8-0x4d9.7 (2) +0x04d0| 13 00 | .. | length: 19 0x4da-0x4db.7 (2) +0x04d0| 00 68 6f 73| .hos| value: "" 0x4dc-0x4ee.7 (19) +0x04e0|74 20 31 39 32 2e 31 36 38 2e 31 2e 31 33 39 |t 192.168.1.139 | +0x04e0| 00| .| padding: raw bits 0x4ef-0x4ef.7 (1) + | | | [3]: option {} 0x4f0-0x523.7 (52) +0x04f0|0c 00 |.. | code: "os" (12) 0x4f0-0x4f1.7 (2) +0x04f0| 2d 00 | -. | length: 45 0x4f2-0x4f3.7 (2) +0x04f0| 4d 61 63 20 4f 53 20 58 20 31 30 2e| Mac OS X 10.| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x4f4-0x520.7 (45) +0x0500|31 30 2e 34 2c 20 62 75 69 6c 64 20 31 34 45 34|10.4, build 14E4| +* |until 0x520.7 (45) | | +0x0520| 00 00 00 | ... | padding: raw bits 0x521-0x523.7 (3) + | | | [4]: option {} 0x524-0x527.7 (4) +0x0520| 00 00 | .. | code: "end" (0) (End of options) 0x524-0x525.7 (2) +0x0520| 00 00 | .. | length: 0 0x526-0x527.7 (2) +0x0520| 78 00 00 00 | x... | footer_length: 120 0x528-0x52b.7 (4) + | | | [11]: block {} 0x52c-0x59f.7 (116) +0x0520| 01 00 00 00| ....| type: "interface_description" (0x1) (Interface Description Block) 0x52c-0x52f.7 (4) +0x0530|74 00 00 00 |t... | length: 116 0x530-0x533.7 (4) +0x0530| 00 00 | .. | link_type: "null" (0) (BSD loopback encapsulation) 0x534-0x535.7 (2) +0x0530| 00 00 | .. | reserved: 0 0x536-0x537.7 (2) +0x0530| 00 00 04 00 | .... | snap_len: 262144 0x538-0x53b.7 (4) + | | | options: [5] 0x53c-0x59b.7 (96) + | | | [0]: option {} 0x53c-0x543.7 (8) +0x0530| 02 00 | .. | code: "name" (2) 0x53c-0x53d.7 (2) +0x0530| 03 00| ..| length: 3 0x53e-0x53f.7 (2) +0x0540|6c 6f 30 |lo0 | value: "lo0" 0x540-0x542.7 (3) +0x0540| 00 | . | padding: raw bits 0x543-0x543.7 (1) + | | | [1]: option {} 0x544-0x54b.7 (8) +0x0540| 09 00 | .. | code: "tsresol" (9) 0x544-0x545.7 (2) +0x0540| 01 00 | .. | length: 1 0x546-0x547.7 (2) +0x0540| 06 | . | value: "\x06" 0x548-0x548.7 (1) +0x0540| 00 00 00 | ... | padding: raw bits 0x549-0x54b.7 (3) + | | | [2]: option {} 0x54c-0x563.7 (24) +0x0540| 0b 00 | .. | code: "filter" (11) 0x54c-0x54d.7 (2) +0x0540| 13 00| ..| length: 19 0x54e-0x54f.7 (2) +0x0550|00 68 6f 73 74 20 31 39 32 2e 31 36 38 2e 31 2e|.host 192.168.1.| value: "" 0x550-0x562.7 (19) +0x0560|31 33 39 |139 | +0x0560| 00 | . | padding: raw bits 0x563-0x563.7 (1) + | | | [3]: option {} 0x564-0x597.7 (52) +0x0560| 0c 00 | .. | code: "os" (12) 0x564-0x565.7 (2) +0x0560| 2d 00 | -. | length: 45 0x566-0x567.7 (2) +0x0560| 4d 61 63 20 4f 53 20 58| Mac OS X| value: "Mac OS X 10.10.4, build 14E46 (Darwin 14.4.0)" 0x568-0x594.7 (45) +0x0570|20 31 30 2e 31 30 2e 34 2c 20 62 75 69 6c 64 20| 10.10.4, build | +* |until 0x594.7 (45) | | +0x0590| 00 00 00 | ... | padding: raw bits 0x595-0x597.7 (3) + | | | [4]: option {} 0x598-0x59b.7 (4) +0x0590| 00 00 | .. | code: "end" (0) (End of options) 0x598-0x599.7 (2) +0x0590| 00 00 | .. | length: 0 0x59a-0x59b.7 (2) +0x0590| 74 00 00 00| t...| footer_length: 116 0x59c-0x59f.7 (4) + | | | [12]: block {} 0x5a0-0x673.7 (212) +0x05a0|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x5a0-0x5a3.7 (4) +0x05a0| d4 00 00 00 | .... | length: 212 0x5a4-0x5a7.7 (4) +0x05a0| 00 00 00 00 | .... | interface_id: 0 0x5a8-0x5ab.7 (4) +0x05a0| 72 1d 05 00| r...| timestamp_high: 335218 0x5ac-0x5af.7 (4) +0x05b0|e7 6d 62 c9 |.mb. | timestamp_low: 3378671079 0x5b0-0x5b3.7 (4) +0x05b0| b2 00 00 00 | .... | capture_packet_length: 178 0x5b4-0x5b7.7 (4) +0x05b0| b2 00 00 00 | .... | original_packet_length: 178 0x5b8-0x5bb.7 (4) + | | | packet: {} (ether8023) 0x5bc-0x66d.7 (178) +0x05b0| ff ff ff ff| ....| destination: "ff:ff:ff:ff:ff:ff" (0xffffffffffff) 0x5bc-0x5c1.7 (6) +0x05c0|ff ff |.. | +0x05c0| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x5c2-0x5c7.7 (6) +0x05c0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x5c8-0x5c9.7 (2) + | | | packet: {} (ipv4) 0x5ca-0x66d.7 (164) +0x05c0| 45 | E | version: 4 0x5ca-0x5ca.3 (0.4) +0x05c0| 45 | E | ihl: 5 0x5ca.4-0x5ca.7 (0.4) +0x05c0| 00 | . | dscp: 0 0x5cb-0x5cb.5 (0.6) +0x05c0| 00 | . | ecn: 0 0x5cb.6-0x5cb.7 (0.2) +0x05c0| 00 a4 | .. | total_length: 164 0x5cc-0x5cd.7 (2) +0x05c0| c6 ce| ..| identification: 50894 0x5ce-0x5cf.7 (2) +0x05d0|00 |. | reserved: 0 0x5d0-0x5d0 (0.1) +0x05d0|00 |. | dont_fragment: false 0x5d0.1-0x5d0.1 (0.1) +0x05d0|00 |. | more_fragments: false 0x5d0.2-0x5d0.2 (0.1) +0x05d0|00 00 |.. | fragment_offset: 0 0x5d0.3-0x5d1.7 (1.5) +0x05d0| 40 | @ | ttl: 64 0x5d2-0x5d2.7 (1) +0x05d0| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x5d3-0x5d3.7 (1) +0x05d0| f1 47 | .G | header_checksum: 0xf147 0x5d4-0x5d5.7 (2) +0x05d0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x5d6-0x5d9.7 (4) +0x05d0| ff ff ff ff | .... | destination_ip: "255.255.255.255" (0xffffffff) 0x5da-0x5dd.7 (4) + | | | data: {} (udp) 0x5de-0x66d.7 (144) +0x05d0| 44 5c| D\| source_port: 17500 0x5de-0x5df.7 (2) +0x05e0|44 5c |D\ | destination_port: 17500 0x5e0-0x5e1.7 (2) +0x05e0| 00 90 | .. | length: 144 0x5e2-0x5e3.7 (2) +0x05e0| ba 03 | .. | checksum: 0xba03 0x5e4-0x5e5.7 (2) +0x05e0| 7b 22 68 6f 73 74 5f 69 6e 74| {"host_int| data: raw bits 0x5e6-0x66d.7 (136) +0x05f0|22 3a 20 34 30 39 34 35 31 34 34 38 33 2c 20 22|": 4094514483, "| +* |until 0x66d.7 (136) | | + | | | capture_padding: raw bits 0x66e-NA (0) +0x0660| 00 00| ..| padding: raw bits 0x66e-0x66f.7 (2) + | | | options: [0] 0x670-NA (0) +0x0670|d4 00 00 00 |.... | footer_length: 212 0x670-0x673.7 (4) + | | | [13]: block {} 0x674-0x747.7 (212) +0x0670| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x674-0x677.7 (4) +0x0670| d4 00 00 00 | .... | length: 212 0x678-0x67b.7 (4) +0x0670| 00 00 00 00| ....| interface_id: 0 0x67c-0x67f.7 (4) +0x0680|72 1d 05 00 |r... | timestamp_high: 335218 0x680-0x683.7 (4) +0x0680| df 6e 62 c9 | .nb. | timestamp_low: 3378671327 0x684-0x687.7 (4) +0x0680| b2 00 00 00 | .... | capture_packet_length: 178 0x688-0x68b.7 (4) +0x0680| b2 00 00 00| ....| original_packet_length: 178 0x68c-0x68f.7 (4) + | | | packet: {} (ether8023) 0x690-0x741.7 (178) +0x0690|ff ff ff ff ff ff |...... | destination: "ff:ff:ff:ff:ff:ff" (0xffffffffffff) 0x690-0x695.7 (6) +0x0690| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x696-0x69b.7 (6) +0x0690| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x69c-0x69d.7 (2) + | | | packet: {} (ipv4) 0x69e-0x741.7 (164) +0x0690| 45 | E | version: 4 0x69e-0x69e.3 (0.4) +0x0690| 45 | E | ihl: 5 0x69e.4-0x69e.7 (0.4) +0x0690| 00| .| dscp: 0 0x69f-0x69f.5 (0.6) +0x0690| 00| .| ecn: 0 0x69f.6-0x69f.7 (0.2) +0x06a0|00 a4 |.. | total_length: 164 0x6a0-0x6a1.7 (2) +0x06a0| 60 b4 | `. | identification: 24756 0x6a2-0x6a3.7 (2) +0x06a0| 00 | . | reserved: 0 0x6a4-0x6a4 (0.1) +0x06a0| 00 | . | dont_fragment: false 0x6a4.1-0x6a4.1 (0.1) +0x06a0| 00 | . | more_fragments: false 0x6a4.2-0x6a4.2 (0.1) +0x06a0| 00 00 | .. | fragment_offset: 0 0x6a4.3-0x6a5.7 (1.5) +0x06a0| 40 | @ | ttl: 64 0x6a6-0x6a6.7 (1) +0x06a0| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x6a7-0x6a7.7 (1) +0x06a0| 94 ba | .. | header_checksum: 0x94ba 0x6a8-0x6a9.7 (2) +0x06a0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x6aa-0x6ad.7 (4) +0x06a0| c0 a8| ..| destination_ip: "192.168.1.255" (0xc0a801ff) 0x6ae-0x6b1.7 (4) +0x06b0|01 ff |.. | + | | | data: {} (udp) 0x6b2-0x741.7 (144) +0x06b0| 44 5c | D\ | source_port: 17500 0x6b2-0x6b3.7 (2) +0x06b0| 44 5c | D\ | destination_port: 17500 0x6b4-0x6b5.7 (2) +0x06b0| 00 90 | .. | length: 144 0x6b6-0x6b7.7 (2) +0x06b0| f7 5b | .[ | checksum: 0xf75b 0x6b8-0x6b9.7 (2) +0x06b0| 7b 22 68 6f 73 74| {"host| data: raw bits 0x6ba-0x741.7 (136) +0x06c0|5f 69 6e 74 22 3a 20 34 30 39 34 35 31 34 34 38|_int": 409451448| +* |until 0x741.7 (136) | | + | | | capture_padding: raw bits 0x742-NA (0) +0x0740| 00 00 | .. | padding: raw bits 0x742-0x743.7 (2) + | | | options: [0] 0x744-NA (0) +0x0740| d4 00 00 00 | .... | footer_length: 212 0x744-0x747.7 (4) + | | | [14]: block {} 0x748-0x80f.7 (200) +0x0740| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x748-0x74b.7 (4) +0x0740| c8 00 00 00| ....| length: 200 0x74c-0x74f.7 (4) +0x0750|0a 00 00 00 |.... | interface_id: 10 0x750-0x753.7 (4) +0x0750| 72 1d 05 00 | r... | timestamp_high: 335218 0x754-0x757.7 (4) +0x0750| c0 6d 62 c9 | .mb. | timestamp_low: 3378671040 0x758-0x75b.7 (4) +0x0750| a8 00 00 00| ....| capture_packet_length: 168 0x75c-0x75f.7 (4) +0x0760|a8 00 00 00 |.... | original_packet_length: 168 0x760-0x763.7 (4) +0x0760| 02 00 00 00 45 00 00 a4 c6 ce 00 00| ....E.......| packet: raw bits 0x764-0x80b.7 (168) +0x0770|40 11 f1 47 c0 a8 01 8b ff ff ff ff 44 5c 44 5c|@..G........D\D\| +* |until 0x80b.7 (168) | | + | | | capture_padding: raw bits 0x80c-NA (0) + | | | padding: raw bits 0x80c-NA (0) + | | | options: [0] 0x80c-NA (0) +0x0800| c8 00 00 00| ....| footer_length: 200 0x80c-0x80f.7 (4) + | | | [15]: block {} 0x810-0x8d7.7 (200) +0x0810|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x810-0x813.7 (4) +0x0810| c8 00 00 00 | .... | length: 200 0x814-0x817.7 (4) +0x0810| 0a 00 00 00 | .... | interface_id: 10 0x818-0x81b.7 (4) +0x0810| 72 1d 05 00| r...| timestamp_high: 335218 0x81c-0x81f.7 (4) +0x0820|be 6e 62 c9 |.nb. | timestamp_low: 3378671294 0x820-0x823.7 (4) +0x0820| a8 00 00 00 | .... | capture_packet_length: 168 0x824-0x827.7 (4) +0x0820| a8 00 00 00 | .... | original_packet_length: 168 0x828-0x82b.7 (4) +0x0820| 02 00 00 00| ....| packet: raw bits 0x82c-0x8d3.7 (168) +0x0830|45 00 00 a4 60 b4 00 00 40 11 94 ba c0 a8 01 8b|E...`...@.......| +* |until 0x8d3.7 (168) | | + | | | capture_padding: raw bits 0x8d4-NA (0) + | | | padding: raw bits 0x8d4-NA (0) + | | | options: [0] 0x8d4-NA (0) +0x08d0| c8 00 00 00 | .... | footer_length: 200 0x8d4-0x8d7.7 (4) + | | | [16]: block {} 0x8d8-0x94f.7 (120) +0x08d0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x8d8-0x8db.7 (4) +0x08d0| 78 00 00 00| x...| length: 120 0x8dc-0x8df.7 (4) +0x08e0|00 00 00 00 |.... | interface_id: 0 0x8e0-0x8e3.7 (4) +0x08e0| 72 1d 05 00 | r... | timestamp_high: 335218 0x8e4-0x8e7.7 (4) +0x08e0| 3f e6 69 c9 | ?.i. | timestamp_low: 3379160639 0x8e8-0x8eb.7 (4) +0x08e0| 56 00 00 00| V...| capture_packet_length: 86 0x8ec-0x8ef.7 (4) +0x08f0|56 00 00 00 |V... | original_packet_length: 86 0x8f0-0x8f3.7 (4) + | | | packet: {} (ether8023) 0x8f4-0x949.7 (86) +0x08f0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x8f4-0x8f9.7 (6) +0x08f0| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x8fa-0x8ff.7 (6) +0x0900|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x900-0x901.7 (2) + | | | packet: {} (ipv4) 0x902-0x949.7 (72) +0x0900| 45 | E | version: 4 0x902-0x902.3 (0.4) +0x0900| 45 | E | ihl: 5 0x902.4-0x902.7 (0.4) +0x0900| 00 | . | dscp: 0 0x903-0x903.5 (0.6) +0x0900| 00 | . | ecn: 0 0x903.6-0x903.7 (0.2) +0x0900| 00 48 | .H | total_length: 72 0x904-0x905.7 (2) +0x0900| db 32 | .2 | identification: 56114 0x906-0x907.7 (2) +0x0900| 00 | . | reserved: 0 0x908-0x908 (0.1) +0x0900| 00 | . | dont_fragment: false 0x908.1-0x908.1 (0.1) +0x0900| 00 | . | more_fragments: false 0x908.2-0x908.2 (0.1) +0x0900| 00 00 | .. | fragment_offset: 0 0x908.3-0x909.7 (1.5) +0x0900| ff | . | ttl: 255 0x90a-0x90a.7 (1) +0x0900| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x90b-0x90b.7 (1) +0x0900| 5c 95 | \. | header_checksum: 0x5c95 0x90c-0x90d.7 (2) +0x0900| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x90e-0x911.7 (4) +0x0910|01 8b |.. | +0x0910| c0 a8 01 01 | .... | destination_ip: "192.168.1.1" (0xc0a80101) 0x912-0x915.7 (4) + | | | data: {} (udp) 0x916-0x949.7 (52) +0x0910| c2 54 | .T | source_port: 49748 0x916-0x917.7 (2) +0x0910| 00 35 | .5 | destination_port: "domain" (53) (Domain Name Server) 0x918-0x919.7 (2) +0x0910| 00 34 | .4 | length: 52 0x91a-0x91b.7 (2) +0x0910| 04 67 | .g | checksum: 0x467 0x91c-0x91d.7 (2) + | | | data: {} (dns) 0x91e-0x949.7 (44) + | | | header: {} 0x91e-0x921.7 (4) +0x0910| f3 03| ..| id: 62211 0x91e-0x91f.7 (2) +0x0920|01 |. | qr: "query" (0) 0x920-0x920 (0.1) +0x0920|01 |. | opcode: "Query" (0) 0x920.1-0x920.4 (0.4) +0x0920|01 |. | authoritative_answer: false 0x920.5-0x920.5 (0.1) +0x0920|01 |. | truncation: false 0x920.6-0x920.6 (0.1) +0x0920|01 |. | recursion_desired: true 0x920.7-0x920.7 (0.1) +0x0920| 00 | . | recursion_available: false 0x921-0x921 (0.1) +0x0920| 00 | . | z: 0 0x921.1-0x921.3 (0.3) +0x0920| 00 | . | rcode: "NoError" (0) (No error) 0x921.4-0x921.7 (0.4) +0x0920| 00 01 | .. | qd_count: 1 0x922-0x923.7 (2) +0x0920| 00 00 | .. | an_count: 0 0x924-0x925.7 (2) +0x0920| 00 00 | .. | ns_count: 0 0x926-0x927.7 (2) +0x0920| 00 00 | .. | ar_count: 0 0x928-0x929.7 (2) + | | | questions: [1] 0x92a-0x949.7 (32) + | | | [0]: question {} 0x92a-0x949.7 (32) + | | | name: {} 0x92a-0x945.7 (28) + | | | labels: [7] 0x92a-0x945.7 (28) + | | | [0]: label {} 0x92a-0x92d.7 (4) +0x0920| 03 | . | length: 3 0x92a-0x92a.7 (1) +0x0920| 31 33 39 | 139 | value: "139" 0x92b-0x92d.7 (3) + | | | [1]: label {} 0x92e-0x92f.7 (2) +0x0920| 01 | . | length: 1 0x92e-0x92e.7 (1) +0x0920| 31| 1| value: "1" 0x92f-0x92f.7 (1) + | | | [2]: label {} 0x930-0x933.7 (4) +0x0930|03 |. | length: 3 0x930-0x930.7 (1) +0x0930| 31 36 38 | 168 | value: "168" 0x931-0x933.7 (3) + | | | [3]: label {} 0x934-0x937.7 (4) +0x0930| 03 | . | length: 3 0x934-0x934.7 (1) +0x0930| 31 39 32 | 192 | value: "192" 0x935-0x937.7 (3) + | | | [4]: label {} 0x938-0x93f.7 (8) +0x0930| 07 | . | length: 7 0x938-0x938.7 (1) +0x0930| 69 6e 2d 61 64 64 72| in-addr| value: "in-addr" 0x939-0x93f.7 (7) + | | | [5]: label {} 0x940-0x944.7 (5) +0x0940|04 |. | length: 4 0x940-0x940.7 (1) +0x0940| 61 72 70 61 | arpa | value: "arpa" 0x941-0x944.7 (4) + | | | [6]: label {} 0x945-0x945.7 (1) +0x0940| 00 | . | length: 0 0x945-0x945.7 (1) + | | | value: "139.1.168.192.in-addr.arpa" 0x946-NA (0) +0x0940| 00 0c | .. | type: "PTR" (12) 0x946-0x947.7 (2) +0x0940| 00 01 | .. | class: "IN" (1) (Internet) 0x948-0x949.7 (2) + | | | answers: [0] 0x94a-NA (0) + | | | nameservers: [0] 0x94a-NA (0) + | | | additionals: [0] 0x94a-NA (0) + | | | capture_padding: raw bits 0x94a-NA (0) +0x0940| 00 00 | .. | padding: raw bits 0x94a-0x94b.7 (2) + | | | options: [0] 0x94c-NA (0) +0x0940| 78 00 00 00| x...| footer_length: 120 0x94c-0x94f.7 (4) + | | | [17]: block {} 0x950-0x9cb.7 (124) +0x0950|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x950-0x953.7 (4) +0x0950| 7c 00 00 00 | |... | length: 124 0x954-0x957.7 (4) +0x0950| 00 00 00 00 | .... | interface_id: 0 0x958-0x95b.7 (4) +0x0950| 72 1d 05 00| r...| timestamp_high: 335218 0x95c-0x95f.7 (4) +0x0960|40 e6 69 c9 |@.i. | timestamp_low: 3379160640 0x960-0x963.7 (4) +0x0960| 5a 00 00 00 | Z... | capture_packet_length: 90 0x964-0x967.7 (4) +0x0960| 5a 00 00 00 | Z... | original_packet_length: 90 0x968-0x96b.7 (4) + | | | packet: {} (ether8023) 0x96c-0x9c5.7 (90) +0x0960| 94 10 3e 05| ..>.| destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x96c-0x971.7 (6) +0x0970|36 d3 |6. | +0x0970| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x972-0x977.7 (6) +0x0970| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x978-0x979.7 (2) + | | | packet: {} (ipv4) 0x97a-0x9c5.7 (76) +0x0970| 45 | E | version: 4 0x97a-0x97a.3 (0.4) +0x0970| 45 | E | ihl: 5 0x97a.4-0x97a.7 (0.4) +0x0970| c0 | . | dscp: 48 0x97b-0x97b.5 (0.6) +0x0970| c0 | . | ecn: 0 0x97b.6-0x97b.7 (0.2) +0x0970| 00 4c | .L | total_length: 76 0x97c-0x97d.7 (2) +0x0970| 6e 26| n&| identification: 28198 0x97e-0x97f.7 (2) +0x0980|00 |. | reserved: 0 0x980-0x980 (0.1) +0x0980|00 |. | dont_fragment: false 0x980.1-0x980.1 (0.1) +0x0980|00 |. | more_fragments: false 0x980.2-0x980.2 (0.1) +0x0980|00 00 |.. | fragment_offset: 0 0x980.3-0x981.7 (1.5) +0x0980| 40 | @ | ttl: 64 0x982-0x982.7 (1) +0x0980| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x983-0x983.7 (1) +0x0980| 2a 8e | *. | header_checksum: 0x2a8e 0x984-0x985.7 (2) +0x0980| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x986-0x989.7 (4) +0x0980| 11 fd 0c fd | .... | destination_ip: "17.253.12.253" (0x11fd0cfd) 0x98a-0x98d.7 (4) + | | | data: {} (udp) 0x98e-0x9c5.7 (56) +0x0980| 00 7b| .{| source_port: "ntp" (123) (Network Time Protocol) 0x98e-0x98f.7 (2) +0x0990|00 7b |.{ | destination_port: "ntp" (123) (Network Time Protocol) 0x990-0x991.7 (2) +0x0990| 00 38 | .8 | length: 56 0x992-0x993.7 (2) +0x0990| 28 7f | (. | checksum: 0x287f 0x994-0x995.7 (2) +0x0990| 23 02 0a ec 00 00 0d 0b 00 00| #.........| data: raw bits 0x996-0x9c5.7 (48) +0x09a0|0a f6 11 fd 0c fd d9 7b 62 3c bf e4 9d cd d9 7b|.......{b<.....{| +* |until 0x9c5.7 (48) | | + | | | capture_padding: raw bits 0x9c6-NA (0) +0x09c0| 00 00 | .. | padding: raw bits 0x9c6-0x9c7.7 (2) + | | | options: [0] 0x9c8-NA (0) +0x09c0| 7c 00 00 00 | |... | footer_length: 124 0x9c8-0x9cb.7 (4) + | | | [18]: block {} 0x9cc-0xa5b.7 (144) +0x09c0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x9cc-0x9cf.7 (4) +0x09d0|90 00 00 00 |.... | length: 144 0x9d0-0x9d3.7 (4) +0x09d0| 00 00 00 00 | .... | interface_id: 0 0x9d4-0x9d7.7 (4) +0x09d0| 72 1d 05 00 | r... | timestamp_high: 335218 0x9d8-0x9db.7 (4) +0x09d0| b2 b0 6a c9| ..j.| timestamp_low: 3379212466 0x9dc-0x9df.7 (4) +0x09e0|70 00 00 00 |p... | capture_packet_length: 112 0x9e0-0x9e3.7 (4) +0x09e0| 70 00 00 00 | p... | original_packet_length: 112 0x9e4-0x9e7.7 (4) + | | | packet: {} (ether8023) 0x9e8-0xa57.7 (112) +0x09e0| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x9e8-0x9ed.7 (6) +0x09e0| 94 10| ..| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x9ee-0x9f3.7 (6) +0x09f0|3e 05 36 d3 |>.6. | +0x09f0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x9f4-0x9f5.7 (2) + | | | packet: {} (ipv4) 0x9f6-0xa57.7 (98) +0x09f0| 45 | E | version: 4 0x9f6-0x9f6.3 (0.4) +0x09f0| 45 | E | ihl: 5 0x9f6.4-0x9f6.7 (0.4) +0x09f0| 00 | . | dscp: 0 0x9f7-0x9f7.5 (0.6) +0x09f0| 00 | . | ecn: 0 0x9f7.6-0x9f7.7 (0.2) +0x09f0| 00 62 | .b | total_length: 98 0x9f8-0x9f9.7 (2) +0x09f0| 00 00 | .. | identification: 0 0x9fa-0x9fb.7 (2) +0x09f0| 40 | @ | reserved: 0 0x9fc-0x9fc (0.1) +0x09f0| 40 | @ | dont_fragment: true 0x9fc.1-0x9fc.1 (0.1) +0x09f0| 40 | @ | more_fragments: false 0x9fc.2-0x9fc.2 (0.1) +0x09f0| 40 00 | @. | fragment_offset: 0 0x9fc.3-0x9fd.7 (1.5) +0x09f0| 40 | @ | ttl: 64 0x9fe-0x9fe.7 (1) +0x09f0| 11| .| protocol: "udp" (17) (user datagram protocol) 0x9ff-0x9ff.7 (1) +0x0a00|b6 ae |.. | header_checksum: 0xb6ae 0xa00-0xa01.7 (2) +0x0a00| c0 a8 01 01 | .... | source_ip: "192.168.1.1" (0xc0a80101) 0xa02-0xa05.7 (4) +0x0a00| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0xa06-0xa09.7 (4) + | | | data: {} (udp) 0xa0a-0xa57.7 (78) +0x0a00| 00 35 | .5 | source_port: "domain" (53) (Domain Name Server) 0xa0a-0xa0b.7 (2) +0x0a00| c2 54 | .T | destination_port: 49748 0xa0c-0xa0d.7 (2) +0x0a00| 00 4e| .N| length: 78 0xa0e-0xa0f.7 (2) +0x0a10|69 97 |i. | checksum: 0x6997 0xa10-0xa11.7 (2) + | | | data: {} (dns) 0xa12-0xa57.7 (70) + | | | header: {} 0xa12-0xa15.7 (4) +0x0a10| f3 03 | .. | id: 62211 0xa12-0xa13.7 (2) +0x0a10| 85 | . | qr: "response" (1) 0xa14-0xa14 (0.1) +0x0a10| 85 | . | opcode: "Query" (0) 0xa14.1-0xa14.4 (0.4) +0x0a10| 85 | . | authoritative_answer: true 0xa14.5-0xa14.5 (0.1) +0x0a10| 85 | . | truncation: false 0xa14.6-0xa14.6 (0.1) +0x0a10| 85 | . | recursion_desired: true 0xa14.7-0xa14.7 (0.1) +0x0a10| 80 | . | recursion_available: true 0xa15-0xa15 (0.1) +0x0a10| 80 | . | z: 0 0xa15.1-0xa15.3 (0.3) +0x0a10| 80 | . | rcode: "NoError" (0) (No error) 0xa15.4-0xa15.7 (0.4) +0x0a10| 00 01 | .. | qd_count: 1 0xa16-0xa17.7 (2) +0x0a10| 00 01 | .. | an_count: 1 0xa18-0xa19.7 (2) +0x0a10| 00 00 | .. | ns_count: 0 0xa1a-0xa1b.7 (2) +0x0a10| 00 00 | .. | ar_count: 0 0xa1c-0xa1d.7 (2) + | | | questions: [1] 0xa1e-0xa3d.7 (32) + | | | [0]: question {} 0xa1e-0xa3d.7 (32) + | | | name: {} 0xa1e-0xa39.7 (28) + | | | labels: [7] 0xa1e-0xa39.7 (28) + | | | [0]: label {} 0xa1e-0xa21.7 (4) +0x0a10| 03 | . | length: 3 0xa1e-0xa1e.7 (1) +0x0a10| 31| 1| value: "139" 0xa1f-0xa21.7 (3) +0x0a20|33 39 |39 | + | | | [1]: label {} 0xa22-0xa23.7 (2) +0x0a20| 01 | . | length: 1 0xa22-0xa22.7 (1) +0x0a20| 31 | 1 | value: "1" 0xa23-0xa23.7 (1) + | | | [2]: label {} 0xa24-0xa27.7 (4) +0x0a20| 03 | . | length: 3 0xa24-0xa24.7 (1) +0x0a20| 31 36 38 | 168 | value: "168" 0xa25-0xa27.7 (3) + | | | [3]: label {} 0xa28-0xa2b.7 (4) +0x0a20| 03 | . | length: 3 0xa28-0xa28.7 (1) +0x0a20| 31 39 32 | 192 | value: "192" 0xa29-0xa2b.7 (3) + | | | [4]: label {} 0xa2c-0xa33.7 (8) +0x0a20| 07 | . | length: 7 0xa2c-0xa2c.7 (1) +0x0a20| 69 6e 2d| in-| value: "in-addr" 0xa2d-0xa33.7 (7) +0x0a30|61 64 64 72 |addr | + | | | [5]: label {} 0xa34-0xa38.7 (5) +0x0a30| 04 | . | length: 4 0xa34-0xa34.7 (1) +0x0a30| 61 72 70 61 | arpa | value: "arpa" 0xa35-0xa38.7 (4) + | | | [6]: label {} 0xa39-0xa39.7 (1) +0x0a30| 00 | . | length: 0 0xa39-0xa39.7 (1) + | | | value: "139.1.168.192.in-addr.arpa" 0xa3a-NA (0) +0x0a30| 00 0c | .. | type: "PTR" (12) 0xa3a-0xa3b.7 (2) +0x0a30| 00 01 | .. | class: "IN" (1) (Internet) 0xa3c-0xa3d.7 (2) + | | | answers: [1] 0xa1e-0xa57.7 (58) + | | | [0]: answer {} 0xa1e-0xa57.7 (58) + | | | name: {} 0xa1e-0xa3f.7 (34) + | | | labels: [7] 0xa1e-0xa3f.7 (34) + | | | [0]: label {} 0xa1e-0xa3f.7 (34) +0x0a10| 03 | . | length: 3 0xa1e-0xa1e.7 (1) +0x0a10| 31| 1| value: "139" 0xa1f-0xa21.7 (3) +0x0a20|33 39 |39 | +0x0a30| c0 | . | is_pointer: 3 0xa3e-0xa3e.1 (0.2) +0x0a30| c0 0c| ..| pointer: 12 0xa3e.2-0xa3f.7 (1.6) + | | | [1]: label {} 0xa22-0xa23.7 (2) +0x0a20| 01 | . | length: 1 0xa22-0xa22.7 (1) +0x0a20| 31 | 1 | value: "1" 0xa23-0xa23.7 (1) + | | | [2]: label {} 0xa24-0xa27.7 (4) +0x0a20| 03 | . | length: 3 0xa24-0xa24.7 (1) +0x0a20| 31 36 38 | 168 | value: "168" 0xa25-0xa27.7 (3) + | | | [3]: label {} 0xa28-0xa2b.7 (4) +0x0a20| 03 | . | length: 3 0xa28-0xa28.7 (1) +0x0a20| 31 39 32 | 192 | value: "192" 0xa29-0xa2b.7 (3) + | | | [4]: label {} 0xa2c-0xa33.7 (8) +0x0a20| 07 | . | length: 7 0xa2c-0xa2c.7 (1) +0x0a20| 69 6e 2d| in-| value: "in-addr" 0xa2d-0xa33.7 (7) +0x0a30|61 64 64 72 |addr | + | | | [5]: label {} 0xa34-0xa38.7 (5) +0x0a30| 04 | . | length: 4 0xa34-0xa34.7 (1) +0x0a30| 61 72 70 61 | arpa | value: "arpa" 0xa35-0xa38.7 (4) + | | | [6]: label {} 0xa39-0xa39.7 (1) +0x0a30| 00 | . | length: 0 0xa39-0xa39.7 (1) + | | | value: "139.1.168.192.in-addr.arpa" 0xa3a-NA (0) +0x0a40|00 0c |.. | type: "PTR" (12) 0xa40-0xa41.7 (2) +0x0a40| 00 01 | .. | class: "IN" (1) (Internet) 0xa42-0xa43.7 (2) +0x0a40| 00 00 00 00 | .... | ttl: 0 0xa44-0xa47.7 (4) +0x0a40| 00 0e | .. | rdlength: 14 0xa48-0xa49.7 (2) + | | | ptr: {} 0xa4a-0xa57.7 (14) + | | | labels: [2] 0xa4a-0xa57.7 (14) + | | | [0]: label {} 0xa4a-0xa56.7 (13) +0x0a40| 0c | . | length: 12 0xa4a-0xa4a.7 (1) +0x0a40| 48 61 64 72 69| Hadri| value: "Hadriels-MBP" 0xa4b-0xa56.7 (12) +0x0a50|65 6c 73 2d 4d 42 50 |els-MBP | + | | | [1]: label {} 0xa57-0xa57.7 (1) +0x0a50| 00 | . | length: 0 0xa57-0xa57.7 (1) + | | | value: "Hadriels-MBP" 0xa58-NA (0) + | | | nameservers: [0] 0xa58-NA (0) + | | | additionals: [0] 0xa58-NA (0) + | | | capture_padding: raw bits 0xa58-NA (0) + | | | padding: raw bits 0xa58-NA (0) + | | | options: [0] 0xa58-NA (0) +0x0a50| 90 00 00 00 | .... | footer_length: 144 0xa58-0xa5b.7 (4) + | | | [19]: block {} 0xa5c-0xad3.7 (120) +0x0a50| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xa5c-0xa5f.7 (4) +0x0a60|78 00 00 00 |x... | length: 120 0xa60-0xa63.7 (4) +0x0a60| 00 00 00 00 | .... | interface_id: 0 0xa64-0xa67.7 (4) +0x0a60| 72 1d 05 00 | r... | timestamp_high: 335218 0xa68-0xa6b.7 (4) +0x0a60| 9a b3 6a c9| ..j.| timestamp_low: 3379213210 0xa6c-0xa6f.7 (4) +0x0a70|58 00 00 00 |X... | capture_packet_length: 88 0xa70-0xa73.7 (4) +0x0a70| 58 00 00 00 | X... | original_packet_length: 88 0xa74-0xa77.7 (4) + | | | packet: {} (ether8023) 0xa78-0xacf.7 (88) +0x0a70| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xa78-0xa7d.7 (6) +0x0a70| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xa7e-0xa83.7 (6) +0x0a80|60 f1 7d 93 |`.}. | +0x0a80| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xa84-0xa85.7 (2) + | | | packet: {} (ipv4) 0xa86-0xacf.7 (74) +0x0a80| 45 | E | version: 4 0xa86-0xa86.3 (0.4) +0x0a80| 45 | E | ihl: 5 0xa86.4-0xa86.7 (0.4) +0x0a80| 00 | . | dscp: 0 0xa87-0xa87.5 (0.6) +0x0a80| 00 | . | ecn: 0 0xa87.6-0xa87.7 (0.2) +0x0a80| 00 4a | .J | total_length: 74 0xa88-0xa89.7 (2) +0x0a80| 52 6f | Ro | identification: 21103 0xa8a-0xa8b.7 (2) +0x0a80| 00 | . | reserved: 0 0xa8c-0xa8c (0.1) +0x0a80| 00 | . | dont_fragment: false 0xa8c.1-0xa8c.1 (0.1) +0x0a80| 00 | . | more_fragments: false 0xa8c.2-0xa8c.2 (0.1) +0x0a80| 00 00 | .. | fragment_offset: 0 0xa8c.3-0xa8d.7 (1.5) +0x0a80| ff | . | ttl: 255 0xa8e-0xa8e.7 (1) +0x0a80| 11| .| protocol: "udp" (17) (user datagram protocol) 0xa8f-0xa8f.7 (1) +0x0a90|e5 56 |.V | header_checksum: 0xe556 0xa90-0xa91.7 (2) +0x0a90| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0xa92-0xa95.7 (4) +0x0a90| c0 a8 01 01 | .... | destination_ip: "192.168.1.1" (0xc0a80101) 0xa96-0xa99.7 (4) + | | | data: {} (udp) 0xa9a-0xacf.7 (54) +0x0a90| fe 21 | .! | source_port: 65057 0xa9a-0xa9b.7 (2) +0x0a90| 00 35 | .5 | destination_port: "domain" (53) (Domain Name Server) 0xa9c-0xa9d.7 (2) +0x0a90| 00 36| .6| length: 54 0xa9e-0xa9f.7 (2) +0x0aa0|95 79 |.y | checksum: 0x9579 0xaa0-0xaa1.7 (2) + | | | data: {} (dns) 0xaa2-0xacf.7 (46) + | | | header: {} 0xaa2-0xaa5.7 (4) +0x0aa0| f1 ea | .. | id: 61930 0xaa2-0xaa3.7 (2) +0x0aa0| 01 | . | qr: "query" (0) 0xaa4-0xaa4 (0.1) +0x0aa0| 01 | . | opcode: "Query" (0) 0xaa4.1-0xaa4.4 (0.4) +0x0aa0| 01 | . | authoritative_answer: false 0xaa4.5-0xaa4.5 (0.1) +0x0aa0| 01 | . | truncation: false 0xaa4.6-0xaa4.6 (0.1) +0x0aa0| 01 | . | recursion_desired: true 0xaa4.7-0xaa4.7 (0.1) +0x0aa0| 00 | . | recursion_available: false 0xaa5-0xaa5 (0.1) +0x0aa0| 00 | . | z: 0 0xaa5.1-0xaa5.3 (0.3) +0x0aa0| 00 | . | rcode: "NoError" (0) (No error) 0xaa5.4-0xaa5.7 (0.4) +0x0aa0| 00 01 | .. | qd_count: 1 0xaa6-0xaa7.7 (2) +0x0aa0| 00 00 | .. | an_count: 0 0xaa8-0xaa9.7 (2) +0x0aa0| 00 00 | .. | ns_count: 0 0xaaa-0xaab.7 (2) +0x0aa0| 00 00 | .. | ar_count: 0 0xaac-0xaad.7 (2) + | | | questions: [1] 0xaae-0xacf.7 (34) + | | | [0]: question {} 0xaae-0xacf.7 (34) + | | | name: {} 0xaae-0xacb.7 (30) + | | | labels: [7] 0xaae-0xacb.7 (30) + | | | [0]: label {} 0xaae-0xab1.7 (4) +0x0aa0| 03 | . | length: 3 0xaae-0xaae.7 (1) +0x0aa0| 32| 2| value: "255" 0xaaf-0xab1.7 (3) +0x0ab0|35 35 |55 | + | | | [1]: label {} 0xab2-0xab5.7 (4) +0x0ab0| 03 | . | length: 3 0xab2-0xab2.7 (1) +0x0ab0| 32 35 35 | 255 | value: "255" 0xab3-0xab5.7 (3) + | | | [2]: label {} 0xab6-0xab9.7 (4) +0x0ab0| 03 | . | length: 3 0xab6-0xab6.7 (1) +0x0ab0| 32 35 35 | 255 | value: "255" 0xab7-0xab9.7 (3) + | | | [3]: label {} 0xaba-0xabd.7 (4) +0x0ab0| 03 | . | length: 3 0xaba-0xaba.7 (1) +0x0ab0| 32 35 35 | 255 | value: "255" 0xabb-0xabd.7 (3) + | | | [4]: label {} 0xabe-0xac5.7 (8) +0x0ab0| 07 | . | length: 7 0xabe-0xabe.7 (1) +0x0ab0| 69| i| value: "in-addr" 0xabf-0xac5.7 (7) +0x0ac0|6e 2d 61 64 64 72 |n-addr | + | | | [5]: label {} 0xac6-0xaca.7 (5) +0x0ac0| 04 | . | length: 4 0xac6-0xac6.7 (1) +0x0ac0| 61 72 70 61 | arpa | value: "arpa" 0xac7-0xaca.7 (4) + | | | [6]: label {} 0xacb-0xacb.7 (1) +0x0ac0| 00 | . | length: 0 0xacb-0xacb.7 (1) + | | | value: "255.255.255.255.in-addr.arpa" 0xacc-NA (0) +0x0ac0| 00 0c | .. | type: "PTR" (12) 0xacc-0xacd.7 (2) +0x0ac0| 00 01| ..| class: "IN" (1) (Internet) 0xace-0xacf.7 (2) + | | | answers: [0] 0xad0-NA (0) + | | | nameservers: [0] 0xad0-NA (0) + | | | additionals: [0] 0xad0-NA (0) + | | | capture_padding: raw bits 0xad0-NA (0) + | | | padding: raw bits 0xad0-NA (0) + | | | options: [0] 0xad0-NA (0) +0x0ad0|78 00 00 00 |x... | footer_length: 120 0xad0-0xad3.7 (4) + | | | [20]: block {} 0xad4-0xb8b.7 (184) +0x0ad0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xad4-0xad7.7 (4) +0x0ad0| b8 00 00 00 | .... | length: 184 0xad8-0xadb.7 (4) +0x0ad0| 00 00 00 00| ....| interface_id: 0 0xadc-0xadf.7 (4) +0x0ae0|72 1d 05 00 |r... | timestamp_high: 335218 0xae0-0xae3.7 (4) +0x0ae0| fd 3a 6b c9 | .:k. | timestamp_low: 3379247869 0xae4-0xae7.7 (4) +0x0ae0| 97 00 00 00 | .... | capture_packet_length: 151 0xae8-0xaeb.7 (4) +0x0ae0| 97 00 00 00| ....| original_packet_length: 151 0xaec-0xaef.7 (4) + | | | packet: {} (ether8023) 0xaf0-0xb86.7 (151) +0x0af0|a4 5e 60 f1 7d 93 |.^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xaf0-0xaf5.7 (6) +0x0af0| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xaf6-0xafb.7 (6) +0x0af0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xafc-0xafd.7 (2) + | | | packet: {} (ipv4) 0xafe-0xb86.7 (137) +0x0af0| 45 | E | version: 4 0xafe-0xafe.3 (0.4) +0x0af0| 45 | E | ihl: 5 0xafe.4-0xafe.7 (0.4) +0x0af0| 00| .| dscp: 0 0xaff-0xaff.5 (0.6) +0x0af0| 00| .| ecn: 0 0xaff.6-0xaff.7 (0.2) +0x0b00|00 89 |.. | total_length: 137 0xb00-0xb01.7 (2) +0x0b00| 00 00 | .. | identification: 0 0xb02-0xb03.7 (2) +0x0b00| 40 | @ | reserved: 0 0xb04-0xb04 (0.1) +0x0b00| 40 | @ | dont_fragment: true 0xb04.1-0xb04.1 (0.1) +0x0b00| 40 | @ | more_fragments: false 0xb04.2-0xb04.2 (0.1) +0x0b00| 40 00 | @. | fragment_offset: 0 0xb04.3-0xb05.7 (1.5) +0x0b00| 40 | @ | ttl: 64 0xb06-0xb06.7 (1) +0x0b00| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xb07-0xb07.7 (1) +0x0b00| b6 87 | .. | header_checksum: 0xb687 0xb08-0xb09.7 (2) +0x0b00| c0 a8 01 01 | .... | source_ip: "192.168.1.1" (0xc0a80101) 0xb0a-0xb0d.7 (4) +0x0b00| c0 a8| ..| destination_ip: "192.168.1.139" (0xc0a8018b) 0xb0e-0xb11.7 (4) +0x0b10|01 8b |.. | + | | | data: {} (udp) 0xb12-0xb86.7 (117) +0x0b10| 00 35 | .5 | source_port: "domain" (53) (Domain Name Server) 0xb12-0xb13.7 (2) +0x0b10| fe 21 | .! | destination_port: 65057 0xb14-0xb15.7 (2) +0x0b10| 00 75 | .u | length: 117 0xb16-0xb17.7 (2) +0x0b10| ff 57 | .W | checksum: 0xff57 0xb18-0xb19.7 (2) + | | | data: {} (dns) 0xb1a-0xb86.7 (109) + | | | header: {} 0xb1a-0xb1d.7 (4) +0x0b10| f1 ea | .. | id: 61930 0xb1a-0xb1b.7 (2) +0x0b10| 85 | . | qr: "response" (1) 0xb1c-0xb1c (0.1) +0x0b10| 85 | . | opcode: "Query" (0) 0xb1c.1-0xb1c.4 (0.4) +0x0b10| 85 | . | authoritative_answer: true 0xb1c.5-0xb1c.5 (0.1) +0x0b10| 85 | . | truncation: false 0xb1c.6-0xb1c.6 (0.1) +0x0b10| 85 | . | recursion_desired: true 0xb1c.7-0xb1c.7 (0.1) +0x0b10| 80 | . | recursion_available: true 0xb1d-0xb1d (0.1) +0x0b10| 80 | . | z: 0 0xb1d.1-0xb1d.3 (0.3) +0x0b10| 80 | . | rcode: "NoError" (0) (No error) 0xb1d.4-0xb1d.7 (0.4) +0x0b10| 00 01| ..| qd_count: 1 0xb1e-0xb1f.7 (2) +0x0b20|00 00 |.. | an_count: 0 0xb20-0xb21.7 (2) +0x0b20| 00 01 | .. | ns_count: 1 0xb22-0xb23.7 (2) +0x0b20| 00 00 | .. | ar_count: 0 0xb24-0xb25.7 (2) + | | | questions: [1] 0xb26-0xb47.7 (34) + | | | [0]: question {} 0xb26-0xb47.7 (34) + | | | name: {} 0xb26-0xb43.7 (30) + | | | labels: [7] 0xb26-0xb43.7 (30) + | | | [0]: label {} 0xb26-0xb29.7 (4) +0x0b20| 03 | . | length: 3 0xb26-0xb26.7 (1) +0x0b20| 32 35 35 | 255 | value: "255" 0xb27-0xb29.7 (3) + | | | [1]: label {} 0xb2a-0xb2d.7 (4) +0x0b20| 03 | . | length: 3 0xb2a-0xb2a.7 (1) +0x0b20| 32 35 35 | 255 | value: "255" 0xb2b-0xb2d.7 (3) + | | | [2]: label {} 0xb2e-0xb31.7 (4) +0x0b20| 03 | . | length: 3 0xb2e-0xb2e.7 (1) +0x0b20| 32| 2| value: "255" 0xb2f-0xb31.7 (3) +0x0b30|35 35 |55 | + | | | [3]: label {} 0xb32-0xb35.7 (4) +0x0b30| 03 | . | length: 3 0xb32-0xb32.7 (1) +0x0b30| 32 35 35 | 255 | value: "255" 0xb33-0xb35.7 (3) + | | | [4]: label {} 0xb36-0xb3d.7 (8) +0x0b30| 07 | . | length: 7 0xb36-0xb36.7 (1) +0x0b30| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0xb37-0xb3d.7 (7) + | | | [5]: label {} 0xb3e-0xb42.7 (5) +0x0b30| 04 | . | length: 4 0xb3e-0xb3e.7 (1) +0x0b30| 61| a| value: "arpa" 0xb3f-0xb42.7 (4) +0x0b40|72 70 61 |rpa | + | | | [6]: label {} 0xb43-0xb43.7 (1) +0x0b40| 00 | . | length: 0 0xb43-0xb43.7 (1) + | | | value: "255.255.255.255.in-addr.arpa" 0xb44-NA (0) +0x0b40| 00 0c | .. | type: "PTR" (12) 0xb44-0xb45.7 (2) +0x0b40| 00 01 | .. | class: "IN" (1) (Internet) 0xb46-0xb47.7 (2) + | | | answers: [0] 0xb48-NA (0) + | | | nameservers: [1] 0xb48-0xb86.7 (63) + | | | [0]: nameserver {} 0xb48-0xb86.7 (63) + | | | name: {} 0xb48-0xb65.7 (30) + | | | labels: [7] 0xb48-0xb65.7 (30) + | | | [0]: label {} 0xb48-0xb4b.7 (4) +0x0b40| 03 | . | length: 3 0xb48-0xb48.7 (1) +0x0b40| 32 35 35 | 255 | value: "255" 0xb49-0xb4b.7 (3) + | | | [1]: label {} 0xb4c-0xb4f.7 (4) +0x0b40| 03 | . | length: 3 0xb4c-0xb4c.7 (1) +0x0b40| 32 35 35| 255| value: "255" 0xb4d-0xb4f.7 (3) + | | | [2]: label {} 0xb50-0xb53.7 (4) +0x0b50|03 |. | length: 3 0xb50-0xb50.7 (1) +0x0b50| 32 35 35 | 255 | value: "255" 0xb51-0xb53.7 (3) + | | | [3]: label {} 0xb54-0xb57.7 (4) +0x0b50| 03 | . | length: 3 0xb54-0xb54.7 (1) +0x0b50| 32 35 35 | 255 | value: "255" 0xb55-0xb57.7 (3) + | | | [4]: label {} 0xb58-0xb5f.7 (8) +0x0b50| 07 | . | length: 7 0xb58-0xb58.7 (1) +0x0b50| 49 4e 2d 41 44 44 52| IN-ADDR| value: "IN-ADDR" 0xb59-0xb5f.7 (7) + | | | [5]: label {} 0xb60-0xb64.7 (5) +0x0b60|04 |. | length: 4 0xb60-0xb60.7 (1) +0x0b60| 41 52 50 41 | ARPA | value: "ARPA" 0xb61-0xb64.7 (4) + | | | [6]: label {} 0xb65-0xb65.7 (1) +0x0b60| 00 | . | length: 0 0xb65-0xb65.7 (1) + | | | value: "255.255.255.255.IN-ADDR.ARPA" 0xb66-NA (0) + | | | mname: {} 0xb48-0xb71.7 (42) + | | | labels: [7] 0xb48-0xb71.7 (42) + | | | [0]: label {} 0xb48-0xb71.7 (42) +0x0b40| 03 | . | length: 3 0xb48-0xb48.7 (1) +0x0b40| 32 35 35 | 255 | value: "255" 0xb49-0xb4b.7 (3) +0x0b70|c0 |. | is_pointer: 3 0xb70-0xb70.1 (0.2) +0x0b70|c0 2e |.. | pointer: 46 0xb70.2-0xb71.7 (1.6) + | | | [1]: label {} 0xb4c-0xb4f.7 (4) +0x0b40| 03 | . | length: 3 0xb4c-0xb4c.7 (1) +0x0b40| 32 35 35| 255| value: "255" 0xb4d-0xb4f.7 (3) + | | | [2]: label {} 0xb50-0xb53.7 (4) +0x0b50|03 |. | length: 3 0xb50-0xb50.7 (1) +0x0b50| 32 35 35 | 255 | value: "255" 0xb51-0xb53.7 (3) + | | | [3]: label {} 0xb54-0xb57.7 (4) +0x0b50| 03 | . | length: 3 0xb54-0xb54.7 (1) +0x0b50| 32 35 35 | 255 | value: "255" 0xb55-0xb57.7 (3) + | | | [4]: label {} 0xb58-0xb5f.7 (8) +0x0b50| 07 | . | length: 7 0xb58-0xb58.7 (1) +0x0b50| 49 4e 2d 41 44 44 52| IN-ADDR| value: "IN-ADDR" 0xb59-0xb5f.7 (7) + | | | [5]: label {} 0xb60-0xb64.7 (5) +0x0b60|04 |. | length: 4 0xb60-0xb60.7 (1) +0x0b60| 41 52 50 41 | ARPA | value: "ARPA" 0xb61-0xb64.7 (4) + | | | [6]: label {} 0xb65-0xb65.7 (1) +0x0b60| 00 | . | length: 0 0xb65-0xb65.7 (1) + | | | value: "255.255.255.255.IN-ADDR.ARPA" 0xb66-NA (0) +0x0b60| 00 06 | .. | type: "SOA" (6) 0xb66-0xb67.7 (2) +0x0b60| 00 01 | .. | class: "IN" (1) (Internet) 0xb68-0xb69.7 (2) +0x0b60| 00 01 51 80 | ..Q. | ttl: 86400 0xb6a-0xb6d.7 (4) +0x0b60| 00 17| ..| rdlength: 23 0xb6e-0xb6f.7 (2) + | | | rname: {} 0xb72-0xb72.7 (1) + | | | labels: [1] 0xb72-0xb72.7 (1) + | | | [0]: label {} 0xb72-0xb72.7 (1) +0x0b70| 00 | . | length: 0 0xb72-0xb72.7 (1) + | | | value: "" 0xb73-NA (0) +0x0b70| 00 00 00 00 | .... | serial: 0 0xb73-0xb76.7 (4) +0x0b70| 00 00 70 80 | ..p. | refresh: 28800 0xb77-0xb7a.7 (4) +0x0b70| 00 00 1c 20 | ... | retry: 7200 0xb7b-0xb7e.7 (4) +0x0b70| 00| .| expire: 604800 0xb7f-0xb82.7 (4) +0x0b80|09 3a 80 |.:. | +0x0b80| 00 01 51 80 | ..Q. | minimum: 86400 0xb83-0xb86.7 (4) + | | | additionals: [0] 0xb87-NA (0) + | | | capture_padding: raw bits 0xb87-NA (0) +0x0b80| 00 | . | padding: raw bits 0xb87-0xb87.7 (1) + | | | options: [0] 0xb88-NA (0) +0x0b80| b8 00 00 00 | .... | footer_length: 184 0xb88-0xb8b.7 (4) + | | | [21]: block {} 0xb8c-0xc03.7 (120) +0x0b80| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xb8c-0xb8f.7 (4) +0x0b90|78 00 00 00 |x... | length: 120 0xb90-0xb93.7 (4) +0x0b90| 00 00 00 00 | .... | interface_id: 0 0xb94-0xb97.7 (4) +0x0b90| 72 1d 05 00 | r... | timestamp_high: 335218 0xb98-0xb9b.7 (4) +0x0b90| 1c 41 6b c9| .Ak.| timestamp_low: 3379249436 0xb9c-0xb9f.7 (4) +0x0ba0|56 00 00 00 |V... | capture_packet_length: 86 0xba0-0xba3.7 (4) +0x0ba0| 56 00 00 00 | V... | original_packet_length: 86 0xba4-0xba7.7 (4) + | | | packet: {} (ether8023) 0xba8-0xbfd.7 (86) +0x0ba0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xba8-0xbad.7 (6) +0x0ba0| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xbae-0xbb3.7 (6) +0x0bb0|60 f1 7d 93 |`.}. | +0x0bb0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xbb4-0xbb5.7 (2) + | | | packet: {} (ipv4) 0xbb6-0xbfd.7 (72) +0x0bb0| 45 | E | version: 4 0xbb6-0xbb6.3 (0.4) +0x0bb0| 45 | E | ihl: 5 0xbb6.4-0xbb6.7 (0.4) +0x0bb0| 00 | . | dscp: 0 0xbb7-0xbb7.5 (0.6) +0x0bb0| 00 | . | ecn: 0 0xbb7.6-0xbb7.7 (0.2) +0x0bb0| 00 48 | .H | total_length: 72 0xbb8-0xbb9.7 (2) +0x0bb0| 1e 68 | .h | identification: 7784 0xbba-0xbbb.7 (2) +0x0bb0| 00 | . | reserved: 0 0xbbc-0xbbc (0.1) +0x0bb0| 00 | . | dont_fragment: false 0xbbc.1-0xbbc.1 (0.1) +0x0bb0| 00 | . | more_fragments: false 0xbbc.2-0xbbc.2 (0.1) +0x0bb0| 00 00 | .. | fragment_offset: 0 0xbbc.3-0xbbd.7 (1.5) +0x0bb0| ff | . | ttl: 255 0xbbe-0xbbe.7 (1) +0x0bb0| 11| .| protocol: "udp" (17) (user datagram protocol) 0xbbf-0xbbf.7 (1) +0x0bc0|19 60 |.` | header_checksum: 0x1960 0xbc0-0xbc1.7 (2) +0x0bc0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0xbc2-0xbc5.7 (4) +0x0bc0| c0 a8 01 01 | .... | destination_ip: "192.168.1.1" (0xc0a80101) 0xbc6-0xbc9.7 (4) + | | | data: {} (udp) 0xbca-0xbfd.7 (52) +0x0bc0| ca 28 | .( | source_port: 51752 0xbca-0xbcb.7 (2) +0x0bc0| 00 35 | .5 | destination_port: "domain" (53) (Domain Name Server) 0xbcc-0xbcd.7 (2) +0x0bc0| 00 34| .4| length: 52 0xbce-0xbcf.7 (2) +0x0bd0|97 14 |.. | checksum: 0x9714 0xbd0-0xbd1.7 (2) + | | | data: {} (dns) 0xbd2-0xbfd.7 (44) + | | | header: {} 0xbd2-0xbd5.7 (4) +0x0bd0| 56 85 | V. | id: 22149 0xbd2-0xbd3.7 (2) +0x0bd0| 01 | . | qr: "query" (0) 0xbd4-0xbd4 (0.1) +0x0bd0| 01 | . | opcode: "Query" (0) 0xbd4.1-0xbd4.4 (0.4) +0x0bd0| 01 | . | authoritative_answer: false 0xbd4.5-0xbd4.5 (0.1) +0x0bd0| 01 | . | truncation: false 0xbd4.6-0xbd4.6 (0.1) +0x0bd0| 01 | . | recursion_desired: true 0xbd4.7-0xbd4.7 (0.1) +0x0bd0| 00 | . | recursion_available: false 0xbd5-0xbd5 (0.1) +0x0bd0| 00 | . | z: 0 0xbd5.1-0xbd5.3 (0.3) +0x0bd0| 00 | . | rcode: "NoError" (0) (No error) 0xbd5.4-0xbd5.7 (0.4) +0x0bd0| 00 01 | .. | qd_count: 1 0xbd6-0xbd7.7 (2) +0x0bd0| 00 00 | .. | an_count: 0 0xbd8-0xbd9.7 (2) +0x0bd0| 00 00 | .. | ns_count: 0 0xbda-0xbdb.7 (2) +0x0bd0| 00 00 | .. | ar_count: 0 0xbdc-0xbdd.7 (2) + | | | questions: [1] 0xbde-0xbfd.7 (32) + | | | [0]: question {} 0xbde-0xbfd.7 (32) + | | | name: {} 0xbde-0xbf9.7 (28) + | | | labels: [7] 0xbde-0xbf9.7 (28) + | | | [0]: label {} 0xbde-0xbe1.7 (4) +0x0bd0| 03 | . | length: 3 0xbde-0xbde.7 (1) +0x0bd0| 32| 2| value: "255" 0xbdf-0xbe1.7 (3) +0x0be0|35 35 |55 | + | | | [1]: label {} 0xbe2-0xbe3.7 (2) +0x0be0| 01 | . | length: 1 0xbe2-0xbe2.7 (1) +0x0be0| 31 | 1 | value: "1" 0xbe3-0xbe3.7 (1) + | | | [2]: label {} 0xbe4-0xbe7.7 (4) +0x0be0| 03 | . | length: 3 0xbe4-0xbe4.7 (1) +0x0be0| 31 36 38 | 168 | value: "168" 0xbe5-0xbe7.7 (3) + | | | [3]: label {} 0xbe8-0xbeb.7 (4) +0x0be0| 03 | . | length: 3 0xbe8-0xbe8.7 (1) +0x0be0| 31 39 32 | 192 | value: "192" 0xbe9-0xbeb.7 (3) + | | | [4]: label {} 0xbec-0xbf3.7 (8) +0x0be0| 07 | . | length: 7 0xbec-0xbec.7 (1) +0x0be0| 69 6e 2d| in-| value: "in-addr" 0xbed-0xbf3.7 (7) +0x0bf0|61 64 64 72 |addr | + | | | [5]: label {} 0xbf4-0xbf8.7 (5) +0x0bf0| 04 | . | length: 4 0xbf4-0xbf4.7 (1) +0x0bf0| 61 72 70 61 | arpa | value: "arpa" 0xbf5-0xbf8.7 (4) + | | | [6]: label {} 0xbf9-0xbf9.7 (1) +0x0bf0| 00 | . | length: 0 0xbf9-0xbf9.7 (1) + | | | value: "255.1.168.192.in-addr.arpa" 0xbfa-NA (0) +0x0bf0| 00 0c | .. | type: "PTR" (12) 0xbfa-0xbfb.7 (2) +0x0bf0| 00 01 | .. | class: "IN" (1) (Internet) 0xbfc-0xbfd.7 (2) + | | | answers: [0] 0xbfe-NA (0) + | | | nameservers: [0] 0xbfe-NA (0) + | | | additionals: [0] 0xbfe-NA (0) + | | | capture_padding: raw bits 0xbfe-NA (0) +0x0bf0| 00 00| ..| padding: raw bits 0xbfe-0xbff.7 (2) + | | | options: [0] 0xc00-NA (0) +0x0c00|78 00 00 00 |x... | footer_length: 120 0xc00-0xc03.7 (4) + | | | [22]: block {} 0xc04-0xc7f.7 (124) +0x0c00| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xc04-0xc07.7 (4) +0x0c00| 7c 00 00 00 | |... | length: 124 0xc08-0xc0b.7 (4) +0x0c00| 00 00 00 00| ....| interface_id: 0 0xc0c-0xc0f.7 (4) +0x0c10|72 1d 05 00 |r... | timestamp_high: 335218 0xc10-0xc13.7 (4) +0x0c10| 23 67 6b c9 | #gk. | timestamp_low: 3379259171 0xc14-0xc17.7 (4) +0x0c10| 5a 00 00 00 | Z... | capture_packet_length: 90 0xc18-0xc1b.7 (4) +0x0c10| 5a 00 00 00| Z...| original_packet_length: 90 0xc1c-0xc1f.7 (4) + | | | packet: {} (ether8023) 0xc20-0xc79.7 (90) +0x0c20|a4 5e 60 f1 7d 93 |.^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xc20-0xc25.7 (6) +0x0c20| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xc26-0xc2b.7 (6) +0x0c20| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xc2c-0xc2d.7 (2) + | | | packet: {} (ipv4) 0xc2e-0xc79.7 (76) +0x0c20| 45 | E | version: 4 0xc2e-0xc2e.3 (0.4) +0x0c20| 45 | E | ihl: 5 0xc2e.4-0xc2e.7 (0.4) +0x0c20| 28| (| dscp: 10 0xc2f-0xc2f.5 (0.6) +0x0c20| 28| (| ecn: 0 0xc2f.6-0xc2f.7 (0.2) +0x0c30|00 4c |.L | total_length: 76 0xc30-0xc31.7 (2) +0x0c30| 00 00 | .. | identification: 0 0xc32-0xc33.7 (2) +0x0c30| 40 | @ | reserved: 0 0xc34-0xc34 (0.1) +0x0c30| 40 | @ | dont_fragment: true 0xc34.1-0xc34.1 (0.1) +0x0c30| 40 | @ | more_fragments: false 0xc34.2-0xc34.2 (0.1) +0x0c30| 40 00 | @. | fragment_offset: 0 0xc34.3-0xc35.7 (1.5) +0x0c30| 34 | 4 | ttl: 52 0xc36-0xc36.7 (1) +0x0c30| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xc37-0xc37.7 (1) +0x0c30| 65 4c | eL | header_checksum: 0x654c 0xc38-0xc39.7 (2) +0x0c30| 11 fd 0c fd | .... | source_ip: "17.253.12.253" (0x11fd0cfd) 0xc3a-0xc3d.7 (4) +0x0c30| c0 a8| ..| destination_ip: "192.168.1.139" (0xc0a8018b) 0xc3e-0xc41.7 (4) +0x0c40|01 8b |.. | + | | | data: {} (udp) 0xc42-0xc79.7 (56) +0x0c40| 00 7b | .{ | source_port: "ntp" (123) (Network Time Protocol) 0xc42-0xc43.7 (2) +0x0c40| 00 7b | .{ | destination_port: "ntp" (123) (Network Time Protocol) 0xc44-0xc45.7 (2) +0x0c40| 00 38 | .8 | length: 56 0xc46-0xc47.7 (2) +0x0c40| ea 4f | .O | checksum: 0xea4f 0xc48-0xc49.7 (2) +0x0c40| 24 01 06 ec 00 00| $.....| data: raw bits 0xc4a-0xc79.7 (48) +0x0c50|00 00 00 00 00 47 47 50 53 73 d9 7b 64 77 91 fd|.....GGPSs.{dw..| +* |until 0xc79.7 (48) | | + | | | capture_padding: raw bits 0xc7a-NA (0) +0x0c70| 00 00 | .. | padding: raw bits 0xc7a-0xc7b.7 (2) + | | | options: [0] 0xc7c-NA (0) +0x0c70| 7c 00 00 00| |...| footer_length: 124 0xc7c-0xc7f.7 (4) + | | | [23]: block {} 0xc80-0xcf7.7 (120) +0x0c80|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xc80-0xc83.7 (4) +0x0c80| 78 00 00 00 | x... | length: 120 0xc84-0xc87.7 (4) +0x0c80| 00 00 00 00 | .... | interface_id: 0 0xc88-0xc8b.7 (4) +0x0c80| 72 1d 05 00| r...| timestamp_high: 335218 0xc8c-0xc8f.7 (4) +0x0c90|27 67 6b c9 |'gk. | timestamp_low: 3379259175 0xc90-0xc93.7 (4) +0x0c90| 56 00 00 00 | V... | capture_packet_length: 86 0xc94-0xc97.7 (4) +0x0c90| 56 00 00 00 | V... | original_packet_length: 86 0xc98-0xc9b.7 (4) + | | | packet: {} (ether8023) 0xc9c-0xcf1.7 (86) +0x0c90| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xc9c-0xca1.7 (6) +0x0ca0|7d 93 |}. | +0x0ca0| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xca2-0xca7.7 (6) +0x0ca0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xca8-0xca9.7 (2) + | | | packet: {} (ipv4) 0xcaa-0xcf1.7 (72) +0x0ca0| 45 | E | version: 4 0xcaa-0xcaa.3 (0.4) +0x0ca0| 45 | E | ihl: 5 0xcaa.4-0xcaa.7 (0.4) +0x0ca0| 00 | . | dscp: 0 0xcab-0xcab.5 (0.6) +0x0ca0| 00 | . | ecn: 0 0xcab.6-0xcab.7 (0.2) +0x0ca0| 00 48 | .H | total_length: 72 0xcac-0xcad.7 (2) +0x0ca0| 00 00| ..| identification: 0 0xcae-0xcaf.7 (2) +0x0cb0|40 |@ | reserved: 0 0xcb0-0xcb0 (0.1) +0x0cb0|40 |@ | dont_fragment: true 0xcb0.1-0xcb0.1 (0.1) +0x0cb0|40 |@ | more_fragments: false 0xcb0.2-0xcb0.2 (0.1) +0x0cb0|40 00 |@. | fragment_offset: 0 0xcb0.3-0xcb1.7 (1.5) +0x0cb0| 40 | @ | ttl: 64 0xcb2-0xcb2.7 (1) +0x0cb0| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xcb3-0xcb3.7 (1) +0x0cb0| b6 c8 | .. | header_checksum: 0xb6c8 0xcb4-0xcb5.7 (2) +0x0cb0| c0 a8 01 01 | .... | source_ip: "192.168.1.1" (0xc0a80101) 0xcb6-0xcb9.7 (4) +0x0cb0| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0xcba-0xcbd.7 (4) + | | | data: {} (udp) 0xcbe-0xcf1.7 (52) +0x0cb0| 00 35| .5| source_port: "domain" (53) (Domain Name Server) 0xcbe-0xcbf.7 (2) +0x0cc0|ca 28 |.( | destination_port: 51752 0xcc0-0xcc1.7 (2) +0x0cc0| 00 34 | .4 | length: 52 0xcc2-0xcc3.7 (2) +0x0cc0| 12 91 | .. | checksum: 0x1291 0xcc4-0xcc5.7 (2) + | | | data: {} (dns) 0xcc6-0xcf1.7 (44) + | | | header: {} 0xcc6-0xcc9.7 (4) +0x0cc0| 56 85 | V. | id: 22149 0xcc6-0xcc7.7 (2) +0x0cc0| 85 | . | qr: "response" (1) 0xcc8-0xcc8 (0.1) +0x0cc0| 85 | . | opcode: "Query" (0) 0xcc8.1-0xcc8.4 (0.4) +0x0cc0| 85 | . | authoritative_answer: true 0xcc8.5-0xcc8.5 (0.1) +0x0cc0| 85 | . | truncation: false 0xcc8.6-0xcc8.6 (0.1) +0x0cc0| 85 | . | recursion_desired: true 0xcc8.7-0xcc8.7 (0.1) +0x0cc0| 83 | . | recursion_available: true 0xcc9-0xcc9 (0.1) +0x0cc0| 83 | . | z: 0 0xcc9.1-0xcc9.3 (0.3) +0x0cc0| 83 | . | rcode: "NXDomain" (3) (Non-Existent Domain) 0xcc9.4-0xcc9.7 (0.4) +0x0cc0| 00 01 | .. | qd_count: 1 0xcca-0xccb.7 (2) +0x0cc0| 00 00 | .. | an_count: 0 0xccc-0xccd.7 (2) +0x0cc0| 00 00| ..| ns_count: 0 0xcce-0xccf.7 (2) +0x0cd0|00 00 |.. | ar_count: 0 0xcd0-0xcd1.7 (2) + | | | questions: [1] 0xcd2-0xcf1.7 (32) + | | | [0]: question {} 0xcd2-0xcf1.7 (32) + | | | name: {} 0xcd2-0xced.7 (28) + | | | labels: [7] 0xcd2-0xced.7 (28) + | | | [0]: label {} 0xcd2-0xcd5.7 (4) +0x0cd0| 03 | . | length: 3 0xcd2-0xcd2.7 (1) +0x0cd0| 32 35 35 | 255 | value: "255" 0xcd3-0xcd5.7 (3) + | | | [1]: label {} 0xcd6-0xcd7.7 (2) +0x0cd0| 01 | . | length: 1 0xcd6-0xcd6.7 (1) +0x0cd0| 31 | 1 | value: "1" 0xcd7-0xcd7.7 (1) + | | | [2]: label {} 0xcd8-0xcdb.7 (4) +0x0cd0| 03 | . | length: 3 0xcd8-0xcd8.7 (1) +0x0cd0| 31 36 38 | 168 | value: "168" 0xcd9-0xcdb.7 (3) + | | | [3]: label {} 0xcdc-0xcdf.7 (4) +0x0cd0| 03 | . | length: 3 0xcdc-0xcdc.7 (1) +0x0cd0| 31 39 32| 192| value: "192" 0xcdd-0xcdf.7 (3) + | | | [4]: label {} 0xce0-0xce7.7 (8) +0x0ce0|07 |. | length: 7 0xce0-0xce0.7 (1) +0x0ce0| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0xce1-0xce7.7 (7) + | | | [5]: label {} 0xce8-0xcec.7 (5) +0x0ce0| 04 | . | length: 4 0xce8-0xce8.7 (1) +0x0ce0| 61 72 70 61 | arpa | value: "arpa" 0xce9-0xcec.7 (4) + | | | [6]: label {} 0xced-0xced.7 (1) +0x0ce0| 00 | . | length: 0 0xced-0xced.7 (1) + | | | value: "255.1.168.192.in-addr.arpa" 0xcee-NA (0) +0x0ce0| 00 0c| ..| type: "PTR" (12) 0xcee-0xcef.7 (2) +0x0cf0|00 01 |.. | class: "IN" (1) (Internet) 0xcf0-0xcf1.7 (2) + | | | answers: [0] 0xcf2-NA (0) + | | | nameservers: [0] 0xcf2-NA (0) + | | | additionals: [0] 0xcf2-NA (0) + | | | capture_padding: raw bits 0xcf2-NA (0) +0x0cf0| 00 00 | .. | padding: raw bits 0xcf2-0xcf3.7 (2) + | | | options: [0] 0xcf4-NA (0) +0x0cf0| 78 00 00 00 | x... | footer_length: 120 0xcf4-0xcf7.7 (4) + | | | [24]: block {} 0xcf8-0xd6b.7 (116) +0x0cf0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xcf8-0xcfb.7 (4) +0x0cf0| 74 00 00 00| t...| length: 116 0xcfc-0xcff.7 (4) +0x0d00|00 00 00 00 |.... | interface_id: 0 0xd00-0xd03.7 (4) +0x0d00| 72 1d 05 00 | r... | timestamp_high: 335218 0xd04-0xd07.7 (4) +0x0d00| a8 34 6e c9 | .4n. | timestamp_low: 3379442856 0xd08-0xd0b.7 (4) +0x0d00| 54 00 00 00| T...| capture_packet_length: 84 0xd0c-0xd0f.7 (4) +0x0d10|54 00 00 00 |T... | original_packet_length: 84 0xd10-0xd13.7 (4) + | | | packet: {} (ether8023) 0xd14-0xd67.7 (84) +0x0d10| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xd14-0xd19.7 (6) +0x0d10| 94 10 3e 05 36 d3| ..>.6.| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xd1a-0xd1f.7 (6) +0x0d20|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xd20-0xd21.7 (2) + | | | packet: {} (ipv4) 0xd22-0xd67.7 (70) +0x0d20| 45 | E | version: 4 0xd22-0xd22.3 (0.4) +0x0d20| 45 | E | ihl: 5 0xd22.4-0xd22.7 (0.4) +0x0d20| 28 | ( | dscp: 10 0xd23-0xd23.5 (0.6) +0x0d20| 28 | ( | ecn: 0 0xd23.6-0xd23.7 (0.2) +0x0d20| 00 46 | .F | total_length: 70 0xd24-0xd25.7 (2) +0x0d20| cb c6 | .. | identification: 52166 0xd26-0xd27.7 (2) +0x0d20| 00 | . | reserved: 0 0xd28-0xd28 (0.1) +0x0d20| 00 | . | dont_fragment: false 0xd28.1-0xd28.1 (0.1) +0x0d20| 00 | . | more_fragments: false 0xd28.2-0xd28.2 (0.1) +0x0d20| 00 00 | .. | fragment_offset: 0 0xd28.3-0xd29.7 (1.5) +0x0d20| 29 | ) | ttl: 41 0xd2a-0xd2a.7 (1) +0x0d20| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xd2b-0xd2b.7 (1) +0x0d20| 89 05 | .. | header_checksum: 0x8905 0xd2c-0xd2d.7 (2) +0x0d20| ad c2| ..| source_ip: "173.194.204.189" (0xadc2ccbd) 0xd2e-0xd31.7 (4) +0x0d30|cc bd |.. | +0x0d30| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0xd32-0xd35.7 (4) + | | | data: {} (udp) 0xd36-0xd67.7 (50) +0x0d30| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0xd36-0xd37.7 (2) +0x0d30| cc c9 | .. | destination_port: 52425 0xd38-0xd39.7 (2) +0x0d30| 00 32 | .2 | length: 50 0xd3a-0xd3b.7 (2) +0x0d30| e0 7e | .~ | checksum: 0xe07e 0xd3c-0xd3d.7 (2) +0x0d30| 10 ef| ..| data: raw bits 0xd3e-0xd67.7 (42) +0x0d40|01 65 d8 b9 9d 48 7a 21 2c ba a9 0d b3 e7 5e bf|.e...Hz!,.....^.| +* |until 0xd67.7 (42) | | + | | | capture_padding: raw bits 0xd68-NA (0) + | | | padding: raw bits 0xd68-NA (0) + | | | options: [0] 0xd68-NA (0) +0x0d60| 74 00 00 00 | t... | footer_length: 116 0xd68-0xd6b.7 (4) + | | | [25]: block {} 0xd6c-0xde3.7 (120) +0x0d60| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xd6c-0xd6f.7 (4) +0x0d70|78 00 00 00 |x... | length: 120 0xd70-0xd73.7 (4) +0x0d70| 00 00 00 00 | .... | interface_id: 0 0xd74-0xd77.7 (4) +0x0d70| 72 1d 05 00 | r... | timestamp_high: 335218 0xd78-0xd7b.7 (4) +0x0d70| b7 e5 71 c9| ..q.| timestamp_low: 3379684791 0xd7c-0xd7f.7 (4) +0x0d80|56 00 00 00 |V... | capture_packet_length: 86 0xd80-0xd83.7 (4) +0x0d80| 56 00 00 00 | V... | original_packet_length: 86 0xd84-0xd87.7 (4) + | | | packet: {} (ether8023) 0xd88-0xddd.7 (86) +0x0d80| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xd88-0xd8d.7 (6) +0x0d80| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xd8e-0xd93.7 (6) +0x0d90|60 f1 7d 93 |`.}. | +0x0d90| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xd94-0xd95.7 (2) + | | | packet: {} (ipv4) 0xd96-0xddd.7 (72) +0x0d90| 45 | E | version: 4 0xd96-0xd96.3 (0.4) +0x0d90| 45 | E | ihl: 5 0xd96.4-0xd96.7 (0.4) +0x0d90| 00 | . | dscp: 0 0xd97-0xd97.5 (0.6) +0x0d90| 00 | . | ecn: 0 0xd97.6-0xd97.7 (0.2) +0x0d90| 00 48 | .H | total_length: 72 0xd98-0xd99.7 (2) +0x0d90| 67 34 | g4 | identification: 26420 0xd9a-0xd9b.7 (2) +0x0d90| 00 | . | reserved: 0 0xd9c-0xd9c (0.1) +0x0d90| 00 | . | dont_fragment: false 0xd9c.1-0xd9c.1 (0.1) +0x0d90| 00 | . | more_fragments: false 0xd9c.2-0xd9c.2 (0.1) +0x0d90| 00 00 | .. | fragment_offset: 0 0xd9c.3-0xd9d.7 (1.5) +0x0d90| ff | . | ttl: 255 0xd9e-0xd9e.7 (1) +0x0d90| 11| .| protocol: "udp" (17) (user datagram protocol) 0xd9f-0xd9f.7 (1) +0x0da0|d0 93 |.. | header_checksum: 0xd093 0xda0-0xda1.7 (2) +0x0da0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0xda2-0xda5.7 (4) +0x0da0| c0 a8 01 01 | .... | destination_ip: "192.168.1.1" (0xc0a80101) 0xda6-0xda9.7 (4) + | | | data: {} (udp) 0xdaa-0xddd.7 (52) +0x0da0| c5 17 | .. | source_port: 50455 0xdaa-0xdab.7 (2) +0x0da0| 00 35 | .5 | destination_port: "domain" (53) (Domain Name Server) 0xdac-0xdad.7 (2) +0x0da0| 00 34| .4| length: 52 0xdae-0xdaf.7 (2) +0x0db0|2f 5a |/Z | checksum: 0x2f5a 0xdb0-0xdb1.7 (2) + | | | data: {} (dns) 0xdb2-0xddd.7 (44) + | | | header: {} 0xdb2-0xdb5.7 (4) +0x0db0| 6f ad | o. | id: 28589 0xdb2-0xdb3.7 (2) +0x0db0| 01 | . | qr: "query" (0) 0xdb4-0xdb4 (0.1) +0x0db0| 01 | . | opcode: "Query" (0) 0xdb4.1-0xdb4.4 (0.4) +0x0db0| 01 | . | authoritative_answer: false 0xdb4.5-0xdb4.5 (0.1) +0x0db0| 01 | . | truncation: false 0xdb4.6-0xdb4.6 (0.1) +0x0db0| 01 | . | recursion_desired: true 0xdb4.7-0xdb4.7 (0.1) +0x0db0| 00 | . | recursion_available: false 0xdb5-0xdb5 (0.1) +0x0db0| 00 | . | z: 0 0xdb5.1-0xdb5.3 (0.3) +0x0db0| 00 | . | rcode: "NoError" (0) (No error) 0xdb5.4-0xdb5.7 (0.4) +0x0db0| 00 01 | .. | qd_count: 1 0xdb6-0xdb7.7 (2) +0x0db0| 00 00 | .. | an_count: 0 0xdb8-0xdb9.7 (2) +0x0db0| 00 00 | .. | ns_count: 0 0xdba-0xdbb.7 (2) +0x0db0| 00 00 | .. | ar_count: 0 0xdbc-0xdbd.7 (2) + | | | questions: [1] 0xdbe-0xddd.7 (32) + | | | [0]: question {} 0xdbe-0xddd.7 (32) + | | | name: {} 0xdbe-0xdd9.7 (28) + | | | labels: [7] 0xdbe-0xdd9.7 (28) + | | | [0]: label {} 0xdbe-0xdc1.7 (4) +0x0db0| 03 | . | length: 3 0xdbe-0xdbe.7 (1) +0x0db0| 32| 2| value: "253" 0xdbf-0xdc1.7 (3) +0x0dc0|35 33 |53 | + | | | [1]: label {} 0xdc2-0xdc4.7 (3) +0x0dc0| 02 | . | length: 2 0xdc2-0xdc2.7 (1) +0x0dc0| 31 32 | 12 | value: "12" 0xdc3-0xdc4.7 (2) + | | | [2]: label {} 0xdc5-0xdc8.7 (4) +0x0dc0| 03 | . | length: 3 0xdc5-0xdc5.7 (1) +0x0dc0| 32 35 33 | 253 | value: "253" 0xdc6-0xdc8.7 (3) + | | | [3]: label {} 0xdc9-0xdcb.7 (3) +0x0dc0| 02 | . | length: 2 0xdc9-0xdc9.7 (1) +0x0dc0| 31 37 | 17 | value: "17" 0xdca-0xdcb.7 (2) + | | | [4]: label {} 0xdcc-0xdd3.7 (8) +0x0dc0| 07 | . | length: 7 0xdcc-0xdcc.7 (1) +0x0dc0| 69 6e 2d| in-| value: "in-addr" 0xdcd-0xdd3.7 (7) +0x0dd0|61 64 64 72 |addr | + | | | [5]: label {} 0xdd4-0xdd8.7 (5) +0x0dd0| 04 | . | length: 4 0xdd4-0xdd4.7 (1) +0x0dd0| 61 72 70 61 | arpa | value: "arpa" 0xdd5-0xdd8.7 (4) + | | | [6]: label {} 0xdd9-0xdd9.7 (1) +0x0dd0| 00 | . | length: 0 0xdd9-0xdd9.7 (1) + | | | value: "253.12.253.17.in-addr.arpa" 0xdda-NA (0) +0x0dd0| 00 0c | .. | type: "PTR" (12) 0xdda-0xddb.7 (2) +0x0dd0| 00 01 | .. | class: "IN" (1) (Internet) 0xddc-0xddd.7 (2) + | | | answers: [0] 0xdde-NA (0) + | | | nameservers: [0] 0xdde-NA (0) + | | | additionals: [0] 0xdde-NA (0) + | | | capture_padding: raw bits 0xdde-NA (0) +0x0dd0| 00 00| ..| padding: raw bits 0xdde-0xddf.7 (2) + | | | options: [0] 0xde0-NA (0) +0x0de0|78 00 00 00 |x... | footer_length: 120 0xde0-0xde3.7 (4) + | | | [26]: block {} 0xde4-0xe57.7 (116) +0x0de0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xde4-0xde7.7 (4) +0x0de0| 74 00 00 00 | t... | length: 116 0xde8-0xdeb.7 (4) +0x0de0| 00 00 00 00| ....| interface_id: 0 0xdec-0xdef.7 (4) +0x0df0|72 1d 05 00 |r... | timestamp_high: 335218 0xdf0-0xdf3.7 (4) +0x0df0| 08 17 72 c9 | ..r. | timestamp_low: 3379697416 0xdf4-0xdf7.7 (4) +0x0df0| 54 00 00 00 | T... | capture_packet_length: 84 0xdf8-0xdfb.7 (4) +0x0df0| 54 00 00 00| T...| original_packet_length: 84 0xdfc-0xdff.7 (4) + | | | packet: {} (ether8023) 0xe00-0xe53.7 (84) +0x0e00|a4 5e 60 f1 7d 93 |.^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xe00-0xe05.7 (6) +0x0e00| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xe06-0xe0b.7 (6) +0x0e00| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xe0c-0xe0d.7 (2) + | | | packet: {} (ipv4) 0xe0e-0xe53.7 (70) +0x0e00| 45 | E | version: 4 0xe0e-0xe0e.3 (0.4) +0x0e00| 45 | E | ihl: 5 0xe0e.4-0xe0e.7 (0.4) +0x0e00| 28| (| dscp: 10 0xe0f-0xe0f.5 (0.6) +0x0e00| 28| (| ecn: 0 0xe0f.6-0xe0f.7 (0.2) +0x0e10|00 46 |.F | total_length: 70 0xe10-0xe11.7 (2) +0x0e10| cc 72 | .r | identification: 52338 0xe12-0xe13.7 (2) +0x0e10| 00 | . | reserved: 0 0xe14-0xe14 (0.1) +0x0e10| 00 | . | dont_fragment: false 0xe14.1-0xe14.1 (0.1) +0x0e10| 00 | . | more_fragments: false 0xe14.2-0xe14.2 (0.1) +0x0e10| 00 00 | .. | fragment_offset: 0 0xe14.3-0xe15.7 (1.5) +0x0e10| 29 | ) | ttl: 41 0xe16-0xe16.7 (1) +0x0e10| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xe17-0xe17.7 (1) +0x0e10| 88 59 | .Y | header_checksum: 0x8859 0xe18-0xe19.7 (2) +0x0e10| ad c2 cc bd | .... | source_ip: "173.194.204.189" (0xadc2ccbd) 0xe1a-0xe1d.7 (4) +0x0e10| c0 a8| ..| destination_ip: "192.168.1.139" (0xc0a8018b) 0xe1e-0xe21.7 (4) +0x0e20|01 8b |.. | + | | | data: {} (udp) 0xe22-0xe53.7 (50) +0x0e20| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0xe22-0xe23.7 (2) +0x0e20| cc c9 | .. | destination_port: 52425 0xe24-0xe25.7 (2) +0x0e20| 00 32 | .2 | length: 50 0xe26-0xe27.7 (2) +0x0e20| 6f 9f | o. | checksum: 0x6f9f 0xe28-0xe29.7 (2) +0x0e20| 10 f0 01 a4 5a 64| ....Zd| data: raw bits 0xe2a-0xe53.7 (42) +0x0e30|b9 ba e6 d0 23 9d 37 49 b0 99 fa 95 56 2f 71 80|....#.7I....V/q.| +* |until 0xe53.7 (42) | | + | | | capture_padding: raw bits 0xe54-NA (0) + | | | padding: raw bits 0xe54-NA (0) + | | | options: [0] 0xe54-NA (0) +0x0e50| 74 00 00 00 | t... | footer_length: 116 0xe54-0xe57.7 (4) + | | | [27]: block {} 0xe58-0xecf.7 (120) +0x0e50| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xe58-0xe5b.7 (4) +0x0e50| 78 00 00 00| x...| length: 120 0xe5c-0xe5f.7 (4) +0x0e60|00 00 00 00 |.... | interface_id: 0 0xe60-0xe63.7 (4) +0x0e60| 72 1d 05 00 | r... | timestamp_high: 335218 0xe64-0xe67.7 (4) +0x0e60| cf 17 72 c9 | ..r. | timestamp_low: 3379697615 0xe68-0xe6b.7 (4) +0x0e60| 56 00 00 00| V...| capture_packet_length: 86 0xe6c-0xe6f.7 (4) +0x0e70|56 00 00 00 |V... | original_packet_length: 86 0xe70-0xe73.7 (4) + | | | packet: {} (ether8023) 0xe74-0xec9.7 (86) +0x0e70| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xe74-0xe79.7 (6) +0x0e70| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xe7a-0xe7f.7 (6) +0x0e80|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xe80-0xe81.7 (2) + | | | packet: {} (ipv4) 0xe82-0xec9.7 (72) +0x0e80| 45 | E | version: 4 0xe82-0xe82.3 (0.4) +0x0e80| 45 | E | ihl: 5 0xe82.4-0xe82.7 (0.4) +0x0e80| 00 | . | dscp: 0 0xe83-0xe83.5 (0.6) +0x0e80| 00 | . | ecn: 0 0xe83.6-0xe83.7 (0.2) +0x0e80| 00 48 | .H | total_length: 72 0xe84-0xe85.7 (2) +0x0e80| 94 5f | ._ | identification: 37983 0xe86-0xe87.7 (2) +0x0e80| 00 | . | reserved: 0 0xe88-0xe88 (0.1) +0x0e80| 00 | . | dont_fragment: false 0xe88.1-0xe88.1 (0.1) +0x0e80| 00 | . | more_fragments: false 0xe88.2-0xe88.2 (0.1) +0x0e80| 00 00 | .. | fragment_offset: 0 0xe88.3-0xe89.7 (1.5) +0x0e80| 40 | @ | ttl: 64 0xe8a-0xe8a.7 (1) +0x0e80| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xe8b-0xe8b.7 (1) +0x0e80| a9 92 | .. | header_checksum: 0xa992 0xe8c-0xe8d.7 (2) +0x0e80| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0xe8e-0xe91.7 (4) +0x0e90|01 8b |.. | +0x0e90| ad c2 cc bd | .... | destination_ip: "173.194.204.189" (0xadc2ccbd) 0xe92-0xe95.7 (4) + | | | data: {} (udp) 0xe96-0xec9.7 (52) +0x0e90| cc c9 | .. | source_port: 52425 0xe96-0xe97.7 (2) +0x0e90| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0xe98-0xe99.7 (2) +0x0e90| 00 34 | .4 | length: 52 0xe9a-0xe9b.7 (2) +0x0e90| 8a 9f | .. | checksum: 0x8a9f 0xe9c-0xe9d.7 (2) +0x0e90| 0c f3| ..| data: raw bits 0xe9e-0xec9.7 (44) +0x0ea0|95 8f 95 ab 35 c2 ea 87 7e 63 12 43 74 c4 ff cb|....5...~c.Ct...| +* |until 0xec9.7 (44) | | + | | | capture_padding: raw bits 0xeca-NA (0) +0x0ec0| 00 00 | .. | padding: raw bits 0xeca-0xecb.7 (2) + | | | options: [0] 0xecc-NA (0) +0x0ec0| 78 00 00 00| x...| footer_length: 120 0xecc-0xecf.7 (4) + | | | [28]: block {} 0xed0-0xf87.7 (184) +0x0ed0|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xed0-0xed3.7 (4) +0x0ed0| b8 00 00 00 | .... | length: 184 0xed4-0xed7.7 (4) +0x0ed0| 00 00 00 00 | .... | interface_id: 0 0xed8-0xedb.7 (4) +0x0ed0| 72 1d 05 00| r...| timestamp_high: 335218 0xedc-0xedf.7 (4) +0x0ee0|bf 8e 73 c9 |..s. | timestamp_low: 3379793599 0xee0-0xee3.7 (4) +0x0ee0| 97 00 00 00 | .... | capture_packet_length: 151 0xee4-0xee7.7 (4) +0x0ee0| 97 00 00 00 | .... | original_packet_length: 151 0xee8-0xeeb.7 (4) + | | | packet: {} (ether8023) 0xeec-0xf82.7 (151) +0x0ee0| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xeec-0xef1.7 (6) +0x0ef0|7d 93 |}. | +0x0ef0| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xef2-0xef7.7 (6) +0x0ef0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xef8-0xef9.7 (2) + | | | packet: {} (ipv4) 0xefa-0xf82.7 (137) +0x0ef0| 45 | E | version: 4 0xefa-0xefa.3 (0.4) +0x0ef0| 45 | E | ihl: 5 0xefa.4-0xefa.7 (0.4) +0x0ef0| 00 | . | dscp: 0 0xefb-0xefb.5 (0.6) +0x0ef0| 00 | . | ecn: 0 0xefb.6-0xefb.7 (0.2) +0x0ef0| 00 89 | .. | total_length: 137 0xefc-0xefd.7 (2) +0x0ef0| 00 00| ..| identification: 0 0xefe-0xeff.7 (2) +0x0f00|40 |@ | reserved: 0 0xf00-0xf00 (0.1) +0x0f00|40 |@ | dont_fragment: true 0xf00.1-0xf00.1 (0.1) +0x0f00|40 |@ | more_fragments: false 0xf00.2-0xf00.2 (0.1) +0x0f00|40 00 |@. | fragment_offset: 0 0xf00.3-0xf01.7 (1.5) +0x0f00| 40 | @ | ttl: 64 0xf02-0xf02.7 (1) +0x0f00| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xf03-0xf03.7 (1) +0x0f00| b6 87 | .. | header_checksum: 0xb687 0xf04-0xf05.7 (2) +0x0f00| c0 a8 01 01 | .... | source_ip: "192.168.1.1" (0xc0a80101) 0xf06-0xf09.7 (4) +0x0f00| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0xf0a-0xf0d.7 (4) + | | | data: {} (udp) 0xf0e-0xf82.7 (117) +0x0f00| 00 35| .5| source_port: "domain" (53) (Domain Name Server) 0xf0e-0xf0f.7 (2) +0x0f10|c5 17 |.. | destination_port: 50455 0xf10-0xf11.7 (2) +0x0f10| 00 75 | .u | length: 117 0xf12-0xf13.7 (2) +0x0f10| ef 63 | .c | checksum: 0xef63 0xf14-0xf15.7 (2) + | | | data: {} (dns) 0xf16-0xf82.7 (109) + | | | header: {} 0xf16-0xf19.7 (4) +0x0f10| 6f ad | o. | id: 28589 0xf16-0xf17.7 (2) +0x0f10| 81 | . | qr: "response" (1) 0xf18-0xf18 (0.1) +0x0f10| 81 | . | opcode: "Query" (0) 0xf18.1-0xf18.4 (0.4) +0x0f10| 81 | . | authoritative_answer: false 0xf18.5-0xf18.5 (0.1) +0x0f10| 81 | . | truncation: false 0xf18.6-0xf18.6 (0.1) +0x0f10| 81 | . | recursion_desired: true 0xf18.7-0xf18.7 (0.1) +0x0f10| 80 | . | recursion_available: true 0xf19-0xf19 (0.1) +0x0f10| 80 | . | z: 0 0xf19.1-0xf19.3 (0.3) +0x0f10| 80 | . | rcode: "NoError" (0) (No error) 0xf19.4-0xf19.7 (0.4) +0x0f10| 00 01 | .. | qd_count: 1 0xf1a-0xf1b.7 (2) +0x0f10| 00 02 | .. | an_count: 2 0xf1c-0xf1d.7 (2) +0x0f10| 00 00| ..| ns_count: 0 0xf1e-0xf1f.7 (2) +0x0f20|00 00 |.. | ar_count: 0 0xf20-0xf21.7 (2) + | | | questions: [1] 0xf22-0xf41.7 (32) + | | | [0]: question {} 0xf22-0xf41.7 (32) + | | | name: {} 0xf22-0xf3d.7 (28) + | | | labels: [7] 0xf22-0xf3d.7 (28) + | | | [0]: label {} 0xf22-0xf25.7 (4) +0x0f20| 03 | . | length: 3 0xf22-0xf22.7 (1) +0x0f20| 32 35 33 | 253 | value: "253" 0xf23-0xf25.7 (3) + | | | [1]: label {} 0xf26-0xf28.7 (3) +0x0f20| 02 | . | length: 2 0xf26-0xf26.7 (1) +0x0f20| 31 32 | 12 | value: "12" 0xf27-0xf28.7 (2) + | | | [2]: label {} 0xf29-0xf2c.7 (4) +0x0f20| 03 | . | length: 3 0xf29-0xf29.7 (1) +0x0f20| 32 35 33 | 253 | value: "253" 0xf2a-0xf2c.7 (3) + | | | [3]: label {} 0xf2d-0xf2f.7 (3) +0x0f20| 02 | . | length: 2 0xf2d-0xf2d.7 (1) +0x0f20| 31 37| 17| value: "17" 0xf2e-0xf2f.7 (2) + | | | [4]: label {} 0xf30-0xf37.7 (8) +0x0f30|07 |. | length: 7 0xf30-0xf30.7 (1) +0x0f30| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0xf31-0xf37.7 (7) + | | | [5]: label {} 0xf38-0xf3c.7 (5) +0x0f30| 04 | . | length: 4 0xf38-0xf38.7 (1) +0x0f30| 61 72 70 61 | arpa | value: "arpa" 0xf39-0xf3c.7 (4) + | | | [6]: label {} 0xf3d-0xf3d.7 (1) +0x0f30| 00 | . | length: 0 0xf3d-0xf3d.7 (1) + | | | value: "253.12.253.17.in-addr.arpa" 0xf3e-NA (0) +0x0f30| 00 0c| ..| type: "PTR" (12) 0xf3e-0xf3f.7 (2) +0x0f40|00 01 |.. | class: "IN" (1) (Internet) 0xf40-0xf41.7 (2) + | | | answers: [2] 0xf22-0xf82.7 (97) + | | | [0]: answer {} 0xf22-0xf69.7 (72) + | | | name: {} 0xf22-0xf43.7 (34) + | | | labels: [7] 0xf22-0xf43.7 (34) + | | | [0]: label {} 0xf22-0xf43.7 (34) +0x0f20| 03 | . | length: 3 0xf22-0xf22.7 (1) +0x0f20| 32 35 33 | 253 | value: "253" 0xf23-0xf25.7 (3) +0x0f40| c0 | . | is_pointer: 3 0xf42-0xf42.1 (0.2) +0x0f40| c0 0c | .. | pointer: 12 0xf42.2-0xf43.7 (1.6) + | | | [1]: label {} 0xf26-0xf28.7 (3) +0x0f20| 02 | . | length: 2 0xf26-0xf26.7 (1) +0x0f20| 31 32 | 12 | value: "12" 0xf27-0xf28.7 (2) + | | | [2]: label {} 0xf29-0xf2c.7 (4) +0x0f20| 03 | . | length: 3 0xf29-0xf29.7 (1) +0x0f20| 32 35 33 | 253 | value: "253" 0xf2a-0xf2c.7 (3) + | | | [3]: label {} 0xf2d-0xf2f.7 (3) +0x0f20| 02 | . | length: 2 0xf2d-0xf2d.7 (1) +0x0f20| 31 37| 17| value: "17" 0xf2e-0xf2f.7 (2) + | | | [4]: label {} 0xf30-0xf37.7 (8) +0x0f30|07 |. | length: 7 0xf30-0xf30.7 (1) +0x0f30| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0xf31-0xf37.7 (7) + | | | [5]: label {} 0xf38-0xf3c.7 (5) +0x0f30| 04 | . | length: 4 0xf38-0xf38.7 (1) +0x0f30| 61 72 70 61 | arpa | value: "arpa" 0xf39-0xf3c.7 (4) + | | | [6]: label {} 0xf3d-0xf3d.7 (1) +0x0f30| 00 | . | length: 0 0xf3d-0xf3d.7 (1) + | | | value: "253.12.253.17.in-addr.arpa" 0xf3e-NA (0) +0x0f40| 00 0c | .. | type: "PTR" (12) 0xf44-0xf45.7 (2) +0x0f40| 00 01 | .. | class: "IN" (1) (Internet) 0xf46-0xf47.7 (2) +0x0f40| 00 00 0a 8c | .... | ttl: 2700 0xf48-0xf4b.7 (4) +0x0f40| 00 1c | .. | rdlength: 28 0xf4c-0xf4d.7 (2) + | | | ptr: {} 0xf4e-0xf69.7 (28) + | | | labels: [4] 0xf4e-0xf69.7 (28) + | | | [0]: label {} 0xf4e-0xf5c.7 (15) +0x0f40| 0e | . | length: 14 0xf4e-0xf4e.7 (1) +0x0f40| 75| u| value: "usmia1-ntp-002" 0xf4f-0xf5c.7 (14) +0x0f50|73 6d 69 61 31 2d 6e 74 70 2d 30 30 32 |smia1-ntp-002 | + | | | [1]: label {} 0xf5d-0xf64.7 (8) +0x0f50| 07 | . | length: 7 0xf5d-0xf5d.7 (1) +0x0f50| 61 61| aa| value: "aaplimg" 0xf5e-0xf64.7 (7) +0x0f60|70 6c 69 6d 67 |plimg | + | | | [2]: label {} 0xf65-0xf68.7 (4) +0x0f60| 03 | . | length: 3 0xf65-0xf65.7 (1) +0x0f60| 63 6f 6d | com | value: "com" 0xf66-0xf68.7 (3) + | | | [3]: label {} 0xf69-0xf69.7 (1) +0x0f60| 00 | . | length: 0 0xf69-0xf69.7 (1) + | | | value: "usmia1-ntp-002.aaplimg.com" 0xf6a-NA (0) + | | | [1]: answer {} 0xf22-0xf82.7 (97) + | | | name: {} 0xf22-0xf6b.7 (74) + | | | labels: [7] 0xf22-0xf6b.7 (74) + | | | [0]: label {} 0xf22-0xf6b.7 (74) +0x0f20| 03 | . | length: 3 0xf22-0xf22.7 (1) +0x0f20| 32 35 33 | 253 | value: "253" 0xf23-0xf25.7 (3) +0x0f60| c0 | . | is_pointer: 3 0xf6a-0xf6a.1 (0.2) +0x0f60| c0 0c | .. | pointer: 12 0xf6a.2-0xf6b.7 (1.6) + | | | [1]: label {} 0xf26-0xf28.7 (3) +0x0f20| 02 | . | length: 2 0xf26-0xf26.7 (1) +0x0f20| 31 32 | 12 | value: "12" 0xf27-0xf28.7 (2) + | | | [2]: label {} 0xf29-0xf2c.7 (4) +0x0f20| 03 | . | length: 3 0xf29-0xf29.7 (1) +0x0f20| 32 35 33 | 253 | value: "253" 0xf2a-0xf2c.7 (3) + | | | [3]: label {} 0xf2d-0xf2f.7 (3) +0x0f20| 02 | . | length: 2 0xf2d-0xf2d.7 (1) +0x0f20| 31 37| 17| value: "17" 0xf2e-0xf2f.7 (2) + | | | [4]: label {} 0xf30-0xf37.7 (8) +0x0f30|07 |. | length: 7 0xf30-0xf30.7 (1) +0x0f30| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0xf31-0xf37.7 (7) + | | | [5]: label {} 0xf38-0xf3c.7 (5) +0x0f30| 04 | . | length: 4 0xf38-0xf38.7 (1) +0x0f30| 61 72 70 61 | arpa | value: "arpa" 0xf39-0xf3c.7 (4) + | | | [6]: label {} 0xf3d-0xf3d.7 (1) +0x0f30| 00 | . | length: 0 0xf3d-0xf3d.7 (1) + | | | value: "253.12.253.17.in-addr.arpa" 0xf3e-NA (0) + | | | ptr: {} 0xf65-0xf82.7 (30) + | | | labels: [4] 0xf65-0xf82.7 (30) + | | | [0]: label {} 0xf65-0xf82.7 (30) +0x0f60| 03 | . | length: 3 0xf65-0xf65.7 (1) +0x0f60| 63 6f 6d | com | value: "com" 0xf66-0xf68.7 (3) +0x0f80| c0 | . | is_pointer: 3 0xf81-0xf81.1 (0.2) +0x0f80| c0 4f | .O | pointer: 79 0xf81.2-0xf82.7 (1.6) + | | | [1]: label {} 0xf69-0xf69.7 (1) +0x0f60| 00 | . | length: 0 0xf69-0xf69.7 (1) + | | | [2]: label {} 0xf76-0xf7a.7 (5) +0x0f70| 04 | . | length: 4 0xf76-0xf76.7 (1) +0x0f70| 74 69 6d 65 | time | value: "time" 0xf77-0xf7a.7 (4) + | | | [3]: label {} 0xf7b-0xf80.7 (6) +0x0f70| 05 | . | length: 5 0xf7b-0xf7b.7 (1) +0x0f70| 61 70 70 6c| appl| value: "apple" 0xf7c-0xf80.7 (5) +0x0f80|65 |e | + | | | value: "time.apple.com" 0xf6a-NA (0) +0x0f60| 00 0c | .. | type: "PTR" (12) 0xf6c-0xf6d.7 (2) +0x0f60| 00 01| ..| class: "IN" (1) (Internet) 0xf6e-0xf6f.7 (2) +0x0f70|00 00 0a 8c |.... | ttl: 2700 0xf70-0xf73.7 (4) +0x0f70| 00 0d | .. | rdlength: 13 0xf74-0xf75.7 (2) + | | | nameservers: [0] 0xf83-NA (0) + | | | additionals: [0] 0xf83-NA (0) + | | | capture_padding: raw bits 0xf83-NA (0) +0x0f80| 00 | . | padding: raw bits 0xf83-0xf83.7 (1) + | | | options: [0] 0xf84-NA (0) +0x0f80| b8 00 00 00 | .... | footer_length: 184 0xf84-0xf87.7 (4) + | | | [29]: block {} 0xf88-0xffb.7 (116) +0x0f80| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xf88-0xf8b.7 (4) +0x0f80| 74 00 00 00| t...| length: 116 0xf8c-0xf8f.7 (4) +0x0f90|00 00 00 00 |.... | interface_id: 0 0xf90-0xf93.7 (4) +0x0f90| 72 1d 05 00 | r... | timestamp_high: 335218 0xf94-0xf97.7 (4) +0x0f90| 9c a7 73 c9 | ..s. | timestamp_low: 3379799964 0xf98-0xf9b.7 (4) +0x0f90| 54 00 00 00| T...| capture_packet_length: 84 0xf9c-0xf9f.7 (4) +0x0fa0|54 00 00 00 |T... | original_packet_length: 84 0xfa0-0xfa3.7 (4) + | | | packet: {} (ether8023) 0xfa4-0xff7.7 (84) +0x0fa0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0xfa4-0xfa9.7 (6) +0x0fa0| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0xfaa-0xfaf.7 (6) +0x0fb0|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0xfb0-0xfb1.7 (2) + | | | packet: {} (ipv4) 0xfb2-0xff7.7 (70) +0x0fb0| 45 | E | version: 4 0xfb2-0xfb2.3 (0.4) +0x0fb0| 45 | E | ihl: 5 0xfb2.4-0xfb2.7 (0.4) +0x0fb0| 00 | . | dscp: 0 0xfb3-0xfb3.5 (0.6) +0x0fb0| 00 | . | ecn: 0 0xfb3.6-0xfb3.7 (0.2) +0x0fb0| 00 46 | .F | total_length: 70 0xfb4-0xfb5.7 (2) +0x0fb0| 5e 74 | ^t | identification: 24180 0xfb6-0xfb7.7 (2) +0x0fb0| 00 | . | reserved: 0 0xfb8-0xfb8 (0.1) +0x0fb0| 00 | . | dont_fragment: false 0xfb8.1-0xfb8.1 (0.1) +0x0fb0| 00 | . | more_fragments: false 0xfb8.2-0xfb8.2 (0.1) +0x0fb0| 00 00 | .. | fragment_offset: 0 0xfb8.3-0xfb9.7 (1.5) +0x0fb0| ff | . | ttl: 255 0xfba-0xfba.7 (1) +0x0fb0| 11 | . | protocol: "udp" (17) (user datagram protocol) 0xfbb-0xfbb.7 (1) +0x0fb0| d9 55 | .U | header_checksum: 0xd955 0xfbc-0xfbd.7 (2) +0x0fb0| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0xfbe-0xfc1.7 (4) +0x0fc0|01 8b |.. | +0x0fc0| c0 a8 01 01 | .... | destination_ip: "192.168.1.1" (0xc0a80101) 0xfc2-0xfc5.7 (4) + | | | data: {} (udp) 0xfc6-0xff7.7 (50) +0x0fc0| f0 c6 | .. | source_port: 61638 0xfc6-0xfc7.7 (2) +0x0fc0| 00 35 | .5 | destination_port: "domain" (53) (Domain Name Server) 0xfc8-0xfc9.7 (2) +0x0fc0| 00 32 | .2 | length: 50 0xfca-0xfcb.7 (2) +0x0fc0| da a2 | .. | checksum: 0xdaa2 0xfcc-0xfcd.7 (2) + | | | data: {} (dns) 0xfce-0xff7.7 (42) + | | | header: {} 0xfce-0xfd1.7 (4) +0x0fc0| 23 93| #.| id: 9107 0xfce-0xfcf.7 (2) +0x0fd0|01 |. | qr: "query" (0) 0xfd0-0xfd0 (0.1) +0x0fd0|01 |. | opcode: "Query" (0) 0xfd0.1-0xfd0.4 (0.4) +0x0fd0|01 |. | authoritative_answer: false 0xfd0.5-0xfd0.5 (0.1) +0x0fd0|01 |. | truncation: false 0xfd0.6-0xfd0.6 (0.1) +0x0fd0|01 |. | recursion_desired: true 0xfd0.7-0xfd0.7 (0.1) +0x0fd0| 00 | . | recursion_available: false 0xfd1-0xfd1 (0.1) +0x0fd0| 00 | . | z: 0 0xfd1.1-0xfd1.3 (0.3) +0x0fd0| 00 | . | rcode: "NoError" (0) (No error) 0xfd1.4-0xfd1.7 (0.4) +0x0fd0| 00 01 | .. | qd_count: 1 0xfd2-0xfd3.7 (2) +0x0fd0| 00 00 | .. | an_count: 0 0xfd4-0xfd5.7 (2) +0x0fd0| 00 00 | .. | ns_count: 0 0xfd6-0xfd7.7 (2) +0x0fd0| 00 00 | .. | ar_count: 0 0xfd8-0xfd9.7 (2) + | | | questions: [1] 0xfda-0xff7.7 (30) + | | | [0]: question {} 0xfda-0xff7.7 (30) + | | | name: {} 0xfda-0xff3.7 (26) + | | | labels: [7] 0xfda-0xff3.7 (26) + | | | [0]: label {} 0xfda-0xfdb.7 (2) +0x0fd0| 01 | . | length: 1 0xfda-0xfda.7 (1) +0x0fd0| 31 | 1 | value: "1" 0xfdb-0xfdb.7 (1) + | | | [1]: label {} 0xfdc-0xfdd.7 (2) +0x0fd0| 01 | . | length: 1 0xfdc-0xfdc.7 (1) +0x0fd0| 31 | 1 | value: "1" 0xfdd-0xfdd.7 (1) + | | | [2]: label {} 0xfde-0xfe1.7 (4) +0x0fd0| 03 | . | length: 3 0xfde-0xfde.7 (1) +0x0fd0| 31| 1| value: "168" 0xfdf-0xfe1.7 (3) +0x0fe0|36 38 |68 | + | | | [3]: label {} 0xfe2-0xfe5.7 (4) +0x0fe0| 03 | . | length: 3 0xfe2-0xfe2.7 (1) +0x0fe0| 31 39 32 | 192 | value: "192" 0xfe3-0xfe5.7 (3) + | | | [4]: label {} 0xfe6-0xfed.7 (8) +0x0fe0| 07 | . | length: 7 0xfe6-0xfe6.7 (1) +0x0fe0| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0xfe7-0xfed.7 (7) + | | | [5]: label {} 0xfee-0xff2.7 (5) +0x0fe0| 04 | . | length: 4 0xfee-0xfee.7 (1) +0x0fe0| 61| a| value: "arpa" 0xfef-0xff2.7 (4) +0x0ff0|72 70 61 |rpa | + | | | [6]: label {} 0xff3-0xff3.7 (1) +0x0ff0| 00 | . | length: 0 0xff3-0xff3.7 (1) + | | | value: "1.1.168.192.in-addr.arpa" 0xff4-NA (0) +0x0ff0| 00 0c | .. | type: "PTR" (12) 0xff4-0xff5.7 (2) +0x0ff0| 00 01 | .. | class: "IN" (1) (Internet) 0xff6-0xff7.7 (2) + | | | answers: [0] 0xff8-NA (0) + | | | nameservers: [0] 0xff8-NA (0) + | | | additionals: [0] 0xff8-NA (0) + | | | capture_padding: raw bits 0xff8-NA (0) + | | | padding: raw bits 0xff8-NA (0) + | | | options: [0] 0xff8-NA (0) +0x0ff0| 74 00 00 00 | t... | footer_length: 116 0xff8-0xffb.7 (4) + | | | [30]: block {} 0xffc-0x1087.7 (140) +0x0ff0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0xffc-0xfff.7 (4) +0x1000|8c 00 00 00 |.... | length: 140 0x1000-0x1003.7 (4) +0x1000| 00 00 00 00 | .... | interface_id: 0 0x1004-0x1007.7 (4) +0x1000| 72 1d 05 00 | r... | timestamp_high: 335218 0x1008-0x100b.7 (4) +0x1000| af ac 73 c9| ..s.| timestamp_low: 3379801263 0x100c-0x100f.7 (4) +0x1010|69 00 00 00 |i... | capture_packet_length: 105 0x1010-0x1013.7 (4) +0x1010| 69 00 00 00 | i... | original_packet_length: 105 0x1014-0x1017.7 (4) + | | | packet: {} (ether8023) 0x1018-0x1080.7 (105) +0x1010| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1018-0x101d.7 (6) +0x1010| 94 10| ..| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x101e-0x1023.7 (6) +0x1020|3e 05 36 d3 |>.6. | +0x1020| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1024-0x1025.7 (2) + | | | packet: {} (ipv4) 0x1026-0x1080.7 (91) +0x1020| 45 | E | version: 4 0x1026-0x1026.3 (0.4) +0x1020| 45 | E | ihl: 5 0x1026.4-0x1026.7 (0.4) +0x1020| 00 | . | dscp: 0 0x1027-0x1027.5 (0.6) +0x1020| 00 | . | ecn: 0 0x1027.6-0x1027.7 (0.2) +0x1020| 00 5b | .[ | total_length: 91 0x1028-0x1029.7 (2) +0x1020| 00 00 | .. | identification: 0 0x102a-0x102b.7 (2) +0x1020| 40 | @ | reserved: 0 0x102c-0x102c (0.1) +0x1020| 40 | @ | dont_fragment: true 0x102c.1-0x102c.1 (0.1) +0x1020| 40 | @ | more_fragments: false 0x102c.2-0x102c.2 (0.1) +0x1020| 40 00 | @. | fragment_offset: 0 0x102c.3-0x102d.7 (1.5) +0x1020| 40 | @ | ttl: 64 0x102e-0x102e.7 (1) +0x1020| 11| .| protocol: "udp" (17) (user datagram protocol) 0x102f-0x102f.7 (1) +0x1030|b6 b5 |.. | header_checksum: 0xb6b5 0x1030-0x1031.7 (2) +0x1030| c0 a8 01 01 | .... | source_ip: "192.168.1.1" (0xc0a80101) 0x1032-0x1035.7 (4) +0x1030| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x1036-0x1039.7 (4) + | | | data: {} (udp) 0x103a-0x1080.7 (71) +0x1030| 00 35 | .5 | source_port: "domain" (53) (Domain Name Server) 0x103a-0x103b.7 (2) +0x1030| f0 c6 | .. | destination_port: 61638 0x103c-0x103d.7 (2) +0x1030| 00 47| .G| length: 71 0x103e-0x103f.7 (2) +0x1040|55 32 |U2 | checksum: 0x5532 0x1040-0x1041.7 (2) + | | | data: {} (dns) 0x1042-0x1080.7 (63) + | | | header: {} 0x1042-0x1045.7 (4) +0x1040| 23 93 | #. | id: 9107 0x1042-0x1043.7 (2) +0x1040| 85 | . | qr: "response" (1) 0x1044-0x1044 (0.1) +0x1040| 85 | . | opcode: "Query" (0) 0x1044.1-0x1044.4 (0.4) +0x1040| 85 | . | authoritative_answer: true 0x1044.5-0x1044.5 (0.1) +0x1040| 85 | . | truncation: false 0x1044.6-0x1044.6 (0.1) +0x1040| 85 | . | recursion_desired: true 0x1044.7-0x1044.7 (0.1) +0x1040| 80 | . | recursion_available: true 0x1045-0x1045 (0.1) +0x1040| 80 | . | z: 0 0x1045.1-0x1045.3 (0.3) +0x1040| 80 | . | rcode: "NoError" (0) (No error) 0x1045.4-0x1045.7 (0.4) +0x1040| 00 01 | .. | qd_count: 1 0x1046-0x1047.7 (2) +0x1040| 00 01 | .. | an_count: 1 0x1048-0x1049.7 (2) +0x1040| 00 00 | .. | ns_count: 0 0x104a-0x104b.7 (2) +0x1040| 00 00 | .. | ar_count: 0 0x104c-0x104d.7 (2) + | | | questions: [1] 0x104e-0x106b.7 (30) + | | | [0]: question {} 0x104e-0x106b.7 (30) + | | | name: {} 0x104e-0x1067.7 (26) + | | | labels: [7] 0x104e-0x1067.7 (26) + | | | [0]: label {} 0x104e-0x104f.7 (2) +0x1040| 01 | . | length: 1 0x104e-0x104e.7 (1) +0x1040| 31| 1| value: "1" 0x104f-0x104f.7 (1) + | | | [1]: label {} 0x1050-0x1051.7 (2) +0x1050|01 |. | length: 1 0x1050-0x1050.7 (1) +0x1050| 31 | 1 | value: "1" 0x1051-0x1051.7 (1) + | | | [2]: label {} 0x1052-0x1055.7 (4) +0x1050| 03 | . | length: 3 0x1052-0x1052.7 (1) +0x1050| 31 36 38 | 168 | value: "168" 0x1053-0x1055.7 (3) + | | | [3]: label {} 0x1056-0x1059.7 (4) +0x1050| 03 | . | length: 3 0x1056-0x1056.7 (1) +0x1050| 31 39 32 | 192 | value: "192" 0x1057-0x1059.7 (3) + | | | [4]: label {} 0x105a-0x1061.7 (8) +0x1050| 07 | . | length: 7 0x105a-0x105a.7 (1) +0x1050| 69 6e 2d 61 64| in-ad| value: "in-addr" 0x105b-0x1061.7 (7) +0x1060|64 72 |dr | + | | | [5]: label {} 0x1062-0x1066.7 (5) +0x1060| 04 | . | length: 4 0x1062-0x1062.7 (1) +0x1060| 61 72 70 61 | arpa | value: "arpa" 0x1063-0x1066.7 (4) + | | | [6]: label {} 0x1067-0x1067.7 (1) +0x1060| 00 | . | length: 0 0x1067-0x1067.7 (1) + | | | value: "1.1.168.192.in-addr.arpa" 0x1068-NA (0) +0x1060| 00 0c | .. | type: "PTR" (12) 0x1068-0x1069.7 (2) +0x1060| 00 01 | .. | class: "IN" (1) (Internet) 0x106a-0x106b.7 (2) + | | | answers: [1] 0x104e-0x1080.7 (51) + | | | [0]: answer {} 0x104e-0x1080.7 (51) + | | | name: {} 0x104e-0x106d.7 (32) + | | | labels: [7] 0x104e-0x106d.7 (32) + | | | [0]: label {} 0x104e-0x106d.7 (32) +0x1040| 01 | . | length: 1 0x104e-0x104e.7 (1) +0x1040| 31| 1| value: "1" 0x104f-0x104f.7 (1) +0x1060| c0 | . | is_pointer: 3 0x106c-0x106c.1 (0.2) +0x1060| c0 0c | .. | pointer: 12 0x106c.2-0x106d.7 (1.6) + | | | [1]: label {} 0x1050-0x1051.7 (2) +0x1050|01 |. | length: 1 0x1050-0x1050.7 (1) +0x1050| 31 | 1 | value: "1" 0x1051-0x1051.7 (1) + | | | [2]: label {} 0x1052-0x1055.7 (4) +0x1050| 03 | . | length: 3 0x1052-0x1052.7 (1) +0x1050| 31 36 38 | 168 | value: "168" 0x1053-0x1055.7 (3) + | | | [3]: label {} 0x1056-0x1059.7 (4) +0x1050| 03 | . | length: 3 0x1056-0x1056.7 (1) +0x1050| 31 39 32 | 192 | value: "192" 0x1057-0x1059.7 (3) + | | | [4]: label {} 0x105a-0x1061.7 (8) +0x1050| 07 | . | length: 7 0x105a-0x105a.7 (1) +0x1050| 69 6e 2d 61 64| in-ad| value: "in-addr" 0x105b-0x1061.7 (7) +0x1060|64 72 |dr | + | | | [5]: label {} 0x1062-0x1066.7 (5) +0x1060| 04 | . | length: 4 0x1062-0x1062.7 (1) +0x1060| 61 72 70 61 | arpa | value: "arpa" 0x1063-0x1066.7 (4) + | | | [6]: label {} 0x1067-0x1067.7 (1) +0x1060| 00 | . | length: 0 0x1067-0x1067.7 (1) + | | | value: "1.1.168.192.in-addr.arpa" 0x1068-NA (0) +0x1060| 00 0c| ..| type: "PTR" (12) 0x106e-0x106f.7 (2) +0x1070|00 01 |.. | class: "IN" (1) (Internet) 0x1070-0x1071.7 (2) +0x1070| 00 00 00 00 | .... | ttl: 0 0x1072-0x1075.7 (4) +0x1070| 00 09 | .. | rdlength: 9 0x1076-0x1077.7 (2) + | | | ptr: {} 0x1078-0x1080.7 (9) + | | | labels: [2] 0x1078-0x1080.7 (9) + | | | [0]: label {} 0x1078-0x107f.7 (8) +0x1070| 07 | . | length: 7 0x1078-0x1078.7 (1) +0x1070| 6b 61 70 6c 61 6b 65| kaplake| value: "kaplake" 0x1079-0x107f.7 (7) + | | | [1]: label {} 0x1080-0x1080.7 (1) +0x1080|00 |. | length: 0 0x1080-0x1080.7 (1) + | | | value: "kaplake" 0x1081-NA (0) + | | | nameservers: [0] 0x1081-NA (0) + | | | additionals: [0] 0x1081-NA (0) + | | | capture_padding: raw bits 0x1081-NA (0) +0x1080| 00 00 00 | ... | padding: raw bits 0x1081-0x1083.7 (3) + | | | options: [0] 0x1084-NA (0) +0x1080| 8c 00 00 00 | .... | footer_length: 140 0x1084-0x1087.7 (4) + | | | [31]: block {} 0x1088-0x10ff.7 (120) +0x1080| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1088-0x108b.7 (4) +0x1080| 78 00 00 00| x...| length: 120 0x108c-0x108f.7 (4) +0x1090|00 00 00 00 |.... | interface_id: 0 0x1090-0x1093.7 (4) +0x1090| 72 1d 05 00 | r... | timestamp_high: 335218 0x1094-0x1097.7 (4) +0x1090| b4 c8 73 c9 | ..s. | timestamp_low: 3379808436 0x1098-0x109b.7 (4) +0x1090| 58 00 00 00| X...| capture_packet_length: 88 0x109c-0x109f.7 (4) +0x10a0|58 00 00 00 |X... | original_packet_length: 88 0x10a0-0x10a3.7 (4) + | | | packet: {} (ether8023) 0x10a4-0x10fb.7 (88) +0x10a0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x10a4-0x10a9.7 (6) +0x10a0| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x10aa-0x10af.7 (6) +0x10b0|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x10b0-0x10b1.7 (2) + | | | packet: {} (ipv4) 0x10b2-0x10fb.7 (74) +0x10b0| 45 | E | version: 4 0x10b2-0x10b2.3 (0.4) +0x10b0| 45 | E | ihl: 5 0x10b2.4-0x10b2.7 (0.4) +0x10b0| 00 | . | dscp: 0 0x10b3-0x10b3.5 (0.6) +0x10b0| 00 | . | ecn: 0 0x10b3.6-0x10b3.7 (0.2) +0x10b0| 00 4a | .J | total_length: 74 0x10b4-0x10b5.7 (2) +0x10b0| 82 d8 | .. | identification: 33496 0x10b6-0x10b7.7 (2) +0x10b0| 00 | . | reserved: 0 0x10b8-0x10b8 (0.1) +0x10b0| 00 | . | dont_fragment: false 0x10b8.1-0x10b8.1 (0.1) +0x10b0| 00 | . | more_fragments: false 0x10b8.2-0x10b8.2 (0.1) +0x10b0| 00 00 | .. | fragment_offset: 0 0x10b8.3-0x10b9.7 (1.5) +0x10b0| ff | . | ttl: 255 0x10ba-0x10ba.7 (1) +0x10b0| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x10bb-0x10bb.7 (1) +0x10b0| b4 ed | .. | header_checksum: 0xb4ed 0x10bc-0x10bd.7 (2) +0x10b0| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x10be-0x10c1.7 (4) +0x10c0|01 8b |.. | +0x10c0| c0 a8 01 01 | .... | destination_ip: "192.168.1.1" (0xc0a80101) 0x10c2-0x10c5.7 (4) + | | | data: {} (udp) 0x10c6-0x10fb.7 (54) +0x10c0| cc 06 | .. | source_port: 52230 0x10c6-0x10c7.7 (2) +0x10c0| 00 35 | .5 | destination_port: "domain" (53) (Domain Name Server) 0x10c8-0x10c9.7 (2) +0x10c0| 00 36 | .6 | length: 54 0x10ca-0x10cb.7 (2) +0x10c0| c9 4f | .O | checksum: 0xc94f 0x10cc-0x10cd.7 (2) + | | | data: {} (dns) 0x10ce-0x10fb.7 (46) + | | | header: {} 0x10ce-0x10d1.7 (4) +0x10c0| ec 32| .2| id: 60466 0x10ce-0x10cf.7 (2) +0x10d0|01 |. | qr: "query" (0) 0x10d0-0x10d0 (0.1) +0x10d0|01 |. | opcode: "Query" (0) 0x10d0.1-0x10d0.4 (0.4) +0x10d0|01 |. | authoritative_answer: false 0x10d0.5-0x10d0.5 (0.1) +0x10d0|01 |. | truncation: false 0x10d0.6-0x10d0.6 (0.1) +0x10d0|01 |. | recursion_desired: true 0x10d0.7-0x10d0.7 (0.1) +0x10d0| 00 | . | recursion_available: false 0x10d1-0x10d1 (0.1) +0x10d0| 00 | . | z: 0 0x10d1.1-0x10d1.3 (0.3) +0x10d0| 00 | . | rcode: "NoError" (0) (No error) 0x10d1.4-0x10d1.7 (0.4) +0x10d0| 00 01 | .. | qd_count: 1 0x10d2-0x10d3.7 (2) +0x10d0| 00 00 | .. | an_count: 0 0x10d4-0x10d5.7 (2) +0x10d0| 00 00 | .. | ns_count: 0 0x10d6-0x10d7.7 (2) +0x10d0| 00 00 | .. | ar_count: 0 0x10d8-0x10d9.7 (2) + | | | questions: [1] 0x10da-0x10fb.7 (34) + | | | [0]: question {} 0x10da-0x10fb.7 (34) + | | | name: {} 0x10da-0x10f7.7 (30) + | | | labels: [7] 0x10da-0x10f7.7 (30) + | | | [0]: label {} 0x10da-0x10dd.7 (4) +0x10d0| 03 | . | length: 3 0x10da-0x10da.7 (1) +0x10d0| 31 38 39 | 189 | value: "189" 0x10db-0x10dd.7 (3) + | | | [1]: label {} 0x10de-0x10e1.7 (4) +0x10d0| 03 | . | length: 3 0x10de-0x10de.7 (1) +0x10d0| 32| 2| value: "204" 0x10df-0x10e1.7 (3) +0x10e0|30 34 |04 | + | | | [2]: label {} 0x10e2-0x10e5.7 (4) +0x10e0| 03 | . | length: 3 0x10e2-0x10e2.7 (1) +0x10e0| 31 39 34 | 194 | value: "194" 0x10e3-0x10e5.7 (3) + | | | [3]: label {} 0x10e6-0x10e9.7 (4) +0x10e0| 03 | . | length: 3 0x10e6-0x10e6.7 (1) +0x10e0| 31 37 33 | 173 | value: "173" 0x10e7-0x10e9.7 (3) + | | | [4]: label {} 0x10ea-0x10f1.7 (8) +0x10e0| 07 | . | length: 7 0x10ea-0x10ea.7 (1) +0x10e0| 69 6e 2d 61 64| in-ad| value: "in-addr" 0x10eb-0x10f1.7 (7) +0x10f0|64 72 |dr | + | | | [5]: label {} 0x10f2-0x10f6.7 (5) +0x10f0| 04 | . | length: 4 0x10f2-0x10f2.7 (1) +0x10f0| 61 72 70 61 | arpa | value: "arpa" 0x10f3-0x10f6.7 (4) + | | | [6]: label {} 0x10f7-0x10f7.7 (1) +0x10f0| 00 | . | length: 0 0x10f7-0x10f7.7 (1) + | | | value: "189.204.194.173.in-addr.arpa" 0x10f8-NA (0) +0x10f0| 00 0c | .. | type: "PTR" (12) 0x10f8-0x10f9.7 (2) +0x10f0| 00 01 | .. | class: "IN" (1) (Internet) 0x10fa-0x10fb.7 (2) + | | | answers: [0] 0x10fc-NA (0) + | | | nameservers: [0] 0x10fc-NA (0) + | | | additionals: [0] 0x10fc-NA (0) + | | | capture_padding: raw bits 0x10fc-NA (0) + | | | padding: raw bits 0x10fc-NA (0) + | | | options: [0] 0x10fc-NA (0) +0x10f0| 78 00 00 00| x...| footer_length: 120 0x10fc-0x10ff.7 (4) + | | | [32]: block {} 0x1100-0x119b.7 (156) +0x1100|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1100-0x1103.7 (4) +0x1100| 9c 00 00 00 | .... | length: 156 0x1104-0x1107.7 (4) +0x1100| 00 00 00 00 | .... | interface_id: 0 0x1108-0x110b.7 (4) +0x1100| 72 1d 05 00| r...| timestamp_high: 335218 0x110c-0x110f.7 (4) +0x1110|3e 01 74 c9 |>.t. | timestamp_low: 3379822910 0x1110-0x1113.7 (4) +0x1110| 7a 00 00 00 | z... | capture_packet_length: 122 0x1114-0x1117.7 (4) +0x1110| 7a 00 00 00 | z... | original_packet_length: 122 0x1118-0x111b.7 (4) + | | | packet: {} (ether8023) 0x111c-0x1195.7 (122) +0x1110| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x111c-0x1121.7 (6) +0x1120|7d 93 |}. | +0x1120| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x1122-0x1127.7 (6) +0x1120| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1128-0x1129.7 (2) + | | | packet: {} (ipv4) 0x112a-0x1195.7 (108) +0x1120| 45 | E | version: 4 0x112a-0x112a.3 (0.4) +0x1120| 45 | E | ihl: 5 0x112a.4-0x112a.7 (0.4) +0x1120| 00 | . | dscp: 0 0x112b-0x112b.5 (0.6) +0x1120| 00 | . | ecn: 0 0x112b.6-0x112b.7 (0.2) +0x1120| 00 6c | .l | total_length: 108 0x112c-0x112d.7 (2) +0x1120| 00 00| ..| identification: 0 0x112e-0x112f.7 (2) +0x1130|40 |@ | reserved: 0 0x1130-0x1130 (0.1) +0x1130|40 |@ | dont_fragment: true 0x1130.1-0x1130.1 (0.1) +0x1130|40 |@ | more_fragments: false 0x1130.2-0x1130.2 (0.1) +0x1130|40 00 |@. | fragment_offset: 0 0x1130.3-0x1131.7 (1.5) +0x1130| 40 | @ | ttl: 64 0x1132-0x1132.7 (1) +0x1130| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x1133-0x1133.7 (1) +0x1130| b6 a4 | .. | header_checksum: 0xb6a4 0x1134-0x1135.7 (2) +0x1130| c0 a8 01 01 | .... | source_ip: "192.168.1.1" (0xc0a80101) 0x1136-0x1139.7 (4) +0x1130| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x113a-0x113d.7 (4) + | | | data: {} (udp) 0x113e-0x1195.7 (88) +0x1130| 00 35| .5| source_port: "domain" (53) (Domain Name Server) 0x113e-0x113f.7 (2) +0x1140|cc 06 |.. | destination_port: 52230 0x1140-0x1141.7 (2) +0x1140| 00 58 | .X | length: 88 0x1142-0x1143.7 (2) +0x1140| 94 07 | .. | checksum: 0x9407 0x1144-0x1145.7 (2) + | | | data: {} (dns) 0x1146-0x1195.7 (80) + | | | header: {} 0x1146-0x1149.7 (4) +0x1140| ec 32 | .2 | id: 60466 0x1146-0x1147.7 (2) +0x1140| 81 | . | qr: "response" (1) 0x1148-0x1148 (0.1) +0x1140| 81 | . | opcode: "Query" (0) 0x1148.1-0x1148.4 (0.4) +0x1140| 81 | . | authoritative_answer: false 0x1148.5-0x1148.5 (0.1) +0x1140| 81 | . | truncation: false 0x1148.6-0x1148.6 (0.1) +0x1140| 81 | . | recursion_desired: true 0x1148.7-0x1148.7 (0.1) +0x1140| 80 | . | recursion_available: true 0x1149-0x1149 (0.1) +0x1140| 80 | . | z: 0 0x1149.1-0x1149.3 (0.3) +0x1140| 80 | . | rcode: "NoError" (0) (No error) 0x1149.4-0x1149.7 (0.4) +0x1140| 00 01 | .. | qd_count: 1 0x114a-0x114b.7 (2) +0x1140| 00 01 | .. | an_count: 1 0x114c-0x114d.7 (2) +0x1140| 00 00| ..| ns_count: 0 0x114e-0x114f.7 (2) +0x1150|00 00 |.. | ar_count: 0 0x1150-0x1151.7 (2) + | | | questions: [1] 0x1152-0x1173.7 (34) + | | | [0]: question {} 0x1152-0x1173.7 (34) + | | | name: {} 0x1152-0x116f.7 (30) + | | | labels: [7] 0x1152-0x116f.7 (30) + | | | [0]: label {} 0x1152-0x1155.7 (4) +0x1150| 03 | . | length: 3 0x1152-0x1152.7 (1) +0x1150| 31 38 39 | 189 | value: "189" 0x1153-0x1155.7 (3) + | | | [1]: label {} 0x1156-0x1159.7 (4) +0x1150| 03 | . | length: 3 0x1156-0x1156.7 (1) +0x1150| 32 30 34 | 204 | value: "204" 0x1157-0x1159.7 (3) + | | | [2]: label {} 0x115a-0x115d.7 (4) +0x1150| 03 | . | length: 3 0x115a-0x115a.7 (1) +0x1150| 31 39 34 | 194 | value: "194" 0x115b-0x115d.7 (3) + | | | [3]: label {} 0x115e-0x1161.7 (4) +0x1150| 03 | . | length: 3 0x115e-0x115e.7 (1) +0x1150| 31| 1| value: "173" 0x115f-0x1161.7 (3) +0x1160|37 33 |73 | + | | | [4]: label {} 0x1162-0x1169.7 (8) +0x1160| 07 | . | length: 7 0x1162-0x1162.7 (1) +0x1160| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0x1163-0x1169.7 (7) + | | | [5]: label {} 0x116a-0x116e.7 (5) +0x1160| 04 | . | length: 4 0x116a-0x116a.7 (1) +0x1160| 61 72 70 61 | arpa | value: "arpa" 0x116b-0x116e.7 (4) + | | | [6]: label {} 0x116f-0x116f.7 (1) +0x1160| 00| .| length: 0 0x116f-0x116f.7 (1) + | | | value: "189.204.194.173.in-addr.arpa" 0x1170-NA (0) +0x1170|00 0c |.. | type: "PTR" (12) 0x1170-0x1171.7 (2) +0x1170| 00 01 | .. | class: "IN" (1) (Internet) 0x1172-0x1173.7 (2) + | | | answers: [1] 0x1152-0x1195.7 (68) + | | | [0]: answer {} 0x1152-0x1195.7 (68) + | | | name: {} 0x1152-0x1175.7 (36) + | | | labels: [7] 0x1152-0x1175.7 (36) + | | | [0]: label {} 0x1152-0x1175.7 (36) +0x1150| 03 | . | length: 3 0x1152-0x1152.7 (1) +0x1150| 31 38 39 | 189 | value: "189" 0x1153-0x1155.7 (3) +0x1170| c0 | . | is_pointer: 3 0x1174-0x1174.1 (0.2) +0x1170| c0 0c | .. | pointer: 12 0x1174.2-0x1175.7 (1.6) + | | | [1]: label {} 0x1156-0x1159.7 (4) +0x1150| 03 | . | length: 3 0x1156-0x1156.7 (1) +0x1150| 32 30 34 | 204 | value: "204" 0x1157-0x1159.7 (3) + | | | [2]: label {} 0x115a-0x115d.7 (4) +0x1150| 03 | . | length: 3 0x115a-0x115a.7 (1) +0x1150| 31 39 34 | 194 | value: "194" 0x115b-0x115d.7 (3) + | | | [3]: label {} 0x115e-0x1161.7 (4) +0x1150| 03 | . | length: 3 0x115e-0x115e.7 (1) +0x1150| 31| 1| value: "173" 0x115f-0x1161.7 (3) +0x1160|37 33 |73 | + | | | [4]: label {} 0x1162-0x1169.7 (8) +0x1160| 07 | . | length: 7 0x1162-0x1162.7 (1) +0x1160| 69 6e 2d 61 64 64 72 | in-addr | value: "in-addr" 0x1163-0x1169.7 (7) + | | | [5]: label {} 0x116a-0x116e.7 (5) +0x1160| 04 | . | length: 4 0x116a-0x116a.7 (1) +0x1160| 61 72 70 61 | arpa | value: "arpa" 0x116b-0x116e.7 (4) + | | | [6]: label {} 0x116f-0x116f.7 (1) +0x1160| 00| .| length: 0 0x116f-0x116f.7 (1) + | | | value: "189.204.194.173.in-addr.arpa" 0x1170-NA (0) +0x1170| 00 0c | .. | type: "PTR" (12) 0x1176-0x1177.7 (2) +0x1170| 00 01 | .. | class: "IN" (1) (Internet) 0x1178-0x1179.7 (2) +0x1170| 00 01 11 a3 | .... | ttl: 70051 0x117a-0x117d.7 (4) +0x1170| 00 16| ..| rdlength: 22 0x117e-0x117f.7 (2) + | | | ptr: {} 0x1180-0x1195.7 (22) + | | | labels: [4] 0x1180-0x1195.7 (22) + | | | [0]: label {} 0x1180-0x118a.7 (11) +0x1180|0a |. | length: 10 0x1180-0x1180.7 (1) +0x1180| 71 62 2d 69 6e 2d 66 31 38 39 | qb-in-f189 | value: "qb-in-f189" 0x1181-0x118a.7 (10) + | | | [1]: label {} 0x118b-0x1190.7 (6) +0x1180| 05 | . | length: 5 0x118b-0x118b.7 (1) +0x1180| 31 65 31 30| 1e10| value: "1e100" 0x118c-0x1190.7 (5) +0x1190|30 |0 | + | | | [2]: label {} 0x1191-0x1194.7 (4) +0x1190| 03 | . | length: 3 0x1191-0x1191.7 (1) +0x1190| 6e 65 74 | net | value: "net" 0x1192-0x1194.7 (3) + | | | [3]: label {} 0x1195-0x1195.7 (1) +0x1190| 00 | . | length: 0 0x1195-0x1195.7 (1) + | | | value: "qb-in-f189.1e100.net" 0x1196-NA (0) + | | | nameservers: [0] 0x1196-NA (0) + | | | additionals: [0] 0x1196-NA (0) + | | | capture_padding: raw bits 0x1196-NA (0) +0x1190| 00 00 | .. | padding: raw bits 0x1196-0x1197.7 (2) + | | | options: [0] 0x1198-NA (0) +0x1190| 9c 00 00 00 | .... | footer_length: 156 0x1198-0x119b.7 (4) + | | | [33]: block {} 0x119c-0x120b.7 (112) +0x1190| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x119c-0x119f.7 (4) +0x11a0|70 00 00 00 |p... | length: 112 0x11a0-0x11a3.7 (4) +0x11a0| 00 00 00 00 | .... | interface_id: 0 0x11a4-0x11a7.7 (4) +0x11a0| 72 1d 05 00 | r... | timestamp_high: 335218 0x11a8-0x11ab.7 (4) +0x11a0| 98 10 84 c9| ....| timestamp_low: 3380875416 0x11ac-0x11af.7 (4) +0x11b0|4f 00 00 00 |O... | capture_packet_length: 79 0x11b0-0x11b3.7 (4) +0x11b0| 4f 00 00 00 | O... | original_packet_length: 79 0x11b4-0x11b7.7 (4) + | | | packet: {} (ether8023) 0x11b8-0x1206.7 (79) +0x11b0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x11b8-0x11bd.7 (6) +0x11b0| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x11be-0x11c3.7 (6) +0x11c0|60 f1 7d 93 |`.}. | +0x11c0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x11c4-0x11c5.7 (2) + | | | packet: {} (ipv4) 0x11c6-0x1206.7 (65) +0x11c0| 45 | E | version: 4 0x11c6-0x11c6.3 (0.4) +0x11c0| 45 | E | ihl: 5 0x11c6.4-0x11c6.7 (0.4) +0x11c0| 00 | . | dscp: 0 0x11c7-0x11c7.5 (0.6) +0x11c0| 00 | . | ecn: 0 0x11c7.6-0x11c7.7 (0.2) +0x11c0| 00 41 | .A | total_length: 65 0x11c8-0x11c9.7 (2) +0x11c0| 95 5b | .[ | identification: 38235 0x11ca-0x11cb.7 (2) +0x11c0| 00 | . | reserved: 0 0x11cc-0x11cc (0.1) +0x11c0| 00 | . | dont_fragment: false 0x11cc.1-0x11cc.1 (0.1) +0x11c0| 00 | . | more_fragments: false 0x11cc.2-0x11cc.2 (0.1) +0x11c0| 00 00 | .. | fragment_offset: 0 0x11cc.3-0x11cd.7 (1.5) +0x11c0| 40 | @ | ttl: 64 0x11ce-0x11ce.7 (1) +0x11c0| 11| .| protocol: "udp" (17) (user datagram protocol) 0x11cf-0x11cf.7 (1) +0x11d0|61 74 |at | header_checksum: 0x6174 0x11d0-0x11d1.7 (2) +0x11d0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x11d2-0x11d5.7 (4) +0x11d0| c0 a8 01 01 | .... | destination_ip: "192.168.1.1" (0xc0a80101) 0x11d6-0x11d9.7 (4) + | | | data: {} (udp) 0x11da-0x1206.7 (45) +0x11d0| 99 6c | .l | source_port: 39276 0x11da-0x11db.7 (2) +0x11d0| 00 35 | .5 | destination_port: "domain" (53) (Domain Name Server) 0x11dc-0x11dd.7 (2) +0x11d0| 00 2d| .-| length: 45 0x11de-0x11df.7 (2) +0x11e0|03 7a |.z | checksum: 0x37a 0x11e0-0x11e1.7 (2) + | | | data: {} (dns) 0x11e2-0x1206.7 (37) + | | | header: {} 0x11e2-0x11e5.7 (4) +0x11e0| a0 d9 | .. | id: 41177 0x11e2-0x11e3.7 (2) +0x11e0| 01 | . | qr: "query" (0) 0x11e4-0x11e4 (0.1) +0x11e0| 01 | . | opcode: "Query" (0) 0x11e4.1-0x11e4.4 (0.4) +0x11e0| 01 | . | authoritative_answer: false 0x11e4.5-0x11e4.5 (0.1) +0x11e0| 01 | . | truncation: false 0x11e4.6-0x11e4.6 (0.1) +0x11e0| 01 | . | recursion_desired: true 0x11e4.7-0x11e4.7 (0.1) +0x11e0| 00 | . | recursion_available: false 0x11e5-0x11e5 (0.1) +0x11e0| 00 | . | z: 0 0x11e5.1-0x11e5.3 (0.3) +0x11e0| 00 | . | rcode: "NoError" (0) (No error) 0x11e5.4-0x11e5.7 (0.4) +0x11e0| 00 01 | .. | qd_count: 1 0x11e6-0x11e7.7 (2) +0x11e0| 00 00 | .. | an_count: 0 0x11e8-0x11e9.7 (2) +0x11e0| 00 00 | .. | ns_count: 0 0x11ea-0x11eb.7 (2) +0x11e0| 00 00 | .. | ar_count: 0 0x11ec-0x11ed.7 (2) + | | | questions: [1] 0x11ee-0x1206.7 (25) + | | | [0]: question {} 0x11ee-0x1206.7 (25) + | | | name: {} 0x11ee-0x1202.7 (21) + | | | labels: [4] 0x11ee-0x1202.7 (21) + | | | [0]: label {} 0x11ee-0x11f6.7 (9) +0x11e0| 08 | . | length: 8 0x11ee-0x11ee.7 (1) +0x11e0| 63| c| value: "clients6" 0x11ef-0x11f6.7 (8) +0x11f0|6c 69 65 6e 74 73 36 |lients6 | + | | | [1]: label {} 0x11f7-0x11fd.7 (7) +0x11f0| 06 | . | length: 6 0x11f7-0x11f7.7 (1) +0x11f0| 67 6f 6f 67 6c 65 | google | value: "google" 0x11f8-0x11fd.7 (6) + | | | [2]: label {} 0x11fe-0x1201.7 (4) +0x11f0| 03 | . | length: 3 0x11fe-0x11fe.7 (1) +0x11f0| 63| c| value: "com" 0x11ff-0x1201.7 (3) +0x1200|6f 6d |om | + | | | [3]: label {} 0x1202-0x1202.7 (1) +0x1200| 00 | . | length: 0 0x1202-0x1202.7 (1) + | | | value: "clients6.google.com" 0x1203-NA (0) +0x1200| 00 01 | .. | type: "A" (1) 0x1203-0x1204.7 (2) +0x1200| 00 01 | .. | class: "IN" (1) (Internet) 0x1205-0x1206.7 (2) + | | | answers: [0] 0x1207-NA (0) + | | | nameservers: [0] 0x1207-NA (0) + | | | additionals: [0] 0x1207-NA (0) + | | | capture_padding: raw bits 0x1207-NA (0) +0x1200| 00 | . | padding: raw bits 0x1207-0x1207.7 (1) + | | | options: [0] 0x1208-NA (0) +0x1200| 70 00 00 00 | p... | footer_length: 112 0x1208-0x120b.7 (4) + | | | [34]: block {} 0x120c-0x1343.7 (312) +0x1200| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x120c-0x120f.7 (4) +0x1210|38 01 00 00 |8... | length: 312 0x1210-0x1213.7 (4) +0x1210| 00 00 00 00 | .... | interface_id: 0 0x1214-0x1217.7 (4) +0x1210| 72 1d 05 00 | r... | timestamp_high: 335218 0x1218-0x121b.7 (4) +0x1210| 22 73 84 c9| "s..| timestamp_low: 3380900642 0x121c-0x121f.7 (4) +0x1220|17 01 00 00 |.... | capture_packet_length: 279 0x1220-0x1223.7 (4) +0x1220| 17 01 00 00 | .... | original_packet_length: 279 0x1224-0x1227.7 (4) + | | | packet: {} (ether8023) 0x1228-0x133e.7 (279) +0x1220| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1228-0x122d.7 (6) +0x1220| 94 10| ..| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x122e-0x1233.7 (6) +0x1230|3e 05 36 d3 |>.6. | +0x1230| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1234-0x1235.7 (2) + | | | packet: {} (ipv4) 0x1236-0x133e.7 (265) +0x1230| 45 | E | version: 4 0x1236-0x1236.3 (0.4) +0x1230| 45 | E | ihl: 5 0x1236.4-0x1236.7 (0.4) +0x1230| 00 | . | dscp: 0 0x1237-0x1237.5 (0.6) +0x1230| 00 | . | ecn: 0 0x1237.6-0x1237.7 (0.2) +0x1230| 01 09 | .. | total_length: 265 0x1238-0x1239.7 (2) +0x1230| 00 00 | .. | identification: 0 0x123a-0x123b.7 (2) +0x1230| 40 | @ | reserved: 0 0x123c-0x123c (0.1) +0x1230| 40 | @ | dont_fragment: true 0x123c.1-0x123c.1 (0.1) +0x1230| 40 | @ | more_fragments: false 0x123c.2-0x123c.2 (0.1) +0x1230| 40 00 | @. | fragment_offset: 0 0x123c.3-0x123d.7 (1.5) +0x1230| 40 | @ | ttl: 64 0x123e-0x123e.7 (1) +0x1230| 11| .| protocol: "udp" (17) (user datagram protocol) 0x123f-0x123f.7 (1) +0x1240|b6 07 |.. | header_checksum: 0xb607 0x1240-0x1241.7 (2) +0x1240| c0 a8 01 01 | .... | source_ip: "192.168.1.1" (0xc0a80101) 0x1242-0x1245.7 (4) +0x1240| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x1246-0x1249.7 (4) + | | | data: {} (udp) 0x124a-0x133e.7 (245) +0x1240| 00 35 | .5 | source_port: "domain" (53) (Domain Name Server) 0x124a-0x124b.7 (2) +0x1240| 99 6c | .l | destination_port: 39276 0x124c-0x124d.7 (2) +0x1240| 00 f5| ..| length: 245 0x124e-0x124f.7 (2) +0x1250|73 38 |s8 | checksum: 0x7338 0x1250-0x1251.7 (2) + | | | data: {} (dns) 0x1252-0x133e.7 (237) + | | | header: {} 0x1252-0x1255.7 (4) +0x1250| a0 d9 | .. | id: 41177 0x1252-0x1253.7 (2) +0x1250| 81 | . | qr: "response" (1) 0x1254-0x1254 (0.1) +0x1250| 81 | . | opcode: "Query" (0) 0x1254.1-0x1254.4 (0.4) +0x1250| 81 | . | authoritative_answer: false 0x1254.5-0x1254.5 (0.1) +0x1250| 81 | . | truncation: false 0x1254.6-0x1254.6 (0.1) +0x1250| 81 | . | recursion_desired: true 0x1254.7-0x1254.7 (0.1) +0x1250| 80 | . | recursion_available: true 0x1255-0x1255 (0.1) +0x1250| 80 | . | z: 0 0x1255.1-0x1255.3 (0.3) +0x1250| 80 | . | rcode: "NoError" (0) (No error) 0x1255.4-0x1255.7 (0.4) +0x1250| 00 01 | .. | qd_count: 1 0x1256-0x1257.7 (2) +0x1250| 00 0c | .. | an_count: 12 0x1258-0x1259.7 (2) +0x1250| 00 00 | .. | ns_count: 0 0x125a-0x125b.7 (2) +0x1250| 00 00 | .. | ar_count: 0 0x125c-0x125d.7 (2) + | | | questions: [1] 0x125e-0x1276.7 (25) + | | | [0]: question {} 0x125e-0x1276.7 (25) + | | | name: {} 0x125e-0x1272.7 (21) + | | | labels: [4] 0x125e-0x1272.7 (21) + | | | [0]: label {} 0x125e-0x1266.7 (9) +0x1250| 08 | . | length: 8 0x125e-0x125e.7 (1) +0x1250| 63| c| value: "clients6" 0x125f-0x1266.7 (8) +0x1260|6c 69 65 6e 74 73 36 |lients6 | + | | | [1]: label {} 0x1267-0x126d.7 (7) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) + | | | [2]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [3]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | value: "clients6.google.com" 0x1273-NA (0) +0x1270| 00 01 | .. | type: "A" (1) 0x1273-0x1274.7 (2) +0x1270| 00 01 | .. | class: "IN" (1) (Internet) 0x1275-0x1276.7 (2) + | | | answers: [12] 0x125e-0x133e.7 (225) + | | | [0]: answer {} 0x125e-0x128e.7 (49) + | | | name: {} 0x125e-0x1278.7 (27) + | | | labels: [4] 0x125e-0x1278.7 (27) + | | | [0]: label {} 0x125e-0x1278.7 (27) +0x1250| 08 | . | length: 8 0x125e-0x125e.7 (1) +0x1250| 63| c| value: "clients6" 0x125f-0x1266.7 (8) +0x1260|6c 69 65 6e 74 73 36 |lients6 | +0x1270| c0 | . | is_pointer: 3 0x1277-0x1277.1 (0.2) +0x1270| c0 0c | .. | pointer: 12 0x1277.2-0x1278.7 (1.6) + | | | [1]: label {} 0x1267-0x126d.7 (7) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) + | | | [2]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [3]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | value: "clients6.google.com" 0x1273-NA (0) + | | | cname: {} 0x1267-0x128e.7 (40) + | | | labels: [5] 0x1267-0x128e.7 (40) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x128a.7 (8) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x1270| 00 05 | .. | type: "CNAME" (5) 0x1279-0x127a.7 (2) +0x1270| 00 01 | .. | class: "IN" (1) (Internet) 0x127b-0x127c.7 (2) +0x1270| 00 00 00| ...| ttl: 16 0x127d-0x1280.7 (4) +0x1280|10 |. | +0x1280| 00 0c | .. | rdlength: 12 0x1281-0x1282.7 (2) + | | | [1]: answer {} 0x1267-0x129e.7 (56) + | | | name: {} 0x1267-0x1290.7 (42) + | | | labels: [5] 0x1267-0x1290.7 (42) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x1290.7 (14) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x1280| c0| .| is_pointer: 3 0x128f-0x128f.1 (0.2) +0x1280| c0| .| pointer: 49 0x128f.2-0x1290.7 (1.6) +0x1290|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x1290| 00 01 | .. | type: "A" (1) 0x1291-0x1292.7 (2) +0x1290| 00 01 | .. | class: "IN" (1) (Internet) 0x1293-0x1294.7 (2) +0x1290| 00 00 00 e9 | .... | ttl: 233 0x1295-0x1298.7 (4) +0x1290| 00 04 | .. | rdlength: 4 0x1299-0x129a.7 (2) +0x1290| 4a 7d e4 e3 | J}.. | address: "74.125.228.227" 0x129b-0x129e.7 (4) + | | | [2]: answer {} 0x1267-0x12ae.7 (72) + | | | name: {} 0x1267-0x12a0.7 (58) + | | | labels: [5] 0x1267-0x12a0.7 (58) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x12a0.7 (30) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x1290| c0| .| is_pointer: 3 0x129f-0x129f.1 (0.2) +0x1290| c0| .| pointer: 49 0x129f.2-0x12a0.7 (1.6) +0x12a0|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x12a0| 00 01 | .. | type: "A" (1) 0x12a1-0x12a2.7 (2) +0x12a0| 00 01 | .. | class: "IN" (1) (Internet) 0x12a3-0x12a4.7 (2) +0x12a0| 00 00 00 e9 | .... | ttl: 233 0x12a5-0x12a8.7 (4) +0x12a0| 00 04 | .. | rdlength: 4 0x12a9-0x12aa.7 (2) +0x12a0| 4a 7d e4 e0 | J}.. | address: "74.125.228.224" 0x12ab-0x12ae.7 (4) + | | | [3]: answer {} 0x1267-0x12be.7 (88) + | | | name: {} 0x1267-0x12b0.7 (74) + | | | labels: [5] 0x1267-0x12b0.7 (74) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x12b0.7 (46) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x12a0| c0| .| is_pointer: 3 0x12af-0x12af.1 (0.2) +0x12a0| c0| .| pointer: 49 0x12af.2-0x12b0.7 (1.6) +0x12b0|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x12b0| 00 01 | .. | type: "A" (1) 0x12b1-0x12b2.7 (2) +0x12b0| 00 01 | .. | class: "IN" (1) (Internet) 0x12b3-0x12b4.7 (2) +0x12b0| 00 00 00 e9 | .... | ttl: 233 0x12b5-0x12b8.7 (4) +0x12b0| 00 04 | .. | rdlength: 4 0x12b9-0x12ba.7 (2) +0x12b0| 4a 7d e4 e1 | J}.. | address: "74.125.228.225" 0x12bb-0x12be.7 (4) + | | | [4]: answer {} 0x1267-0x12ce.7 (104) + | | | name: {} 0x1267-0x12c0.7 (90) + | | | labels: [5] 0x1267-0x12c0.7 (90) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x12c0.7 (62) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x12b0| c0| .| is_pointer: 3 0x12bf-0x12bf.1 (0.2) +0x12b0| c0| .| pointer: 49 0x12bf.2-0x12c0.7 (1.6) +0x12c0|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x12c0| 00 01 | .. | type: "A" (1) 0x12c1-0x12c2.7 (2) +0x12c0| 00 01 | .. | class: "IN" (1) (Internet) 0x12c3-0x12c4.7 (2) +0x12c0| 00 00 00 e9 | .... | ttl: 233 0x12c5-0x12c8.7 (4) +0x12c0| 00 04 | .. | rdlength: 4 0x12c9-0x12ca.7 (2) +0x12c0| 4a 7d e4 e7 | J}.. | address: "74.125.228.231" 0x12cb-0x12ce.7 (4) + | | | [5]: answer {} 0x1267-0x12de.7 (120) + | | | name: {} 0x1267-0x12d0.7 (106) + | | | labels: [5] 0x1267-0x12d0.7 (106) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x12d0.7 (78) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x12c0| c0| .| is_pointer: 3 0x12cf-0x12cf.1 (0.2) +0x12c0| c0| .| pointer: 49 0x12cf.2-0x12d0.7 (1.6) +0x12d0|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x12d0| 00 01 | .. | type: "A" (1) 0x12d1-0x12d2.7 (2) +0x12d0| 00 01 | .. | class: "IN" (1) (Internet) 0x12d3-0x12d4.7 (2) +0x12d0| 00 00 00 e9 | .... | ttl: 233 0x12d5-0x12d8.7 (4) +0x12d0| 00 04 | .. | rdlength: 4 0x12d9-0x12da.7 (2) +0x12d0| 4a 7d e4 e2 | J}.. | address: "74.125.228.226" 0x12db-0x12de.7 (4) + | | | [6]: answer {} 0x1267-0x12ee.7 (136) + | | | name: {} 0x1267-0x12e0.7 (122) + | | | labels: [5] 0x1267-0x12e0.7 (122) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x12e0.7 (94) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x12d0| c0| .| is_pointer: 3 0x12df-0x12df.1 (0.2) +0x12d0| c0| .| pointer: 49 0x12df.2-0x12e0.7 (1.6) +0x12e0|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x12e0| 00 01 | .. | type: "A" (1) 0x12e1-0x12e2.7 (2) +0x12e0| 00 01 | .. | class: "IN" (1) (Internet) 0x12e3-0x12e4.7 (2) +0x12e0| 00 00 00 e9 | .... | ttl: 233 0x12e5-0x12e8.7 (4) +0x12e0| 00 04 | .. | rdlength: 4 0x12e9-0x12ea.7 (2) +0x12e0| 4a 7d e4 e8 | J}.. | address: "74.125.228.232" 0x12eb-0x12ee.7 (4) + | | | [7]: answer {} 0x1267-0x12fe.7 (152) + | | | name: {} 0x1267-0x12f0.7 (138) + | | | labels: [5] 0x1267-0x12f0.7 (138) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x12f0.7 (110) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x12e0| c0| .| is_pointer: 3 0x12ef-0x12ef.1 (0.2) +0x12e0| c0| .| pointer: 49 0x12ef.2-0x12f0.7 (1.6) +0x12f0|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x12f0| 00 01 | .. | type: "A" (1) 0x12f1-0x12f2.7 (2) +0x12f0| 00 01 | .. | class: "IN" (1) (Internet) 0x12f3-0x12f4.7 (2) +0x12f0| 00 00 00 e9 | .... | ttl: 233 0x12f5-0x12f8.7 (4) +0x12f0| 00 04 | .. | rdlength: 4 0x12f9-0x12fa.7 (2) +0x12f0| 4a 7d e4 e6 | J}.. | address: "74.125.228.230" 0x12fb-0x12fe.7 (4) + | | | [8]: answer {} 0x1267-0x130e.7 (168) + | | | name: {} 0x1267-0x1300.7 (154) + | | | labels: [5] 0x1267-0x1300.7 (154) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x1300.7 (126) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x12f0| c0| .| is_pointer: 3 0x12ff-0x12ff.1 (0.2) +0x12f0| c0| .| pointer: 49 0x12ff.2-0x1300.7 (1.6) +0x1300|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x1300| 00 01 | .. | type: "A" (1) 0x1301-0x1302.7 (2) +0x1300| 00 01 | .. | class: "IN" (1) (Internet) 0x1303-0x1304.7 (2) +0x1300| 00 00 00 e9 | .... | ttl: 233 0x1305-0x1308.7 (4) +0x1300| 00 04 | .. | rdlength: 4 0x1309-0x130a.7 (2) +0x1300| 4a 7d e4 e9 | J}.. | address: "74.125.228.233" 0x130b-0x130e.7 (4) + | | | [9]: answer {} 0x1267-0x131e.7 (184) + | | | name: {} 0x1267-0x1310.7 (170) + | | | labels: [5] 0x1267-0x1310.7 (170) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x1310.7 (142) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x1300| c0| .| is_pointer: 3 0x130f-0x130f.1 (0.2) +0x1300| c0| .| pointer: 49 0x130f.2-0x1310.7 (1.6) +0x1310|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x1310| 00 01 | .. | type: "A" (1) 0x1311-0x1312.7 (2) +0x1310| 00 01 | .. | class: "IN" (1) (Internet) 0x1313-0x1314.7 (2) +0x1310| 00 00 00 e9 | .... | ttl: 233 0x1315-0x1318.7 (4) +0x1310| 00 04 | .. | rdlength: 4 0x1319-0x131a.7 (2) +0x1310| 4a 7d e4 e4 | J}.. | address: "74.125.228.228" 0x131b-0x131e.7 (4) + | | | [10]: answer {} 0x1267-0x132e.7 (200) + | | | name: {} 0x1267-0x1320.7 (186) + | | | labels: [5] 0x1267-0x1320.7 (186) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x1320.7 (158) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x1310| c0| .| is_pointer: 3 0x131f-0x131f.1 (0.2) +0x1310| c0| .| pointer: 49 0x131f.2-0x1320.7 (1.6) +0x1320|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x1320| 00 01 | .. | type: "A" (1) 0x1321-0x1322.7 (2) +0x1320| 00 01 | .. | class: "IN" (1) (Internet) 0x1323-0x1324.7 (2) +0x1320| 00 00 00 e9 | .... | ttl: 233 0x1325-0x1328.7 (4) +0x1320| 00 04 | .. | rdlength: 4 0x1329-0x132a.7 (2) +0x1320| 4a 7d e4 e5 | J}.. | address: "74.125.228.229" 0x132b-0x132e.7 (4) + | | | [11]: answer {} 0x1267-0x133e.7 (216) + | | | name: {} 0x1267-0x1330.7 (202) + | | | labels: [5] 0x1267-0x1330.7 (202) + | | | [0]: label {} 0x1267-0x128e.7 (40) +0x1260| 06 | . | length: 6 0x1267-0x1267.7 (1) +0x1260| 67 6f 6f 67 6c 65 | google | value: "google" 0x1268-0x126d.7 (6) +0x1280| c0 | . | is_pointer: 3 0x128d-0x128d.1 (0.2) +0x1280| c0 15 | .. | pointer: 21 0x128d.2-0x128e.7 (1.6) + | | | [1]: label {} 0x126e-0x1271.7 (4) +0x1260| 03 | . | length: 3 0x126e-0x126e.7 (1) +0x1260| 63| c| value: "com" 0x126f-0x1271.7 (3) +0x1270|6f 6d |om | + | | | [2]: label {} 0x1272-0x1272.7 (1) +0x1270| 00 | . | length: 0 0x1272-0x1272.7 (1) + | | | [3]: label {} 0x1283-0x1330.7 (174) +0x1280| 07 | . | length: 7 0x1283-0x1283.7 (1) +0x1280| 63 6c 69 65 6e 74 73 | clients | value: "clients" 0x1284-0x128a.7 (7) +0x1320| c0| .| is_pointer: 3 0x132f-0x132f.1 (0.2) +0x1320| c0| .| pointer: 49 0x132f.2-0x1330.7 (1.6) +0x1330|31 |1 | + | | | [4]: label {} 0x128b-0x128c.7 (2) +0x1280| 01 | . | length: 1 0x128b-0x128b.7 (1) +0x1280| 6c | l | value: "l" 0x128c-0x128c.7 (1) + | | | value: "clients.l.google.com" 0x1273-NA (0) +0x1330| 00 01 | .. | type: "A" (1) 0x1331-0x1332.7 (2) +0x1330| 00 01 | .. | class: "IN" (1) (Internet) 0x1333-0x1334.7 (2) +0x1330| 00 00 00 e9 | .... | ttl: 233 0x1335-0x1338.7 (4) +0x1330| 00 04 | .. | rdlength: 4 0x1339-0x133a.7 (2) +0x1330| 4a 7d e4 ee | J}.. | address: "74.125.228.238" 0x133b-0x133e.7 (4) + | | | nameservers: [0] 0x133f-NA (0) + | | | additionals: [0] 0x133f-NA (0) + | | | capture_padding: raw bits 0x133f-NA (0) +0x1330| 00| .| padding: raw bits 0x133f-0x133f.7 (1) + | | | options: [0] 0x1340-NA (0) +0x1340|38 01 00 00 |8... | footer_length: 312 0x1340-0x1343.7 (4) + | | | [35]: block {} 0x1344-0x13b3.7 (112) +0x1340| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1344-0x1347.7 (4) +0x1340| 70 00 00 00 | p... | length: 112 0x1348-0x134b.7 (4) +0x1340| 00 00 00 00| ....| interface_id: 0 0x134c-0x134f.7 (4) +0x1350|72 1d 05 00 |r... | timestamp_high: 335218 0x1350-0x1353.7 (4) +0x1350| 82 74 84 c9 | .t.. | timestamp_low: 3380900994 0x1354-0x1357.7 (4) +0x1350| 4e 00 00 00 | N... | capture_packet_length: 78 0x1358-0x135b.7 (4) +0x1350| 4e 00 00 00| N...| original_packet_length: 78 0x135c-0x135f.7 (4) + | | | packet: {} (ether8023) 0x1360-0x13ad.7 (78) +0x1360|94 10 3e 05 36 d3 |..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x1360-0x1365.7 (6) +0x1360| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1366-0x136b.7 (6) +0x1360| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x136c-0x136d.7 (2) + | | | packet: {} (ipv4) 0x136e-0x13ad.7 (64) +0x1360| 45 | E | version: 4 0x136e-0x136e.3 (0.4) +0x1360| 45 | E | ihl: 5 0x136e.4-0x136e.7 (0.4) +0x1360| 00| .| dscp: 0 0x136f-0x136f.5 (0.6) +0x1360| 00| .| ecn: 0 0x136f.6-0x136f.7 (0.2) +0x1370|00 40 |.@ | total_length: 64 0x1370-0x1371.7 (2) +0x1370| 16 35 | .5 | identification: 5685 0x1372-0x1373.7 (2) +0x1370| 40 | @ | reserved: 0 0x1374-0x1374 (0.1) +0x1370| 40 | @ | dont_fragment: true 0x1374.1-0x1374.1 (0.1) +0x1370| 40 | @ | more_fragments: false 0x1374.2-0x1374.2 (0.1) +0x1370| 40 00 | @. | fragment_offset: 0 0x1374.3-0x1375.7 (1.5) +0x1370| 40 | @ | ttl: 64 0x1376-0x1376.7 (1) +0x1370| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x1377-0x1377.7 (1) +0x1370| 32 ef | 2. | header_checksum: 0x32ef 0x1378-0x1379.7 (2) +0x1370| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x137a-0x137d.7 (4) +0x1370| 4a 7d| J}| destination_ip: "74.125.228.227" (0x4a7de4e3) 0x137e-0x1381.7 (4) +0x1380|e4 e3 |.. | + | | | data: {} (tcp) 0x1382-0x13ad.7 (44) +0x1380| c7 25 | .% | source_port: 50981 0x1382-0x1383.7 (2) +0x1380| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x1384-0x1385.7 (2) +0x1380| 2b ce 2e 8a | +... | sequence_number: 734932618 0x1386-0x1389.7 (4) +0x1380| 00 00 00 00 | .... | acknowledgment_number: 0 0x138a-0x138d.7 (4) +0x1380| b0 | . | data_offset: 11 0x138e-0x138e.3 (0.4) +0x1380| b0 | . | reserved: 0 0x138e.4-0x138e.6 (0.3) +0x1380| b0 | . | ns: false 0x138e.7-0x138e.7 (0.1) +0x1380| 02| .| cwr: false 0x138f-0x138f (0.1) +0x1380| 02| .| ece: false 0x138f.1-0x138f.1 (0.1) +0x1380| 02| .| urg: false 0x138f.2-0x138f.2 (0.1) +0x1380| 02| .| ack: false 0x138f.3-0x138f.3 (0.1) +0x1380| 02| .| psh: false 0x138f.4-0x138f.4 (0.1) +0x1380| 02| .| rst: false 0x138f.5-0x138f.5 (0.1) +0x1380| 02| .| syn: true 0x138f.6-0x138f.6 (0.1) +0x1380| 02| .| fin: false 0x138f.7-0x138f.7 (0.1) +0x1390|ff ff |.. | window_size: 65535 0x1390-0x1391.7 (2) +0x1390| 45 e4 | E. | checksum: 0x45e4 0x1392-0x1393.7 (2) +0x1390| 00 00 | .. | urgent_pointer: 0 0x1394-0x1395.7 (2) +0x1390| 02 04 05 b4 01 03 03 05 01 01| ..........| options: raw bits 0x1396-0x13ad.7 (24) +0x13a0|08 0a 4b 2a 91 21 00 00 00 00 04 02 00 00 |..K*.!........ | + | | | data: raw bits 0x13ae-NA (0) + | | | capture_padding: raw bits 0x13ae-NA (0) +0x13a0| 00 00| ..| padding: raw bits 0x13ae-0x13af.7 (2) + | | | options: [0] 0x13b0-NA (0) +0x13b0|70 00 00 00 |p... | footer_length: 112 0x13b0-0x13b3.7 (4) + | | | [36]: block {} 0x13b4-0x141f.7 (108) +0x13b0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x13b4-0x13b7.7 (4) +0x13b0| 6c 00 00 00 | l... | length: 108 0x13b8-0x13bb.7 (4) +0x13b0| 00 00 00 00| ....| interface_id: 0 0x13bc-0x13bf.7 (4) +0x13c0|72 1d 05 00 |r... | timestamp_high: 335218 0x13c0-0x13c3.7 (4) +0x13c0| 83 db 84 c9 | .... | timestamp_low: 3380927363 0x13c4-0x13c7.7 (4) +0x13c0| 4a 00 00 00 | J... | capture_packet_length: 74 0x13c8-0x13cb.7 (4) +0x13c0| 4a 00 00 00| J...| original_packet_length: 74 0x13cc-0x13cf.7 (4) + | | | packet: {} (ether8023) 0x13d0-0x1419.7 (74) +0x13d0|a4 5e 60 f1 7d 93 |.^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x13d0-0x13d5.7 (6) +0x13d0| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x13d6-0x13db.7 (6) +0x13d0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x13dc-0x13dd.7 (2) + | | | packet: {} (ipv4) 0x13de-0x1419.7 (60) +0x13d0| 45 | E | version: 4 0x13de-0x13de.3 (0.4) +0x13d0| 45 | E | ihl: 5 0x13de.4-0x13de.7 (0.4) +0x13d0| 28| (| dscp: 10 0x13df-0x13df.5 (0.6) +0x13d0| 28| (| ecn: 0 0x13df.6-0x13df.7 (0.2) +0x13e0|00 3c |.< | total_length: 60 0x13e0-0x13e1.7 (2) +0x13e0| 40 e2 | @. | identification: 16610 0x13e2-0x13e3.7 (2) +0x13e0| 00 | . | reserved: 0 0x13e4-0x13e4 (0.1) +0x13e0| 00 | . | dont_fragment: false 0x13e4.1-0x13e4.1 (0.1) +0x13e0| 00 | . | more_fragments: false 0x13e4.2-0x13e4.2 (0.1) +0x13e0| 00 00 | .. | fragment_offset: 0 0x13e4.3-0x13e5.7 (1.5) +0x13e0| 35 | 5 | ttl: 53 0x13e6-0x13e6.7 (1) +0x13e0| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x13e7-0x13e7.7 (1) +0x13e0| 53 1e | S. | header_checksum: 0x531e 0x13e8-0x13e9.7 (2) +0x13e0| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x13ea-0x13ed.7 (4) +0x13e0| c0 a8| ..| destination_ip: "192.168.1.139" (0xc0a8018b) 0x13ee-0x13f1.7 (4) +0x13f0|01 8b |.. | + | | | data: {} (tcp) 0x13f2-0x1419.7 (40) +0x13f0| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0x13f2-0x13f3.7 (2) +0x13f0| c7 25 | .% | destination_port: 50981 0x13f4-0x13f5.7 (2) +0x13f0| 43 54 83 30 | CT.0 | sequence_number: 1129612080 0x13f6-0x13f9.7 (4) +0x13f0| 2b ce 2e 8b | +... | acknowledgment_number: 734932619 0x13fa-0x13fd.7 (4) +0x13f0| a0 | . | data_offset: 10 0x13fe-0x13fe.3 (0.4) +0x13f0| a0 | . | reserved: 0 0x13fe.4-0x13fe.6 (0.3) +0x13f0| a0 | . | ns: false 0x13fe.7-0x13fe.7 (0.1) +0x13f0| 12| .| cwr: false 0x13ff-0x13ff (0.1) +0x13f0| 12| .| ece: false 0x13ff.1-0x13ff.1 (0.1) +0x13f0| 12| .| urg: false 0x13ff.2-0x13ff.2 (0.1) +0x13f0| 12| .| ack: true 0x13ff.3-0x13ff.3 (0.1) +0x13f0| 12| .| psh: false 0x13ff.4-0x13ff.4 (0.1) +0x13f0| 12| .| rst: false 0x13ff.5-0x13ff.5 (0.1) +0x13f0| 12| .| syn: true 0x13ff.6-0x13ff.6 (0.1) +0x13f0| 12| .| fin: false 0x13ff.7-0x13ff.7 (0.1) +0x1400|a6 2c |., | window_size: 42540 0x1400-0x1401.7 (2) +0x1400| 8a 97 | .. | checksum: 0x8a97 0x1402-0x1403.7 (2) +0x1400| 00 00 | .. | urgent_pointer: 0 0x1404-0x1405.7 (2) +0x1400| 02 04 05 96 04 02 08 0a e4 57| .........W| options: raw bits 0x1406-0x1419.7 (20) +0x1410|7b 53 4b 2a 91 21 01 03 03 07 |{SK*.!.... | + | | | data: raw bits 0x141a-NA (0) + | | | capture_padding: raw bits 0x141a-NA (0) +0x1410| 00 00 | .. | padding: raw bits 0x141a-0x141b.7 (2) + | | | options: [0] 0x141c-NA (0) +0x1410| 6c 00 00 00| l...| footer_length: 108 0x141c-0x141f.7 (4) + | | | [37]: block {} 0x1420-0x1483.7 (100) +0x1420|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1420-0x1423.7 (4) +0x1420| 64 00 00 00 | d... | length: 100 0x1424-0x1427.7 (4) +0x1420| 00 00 00 00 | .... | interface_id: 0 0x1428-0x142b.7 (4) +0x1420| 72 1d 05 00| r...| timestamp_high: 335218 0x142c-0x142f.7 (4) +0x1430|c1 db 84 c9 |.... | timestamp_low: 3380927425 0x1430-0x1433.7 (4) +0x1430| 42 00 00 00 | B... | capture_packet_length: 66 0x1434-0x1437.7 (4) +0x1430| 42 00 00 00 | B... | original_packet_length: 66 0x1438-0x143b.7 (4) + | | | packet: {} (ether8023) 0x143c-0x147d.7 (66) +0x1430| 94 10 3e 05| ..>.| destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x143c-0x1441.7 (6) +0x1440|36 d3 |6. | +0x1440| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1442-0x1447.7 (6) +0x1440| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1448-0x1449.7 (2) + | | | packet: {} (ipv4) 0x144a-0x147d.7 (52) +0x1440| 45 | E | version: 4 0x144a-0x144a.3 (0.4) +0x1440| 45 | E | ihl: 5 0x144a.4-0x144a.7 (0.4) +0x1440| 00 | . | dscp: 0 0x144b-0x144b.5 (0.6) +0x1440| 00 | . | ecn: 0 0x144b.6-0x144b.7 (0.2) +0x1440| 00 34 | .4 | total_length: 52 0x144c-0x144d.7 (2) +0x1440| 2e 37| .7| identification: 11831 0x144e-0x144f.7 (2) +0x1450|40 |@ | reserved: 0 0x1450-0x1450 (0.1) +0x1450|40 |@ | dont_fragment: true 0x1450.1-0x1450.1 (0.1) +0x1450|40 |@ | more_fragments: false 0x1450.2-0x1450.2 (0.1) +0x1450|40 00 |@. | fragment_offset: 0 0x1450.3-0x1451.7 (1.5) +0x1450| 40 | @ | ttl: 64 0x1452-0x1452.7 (1) +0x1450| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x1453-0x1453.7 (1) +0x1450| 1a f9 | .. | header_checksum: 0x1af9 0x1454-0x1455.7 (2) +0x1450| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x1456-0x1459.7 (4) +0x1450| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x145a-0x145d.7 (4) + | | | data: {} (tcp) 0x145e-0x147d.7 (32) +0x1450| c7 25| .%| source_port: 50981 0x145e-0x145f.7 (2) +0x1460|01 bb |.. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x1460-0x1461.7 (2) +0x1460| 2b ce 2e 8b | +... | sequence_number: 734932619 0x1462-0x1465.7 (4) +0x1460| 43 54 83 31 | CT.1 | acknowledgment_number: 1129612081 0x1466-0x1469.7 (4) +0x1460| 80 | . | data_offset: 8 0x146a-0x146a.3 (0.4) +0x1460| 80 | . | reserved: 0 0x146a.4-0x146a.6 (0.3) +0x1460| 80 | . | ns: false 0x146a.7-0x146a.7 (0.1) +0x1460| 10 | . | cwr: false 0x146b-0x146b (0.1) +0x1460| 10 | . | ece: false 0x146b.1-0x146b.1 (0.1) +0x1460| 10 | . | urg: false 0x146b.2-0x146b.2 (0.1) +0x1460| 10 | . | ack: true 0x146b.3-0x146b.3 (0.1) +0x1460| 10 | . | psh: false 0x146b.4-0x146b.4 (0.1) +0x1460| 10 | . | rst: false 0x146b.5-0x146b.5 (0.1) +0x1460| 10 | . | syn: false 0x146b.6-0x146b.6 (0.1) +0x1460| 10 | . | fin: false 0x146b.7-0x146b.7 (0.1) +0x1460| 10 19 | .. | window_size: 4121 0x146c-0x146d.7 (2) +0x1460| 4f 3f| O?| checksum: 0x4f3f 0x146e-0x146f.7 (2) +0x1470|00 00 |.. | urgent_pointer: 0 0x1470-0x1471.7 (2) +0x1470| 01 01 08 0a 4b 2a 91 3b e4 57 7b 53 | ....K*.;.W{S | options: raw bits 0x1472-0x147d.7 (12) + | | | data: raw bits 0x147e-NA (0) + | | | capture_padding: raw bits 0x147e-NA (0) +0x1470| 00 00| ..| padding: raw bits 0x147e-0x147f.7 (2) + | | | options: [0] 0x1480-NA (0) +0x1480|64 00 00 00 |d... | footer_length: 100 0x1480-0x1483.7 (4) + | | | [38]: block {} 0x1484-0x16eb.7 (616) +0x1480| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1484-0x1487.7 (4) +0x1480| 68 02 00 00 | h... | length: 616 0x1488-0x148b.7 (4) +0x1480| 00 00 00 00| ....| interface_id: 0 0x148c-0x148f.7 (4) +0x1490|72 1d 05 00 |r... | timestamp_high: 335218 0x1490-0x1493.7 (4) +0x1490| 6d dc 84 c9 | m... | timestamp_low: 3380927597 0x1494-0x1497.7 (4) +0x1490| 47 02 00 00 | G... | capture_packet_length: 583 0x1498-0x149b.7 (4) +0x1490| 47 02 00 00| G...| original_packet_length: 583 0x149c-0x149f.7 (4) + | | | packet: {} (ether8023) 0x14a0-0x16e6.7 (583) +0x14a0|94 10 3e 05 36 d3 |..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x14a0-0x14a5.7 (6) +0x14a0| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x14a6-0x14ab.7 (6) +0x14a0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x14ac-0x14ad.7 (2) + | | | packet: {} (ipv4) 0x14ae-0x16e6.7 (569) +0x14a0| 45 | E | version: 4 0x14ae-0x14ae.3 (0.4) +0x14a0| 45 | E | ihl: 5 0x14ae.4-0x14ae.7 (0.4) +0x14a0| 00| .| dscp: 0 0x14af-0x14af.5 (0.6) +0x14a0| 00| .| ecn: 0 0x14af.6-0x14af.7 (0.2) +0x14b0|02 39 |.9 | total_length: 569 0x14b0-0x14b1.7 (2) +0x14b0| 8d a8 | .. | identification: 36264 0x14b2-0x14b3.7 (2) +0x14b0| 40 | @ | reserved: 0 0x14b4-0x14b4 (0.1) +0x14b0| 40 | @ | dont_fragment: true 0x14b4.1-0x14b4.1 (0.1) +0x14b0| 40 | @ | more_fragments: false 0x14b4.2-0x14b4.2 (0.1) +0x14b0| 40 00 | @. | fragment_offset: 0 0x14b4.3-0x14b5.7 (1.5) +0x14b0| 40 | @ | ttl: 64 0x14b6-0x14b6.7 (1) +0x14b0| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x14b7-0x14b7.7 (1) +0x14b0| b9 82 | .. | header_checksum: 0xb982 0x14b8-0x14b9.7 (2) +0x14b0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x14ba-0x14bd.7 (4) +0x14b0| 4a 7d| J}| destination_ip: "74.125.228.227" (0x4a7de4e3) 0x14be-0x14c1.7 (4) +0x14c0|e4 e3 |.. | + | | | data: {} (tcp) 0x14c2-0x16e6.7 (549) +0x14c0| c7 25 | .% | source_port: 50981 0x14c2-0x14c3.7 (2) +0x14c0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x14c4-0x14c5.7 (2) +0x14c0| 2b ce 2e 8b | +... | sequence_number: 734932619 0x14c6-0x14c9.7 (4) +0x14c0| 43 54 83 31 | CT.1 | acknowledgment_number: 1129612081 0x14ca-0x14cd.7 (4) +0x14c0| 80 | . | data_offset: 8 0x14ce-0x14ce.3 (0.4) +0x14c0| 80 | . | reserved: 0 0x14ce.4-0x14ce.6 (0.3) +0x14c0| 80 | . | ns: false 0x14ce.7-0x14ce.7 (0.1) +0x14c0| 18| .| cwr: false 0x14cf-0x14cf (0.1) +0x14c0| 18| .| ece: false 0x14cf.1-0x14cf.1 (0.1) +0x14c0| 18| .| urg: false 0x14cf.2-0x14cf.2 (0.1) +0x14c0| 18| .| ack: true 0x14cf.3-0x14cf.3 (0.1) +0x14c0| 18| .| psh: true 0x14cf.4-0x14cf.4 (0.1) +0x14c0| 18| .| rst: false 0x14cf.5-0x14cf.5 (0.1) +0x14c0| 18| .| syn: false 0x14cf.6-0x14cf.6 (0.1) +0x14c0| 18| .| fin: false 0x14cf.7-0x14cf.7 (0.1) +0x14d0|10 19 |.. | window_size: 4121 0x14d0-0x14d1.7 (2) +0x14d0| 15 03 | .. | checksum: 0x1503 0x14d2-0x14d3.7 (2) +0x14d0| 00 00 | .. | urgent_pointer: 0 0x14d4-0x14d5.7 (2) +0x14d0| 01 01 08 0a 4b 2a 91 3b e4 57| ....K*.;.W| options: raw bits 0x14d6-0x14e1.7 (12) +0x14e0|7b 53 |{S | +0x14e0| 16 03 01 02 00 01 00 01 fc 03 03 f0 91 bc| ..............| data: raw bits 0x14e2-0x16e6.7 (517) +0x14f0|87 3e ed 9d cc 98 4a 6a 2e 84 3f 5c 1d 9b a9 e9|.>....Jj..?\....| +* |until 0x16e6.7 (517) | | + | | | capture_padding: raw bits 0x16e7-NA (0) +0x16e0| 00 | . | padding: raw bits 0x16e7-0x16e7.7 (1) + | | | options: [0] 0x16e8-NA (0) +0x16e0| 68 02 00 00 | h... | footer_length: 616 0x16e8-0x16eb.7 (4) + | | | [39]: block {} 0x16ec-0x174f.7 (100) +0x16e0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x16ec-0x16ef.7 (4) +0x16f0|64 00 00 00 |d... | length: 100 0x16f0-0x16f3.7 (4) +0x16f0| 00 00 00 00 | .... | interface_id: 0 0x16f4-0x16f7.7 (4) +0x16f0| 72 1d 05 00 | r... | timestamp_high: 335218 0x16f8-0x16fb.7 (4) +0x16f0| 70 40 85 c9| p@..| timestamp_low: 3380953200 0x16fc-0x16ff.7 (4) +0x1700|42 00 00 00 |B... | capture_packet_length: 66 0x1700-0x1703.7 (4) +0x1700| 42 00 00 00 | B... | original_packet_length: 66 0x1704-0x1707.7 (4) + | | | packet: {} (ether8023) 0x1708-0x1749.7 (66) +0x1700| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1708-0x170d.7 (6) +0x1700| 94 10| ..| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x170e-0x1713.7 (6) +0x1710|3e 05 36 d3 |>.6. | +0x1710| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1714-0x1715.7 (2) + | | | packet: {} (ipv4) 0x1716-0x1749.7 (52) +0x1710| 45 | E | version: 4 0x1716-0x1716.3 (0.4) +0x1710| 45 | E | ihl: 5 0x1716.4-0x1716.7 (0.4) +0x1710| 28 | ( | dscp: 10 0x1717-0x1717.5 (0.6) +0x1710| 28 | ( | ecn: 0 0x1717.6-0x1717.7 (0.2) +0x1710| 00 34 | .4 | total_length: 52 0x1718-0x1719.7 (2) +0x1710| 40 ed | @. | identification: 16621 0x171a-0x171b.7 (2) +0x1710| 00 | . | reserved: 0 0x171c-0x171c (0.1) +0x1710| 00 | . | dont_fragment: false 0x171c.1-0x171c.1 (0.1) +0x1710| 00 | . | more_fragments: false 0x171c.2-0x171c.2 (0.1) +0x1710| 00 00 | .. | fragment_offset: 0 0x171c.3-0x171d.7 (1.5) +0x1710| 35 | 5 | ttl: 53 0x171e-0x171e.7 (1) +0x1710| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x171f-0x171f.7 (1) +0x1720|53 1b |S. | header_checksum: 0x531b 0x1720-0x1721.7 (2) +0x1720| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x1722-0x1725.7 (4) +0x1720| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x1726-0x1729.7 (4) + | | | data: {} (tcp) 0x172a-0x1749.7 (32) +0x1720| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0x172a-0x172b.7 (2) +0x1720| c7 25 | .% | destination_port: 50981 0x172c-0x172d.7 (2) +0x1720| 43 54| CT| sequence_number: 1129612081 0x172e-0x1731.7 (4) +0x1730|83 31 |.1 | +0x1730| 2b ce 30 90 | +.0. | acknowledgment_number: 734933136 0x1732-0x1735.7 (4) +0x1730| 80 | . | data_offset: 8 0x1736-0x1736.3 (0.4) +0x1730| 80 | . | reserved: 0 0x1736.4-0x1736.6 (0.3) +0x1730| 80 | . | ns: false 0x1736.7-0x1736.7 (0.1) +0x1730| 10 | . | cwr: false 0x1737-0x1737 (0.1) +0x1730| 10 | . | ece: false 0x1737.1-0x1737.1 (0.1) +0x1730| 10 | . | urg: false 0x1737.2-0x1737.2 (0.1) +0x1730| 10 | . | ack: true 0x1737.3-0x1737.3 (0.1) +0x1730| 10 | . | psh: false 0x1737.4-0x1737.4 (0.1) +0x1730| 10 | . | rst: false 0x1737.5-0x1737.5 (0.1) +0x1730| 10 | . | syn: false 0x1737.6-0x1737.6 (0.1) +0x1730| 10 | . | fin: false 0x1737.7-0x1737.7 (0.1) +0x1730| 01 55 | .U | window_size: 341 0x1738-0x1739.7 (2) +0x1730| 5b e3 | [. | checksum: 0x5be3 0x173a-0x173b.7 (2) +0x1730| 00 00 | .. | urgent_pointer: 0 0x173c-0x173d.7 (2) +0x1730| 01 01| ..| options: raw bits 0x173e-0x1749.7 (12) +0x1740|08 0a e4 57 7b 6e 4b 2a 91 3b |...W{nK*.; | + | | | data: raw bits 0x174a-NA (0) + | | | capture_padding: raw bits 0x174a-NA (0) +0x1740| 00 00 | .. | padding: raw bits 0x174a-0x174b.7 (2) + | | | options: [0] 0x174c-NA (0) +0x1740| 64 00 00 00| d...| footer_length: 100 0x174c-0x174f.7 (4) + | | | [40]: block {} 0x1750-0x1843.7 (244) +0x1750|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1750-0x1753.7 (4) +0x1750| f4 00 00 00 | .... | length: 244 0x1754-0x1757.7 (4) +0x1750| 00 00 00 00 | .... | interface_id: 0 0x1758-0x175b.7 (4) +0x1750| 72 1d 05 00| r...| timestamp_high: 335218 0x175c-0x175f.7 (4) +0x1760|5d 45 85 c9 |]E.. | timestamp_low: 3380954461 0x1760-0x1763.7 (4) +0x1760| d4 00 00 00 | .... | capture_packet_length: 212 0x1764-0x1767.7 (4) +0x1760| d4 00 00 00 | .... | original_packet_length: 212 0x1768-0x176b.7 (4) + | | | packet: {} (ether8023) 0x176c-0x183f.7 (212) +0x1760| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x176c-0x1771.7 (6) +0x1770|7d 93 |}. | +0x1770| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x1772-0x1777.7 (6) +0x1770| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1778-0x1779.7 (2) + | | | packet: {} (ipv4) 0x177a-0x183f.7 (198) +0x1770| 45 | E | version: 4 0x177a-0x177a.3 (0.4) +0x1770| 45 | E | ihl: 5 0x177a.4-0x177a.7 (0.4) +0x1770| 28 | ( | dscp: 10 0x177b-0x177b.5 (0.6) +0x1770| 28 | ( | ecn: 0 0x177b.6-0x177b.7 (0.2) +0x1770| 00 c6 | .. | total_length: 198 0x177c-0x177d.7 (2) +0x1770| 40 ee| @.| identification: 16622 0x177e-0x177f.7 (2) +0x1780|00 |. | reserved: 0 0x1780-0x1780 (0.1) +0x1780|00 |. | dont_fragment: false 0x1780.1-0x1780.1 (0.1) +0x1780|00 |. | more_fragments: false 0x1780.2-0x1780.2 (0.1) +0x1780|00 00 |.. | fragment_offset: 0 0x1780.3-0x1781.7 (1.5) +0x1780| 35 | 5 | ttl: 53 0x1782-0x1782.7 (1) +0x1780| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x1783-0x1783.7 (1) +0x1780| 52 88 | R. | header_checksum: 0x5288 0x1784-0x1785.7 (2) +0x1780| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x1786-0x1789.7 (4) +0x1780| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x178a-0x178d.7 (4) + | | | data: {} (tcp) 0x178e-0x183f.7 (178) +0x1780| 01 bb| ..| source_port: "https" (443) (http protocol over TLS/SSL) 0x178e-0x178f.7 (2) +0x1790|c7 25 |.% | destination_port: 50981 0x1790-0x1791.7 (2) +0x1790| 43 54 83 31 | CT.1 | sequence_number: 1129612081 0x1792-0x1795.7 (4) +0x1790| 2b ce 30 90 | +.0. | acknowledgment_number: 734933136 0x1796-0x1799.7 (4) +0x1790| 80 | . | data_offset: 8 0x179a-0x179a.3 (0.4) +0x1790| 80 | . | reserved: 0 0x179a.4-0x179a.6 (0.3) +0x1790| 80 | . | ns: false 0x179a.7-0x179a.7 (0.1) +0x1790| 18 | . | cwr: false 0x179b-0x179b (0.1) +0x1790| 18 | . | ece: false 0x179b.1-0x179b.1 (0.1) +0x1790| 18 | . | urg: false 0x179b.2-0x179b.2 (0.1) +0x1790| 18 | . | ack: true 0x179b.3-0x179b.3 (0.1) +0x1790| 18 | . | psh: true 0x179b.4-0x179b.4 (0.1) +0x1790| 18 | . | rst: false 0x179b.5-0x179b.5 (0.1) +0x1790| 18 | . | syn: false 0x179b.6-0x179b.6 (0.1) +0x1790| 18 | . | fin: false 0x179b.7-0x179b.7 (0.1) +0x1790| 01 55 | .U | window_size: 341 0x179c-0x179d.7 (2) +0x1790| bf 9c| ..| checksum: 0xbf9c 0x179e-0x179f.7 (2) +0x17a0|00 00 |.. | urgent_pointer: 0 0x17a0-0x17a1.7 (2) +0x17a0| 01 01 08 0a e4 57 7b 6e 4b 2a 91 3b | .....W{nK*.; | options: raw bits 0x17a2-0x17ad.7 (12) +0x17a0| 16 03| ..| data: raw bits 0x17ae-0x183f.7 (146) +0x17b0|03 00 5a 02 00 00 56 03 03 55 d0 e5 ff ab 64 a2|..Z...V..U....d.| +* |until 0x183f.7 (146) | | + | | | capture_padding: raw bits 0x1840-NA (0) + | | | padding: raw bits 0x1840-NA (0) + | | | options: [0] 0x1840-NA (0) +0x1840|f4 00 00 00 |.... | footer_length: 244 0x1840-0x1843.7 (4) + | | | [41]: block {} 0x1844-0x18a7.7 (100) +0x1840| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1844-0x1847.7 (4) +0x1840| 64 00 00 00 | d... | length: 100 0x1848-0x184b.7 (4) +0x1840| 00 00 00 00| ....| interface_id: 0 0x184c-0x184f.7 (4) +0x1850|72 1d 05 00 |r... | timestamp_high: 335218 0x1850-0x1853.7 (4) +0x1850| 94 45 85 c9 | .E.. | timestamp_low: 3380954516 0x1854-0x1857.7 (4) +0x1850| 42 00 00 00 | B... | capture_packet_length: 66 0x1858-0x185b.7 (4) +0x1850| 42 00 00 00| B...| original_packet_length: 66 0x185c-0x185f.7 (4) + | | | packet: {} (ether8023) 0x1860-0x18a1.7 (66) +0x1860|94 10 3e 05 36 d3 |..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x1860-0x1865.7 (6) +0x1860| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1866-0x186b.7 (6) +0x1860| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x186c-0x186d.7 (2) + | | | packet: {} (ipv4) 0x186e-0x18a1.7 (52) +0x1860| 45 | E | version: 4 0x186e-0x186e.3 (0.4) +0x1860| 45 | E | ihl: 5 0x186e.4-0x186e.7 (0.4) +0x1860| 00| .| dscp: 0 0x186f-0x186f.5 (0.6) +0x1860| 00| .| ecn: 0 0x186f.6-0x186f.7 (0.2) +0x1870|00 34 |.4 | total_length: 52 0x1870-0x1871.7 (2) +0x1870| d9 7a | .z | identification: 55674 0x1872-0x1873.7 (2) +0x1870| 40 | @ | reserved: 0 0x1874-0x1874 (0.1) +0x1870| 40 | @ | dont_fragment: true 0x1874.1-0x1874.1 (0.1) +0x1870| 40 | @ | more_fragments: false 0x1874.2-0x1874.2 (0.1) +0x1870| 40 00 | @. | fragment_offset: 0 0x1874.3-0x1875.7 (1.5) +0x1870| 40 | @ | ttl: 64 0x1876-0x1876.7 (1) +0x1870| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x1877-0x1877.7 (1) +0x1870| 6f b5 | o. | header_checksum: 0x6fb5 0x1878-0x1879.7 (2) +0x1870| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x187a-0x187d.7 (4) +0x1870| 4a 7d| J}| destination_ip: "74.125.228.227" (0x4a7de4e3) 0x187e-0x1881.7 (4) +0x1880|e4 e3 |.. | + | | | data: {} (tcp) 0x1882-0x18a1.7 (32) +0x1880| c7 25 | .% | source_port: 50981 0x1882-0x1883.7 (2) +0x1880| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x1884-0x1885.7 (2) +0x1880| 2b ce 30 90 | +.0. | sequence_number: 734933136 0x1886-0x1889.7 (4) +0x1880| 43 54 83 c3 | CT.. | acknowledgment_number: 1129612227 0x188a-0x188d.7 (4) +0x1880| 80 | . | data_offset: 8 0x188e-0x188e.3 (0.4) +0x1880| 80 | . | reserved: 0 0x188e.4-0x188e.6 (0.3) +0x1880| 80 | . | ns: false 0x188e.7-0x188e.7 (0.1) +0x1880| 10| .| cwr: false 0x188f-0x188f (0.1) +0x1880| 10| .| ece: false 0x188f.1-0x188f.1 (0.1) +0x1880| 10| .| urg: false 0x188f.2-0x188f.2 (0.1) +0x1880| 10| .| ack: true 0x188f.3-0x188f.3 (0.1) +0x1880| 10| .| psh: false 0x188f.4-0x188f.4 (0.1) +0x1880| 10| .| rst: false 0x188f.5-0x188f.5 (0.1) +0x1880| 10| .| syn: false 0x188f.6-0x188f.6 (0.1) +0x1880| 10| .| fin: false 0x188f.7-0x188f.7 (0.1) +0x1890|10 14 |.. | window_size: 4116 0x1890-0x1891.7 (2) +0x1890| 4c 78 | Lx | checksum: 0x4c78 0x1892-0x1893.7 (2) +0x1890| 00 00 | .. | urgent_pointer: 0 0x1894-0x1895.7 (2) +0x1890| 01 01 08 0a 4b 2a 91 55 e4 57| ....K*.U.W| options: raw bits 0x1896-0x18a1.7 (12) +0x18a0|7b 6e |{n | + | | | data: raw bits 0x18a2-NA (0) + | | | capture_padding: raw bits 0x18a2-NA (0) +0x18a0| 00 00 | .. | padding: raw bits 0x18a2-0x18a3.7 (2) + | | | options: [0] 0x18a4-NA (0) +0x18a0| 64 00 00 00 | d... | footer_length: 100 0x18a4-0x18a7.7 (4) + | | | [42]: block {} 0x18a8-0x193f.7 (152) +0x18a0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x18a8-0x18ab.7 (4) +0x18a0| 98 00 00 00| ....| length: 152 0x18ac-0x18af.7 (4) +0x18b0|00 00 00 00 |.... | interface_id: 0 0x18b0-0x18b3.7 (4) +0x18b0| 72 1d 05 00 | r... | timestamp_high: 335218 0x18b4-0x18b7.7 (4) +0x18b0| 4b 46 85 c9 | KF.. | timestamp_low: 3380954699 0x18b8-0x18bb.7 (4) +0x18b0| 75 00 00 00| u...| capture_packet_length: 117 0x18bc-0x18bf.7 (4) +0x18c0|75 00 00 00 |u... | original_packet_length: 117 0x18c0-0x18c3.7 (4) + | | | packet: {} (ether8023) 0x18c4-0x1938.7 (117) +0x18c0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x18c4-0x18c9.7 (6) +0x18c0| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x18ca-0x18cf.7 (6) +0x18d0|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x18d0-0x18d1.7 (2) + | | | packet: {} (ipv4) 0x18d2-0x1938.7 (103) +0x18d0| 45 | E | version: 4 0x18d2-0x18d2.3 (0.4) +0x18d0| 45 | E | ihl: 5 0x18d2.4-0x18d2.7 (0.4) +0x18d0| 00 | . | dscp: 0 0x18d3-0x18d3.5 (0.6) +0x18d0| 00 | . | ecn: 0 0x18d3.6-0x18d3.7 (0.2) +0x18d0| 00 67 | .g | total_length: 103 0x18d4-0x18d5.7 (2) +0x18d0| 7c a2 | |. | identification: 31906 0x18d6-0x18d7.7 (2) +0x18d0| 40 | @ | reserved: 0 0x18d8-0x18d8 (0.1) +0x18d0| 40 | @ | dont_fragment: true 0x18d8.1-0x18d8.1 (0.1) +0x18d0| 40 | @ | more_fragments: false 0x18d8.2-0x18d8.2 (0.1) +0x18d0| 40 00 | @. | fragment_offset: 0 0x18d8.3-0x18d9.7 (1.5) +0x18d0| 40 | @ | ttl: 64 0x18da-0x18da.7 (1) +0x18d0| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x18db-0x18db.7 (1) +0x18d0| cc 5a | .Z | header_checksum: 0xcc5a 0x18dc-0x18dd.7 (2) +0x18d0| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x18de-0x18e1.7 (4) +0x18e0|01 8b |.. | +0x18e0| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x18e2-0x18e5.7 (4) + | | | data: {} (tcp) 0x18e6-0x1938.7 (83) +0x18e0| c7 25 | .% | source_port: 50981 0x18e6-0x18e7.7 (2) +0x18e0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x18e8-0x18e9.7 (2) +0x18e0| 2b ce 30 90 | +.0. | sequence_number: 734933136 0x18ea-0x18ed.7 (4) +0x18e0| 43 54| CT| acknowledgment_number: 1129612227 0x18ee-0x18f1.7 (4) +0x18f0|83 c3 |.. | +0x18f0| 80 | . | data_offset: 8 0x18f2-0x18f2.3 (0.4) +0x18f0| 80 | . | reserved: 0 0x18f2.4-0x18f2.6 (0.3) +0x18f0| 80 | . | ns: false 0x18f2.7-0x18f2.7 (0.1) +0x18f0| 18 | . | cwr: false 0x18f3-0x18f3 (0.1) +0x18f0| 18 | . | ece: false 0x18f3.1-0x18f3.1 (0.1) +0x18f0| 18 | . | urg: false 0x18f3.2-0x18f3.2 (0.1) +0x18f0| 18 | . | ack: true 0x18f3.3-0x18f3.3 (0.1) +0x18f0| 18 | . | psh: true 0x18f3.4-0x18f3.4 (0.1) +0x18f0| 18 | . | rst: false 0x18f3.5-0x18f3.5 (0.1) +0x18f0| 18 | . | syn: false 0x18f3.6-0x18f3.6 (0.1) +0x18f0| 18 | . | fin: false 0x18f3.7-0x18f3.7 (0.1) +0x18f0| 10 14 | .. | window_size: 4116 0x18f4-0x18f5.7 (2) +0x18f0| 9a 08 | .. | checksum: 0x9a08 0x18f6-0x18f7.7 (2) +0x18f0| 00 00 | .. | urgent_pointer: 0 0x18f8-0x18f9.7 (2) +0x18f0| 01 01 08 0a 4b 2a| ....K*| options: raw bits 0x18fa-0x1905.7 (12) +0x1900|91 55 e4 57 7b 6e |.U.W{n | +0x1900| 14 03 03 00 01 01 16 03 03 00| ..........| data: raw bits 0x1906-0x1938.7 (51) +0x1910|28 00 00 00 00 00 00 00 00 2f 64 40 f5 c5 eb af|(......../d@....| +* |until 0x1938.7 (51) | | + | | | capture_padding: raw bits 0x1939-NA (0) +0x1930| 00 00 00 | ... | padding: raw bits 0x1939-0x193b.7 (3) + | | | options: [0] 0x193c-NA (0) +0x1930| 98 00 00 00| ....| footer_length: 152 0x193c-0x193f.7 (4) + | | | [43]: block {} 0x1940-0x19d7.7 (152) +0x1940|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1940-0x1943.7 (4) +0x1940| 98 00 00 00 | .... | length: 152 0x1944-0x1947.7 (4) +0x1940| 00 00 00 00 | .... | interface_id: 0 0x1948-0x194b.7 (4) +0x1940| 72 1d 05 00| r...| timestamp_high: 335218 0x194c-0x194f.7 (4) +0x1950|7e 4d 85 c9 |~M.. | timestamp_low: 3380956542 0x1950-0x1953.7 (4) +0x1950| 77 00 00 00 | w... | capture_packet_length: 119 0x1954-0x1957.7 (4) +0x1950| 77 00 00 00 | w... | original_packet_length: 119 0x1958-0x195b.7 (4) + | | | packet: {} (ether8023) 0x195c-0x19d2.7 (119) +0x1950| 94 10 3e 05| ..>.| destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x195c-0x1961.7 (6) +0x1960|36 d3 |6. | +0x1960| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1962-0x1967.7 (6) +0x1960| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1968-0x1969.7 (2) + | | | packet: {} (ipv4) 0x196a-0x19d2.7 (105) +0x1960| 45 | E | version: 4 0x196a-0x196a.3 (0.4) +0x1960| 45 | E | ihl: 5 0x196a.4-0x196a.7 (0.4) +0x1960| 00 | . | dscp: 0 0x196b-0x196b.5 (0.6) +0x1960| 00 | . | ecn: 0 0x196b.6-0x196b.7 (0.2) +0x1960| 00 69 | .i | total_length: 105 0x196c-0x196d.7 (2) +0x1960| c4 1b| ..| identification: 50203 0x196e-0x196f.7 (2) +0x1970|40 |@ | reserved: 0 0x1970-0x1970 (0.1) +0x1970|40 |@ | dont_fragment: true 0x1970.1-0x1970.1 (0.1) +0x1970|40 |@ | more_fragments: false 0x1970.2-0x1970.2 (0.1) +0x1970|40 00 |@. | fragment_offset: 0 0x1970.3-0x1971.7 (1.5) +0x1970| 40 | @ | ttl: 64 0x1972-0x1972.7 (1) +0x1970| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x1973-0x1973.7 (1) +0x1970| 84 df | .. | header_checksum: 0x84df 0x1974-0x1975.7 (2) +0x1970| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x1976-0x1979.7 (4) +0x1970| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x197a-0x197d.7 (4) + | | | data: {} (tcp) 0x197e-0x19d2.7 (85) +0x1970| c7 25| .%| source_port: 50981 0x197e-0x197f.7 (2) +0x1980|01 bb |.. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x1980-0x1981.7 (2) +0x1980| 2b ce 30 c3 | +.0. | sequence_number: 734933187 0x1982-0x1985.7 (4) +0x1980| 43 54 83 c3 | CT.. | acknowledgment_number: 1129612227 0x1986-0x1989.7 (4) +0x1980| 80 | . | data_offset: 8 0x198a-0x198a.3 (0.4) +0x1980| 80 | . | reserved: 0 0x198a.4-0x198a.6 (0.3) +0x1980| 80 | . | ns: false 0x198a.7-0x198a.7 (0.1) +0x1980| 18 | . | cwr: false 0x198b-0x198b (0.1) +0x1980| 18 | . | ece: false 0x198b.1-0x198b.1 (0.1) +0x1980| 18 | . | urg: false 0x198b.2-0x198b.2 (0.1) +0x1980| 18 | . | ack: true 0x198b.3-0x198b.3 (0.1) +0x1980| 18 | . | psh: true 0x198b.4-0x198b.4 (0.1) +0x1980| 18 | . | rst: false 0x198b.5-0x198b.5 (0.1) +0x1980| 18 | . | syn: false 0x198b.6-0x198b.6 (0.1) +0x1980| 18 | . | fin: false 0x198b.7-0x198b.7 (0.1) +0x1980| 10 14 | .. | window_size: 4116 0x198c-0x198d.7 (2) +0x1980| 2a 6b| *k| checksum: 0x2a6b 0x198e-0x198f.7 (2) +0x1990|00 00 |.. | urgent_pointer: 0 0x1990-0x1991.7 (2) +0x1990| 01 01 08 0a 4b 2a 91 57 e4 57 7b 6e | ....K*.W.W{n | options: raw bits 0x1992-0x199d.7 (12) +0x1990| 17 03| ..| data: raw bits 0x199e-0x19d2.7 (53) +0x19a0|03 00 30 00 00 00 00 00 00 00 01 51 98 2a 12 b0|..0........Q.*..| +* |until 0x19d2.7 (53) | | + | | | capture_padding: raw bits 0x19d3-NA (0) +0x19d0| 00 | . | padding: raw bits 0x19d3-0x19d3.7 (1) + | | | options: [0] 0x19d4-NA (0) +0x19d0| 98 00 00 00 | .... | footer_length: 152 0x19d4-0x19d7.7 (4) + | | | [44]: block {} 0x19d8-0x1a6b.7 (148) +0x19d0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x19d8-0x19db.7 (4) +0x19d0| 94 00 00 00| ....| length: 148 0x19dc-0x19df.7 (4) +0x19e0|00 00 00 00 |.... | interface_id: 0 0x19e0-0x19e3.7 (4) +0x19e0| 72 1d 05 00 | r... | timestamp_high: 335218 0x19e4-0x19e7.7 (4) +0x19e0| 7f 4d 85 c9 | .M.. | timestamp_low: 3380956543 0x19e8-0x19eb.7 (4) +0x19e0| 74 00 00 00| t...| capture_packet_length: 116 0x19ec-0x19ef.7 (4) +0x19f0|74 00 00 00 |t... | original_packet_length: 116 0x19f0-0x19f3.7 (4) + | | | packet: {} (ether8023) 0x19f4-0x1a67.7 (116) +0x19f0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x19f4-0x19f9.7 (6) +0x19f0| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x19fa-0x19ff.7 (6) +0x1a00|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1a00-0x1a01.7 (2) + | | | packet: {} (ipv4) 0x1a02-0x1a67.7 (102) +0x1a00| 45 | E | version: 4 0x1a02-0x1a02.3 (0.4) +0x1a00| 45 | E | ihl: 5 0x1a02.4-0x1a02.7 (0.4) +0x1a00| 00 | . | dscp: 0 0x1a03-0x1a03.5 (0.6) +0x1a00| 00 | . | ecn: 0 0x1a03.6-0x1a03.7 (0.2) +0x1a00| 00 66 | .f | total_length: 102 0x1a04-0x1a05.7 (2) +0x1a00| e3 b8 | .. | identification: 58296 0x1a06-0x1a07.7 (2) +0x1a00| 40 | @ | reserved: 0 0x1a08-0x1a08 (0.1) +0x1a00| 40 | @ | dont_fragment: true 0x1a08.1-0x1a08.1 (0.1) +0x1a00| 40 | @ | more_fragments: false 0x1a08.2-0x1a08.2 (0.1) +0x1a00| 40 00 | @. | fragment_offset: 0 0x1a08.3-0x1a09.7 (1.5) +0x1a00| 40 | @ | ttl: 64 0x1a0a-0x1a0a.7 (1) +0x1a00| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x1a0b-0x1a0b.7 (1) +0x1a00| 65 45 | eE | header_checksum: 0x6545 0x1a0c-0x1a0d.7 (2) +0x1a00| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x1a0e-0x1a11.7 (4) +0x1a10|01 8b |.. | +0x1a10| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x1a12-0x1a15.7 (4) + | | | data: {} (tcp) 0x1a16-0x1a67.7 (82) +0x1a10| c7 25 | .% | source_port: 50981 0x1a16-0x1a17.7 (2) +0x1a10| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x1a18-0x1a19.7 (2) +0x1a10| 2b ce 30 f8 | +.0. | sequence_number: 734933240 0x1a1a-0x1a1d.7 (4) +0x1a10| 43 54| CT| acknowledgment_number: 1129612227 0x1a1e-0x1a21.7 (4) +0x1a20|83 c3 |.. | +0x1a20| 80 | . | data_offset: 8 0x1a22-0x1a22.3 (0.4) +0x1a20| 80 | . | reserved: 0 0x1a22.4-0x1a22.6 (0.3) +0x1a20| 80 | . | ns: false 0x1a22.7-0x1a22.7 (0.1) +0x1a20| 18 | . | cwr: false 0x1a23-0x1a23 (0.1) +0x1a20| 18 | . | ece: false 0x1a23.1-0x1a23.1 (0.1) +0x1a20| 18 | . | urg: false 0x1a23.2-0x1a23.2 (0.1) +0x1a20| 18 | . | ack: true 0x1a23.3-0x1a23.3 (0.1) +0x1a20| 18 | . | psh: true 0x1a23.4-0x1a23.4 (0.1) +0x1a20| 18 | . | rst: false 0x1a23.5-0x1a23.5 (0.1) +0x1a20| 18 | . | syn: false 0x1a23.6-0x1a23.6 (0.1) +0x1a20| 18 | . | fin: false 0x1a23.7-0x1a23.7 (0.1) +0x1a20| 10 14 | .. | window_size: 4116 0x1a24-0x1a25.7 (2) +0x1a20| f2 bb | .. | checksum: 0xf2bb 0x1a26-0x1a27.7 (2) +0x1a20| 00 00 | .. | urgent_pointer: 0 0x1a28-0x1a29.7 (2) +0x1a20| 01 01 08 0a 4b 2a| ....K*| options: raw bits 0x1a2a-0x1a35.7 (12) +0x1a30|91 57 e4 57 7b 6e |.W.W{n | +0x1a30| 17 03 03 00 2d 00 00 00 00 00| ....-.....| data: raw bits 0x1a36-0x1a67.7 (50) +0x1a40|00 00 02 f0 bc fa 7b fe 22 8d 11 11 1b 0b 72 db|......{.".....r.| +* |until 0x1a67.7 (50) | | + | | | capture_padding: raw bits 0x1a68-NA (0) + | | | padding: raw bits 0x1a68-NA (0) + | | | options: [0] 0x1a68-NA (0) +0x1a60| 94 00 00 00 | .... | footer_length: 148 0x1a68-0x1a6b.7 (4) + | | | [45]: block {} 0x1a6c-0x1af7.7 (140) +0x1a60| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1a6c-0x1a6f.7 (4) +0x1a70|8c 00 00 00 |.... | length: 140 0x1a70-0x1a73.7 (4) +0x1a70| 00 00 00 00 | .... | interface_id: 0 0x1a74-0x1a77.7 (4) +0x1a70| 72 1d 05 00 | r... | timestamp_high: 335218 0x1a78-0x1a7b.7 (4) +0x1a70| 80 4d 85 c9| .M..| timestamp_low: 3380956544 0x1a7c-0x1a7f.7 (4) +0x1a80|6c 00 00 00 |l... | capture_packet_length: 108 0x1a80-0x1a83.7 (4) +0x1a80| 6c 00 00 00 | l... | original_packet_length: 108 0x1a84-0x1a87.7 (4) + | | | packet: {} (ether8023) 0x1a88-0x1af3.7 (108) +0x1a80| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x1a88-0x1a8d.7 (6) +0x1a80| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1a8e-0x1a93.7 (6) +0x1a90|60 f1 7d 93 |`.}. | +0x1a90| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1a94-0x1a95.7 (2) + | | | packet: {} (ipv4) 0x1a96-0x1af3.7 (94) +0x1a90| 45 | E | version: 4 0x1a96-0x1a96.3 (0.4) +0x1a90| 45 | E | ihl: 5 0x1a96.4-0x1a96.7 (0.4) +0x1a90| 00 | . | dscp: 0 0x1a97-0x1a97.5 (0.6) +0x1a90| 00 | . | ecn: 0 0x1a97.6-0x1a97.7 (0.2) +0x1a90| 00 5e | .^ | total_length: 94 0x1a98-0x1a99.7 (2) +0x1a90| 03 80 | .. | identification: 896 0x1a9a-0x1a9b.7 (2) +0x1a90| 40 | @ | reserved: 0 0x1a9c-0x1a9c (0.1) +0x1a90| 40 | @ | dont_fragment: true 0x1a9c.1-0x1a9c.1 (0.1) +0x1a90| 40 | @ | more_fragments: false 0x1a9c.2-0x1a9c.2 (0.1) +0x1a90| 40 00 | @. | fragment_offset: 0 0x1a9c.3-0x1a9d.7 (1.5) +0x1a90| 40 | @ | ttl: 64 0x1a9e-0x1a9e.7 (1) +0x1a90| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x1a9f-0x1a9f.7 (1) +0x1aa0|45 86 |E. | header_checksum: 0x4586 0x1aa0-0x1aa1.7 (2) +0x1aa0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x1aa2-0x1aa5.7 (4) +0x1aa0| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x1aa6-0x1aa9.7 (4) + | | | data: {} (tcp) 0x1aaa-0x1af3.7 (74) +0x1aa0| c7 25 | .% | source_port: 50981 0x1aaa-0x1aab.7 (2) +0x1aa0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x1aac-0x1aad.7 (2) +0x1aa0| 2b ce| +.| sequence_number: 734933290 0x1aae-0x1ab1.7 (4) +0x1ab0|31 2a |1* | +0x1ab0| 43 54 83 c3 | CT.. | acknowledgment_number: 1129612227 0x1ab2-0x1ab5.7 (4) +0x1ab0| 80 | . | data_offset: 8 0x1ab6-0x1ab6.3 (0.4) +0x1ab0| 80 | . | reserved: 0 0x1ab6.4-0x1ab6.6 (0.3) +0x1ab0| 80 | . | ns: false 0x1ab6.7-0x1ab6.7 (0.1) +0x1ab0| 18 | . | cwr: false 0x1ab7-0x1ab7 (0.1) +0x1ab0| 18 | . | ece: false 0x1ab7.1-0x1ab7.1 (0.1) +0x1ab0| 18 | . | urg: false 0x1ab7.2-0x1ab7.2 (0.1) +0x1ab0| 18 | . | ack: true 0x1ab7.3-0x1ab7.3 (0.1) +0x1ab0| 18 | . | psh: true 0x1ab7.4-0x1ab7.4 (0.1) +0x1ab0| 18 | . | rst: false 0x1ab7.5-0x1ab7.5 (0.1) +0x1ab0| 18 | . | syn: false 0x1ab7.6-0x1ab7.6 (0.1) +0x1ab0| 18 | . | fin: false 0x1ab7.7-0x1ab7.7 (0.1) +0x1ab0| 10 14 | .. | window_size: 4116 0x1ab8-0x1ab9.7 (2) +0x1ab0| 17 a0 | .. | checksum: 0x17a0 0x1aba-0x1abb.7 (2) +0x1ab0| 00 00 | .. | urgent_pointer: 0 0x1abc-0x1abd.7 (2) +0x1ab0| 01 01| ..| options: raw bits 0x1abe-0x1ac9.7 (12) +0x1ac0|08 0a 4b 2a 91 57 e4 57 7b 6e |..K*.W.W{n | +0x1ac0| 17 03 03 00 25 00| ....%.| data: raw bits 0x1aca-0x1af3.7 (42) +0x1ad0|00 00 00 00 00 00 03 91 f4 86 be 5b 2a 4f 9f 3e|...........[*O.>| +* |until 0x1af3.7 (42) | | + | | | capture_padding: raw bits 0x1af4-NA (0) + | | | padding: raw bits 0x1af4-NA (0) + | | | options: [0] 0x1af4-NA (0) +0x1af0| 8c 00 00 00 | .... | footer_length: 140 0x1af4-0x1af7.7 (4) + | | | [46]: block {} 0x1af8-0x1fef.7 (1272) +0x1af0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1af8-0x1afb.7 (4) +0x1af0| f8 04 00 00| ....| length: 1272 0x1afc-0x1aff.7 (4) +0x1b00|00 00 00 00 |.... | interface_id: 0 0x1b00-0x1b03.7 (4) +0x1b00| 72 1d 05 00 | r... | timestamp_high: 335218 0x1b04-0x1b07.7 (4) +0x1b00| 58 4e 85 c9 | XN.. | timestamp_low: 3380956760 0x1b08-0x1b0b.7 (4) +0x1b00| d6 04 00 00| ....| capture_packet_length: 1238 0x1b0c-0x1b0f.7 (4) +0x1b10|d6 04 00 00 |.... | original_packet_length: 1238 0x1b10-0x1b13.7 (4) + | | | packet: {} (ether8023) 0x1b14-0x1fe9.7 (1238) +0x1b10| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x1b14-0x1b19.7 (6) +0x1b10| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x1b1a-0x1b1f.7 (6) +0x1b20|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x1b20-0x1b21.7 (2) + | | | packet: {} (ipv4) 0x1b22-0x1fe9.7 (1224) +0x1b20| 45 | E | version: 4 0x1b22-0x1b22.3 (0.4) +0x1b20| 45 | E | ihl: 5 0x1b22.4-0x1b22.7 (0.4) +0x1b20| 00 | . | dscp: 0 0x1b23-0x1b23.5 (0.6) +0x1b20| 00 | . | ecn: 0 0x1b23.6-0x1b23.7 (0.2) +0x1b20| 04 c8 | .. | total_length: 1224 0x1b24-0x1b25.7 (2) +0x1b20| b8 1a | .. | identification: 47130 0x1b26-0x1b27.7 (2) +0x1b20| 40 | @ | reserved: 0 0x1b28-0x1b28 (0.1) +0x1b20| 40 | @ | dont_fragment: true 0x1b28.1-0x1b28.1 (0.1) +0x1b20| 40 | @ | more_fragments: false 0x1b28.2-0x1b28.2 (0.1) +0x1b20| 40 00 | @. | fragment_offset: 0 0x1b28.3-0x1b29.7 (1.5) +0x1b20| 40 | @ | ttl: 64 0x1b2a-0x1b2a.7 (1) +0x1b20| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x1b2b-0x1b2b.7 (1) +0x1b20| 8c 81 | .. | header_checksum: 0x8c81 0x1b2c-0x1b2d.7 (2) +0x1b20| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x1b2e-0x1b31.7 (4) +0x1b30|01 8b |.. | +0x1b30| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x1b32-0x1b35.7 (4) + | | | data: {} (tcp) 0x1b36-0x1fe9.7 (1204) +0x1b30| c7 25 | .% | source_port: 50981 0x1b36-0x1b37.7 (2) +0x1b30| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x1b38-0x1b39.7 (2) +0x1b30| 2b ce 31 54 | +.1T | sequence_number: 734933332 0x1b3a-0x1b3d.7 (4) +0x1b30| 43 54| CT| acknowledgment_number: 1129612227 0x1b3e-0x1b41.7 (4) +0x1b40|83 c3 |.. | +0x1b40| 80 | . | data_offset: 8 0x1b42-0x1b42.3 (0.4) +0x1b40| 80 | . | reserved: 0 0x1b42.4-0x1b42.6 (0.3) +0x1b40| 80 | . | ns: false 0x1b42.7-0x1b42.7 (0.1) +0x1b40| 18 | . | cwr: false 0x1b43-0x1b43 (0.1) +0x1b40| 18 | . | ece: false 0x1b43.1-0x1b43.1 (0.1) +0x1b40| 18 | . | urg: false 0x1b43.2-0x1b43.2 (0.1) +0x1b40| 18 | . | ack: true 0x1b43.3-0x1b43.3 (0.1) +0x1b40| 18 | . | psh: true 0x1b43.4-0x1b43.4 (0.1) +0x1b40| 18 | . | rst: false 0x1b43.5-0x1b43.5 (0.1) +0x1b40| 18 | . | syn: false 0x1b43.6-0x1b43.6 (0.1) +0x1b40| 18 | . | fin: false 0x1b43.7-0x1b43.7 (0.1) +0x1b40| 10 14 | .. | window_size: 4116 0x1b44-0x1b45.7 (2) +0x1b40| 4e 99 | N. | checksum: 0x4e99 0x1b46-0x1b47.7 (2) +0x1b40| 00 00 | .. | urgent_pointer: 0 0x1b48-0x1b49.7 (2) +0x1b40| 01 01 08 0a 4b 2a| ....K*| options: raw bits 0x1b4a-0x1b55.7 (12) +0x1b50|91 57 e4 57 7b 6e |.W.W{n | +0x1b50| 17 03 03 04 8f 00 00 00 00 00| ..........| data: raw bits 0x1b56-0x1fe9.7 (1172) +0x1b60|00 00 04 98 59 fb 7c d9 ba ce c7 cc 54 de 7c d1|....Y.|.....T.|.| +* |until 0x1fe9.7 (1172) | | + | | | capture_padding: raw bits 0x1fea-NA (0) +0x1fe0| 00 00 | .. | padding: raw bits 0x1fea-0x1feb.7 (2) + | | | options: [0] 0x1fec-NA (0) +0x1fe0| f8 04 00 00| ....| footer_length: 1272 0x1fec-0x1fef.7 (4) + | | | [47]: block {} 0x1ff0-0x2053.7 (100) +0x1ff0|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x1ff0-0x1ff3.7 (4) +0x1ff0| 64 00 00 00 | d... | length: 100 0x1ff4-0x1ff7.7 (4) +0x1ff0| 00 00 00 00 | .... | interface_id: 0 0x1ff8-0x1ffb.7 (4) +0x1ff0| 72 1d 05 00| r...| timestamp_high: 335218 0x1ffc-0x1fff.7 (4) +0x2000|56 fc 85 c9 |V... | timestamp_low: 3381001302 0x2000-0x2003.7 (4) +0x2000| 42 00 00 00 | B... | capture_packet_length: 66 0x2004-0x2007.7 (4) +0x2000| 42 00 00 00 | B... | original_packet_length: 66 0x2008-0x200b.7 (4) + | | | packet: {} (ether8023) 0x200c-0x204d.7 (66) +0x2000| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x200c-0x2011.7 (6) +0x2010|7d 93 |}. | +0x2010| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2012-0x2017.7 (6) +0x2010| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2018-0x2019.7 (2) + | | | packet: {} (ipv4) 0x201a-0x204d.7 (52) +0x2010| 45 | E | version: 4 0x201a-0x201a.3 (0.4) +0x2010| 45 | E | ihl: 5 0x201a.4-0x201a.7 (0.4) +0x2010| 28 | ( | dscp: 10 0x201b-0x201b.5 (0.6) +0x2010| 28 | ( | ecn: 0 0x201b.6-0x201b.7 (0.2) +0x2010| 00 34 | .4 | total_length: 52 0x201c-0x201d.7 (2) +0x2010| 40 fc| @.| identification: 16636 0x201e-0x201f.7 (2) +0x2020|00 |. | reserved: 0 0x2020-0x2020 (0.1) +0x2020|00 |. | dont_fragment: false 0x2020.1-0x2020.1 (0.1) +0x2020|00 |. | more_fragments: false 0x2020.2-0x2020.2 (0.1) +0x2020|00 00 |.. | fragment_offset: 0 0x2020.3-0x2021.7 (1.5) +0x2020| 35 | 5 | ttl: 53 0x2022-0x2022.7 (1) +0x2020| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x2023-0x2023.7 (1) +0x2020| 53 0c | S. | header_checksum: 0x530c 0x2024-0x2025.7 (2) +0x2020| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x2026-0x2029.7 (4) +0x2020| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x202a-0x202d.7 (4) + | | | data: {} (tcp) 0x202e-0x204d.7 (32) +0x2020| 01 bb| ..| source_port: "https" (443) (http protocol over TLS/SSL) 0x202e-0x202f.7 (2) +0x2030|c7 25 |.% | destination_port: 50981 0x2030-0x2031.7 (2) +0x2030| 43 54 83 c3 | CT.. | sequence_number: 1129612227 0x2032-0x2035.7 (4) +0x2030| 2b ce 35 e8 | +.5. | acknowledgment_number: 734934504 0x2036-0x2039.7 (4) +0x2030| 80 | . | data_offset: 8 0x203a-0x203a.3 (0.4) +0x2030| 80 | . | reserved: 0 0x203a.4-0x203a.6 (0.3) +0x2030| 80 | . | ns: false 0x203a.7-0x203a.7 (0.1) +0x2030| 10 | . | cwr: false 0x203b-0x203b (0.1) +0x2030| 10 | . | ece: false 0x203b.1-0x203b.1 (0.1) +0x2030| 10 | . | urg: false 0x203b.2-0x203b.2 (0.1) +0x2030| 10 | . | ack: true 0x203b.3-0x203b.3 (0.1) +0x2030| 10 | . | psh: false 0x203b.4-0x203b.4 (0.1) +0x2030| 10 | . | rst: false 0x203b.5-0x203b.5 (0.1) +0x2030| 10 | . | syn: false 0x203b.6-0x203b.6 (0.1) +0x2030| 10 | . | fin: false 0x203b.7-0x203b.7 (0.1) +0x2030| 01 68 | .h | window_size: 360 0x203c-0x203d.7 (2) +0x2030| 55 ae| U.| checksum: 0x55ae 0x203e-0x203f.7 (2) +0x2040|00 00 |.. | urgent_pointer: 0 0x2040-0x2041.7 (2) +0x2040| 01 01 08 0a e4 57 7b 8c 4b 2a 91 55 | .....W{.K*.U | options: raw bits 0x2042-0x204d.7 (12) + | | | data: raw bits 0x204e-NA (0) + | | | capture_padding: raw bits 0x204e-NA (0) +0x2040| 00 00| ..| padding: raw bits 0x204e-0x204f.7 (2) + | | | options: [0] 0x2050-NA (0) +0x2050|64 00 00 00 |d... | footer_length: 100 0x2050-0x2053.7 (4) + | | | [48]: block {} 0x2054-0x20ef.7 (156) +0x2050| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2054-0x2057.7 (4) +0x2050| 9c 00 00 00 | .... | length: 156 0x2058-0x205b.7 (4) +0x2050| 00 00 00 00| ....| interface_id: 0 0x205c-0x205f.7 (4) +0x2060|72 1d 05 00 |r... | timestamp_high: 335218 0x2060-0x2063.7 (4) +0x2060| 3e 00 86 c9 | >... | timestamp_low: 3381002302 0x2064-0x2067.7 (4) +0x2060| 7a 00 00 00 | z... | capture_packet_length: 122 0x2068-0x206b.7 (4) +0x2060| 7a 00 00 00| z...| original_packet_length: 122 0x206c-0x206f.7 (4) + | | | packet: {} (ether8023) 0x2070-0x20e9.7 (122) +0x2070|a4 5e 60 f1 7d 93 |.^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2070-0x2075.7 (6) +0x2070| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2076-0x207b.7 (6) +0x2070| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x207c-0x207d.7 (2) + | | | packet: {} (ipv4) 0x207e-0x20e9.7 (108) +0x2070| 45 | E | version: 4 0x207e-0x207e.3 (0.4) +0x2070| 45 | E | ihl: 5 0x207e.4-0x207e.7 (0.4) +0x2070| 28| (| dscp: 10 0x207f-0x207f.5 (0.6) +0x2070| 28| (| ecn: 0 0x207f.6-0x207f.7 (0.2) +0x2080|00 6c |.l | total_length: 108 0x2080-0x2081.7 (2) +0x2080| 40 fd | @. | identification: 16637 0x2082-0x2083.7 (2) +0x2080| 00 | . | reserved: 0 0x2084-0x2084 (0.1) +0x2080| 00 | . | dont_fragment: false 0x2084.1-0x2084.1 (0.1) +0x2080| 00 | . | more_fragments: false 0x2084.2-0x2084.2 (0.1) +0x2080| 00 00 | .. | fragment_offset: 0 0x2084.3-0x2085.7 (1.5) +0x2080| 35 | 5 | ttl: 53 0x2086-0x2086.7 (1) +0x2080| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x2087-0x2087.7 (1) +0x2080| 52 d3 | R. | header_checksum: 0x52d3 0x2088-0x2089.7 (2) +0x2080| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x208a-0x208d.7 (4) +0x2080| c0 a8| ..| destination_ip: "192.168.1.139" (0xc0a8018b) 0x208e-0x2091.7 (4) +0x2090|01 8b |.. | + | | | data: {} (tcp) 0x2092-0x20e9.7 (88) +0x2090| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0x2092-0x2093.7 (2) +0x2090| c7 25 | .% | destination_port: 50981 0x2094-0x2095.7 (2) +0x2090| 43 54 83 c3 | CT.. | sequence_number: 1129612227 0x2096-0x2099.7 (4) +0x2090| 2b ce 35 e8 | +.5. | acknowledgment_number: 734934504 0x209a-0x209d.7 (4) +0x2090| 80 | . | data_offset: 8 0x209e-0x209e.3 (0.4) +0x2090| 80 | . | reserved: 0 0x209e.4-0x209e.6 (0.3) +0x2090| 80 | . | ns: false 0x209e.7-0x209e.7 (0.1) +0x2090| 18| .| cwr: false 0x209f-0x209f (0.1) +0x2090| 18| .| ece: false 0x209f.1-0x209f.1 (0.1) +0x2090| 18| .| urg: false 0x209f.2-0x209f.2 (0.1) +0x2090| 18| .| ack: true 0x209f.3-0x209f.3 (0.1) +0x2090| 18| .| psh: true 0x209f.4-0x209f.4 (0.1) +0x2090| 18| .| rst: false 0x209f.5-0x209f.5 (0.1) +0x2090| 18| .| syn: false 0x209f.6-0x209f.6 (0.1) +0x2090| 18| .| fin: false 0x209f.7-0x209f.7 (0.1) +0x20a0|01 68 |.h | window_size: 360 0x20a0-0x20a1.7 (2) +0x20a0| 94 d1 | .. | checksum: 0x94d1 0x20a2-0x20a3.7 (2) +0x20a0| 00 00 | .. | urgent_pointer: 0 0x20a4-0x20a5.7 (2) +0x20a0| 01 01 08 0a e4 57 7b 8d 4b 2a| .....W{.K*| options: raw bits 0x20a6-0x20b1.7 (12) +0x20b0|91 55 |.U | +0x20b0| 17 03 03 00 33 00 00 00 00 00 00 00 01 84| ....3.........| data: raw bits 0x20b2-0x20e9.7 (56) +0x20c0|43 dc 31 8d ea 84 17 37 3d ee 7d 47 7d a0 24 3f|C.1....7=.}G}.$?| +* |until 0x20e9.7 (56) | | + | | | capture_padding: raw bits 0x20ea-NA (0) +0x20e0| 00 00 | .. | padding: raw bits 0x20ea-0x20eb.7 (2) + | | | options: [0] 0x20ec-NA (0) +0x20e0| 9c 00 00 00| ....| footer_length: 156 0x20ec-0x20ef.7 (4) + | | | [49]: block {} 0x20f0-0x217b.7 (140) +0x20f0|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x20f0-0x20f3.7 (4) +0x20f0| 8c 00 00 00 | .... | length: 140 0x20f4-0x20f7.7 (4) +0x20f0| 00 00 00 00 | .... | interface_id: 0 0x20f8-0x20fb.7 (4) +0x20f0| 72 1d 05 00| r...| timestamp_high: 335218 0x20fc-0x20ff.7 (4) +0x2100|43 00 86 c9 |C... | timestamp_low: 3381002307 0x2100-0x2103.7 (4) +0x2100| 6c 00 00 00 | l... | capture_packet_length: 108 0x2104-0x2107.7 (4) +0x2100| 6c 00 00 00 | l... | original_packet_length: 108 0x2108-0x210b.7 (4) + | | | packet: {} (ether8023) 0x210c-0x2177.7 (108) +0x2100| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x210c-0x2111.7 (6) +0x2110|7d 93 |}. | +0x2110| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2112-0x2117.7 (6) +0x2110| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2118-0x2119.7 (2) + | | | packet: {} (ipv4) 0x211a-0x2177.7 (94) +0x2110| 45 | E | version: 4 0x211a-0x211a.3 (0.4) +0x2110| 45 | E | ihl: 5 0x211a.4-0x211a.7 (0.4) +0x2110| 28 | ( | dscp: 10 0x211b-0x211b.5 (0.6) +0x2110| 28 | ( | ecn: 0 0x211b.6-0x211b.7 (0.2) +0x2110| 00 5e | .^ | total_length: 94 0x211c-0x211d.7 (2) +0x2110| 40 fe| @.| identification: 16638 0x211e-0x211f.7 (2) +0x2120|00 |. | reserved: 0 0x2120-0x2120 (0.1) +0x2120|00 |. | dont_fragment: false 0x2120.1-0x2120.1 (0.1) +0x2120|00 |. | more_fragments: false 0x2120.2-0x2120.2 (0.1) +0x2120|00 00 |.. | fragment_offset: 0 0x2120.3-0x2121.7 (1.5) +0x2120| 35 | 5 | ttl: 53 0x2122-0x2122.7 (1) +0x2120| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x2123-0x2123.7 (1) +0x2120| 52 e0 | R. | header_checksum: 0x52e0 0x2124-0x2125.7 (2) +0x2120| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x2126-0x2129.7 (4) +0x2120| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x212a-0x212d.7 (4) + | | | data: {} (tcp) 0x212e-0x2177.7 (74) +0x2120| 01 bb| ..| source_port: "https" (443) (http protocol over TLS/SSL) 0x212e-0x212f.7 (2) +0x2130|c7 25 |.% | destination_port: 50981 0x2130-0x2131.7 (2) +0x2130| 43 54 83 fb | CT.. | sequence_number: 1129612283 0x2132-0x2135.7 (4) +0x2130| 2b ce 35 e8 | +.5. | acknowledgment_number: 734934504 0x2136-0x2139.7 (4) +0x2130| 80 | . | data_offset: 8 0x213a-0x213a.3 (0.4) +0x2130| 80 | . | reserved: 0 0x213a.4-0x213a.6 (0.3) +0x2130| 80 | . | ns: false 0x213a.7-0x213a.7 (0.1) +0x2130| 18 | . | cwr: false 0x213b-0x213b (0.1) +0x2130| 18 | . | ece: false 0x213b.1-0x213b.1 (0.1) +0x2130| 18 | . | urg: false 0x213b.2-0x213b.2 (0.1) +0x2130| 18 | . | ack: true 0x213b.3-0x213b.3 (0.1) +0x2130| 18 | . | psh: true 0x213b.4-0x213b.4 (0.1) +0x2130| 18 | . | rst: false 0x213b.5-0x213b.5 (0.1) +0x2130| 18 | . | syn: false 0x213b.6-0x213b.6 (0.1) +0x2130| 18 | . | fin: false 0x213b.7-0x213b.7 (0.1) +0x2130| 01 68 | .h | window_size: 360 0x213c-0x213d.7 (2) +0x2130| fb 2c| .,| checksum: 0xfb2c 0x213e-0x213f.7 (2) +0x2140|00 00 |.. | urgent_pointer: 0 0x2140-0x2141.7 (2) +0x2140| 01 01 08 0a e4 57 7b 8d 4b 2a 91 55 | .....W{.K*.U | options: raw bits 0x2142-0x214d.7 (12) +0x2140| 17 03| ..| data: raw bits 0x214e-0x2177.7 (42) +0x2150|03 00 25 00 00 00 00 00 00 00 02 a8 2a 53 77 c7|..%.........*Sw.| +* |until 0x2177.7 (42) | | + | | | capture_padding: raw bits 0x2178-NA (0) + | | | padding: raw bits 0x2178-NA (0) + | | | options: [0] 0x2178-NA (0) +0x2170| 8c 00 00 00 | .... | footer_length: 140 0x2178-0x217b.7 (4) + | | | [50]: block {} 0x217c-0x2203.7 (136) +0x2170| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x217c-0x217f.7 (4) +0x2180|88 00 00 00 |.... | length: 136 0x2180-0x2183.7 (4) +0x2180| 00 00 00 00 | .... | interface_id: 0 0x2184-0x2187.7 (4) +0x2180| 72 1d 05 00 | r... | timestamp_high: 335218 0x2188-0x218b.7 (4) +0x2180| 44 00 86 c9| D...| timestamp_low: 3381002308 0x218c-0x218f.7 (4) +0x2190|68 00 00 00 |h... | capture_packet_length: 104 0x2190-0x2193.7 (4) +0x2190| 68 00 00 00 | h... | original_packet_length: 104 0x2194-0x2197.7 (4) + | | | packet: {} (ether8023) 0x2198-0x21ff.7 (104) +0x2190| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2198-0x219d.7 (6) +0x2190| 94 10| ..| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x219e-0x21a3.7 (6) +0x21a0|3e 05 36 d3 |>.6. | +0x21a0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x21a4-0x21a5.7 (2) + | | | packet: {} (ipv4) 0x21a6-0x21ff.7 (90) +0x21a0| 45 | E | version: 4 0x21a6-0x21a6.3 (0.4) +0x21a0| 45 | E | ihl: 5 0x21a6.4-0x21a6.7 (0.4) +0x21a0| 28 | ( | dscp: 10 0x21a7-0x21a7.5 (0.6) +0x21a0| 28 | ( | ecn: 0 0x21a7.6-0x21a7.7 (0.2) +0x21a0| 00 5a | .Z | total_length: 90 0x21a8-0x21a9.7 (2) +0x21a0| 40 ff | @. | identification: 16639 0x21aa-0x21ab.7 (2) +0x21a0| 00 | . | reserved: 0 0x21ac-0x21ac (0.1) +0x21a0| 00 | . | dont_fragment: false 0x21ac.1-0x21ac.1 (0.1) +0x21a0| 00 | . | more_fragments: false 0x21ac.2-0x21ac.2 (0.1) +0x21a0| 00 00 | .. | fragment_offset: 0 0x21ac.3-0x21ad.7 (1.5) +0x21a0| 35 | 5 | ttl: 53 0x21ae-0x21ae.7 (1) +0x21a0| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x21af-0x21af.7 (1) +0x21b0|52 e3 |R. | header_checksum: 0x52e3 0x21b0-0x21b1.7 (2) +0x21b0| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x21b2-0x21b5.7 (4) +0x21b0| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x21b6-0x21b9.7 (4) + | | | data: {} (tcp) 0x21ba-0x21ff.7 (70) +0x21b0| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0x21ba-0x21bb.7 (2) +0x21b0| c7 25 | .% | destination_port: 50981 0x21bc-0x21bd.7 (2) +0x21b0| 43 54| CT| sequence_number: 1129612325 0x21be-0x21c1.7 (4) +0x21c0|84 25 |.% | +0x21c0| 2b ce 35 e8 | +.5. | acknowledgment_number: 734934504 0x21c2-0x21c5.7 (4) +0x21c0| 80 | . | data_offset: 8 0x21c6-0x21c6.3 (0.4) +0x21c0| 80 | . | reserved: 0 0x21c6.4-0x21c6.6 (0.3) +0x21c0| 80 | . | ns: false 0x21c6.7-0x21c6.7 (0.1) +0x21c0| 18 | . | cwr: false 0x21c7-0x21c7 (0.1) +0x21c0| 18 | . | ece: false 0x21c7.1-0x21c7.1 (0.1) +0x21c0| 18 | . | urg: false 0x21c7.2-0x21c7.2 (0.1) +0x21c0| 18 | . | ack: true 0x21c7.3-0x21c7.3 (0.1) +0x21c0| 18 | . | psh: true 0x21c7.4-0x21c7.4 (0.1) +0x21c0| 18 | . | rst: false 0x21c7.5-0x21c7.5 (0.1) +0x21c0| 18 | . | syn: false 0x21c7.6-0x21c7.6 (0.1) +0x21c0| 18 | . | fin: false 0x21c7.7-0x21c7.7 (0.1) +0x21c0| 01 68 | .h | window_size: 360 0x21c8-0x21c9.7 (2) +0x21c0| 01 de | .. | checksum: 0x1de 0x21ca-0x21cb.7 (2) +0x21c0| 00 00 | .. | urgent_pointer: 0 0x21cc-0x21cd.7 (2) +0x21c0| 01 01| ..| options: raw bits 0x21ce-0x21d9.7 (12) +0x21d0|08 0a e4 57 7b 8e 4b 2a 91 55 |...W{.K*.U | +0x21d0| 17 03 03 00 21 00| ....!.| data: raw bits 0x21da-0x21ff.7 (38) +0x21e0|00 00 00 00 00 00 03 bd 10 a7 a4 4e 7d 28 b4 4a|...........N}(.J| +0x21f0|55 a3 39 db 64 b3 7a ae 3d e4 2e fc eb 8e 66 c5|U.9.d.z.=.....f.| + | | | capture_padding: raw bits 0x2200-NA (0) + | | | padding: raw bits 0x2200-NA (0) + | | | options: [0] 0x2200-NA (0) +0x2200|88 00 00 00 |.... | footer_length: 136 0x2200-0x2203.7 (4) + | | | [51]: block {} 0x2204-0x2267.7 (100) +0x2200| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2204-0x2207.7 (4) +0x2200| 64 00 00 00 | d... | length: 100 0x2208-0x220b.7 (4) +0x2200| 00 00 00 00| ....| interface_id: 0 0x220c-0x220f.7 (4) +0x2210|72 1d 05 00 |r... | timestamp_high: 335218 0x2210-0x2213.7 (4) +0x2210| 9b 00 86 c9 | .... | timestamp_low: 3381002395 0x2214-0x2217.7 (4) +0x2210| 42 00 00 00 | B... | capture_packet_length: 66 0x2218-0x221b.7 (4) +0x2210| 42 00 00 00| B...| original_packet_length: 66 0x221c-0x221f.7 (4) + | | | packet: {} (ether8023) 0x2220-0x2261.7 (66) +0x2220|94 10 3e 05 36 d3 |..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2220-0x2225.7 (6) +0x2220| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2226-0x222b.7 (6) +0x2220| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x222c-0x222d.7 (2) + | | | packet: {} (ipv4) 0x222e-0x2261.7 (52) +0x2220| 45 | E | version: 4 0x222e-0x222e.3 (0.4) +0x2220| 45 | E | ihl: 5 0x222e.4-0x222e.7 (0.4) +0x2220| 00| .| dscp: 0 0x222f-0x222f.5 (0.6) +0x2220| 00| .| ecn: 0 0x222f.6-0x222f.7 (0.2) +0x2230|00 34 |.4 | total_length: 52 0x2230-0x2231.7 (2) +0x2230| 59 73 | Ys | identification: 22899 0x2232-0x2233.7 (2) +0x2230| 40 | @ | reserved: 0 0x2234-0x2234 (0.1) +0x2230| 40 | @ | dont_fragment: true 0x2234.1-0x2234.1 (0.1) +0x2230| 40 | @ | more_fragments: false 0x2234.2-0x2234.2 (0.1) +0x2230| 40 00 | @. | fragment_offset: 0 0x2234.3-0x2235.7 (1.5) +0x2230| 40 | @ | ttl: 64 0x2236-0x2236.7 (1) +0x2230| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x2237-0x2237.7 (1) +0x2230| ef bc | .. | header_checksum: 0xefbc 0x2238-0x2239.7 (2) +0x2230| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x223a-0x223d.7 (4) +0x2230| 4a 7d| J}| destination_ip: "74.125.228.227" (0x4a7de4e3) 0x223e-0x2241.7 (4) +0x2240|e4 e3 |.. | + | | | data: {} (tcp) 0x2242-0x2261.7 (32) +0x2240| c7 25 | .% | source_port: 50981 0x2242-0x2243.7 (2) +0x2240| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2244-0x2245.7 (2) +0x2240| 2b ce 35 e8 | +.5. | sequence_number: 734934504 0x2246-0x2249.7 (4) +0x2240| 43 54 83 fb | CT.. | acknowledgment_number: 1129612283 0x224a-0x224d.7 (4) +0x2240| 80 | . | data_offset: 8 0x224e-0x224e.3 (0.4) +0x2240| 80 | . | reserved: 0 0x224e.4-0x224e.6 (0.3) +0x2240| 80 | . | ns: false 0x224e.7-0x224e.7 (0.1) +0x2240| 10| .| cwr: false 0x224f-0x224f (0.1) +0x2240| 10| .| ece: false 0x224f.1-0x224f.1 (0.1) +0x2240| 10| .| urg: false 0x224f.2-0x224f.2 (0.1) +0x2240| 10| .| ack: true 0x224f.3-0x224f.3 (0.1) +0x2240| 10| .| psh: false 0x224f.4-0x224f.4 (0.1) +0x2240| 10| .| rst: false 0x224f.5-0x224f.5 (0.1) +0x2240| 10| .| syn: false 0x224f.6-0x224f.6 (0.1) +0x2240| 10| .| fin: false 0x224f.7-0x224f.7 (0.1) +0x2250|10 12 |.. | window_size: 4114 0x2250-0x2251.7 (2) +0x2250| 46 9c | F. | checksum: 0x469c 0x2252-0x2253.7 (2) +0x2250| 00 00 | .. | urgent_pointer: 0 0x2254-0x2255.7 (2) +0x2250| 01 01 08 0a 4b 2a 91 84 e4 57| ....K*...W| options: raw bits 0x2256-0x2261.7 (12) +0x2260|7b 8d |{. | + | | | data: raw bits 0x2262-NA (0) + | | | capture_padding: raw bits 0x2262-NA (0) +0x2260| 00 00 | .. | padding: raw bits 0x2262-0x2263.7 (2) + | | | options: [0] 0x2264-NA (0) +0x2260| 64 00 00 00 | d... | footer_length: 100 0x2264-0x2267.7 (4) + | | | [52]: block {} 0x2268-0x22cb.7 (100) +0x2260| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2268-0x226b.7 (4) +0x2260| 64 00 00 00| d...| length: 100 0x226c-0x226f.7 (4) +0x2270|00 00 00 00 |.... | interface_id: 0 0x2270-0x2273.7 (4) +0x2270| 72 1d 05 00 | r... | timestamp_high: 335218 0x2274-0x2277.7 (4) +0x2270| 9b 00 86 c9 | .... | timestamp_low: 3381002395 0x2278-0x227b.7 (4) +0x2270| 42 00 00 00| B...| capture_packet_length: 66 0x227c-0x227f.7 (4) +0x2280|42 00 00 00 |B... | original_packet_length: 66 0x2280-0x2283.7 (4) + | | | packet: {} (ether8023) 0x2284-0x22c5.7 (66) +0x2280| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2284-0x2289.7 (6) +0x2280| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x228a-0x228f.7 (6) +0x2290|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2290-0x2291.7 (2) + | | | packet: {} (ipv4) 0x2292-0x22c5.7 (52) +0x2290| 45 | E | version: 4 0x2292-0x2292.3 (0.4) +0x2290| 45 | E | ihl: 5 0x2292.4-0x2292.7 (0.4) +0x2290| 00 | . | dscp: 0 0x2293-0x2293.5 (0.6) +0x2290| 00 | . | ecn: 0 0x2293.6-0x2293.7 (0.2) +0x2290| 00 34 | .4 | total_length: 52 0x2294-0x2295.7 (2) +0x2290| a5 b5 | .. | identification: 42421 0x2296-0x2297.7 (2) +0x2290| 40 | @ | reserved: 0 0x2298-0x2298 (0.1) +0x2290| 40 | @ | dont_fragment: true 0x2298.1-0x2298.1 (0.1) +0x2290| 40 | @ | more_fragments: false 0x2298.2-0x2298.2 (0.1) +0x2290| 40 00 | @. | fragment_offset: 0 0x2298.3-0x2299.7 (1.5) +0x2290| 40 | @ | ttl: 64 0x229a-0x229a.7 (1) +0x2290| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x229b-0x229b.7 (1) +0x2290| a3 7a | .z | header_checksum: 0xa37a 0x229c-0x229d.7 (2) +0x2290| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x229e-0x22a1.7 (4) +0x22a0|01 8b |.. | +0x22a0| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x22a2-0x22a5.7 (4) + | | | data: {} (tcp) 0x22a6-0x22c5.7 (32) +0x22a0| c7 25 | .% | source_port: 50981 0x22a6-0x22a7.7 (2) +0x22a0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x22a8-0x22a9.7 (2) +0x22a0| 2b ce 35 e8 | +.5. | sequence_number: 734934504 0x22aa-0x22ad.7 (4) +0x22a0| 43 54| CT| acknowledgment_number: 1129612325 0x22ae-0x22b1.7 (4) +0x22b0|84 25 |.% | +0x22b0| 80 | . | data_offset: 8 0x22b2-0x22b2.3 (0.4) +0x22b0| 80 | . | reserved: 0 0x22b2.4-0x22b2.6 (0.3) +0x22b0| 80 | . | ns: false 0x22b2.7-0x22b2.7 (0.1) +0x22b0| 10 | . | cwr: false 0x22b3-0x22b3 (0.1) +0x22b0| 10 | . | ece: false 0x22b3.1-0x22b3.1 (0.1) +0x22b0| 10 | . | urg: false 0x22b3.2-0x22b3.2 (0.1) +0x22b0| 10 | . | ack: true 0x22b3.3-0x22b3.3 (0.1) +0x22b0| 10 | . | psh: false 0x22b3.4-0x22b3.4 (0.1) +0x22b0| 10 | . | rst: false 0x22b3.5-0x22b3.5 (0.1) +0x22b0| 10 | . | syn: false 0x22b3.6-0x22b3.6 (0.1) +0x22b0| 10 | . | fin: false 0x22b3.7-0x22b3.7 (0.1) +0x22b0| 10 11 | .. | window_size: 4113 0x22b4-0x22b5.7 (2) +0x22b0| 46 73 | Fs | checksum: 0x4673 0x22b6-0x22b7.7 (2) +0x22b0| 00 00 | .. | urgent_pointer: 0 0x22b8-0x22b9.7 (2) +0x22b0| 01 01 08 0a 4b 2a| ....K*| options: raw bits 0x22ba-0x22c5.7 (12) +0x22c0|91 84 e4 57 7b 8d |...W{. | + | | | data: raw bits 0x22c6-NA (0) + | | | capture_padding: raw bits 0x22c6-NA (0) +0x22c0| 00 00 | .. | padding: raw bits 0x22c6-0x22c7.7 (2) + | | | options: [0] 0x22c8-NA (0) +0x22c0| 64 00 00 00 | d... | footer_length: 100 0x22c8-0x22cb.7 (4) + | | | [53]: block {} 0x22cc-0x232f.7 (100) +0x22c0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x22cc-0x22cf.7 (4) +0x22d0|64 00 00 00 |d... | length: 100 0x22d0-0x22d3.7 (4) +0x22d0| 00 00 00 00 | .... | interface_id: 0 0x22d4-0x22d7.7 (4) +0x22d0| 72 1d 05 00 | r... | timestamp_high: 335218 0x22d8-0x22db.7 (4) +0x22d0| 9c 00 86 c9| ....| timestamp_low: 3381002396 0x22dc-0x22df.7 (4) +0x22e0|42 00 00 00 |B... | capture_packet_length: 66 0x22e0-0x22e3.7 (4) +0x22e0| 42 00 00 00 | B... | original_packet_length: 66 0x22e4-0x22e7.7 (4) + | | | packet: {} (ether8023) 0x22e8-0x2329.7 (66) +0x22e0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x22e8-0x22ed.7 (6) +0x22e0| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x22ee-0x22f3.7 (6) +0x22f0|60 f1 7d 93 |`.}. | +0x22f0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x22f4-0x22f5.7 (2) + | | | packet: {} (ipv4) 0x22f6-0x2329.7 (52) +0x22f0| 45 | E | version: 4 0x22f6-0x22f6.3 (0.4) +0x22f0| 45 | E | ihl: 5 0x22f6.4-0x22f6.7 (0.4) +0x22f0| 00 | . | dscp: 0 0x22f7-0x22f7.5 (0.6) +0x22f0| 00 | . | ecn: 0 0x22f7.6-0x22f7.7 (0.2) +0x22f0| 00 34 | .4 | total_length: 52 0x22f8-0x22f9.7 (2) +0x22f0| 80 93 | .. | identification: 32915 0x22fa-0x22fb.7 (2) +0x22f0| 40 | @ | reserved: 0 0x22fc-0x22fc (0.1) +0x22f0| 40 | @ | dont_fragment: true 0x22fc.1-0x22fc.1 (0.1) +0x22f0| 40 | @ | more_fragments: false 0x22fc.2-0x22fc.2 (0.1) +0x22f0| 40 00 | @. | fragment_offset: 0 0x22fc.3-0x22fd.7 (1.5) +0x22f0| 40 | @ | ttl: 64 0x22fe-0x22fe.7 (1) +0x22f0| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x22ff-0x22ff.7 (1) +0x2300|c8 9c |.. | header_checksum: 0xc89c 0x2300-0x2301.7 (2) +0x2300| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x2302-0x2305.7 (4) +0x2300| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x2306-0x2309.7 (4) + | | | data: {} (tcp) 0x230a-0x2329.7 (32) +0x2300| c7 25 | .% | source_port: 50981 0x230a-0x230b.7 (2) +0x2300| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x230c-0x230d.7 (2) +0x2300| 2b ce| +.| sequence_number: 734934504 0x230e-0x2311.7 (4) +0x2310|35 e8 |5. | +0x2310| 43 54 84 4b | CT.K | acknowledgment_number: 1129612363 0x2312-0x2315.7 (4) +0x2310| 80 | . | data_offset: 8 0x2316-0x2316.3 (0.4) +0x2310| 80 | . | reserved: 0 0x2316.4-0x2316.6 (0.3) +0x2310| 80 | . | ns: false 0x2316.7-0x2316.7 (0.1) +0x2310| 10 | . | cwr: false 0x2317-0x2317 (0.1) +0x2310| 10 | . | ece: false 0x2317.1-0x2317.1 (0.1) +0x2310| 10 | . | urg: false 0x2317.2-0x2317.2 (0.1) +0x2310| 10 | . | ack: true 0x2317.3-0x2317.3 (0.1) +0x2310| 10 | . | psh: false 0x2317.4-0x2317.4 (0.1) +0x2310| 10 | . | rst: false 0x2317.5-0x2317.5 (0.1) +0x2310| 10 | . | syn: false 0x2317.6-0x2317.6 (0.1) +0x2310| 10 | . | fin: false 0x2317.7-0x2317.7 (0.1) +0x2310| 10 10 | .. | window_size: 4112 0x2318-0x2319.7 (2) +0x2310| 46 4d | FM | checksum: 0x464d 0x231a-0x231b.7 (2) +0x2310| 00 00 | .. | urgent_pointer: 0 0x231c-0x231d.7 (2) +0x2310| 01 01| ..| options: raw bits 0x231e-0x2329.7 (12) +0x2320|08 0a 4b 2a 91 84 e4 57 7b 8e |..K*...W{. | + | | | data: raw bits 0x232a-NA (0) + | | | capture_padding: raw bits 0x232a-NA (0) +0x2320| 00 00 | .. | padding: raw bits 0x232a-0x232b.7 (2) + | | | options: [0] 0x232c-NA (0) +0x2320| 64 00 00 00| d...| footer_length: 100 0x232c-0x232f.7 (4) + | | | [54]: block {} 0x2330-0x23b7.7 (136) +0x2330|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2330-0x2333.7 (4) +0x2330| 88 00 00 00 | .... | length: 136 0x2334-0x2337.7 (4) +0x2330| 00 00 00 00 | .... | interface_id: 0 0x2338-0x233b.7 (4) +0x2330| 72 1d 05 00| r...| timestamp_high: 335218 0x233c-0x233f.7 (4) +0x2340|5e 01 86 c9 |^... | timestamp_low: 3381002590 0x2340-0x2343.7 (4) +0x2340| 68 00 00 00 | h... | capture_packet_length: 104 0x2344-0x2347.7 (4) +0x2340| 68 00 00 00 | h... | original_packet_length: 104 0x2348-0x234b.7 (4) + | | | packet: {} (ether8023) 0x234c-0x23b3.7 (104) +0x2340| 94 10 3e 05| ..>.| destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x234c-0x2351.7 (6) +0x2350|36 d3 |6. | +0x2350| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2352-0x2357.7 (6) +0x2350| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2358-0x2359.7 (2) + | | | packet: {} (ipv4) 0x235a-0x23b3.7 (90) +0x2350| 45 | E | version: 4 0x235a-0x235a.3 (0.4) +0x2350| 45 | E | ihl: 5 0x235a.4-0x235a.7 (0.4) +0x2350| 00 | . | dscp: 0 0x235b-0x235b.5 (0.6) +0x2350| 00 | . | ecn: 0 0x235b.6-0x235b.7 (0.2) +0x2350| 00 5a | .Z | total_length: 90 0x235c-0x235d.7 (2) +0x2350| 1b 47| .G| identification: 6983 0x235e-0x235f.7 (2) +0x2360|40 |@ | reserved: 0 0x2360-0x2360 (0.1) +0x2360|40 |@ | dont_fragment: true 0x2360.1-0x2360.1 (0.1) +0x2360|40 |@ | more_fragments: false 0x2360.2-0x2360.2 (0.1) +0x2360|40 00 |@. | fragment_offset: 0 0x2360.3-0x2361.7 (1.5) +0x2360| 40 | @ | ttl: 64 0x2362-0x2362.7 (1) +0x2360| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x2363-0x2363.7 (1) +0x2360| 2d c3 | -. | header_checksum: 0x2dc3 0x2364-0x2365.7 (2) +0x2360| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x2366-0x2369.7 (4) +0x2360| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x236a-0x236d.7 (4) + | | | data: {} (tcp) 0x236e-0x23b3.7 (70) +0x2360| c7 25| .%| source_port: 50981 0x236e-0x236f.7 (2) +0x2370|01 bb |.. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2370-0x2371.7 (2) +0x2370| 2b ce 35 e8 | +.5. | sequence_number: 734934504 0x2372-0x2375.7 (4) +0x2370| 43 54 84 4b | CT.K | acknowledgment_number: 1129612363 0x2376-0x2379.7 (4) +0x2370| 80 | . | data_offset: 8 0x237a-0x237a.3 (0.4) +0x2370| 80 | . | reserved: 0 0x237a.4-0x237a.6 (0.3) +0x2370| 80 | . | ns: false 0x237a.7-0x237a.7 (0.1) +0x2370| 18 | . | cwr: false 0x237b-0x237b (0.1) +0x2370| 18 | . | ece: false 0x237b.1-0x237b.1 (0.1) +0x2370| 18 | . | urg: false 0x237b.2-0x237b.2 (0.1) +0x2370| 18 | . | ack: true 0x237b.3-0x237b.3 (0.1) +0x2370| 18 | . | psh: true 0x237b.4-0x237b.4 (0.1) +0x2370| 18 | . | rst: false 0x237b.5-0x237b.5 (0.1) +0x2370| 18 | . | syn: false 0x237b.6-0x237b.6 (0.1) +0x2370| 18 | . | fin: false 0x237b.7-0x237b.7 (0.1) +0x2370| 10 10 | .. | window_size: 4112 0x237c-0x237d.7 (2) +0x2370| c1 14| ..| checksum: 0xc114 0x237e-0x237f.7 (2) +0x2380|00 00 |.. | urgent_pointer: 0 0x2380-0x2381.7 (2) +0x2380| 01 01 08 0a 4b 2a 91 84 e4 57 7b 8e | ....K*...W{. | options: raw bits 0x2382-0x238d.7 (12) +0x2380| 17 03| ..| data: raw bits 0x238e-0x23b3.7 (38) +0x2390|03 00 21 00 00 00 00 00 00 00 05 04 b0 d9 88 2d|..!............-| +* |until 0x23b3.7 (38) | | + | | | capture_padding: raw bits 0x23b4-NA (0) + | | | padding: raw bits 0x23b4-NA (0) + | | | options: [0] 0x23b4-NA (0) +0x23b0| 88 00 00 00 | .... | footer_length: 136 0x23b4-0x23b7.7 (4) + | | | [55]: block {} 0x23b8-0x2607.7 (592) +0x23b0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x23b8-0x23bb.7 (4) +0x23b0| 50 02 00 00| P...| length: 592 0x23bc-0x23bf.7 (4) +0x23c0|00 00 00 00 |.... | interface_id: 0 0x23c0-0x23c3.7 (4) +0x23c0| 72 1d 05 00 | r... | timestamp_high: 335218 0x23c4-0x23c7.7 (4) +0x23c0| 31 06 86 c9 | 1... | timestamp_low: 3381003825 0x23c8-0x23cb.7 (4) +0x23c0| 30 02 00 00| 0...| capture_packet_length: 560 0x23cc-0x23cf.7 (4) +0x23d0|30 02 00 00 |0... | original_packet_length: 560 0x23d0-0x23d3.7 (4) + | | | packet: {} (ether8023) 0x23d4-0x2603.7 (560) +0x23d0| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x23d4-0x23d9.7 (6) +0x23d0| 94 10 3e 05 36 d3| ..>.6.| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x23da-0x23df.7 (6) +0x23e0|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x23e0-0x23e1.7 (2) + | | | packet: {} (ipv4) 0x23e2-0x2603.7 (546) +0x23e0| 45 | E | version: 4 0x23e2-0x23e2.3 (0.4) +0x23e0| 45 | E | ihl: 5 0x23e2.4-0x23e2.7 (0.4) +0x23e0| 28 | ( | dscp: 10 0x23e3-0x23e3.5 (0.6) +0x23e0| 28 | ( | ecn: 0 0x23e3.6-0x23e3.7 (0.2) +0x23e0| 02 22 | ." | total_length: 546 0x23e4-0x23e5.7 (2) +0x23e0| 41 00 | A. | identification: 16640 0x23e6-0x23e7.7 (2) +0x23e0| 00 | . | reserved: 0 0x23e8-0x23e8 (0.1) +0x23e0| 00 | . | dont_fragment: false 0x23e8.1-0x23e8.1 (0.1) +0x23e0| 00 | . | more_fragments: false 0x23e8.2-0x23e8.2 (0.1) +0x23e0| 00 00 | .. | fragment_offset: 0 0x23e8.3-0x23e9.7 (1.5) +0x23e0| 35 | 5 | ttl: 53 0x23ea-0x23ea.7 (1) +0x23e0| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x23eb-0x23eb.7 (1) +0x23e0| 51 1a | Q. | header_checksum: 0x511a 0x23ec-0x23ed.7 (2) +0x23e0| 4a 7d| J}| source_ip: "74.125.228.227" (0x4a7de4e3) 0x23ee-0x23f1.7 (4) +0x23f0|e4 e3 |.. | +0x23f0| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x23f2-0x23f5.7 (4) + | | | data: {} (tcp) 0x23f6-0x2603.7 (526) +0x23f0| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0x23f6-0x23f7.7 (2) +0x23f0| c7 25 | .% | destination_port: 50981 0x23f8-0x23f9.7 (2) +0x23f0| 43 54 84 4b | CT.K | sequence_number: 1129612363 0x23fa-0x23fd.7 (4) +0x23f0| 2b ce| +.| acknowledgment_number: 734934504 0x23fe-0x2401.7 (4) +0x2400|35 e8 |5. | +0x2400| 80 | . | data_offset: 8 0x2402-0x2402.3 (0.4) +0x2400| 80 | . | reserved: 0 0x2402.4-0x2402.6 (0.3) +0x2400| 80 | . | ns: false 0x2402.7-0x2402.7 (0.1) +0x2400| 18 | . | cwr: false 0x2403-0x2403 (0.1) +0x2400| 18 | . | ece: false 0x2403.1-0x2403.1 (0.1) +0x2400| 18 | . | urg: false 0x2403.2-0x2403.2 (0.1) +0x2400| 18 | . | ack: true 0x2403.3-0x2403.3 (0.1) +0x2400| 18 | . | psh: true 0x2403.4-0x2403.4 (0.1) +0x2400| 18 | . | rst: false 0x2403.5-0x2403.5 (0.1) +0x2400| 18 | . | syn: false 0x2403.6-0x2403.6 (0.1) +0x2400| 18 | . | fin: false 0x2403.7-0x2403.7 (0.1) +0x2400| 01 68 | .h | window_size: 360 0x2404-0x2405.7 (2) +0x2400| 6c 2b | l+ | checksum: 0x6c2b 0x2406-0x2407.7 (2) +0x2400| 00 00 | .. | urgent_pointer: 0 0x2408-0x2409.7 (2) +0x2400| 01 01 08 0a e4 57| .....W| options: raw bits 0x240a-0x2415.7 (12) +0x2410|7b 99 4b 2a 91 55 |{.K*.U | +0x2410| 17 03 03 01 e9 00 00 00 00 00| ..........| data: raw bits 0x2416-0x2603.7 (494) +0x2420|00 00 04 cf 1d 4f e3 82 9a 07 84 9e f6 6f 6c 9c|.....O.......ol.| +* |until 0x2603.7 (494) | | + | | | capture_padding: raw bits 0x2604-NA (0) + | | | padding: raw bits 0x2604-NA (0) + | | | options: [0] 0x2604-NA (0) +0x2600| 50 02 00 00 | P... | footer_length: 592 0x2604-0x2607.7 (4) + | | | [56]: block {} 0x2608-0x268f.7 (136) +0x2600| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2608-0x260b.7 (4) +0x2600| 88 00 00 00| ....| length: 136 0x260c-0x260f.7 (4) +0x2610|00 00 00 00 |.... | interface_id: 0 0x2610-0x2613.7 (4) +0x2610| 72 1d 05 00 | r... | timestamp_high: 335218 0x2614-0x2617.7 (4) +0x2610| 34 06 86 c9 | 4... | timestamp_low: 3381003828 0x2618-0x261b.7 (4) +0x2610| 68 00 00 00| h...| capture_packet_length: 104 0x261c-0x261f.7 (4) +0x2620|68 00 00 00 |h... | original_packet_length: 104 0x2620-0x2623.7 (4) + | | | packet: {} (ether8023) 0x2624-0x268b.7 (104) +0x2620| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2624-0x2629.7 (6) +0x2620| 94 10 3e 05 36 d3| ..>.6.| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x262a-0x262f.7 (6) +0x2630|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2630-0x2631.7 (2) + | | | packet: {} (ipv4) 0x2632-0x268b.7 (90) +0x2630| 45 | E | version: 4 0x2632-0x2632.3 (0.4) +0x2630| 45 | E | ihl: 5 0x2632.4-0x2632.7 (0.4) +0x2630| 28 | ( | dscp: 10 0x2633-0x2633.5 (0.6) +0x2630| 28 | ( | ecn: 0 0x2633.6-0x2633.7 (0.2) +0x2630| 00 5a | .Z | total_length: 90 0x2634-0x2635.7 (2) +0x2630| 41 01 | A. | identification: 16641 0x2636-0x2637.7 (2) +0x2630| 00 | . | reserved: 0 0x2638-0x2638 (0.1) +0x2630| 00 | . | dont_fragment: false 0x2638.1-0x2638.1 (0.1) +0x2630| 00 | . | more_fragments: false 0x2638.2-0x2638.2 (0.1) +0x2630| 00 00 | .. | fragment_offset: 0 0x2638.3-0x2639.7 (1.5) +0x2630| 35 | 5 | ttl: 53 0x263a-0x263a.7 (1) +0x2630| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x263b-0x263b.7 (1) +0x2630| 52 e1 | R. | header_checksum: 0x52e1 0x263c-0x263d.7 (2) +0x2630| 4a 7d| J}| source_ip: "74.125.228.227" (0x4a7de4e3) 0x263e-0x2641.7 (4) +0x2640|e4 e3 |.. | +0x2640| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x2642-0x2645.7 (4) + | | | data: {} (tcp) 0x2646-0x268b.7 (70) +0x2640| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0x2646-0x2647.7 (2) +0x2640| c7 25 | .% | destination_port: 50981 0x2648-0x2649.7 (2) +0x2640| 43 54 86 39 | CT.9 | sequence_number: 1129612857 0x264a-0x264d.7 (4) +0x2640| 2b ce| +.| acknowledgment_number: 734934504 0x264e-0x2651.7 (4) +0x2650|35 e8 |5. | +0x2650| 80 | . | data_offset: 8 0x2652-0x2652.3 (0.4) +0x2650| 80 | . | reserved: 0 0x2652.4-0x2652.6 (0.3) +0x2650| 80 | . | ns: false 0x2652.7-0x2652.7 (0.1) +0x2650| 18 | . | cwr: false 0x2653-0x2653 (0.1) +0x2650| 18 | . | ece: false 0x2653.1-0x2653.1 (0.1) +0x2650| 18 | . | urg: false 0x2653.2-0x2653.2 (0.1) +0x2650| 18 | . | ack: true 0x2653.3-0x2653.3 (0.1) +0x2650| 18 | . | psh: true 0x2653.4-0x2653.4 (0.1) +0x2650| 18 | . | rst: false 0x2653.5-0x2653.5 (0.1) +0x2650| 18 | . | syn: false 0x2653.6-0x2653.6 (0.1) +0x2650| 18 | . | fin: false 0x2653.7-0x2653.7 (0.1) +0x2650| 01 68 | .h | window_size: 360 0x2654-0x2655.7 (2) +0x2650| 2a ae | *. | checksum: 0x2aae 0x2656-0x2657.7 (2) +0x2650| 00 00 | .. | urgent_pointer: 0 0x2658-0x2659.7 (2) +0x2650| 01 01 08 0a e4 57| .....W| options: raw bits 0x265a-0x2665.7 (12) +0x2660|7b 99 4b 2a 91 55 |{.K*.U | +0x2660| 17 03 03 00 21 00 00 00 00 00| ....!.....| data: raw bits 0x2666-0x268b.7 (38) +0x2670|00 00 05 d5 71 fb a3 87 9f 58 83 90 15 c7 2d 65|....q....X....-e| +0x2680|52 df 40 13 ee cb 7f d6 30 c8 39 81 |R.@.....0.9. | + | | | capture_padding: raw bits 0x268c-NA (0) + | | | padding: raw bits 0x268c-NA (0) + | | | options: [0] 0x268c-NA (0) +0x2680| 88 00 00 00| ....| footer_length: 136 0x268c-0x268f.7 (4) + | | | [57]: block {} 0x2690-0x271f.7 (144) +0x2690|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2690-0x2693.7 (4) +0x2690| 90 00 00 00 | .... | length: 144 0x2694-0x2697.7 (4) +0x2690| 00 00 00 00 | .... | interface_id: 0 0x2698-0x269b.7 (4) +0x2690| 72 1d 05 00| r...| timestamp_high: 335218 0x269c-0x269f.7 (4) +0x26a0|35 06 86 c9 |5... | timestamp_low: 3381003829 0x26a0-0x26a3.7 (4) +0x26a0| 70 00 00 00 | p... | capture_packet_length: 112 0x26a4-0x26a7.7 (4) +0x26a0| 70 00 00 00 | p... | original_packet_length: 112 0x26a8-0x26ab.7 (4) + | | | packet: {} (ether8023) 0x26ac-0x271b.7 (112) +0x26a0| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x26ac-0x26b1.7 (6) +0x26b0|7d 93 |}. | +0x26b0| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x26b2-0x26b7.7 (6) +0x26b0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x26b8-0x26b9.7 (2) + | | | packet: {} (ipv4) 0x26ba-0x271b.7 (98) +0x26b0| 45 | E | version: 4 0x26ba-0x26ba.3 (0.4) +0x26b0| 45 | E | ihl: 5 0x26ba.4-0x26ba.7 (0.4) +0x26b0| 28 | ( | dscp: 10 0x26bb-0x26bb.5 (0.6) +0x26b0| 28 | ( | ecn: 0 0x26bb.6-0x26bb.7 (0.2) +0x26b0| 00 62 | .b | total_length: 98 0x26bc-0x26bd.7 (2) +0x26b0| 41 02| A.| identification: 16642 0x26be-0x26bf.7 (2) +0x26c0|00 |. | reserved: 0 0x26c0-0x26c0 (0.1) +0x26c0|00 |. | dont_fragment: false 0x26c0.1-0x26c0.1 (0.1) +0x26c0|00 |. | more_fragments: false 0x26c0.2-0x26c0.2 (0.1) +0x26c0|00 00 |.. | fragment_offset: 0 0x26c0.3-0x26c1.7 (1.5) +0x26c0| 35 | 5 | ttl: 53 0x26c2-0x26c2.7 (1) +0x26c0| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x26c3-0x26c3.7 (1) +0x26c0| 52 d8 | R. | header_checksum: 0x52d8 0x26c4-0x26c5.7 (2) +0x26c0| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x26c6-0x26c9.7 (4) +0x26c0| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x26ca-0x26cd.7 (4) + | | | data: {} (tcp) 0x26ce-0x271b.7 (78) +0x26c0| 01 bb| ..| source_port: "https" (443) (http protocol over TLS/SSL) 0x26ce-0x26cf.7 (2) +0x26d0|c7 25 |.% | destination_port: 50981 0x26d0-0x26d1.7 (2) +0x26d0| 43 54 86 5f | CT._ | sequence_number: 1129612895 0x26d2-0x26d5.7 (4) +0x26d0| 2b ce 35 e8 | +.5. | acknowledgment_number: 734934504 0x26d6-0x26d9.7 (4) +0x26d0| 80 | . | data_offset: 8 0x26da-0x26da.3 (0.4) +0x26d0| 80 | . | reserved: 0 0x26da.4-0x26da.6 (0.3) +0x26d0| 80 | . | ns: false 0x26da.7-0x26da.7 (0.1) +0x26d0| 18 | . | cwr: false 0x26db-0x26db (0.1) +0x26d0| 18 | . | ece: false 0x26db.1-0x26db.1 (0.1) +0x26d0| 18 | . | urg: false 0x26db.2-0x26db.2 (0.1) +0x26d0| 18 | . | ack: true 0x26db.3-0x26db.3 (0.1) +0x26d0| 18 | . | psh: true 0x26db.4-0x26db.4 (0.1) +0x26d0| 18 | . | rst: false 0x26db.5-0x26db.5 (0.1) +0x26d0| 18 | . | syn: false 0x26db.6-0x26db.6 (0.1) +0x26d0| 18 | . | fin: false 0x26db.7-0x26db.7 (0.1) +0x26d0| 01 68 | .h | window_size: 360 0x26dc-0x26dd.7 (2) +0x26d0| f9 18| ..| checksum: 0xf918 0x26de-0x26df.7 (2) +0x26e0|00 00 |.. | urgent_pointer: 0 0x26e0-0x26e1.7 (2) +0x26e0| 01 01 08 0a e4 57 7b 99 4b 2a 91 55 | .....W{.K*.U | options: raw bits 0x26e2-0x26ed.7 (12) +0x26e0| 17 03| ..| data: raw bits 0x26ee-0x271b.7 (46) +0x26f0|03 00 29 00 00 00 00 00 00 00 06 a7 fa e5 cc 23|..)............#| +* |until 0x271b.7 (46) | | + | | | capture_padding: raw bits 0x271c-NA (0) + | | | padding: raw bits 0x271c-NA (0) + | | | options: [0] 0x271c-NA (0) +0x2710| 90 00 00 00| ....| footer_length: 144 0x271c-0x271f.7 (4) + | | | [58]: block {} 0x2720-0x2783.7 (100) +0x2720|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2720-0x2723.7 (4) +0x2720| 64 00 00 00 | d... | length: 100 0x2724-0x2727.7 (4) +0x2720| 00 00 00 00 | .... | interface_id: 0 0x2728-0x272b.7 (4) +0x2720| 72 1d 05 00| r...| timestamp_high: 335218 0x272c-0x272f.7 (4) +0x2730|70 06 86 c9 |p... | timestamp_low: 3381003888 0x2730-0x2733.7 (4) +0x2730| 42 00 00 00 | B... | capture_packet_length: 66 0x2734-0x2737.7 (4) +0x2730| 42 00 00 00 | B... | original_packet_length: 66 0x2738-0x273b.7 (4) + | | | packet: {} (ether8023) 0x273c-0x277d.7 (66) +0x2730| 94 10 3e 05| ..>.| destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x273c-0x2741.7 (6) +0x2740|36 d3 |6. | +0x2740| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2742-0x2747.7 (6) +0x2740| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2748-0x2749.7 (2) + | | | packet: {} (ipv4) 0x274a-0x277d.7 (52) +0x2740| 45 | E | version: 4 0x274a-0x274a.3 (0.4) +0x2740| 45 | E | ihl: 5 0x274a.4-0x274a.7 (0.4) +0x2740| 00 | . | dscp: 0 0x274b-0x274b.5 (0.6) +0x2740| 00 | . | ecn: 0 0x274b.6-0x274b.7 (0.2) +0x2740| 00 34 | .4 | total_length: 52 0x274c-0x274d.7 (2) +0x2740| b7 12| ..| identification: 46866 0x274e-0x274f.7 (2) +0x2750|40 |@ | reserved: 0 0x2750-0x2750 (0.1) +0x2750|40 |@ | dont_fragment: true 0x2750.1-0x2750.1 (0.1) +0x2750|40 |@ | more_fragments: false 0x2750.2-0x2750.2 (0.1) +0x2750|40 00 |@. | fragment_offset: 0 0x2750.3-0x2751.7 (1.5) +0x2750| 40 | @ | ttl: 64 0x2752-0x2752.7 (1) +0x2750| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x2753-0x2753.7 (1) +0x2750| 92 1d | .. | header_checksum: 0x921d 0x2754-0x2755.7 (2) +0x2750| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x2756-0x2759.7 (4) +0x2750| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x275a-0x275d.7 (4) + | | | data: {} (tcp) 0x275e-0x277d.7 (32) +0x2750| c7 25| .%| source_port: 50981 0x275e-0x275f.7 (2) +0x2760|01 bb |.. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2760-0x2761.7 (2) +0x2760| 2b ce 36 0e | +.6. | sequence_number: 734934542 0x2762-0x2765.7 (4) +0x2760| 43 54 86 39 | CT.9 | acknowledgment_number: 1129612857 0x2766-0x2769.7 (4) +0x2760| 80 | . | data_offset: 8 0x276a-0x276a.3 (0.4) +0x2760| 80 | . | reserved: 0 0x276a.4-0x276a.6 (0.3) +0x2760| 80 | . | ns: false 0x276a.7-0x276a.7 (0.1) +0x2760| 10 | . | cwr: false 0x276b-0x276b (0.1) +0x2760| 10 | . | ece: false 0x276b.1-0x276b.1 (0.1) +0x2760| 10 | . | urg: false 0x276b.2-0x276b.2 (0.1) +0x2760| 10 | . | ack: true 0x276b.3-0x276b.3 (0.1) +0x2760| 10 | . | psh: false 0x276b.4-0x276b.4 (0.1) +0x2760| 10 | . | rst: false 0x276b.5-0x276b.5 (0.1) +0x2760| 10 | . | syn: false 0x276b.6-0x276b.6 (0.1) +0x2760| 10 | . | fin: false 0x276b.7-0x276b.7 (0.1) +0x2760| 10 00 | .. | window_size: 4096 0x276c-0x276d.7 (2) +0x2760| 44 3d| D=| checksum: 0x443d 0x276e-0x276f.7 (2) +0x2770|00 00 |.. | urgent_pointer: 0 0x2770-0x2771.7 (2) +0x2770| 01 01 08 0a 4b 2a 91 85 e4 57 7b 99 | ....K*...W{. | options: raw bits 0x2772-0x277d.7 (12) + | | | data: raw bits 0x277e-NA (0) + | | | capture_padding: raw bits 0x277e-NA (0) +0x2770| 00 00| ..| padding: raw bits 0x277e-0x277f.7 (2) + | | | options: [0] 0x2780-NA (0) +0x2780|64 00 00 00 |d... | footer_length: 100 0x2780-0x2783.7 (4) + | | | [59]: block {} 0x2784-0x27e7.7 (100) +0x2780| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2784-0x2787.7 (4) +0x2780| 64 00 00 00 | d... | length: 100 0x2788-0x278b.7 (4) +0x2780| 00 00 00 00| ....| interface_id: 0 0x278c-0x278f.7 (4) +0x2790|72 1d 05 00 |r... | timestamp_high: 335218 0x2790-0x2793.7 (4) +0x2790| 70 06 86 c9 | p... | timestamp_low: 3381003888 0x2794-0x2797.7 (4) +0x2790| 42 00 00 00 | B... | capture_packet_length: 66 0x2798-0x279b.7 (4) +0x2790| 42 00 00 00| B...| original_packet_length: 66 0x279c-0x279f.7 (4) + | | | packet: {} (ether8023) 0x27a0-0x27e1.7 (66) +0x27a0|94 10 3e 05 36 d3 |..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x27a0-0x27a5.7 (6) +0x27a0| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x27a6-0x27ab.7 (6) +0x27a0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x27ac-0x27ad.7 (2) + | | | packet: {} (ipv4) 0x27ae-0x27e1.7 (52) +0x27a0| 45 | E | version: 4 0x27ae-0x27ae.3 (0.4) +0x27a0| 45 | E | ihl: 5 0x27ae.4-0x27ae.7 (0.4) +0x27a0| 00| .| dscp: 0 0x27af-0x27af.5 (0.6) +0x27a0| 00| .| ecn: 0 0x27af.6-0x27af.7 (0.2) +0x27b0|00 34 |.4 | total_length: 52 0x27b0-0x27b1.7 (2) +0x27b0| ba 9a | .. | identification: 47770 0x27b2-0x27b3.7 (2) +0x27b0| 40 | @ | reserved: 0 0x27b4-0x27b4 (0.1) +0x27b0| 40 | @ | dont_fragment: true 0x27b4.1-0x27b4.1 (0.1) +0x27b0| 40 | @ | more_fragments: false 0x27b4.2-0x27b4.2 (0.1) +0x27b0| 40 00 | @. | fragment_offset: 0 0x27b4.3-0x27b5.7 (1.5) +0x27b0| 40 | @ | ttl: 64 0x27b6-0x27b6.7 (1) +0x27b0| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x27b7-0x27b7.7 (1) +0x27b0| 8e 95 | .. | header_checksum: 0x8e95 0x27b8-0x27b9.7 (2) +0x27b0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x27ba-0x27bd.7 (4) +0x27b0| 4a 7d| J}| destination_ip: "74.125.228.227" (0x4a7de4e3) 0x27be-0x27c1.7 (4) +0x27c0|e4 e3 |.. | + | | | data: {} (tcp) 0x27c2-0x27e1.7 (32) +0x27c0| c7 25 | .% | source_port: 50981 0x27c2-0x27c3.7 (2) +0x27c0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x27c4-0x27c5.7 (2) +0x27c0| 2b ce 36 0e | +.6. | sequence_number: 734934542 0x27c6-0x27c9.7 (4) +0x27c0| 43 54 86 5f | CT._ | acknowledgment_number: 1129612895 0x27ca-0x27cd.7 (4) +0x27c0| 80 | . | data_offset: 8 0x27ce-0x27ce.3 (0.4) +0x27c0| 80 | . | reserved: 0 0x27ce.4-0x27ce.6 (0.3) +0x27c0| 80 | . | ns: false 0x27ce.7-0x27ce.7 (0.1) +0x27c0| 10| .| cwr: false 0x27cf-0x27cf (0.1) +0x27c0| 10| .| ece: false 0x27cf.1-0x27cf.1 (0.1) +0x27c0| 10| .| urg: false 0x27cf.2-0x27cf.2 (0.1) +0x27c0| 10| .| ack: true 0x27cf.3-0x27cf.3 (0.1) +0x27c0| 10| .| psh: false 0x27cf.4-0x27cf.4 (0.1) +0x27c0| 10| .| rst: false 0x27cf.5-0x27cf.5 (0.1) +0x27c0| 10| .| syn: false 0x27cf.6-0x27cf.6 (0.1) +0x27c0| 10| .| fin: false 0x27cf.7-0x27cf.7 (0.1) +0x27d0|0f ff |.. | window_size: 4095 0x27d0-0x27d1.7 (2) +0x27d0| 44 18 | D. | checksum: 0x4418 0x27d2-0x27d3.7 (2) +0x27d0| 00 00 | .. | urgent_pointer: 0 0x27d4-0x27d5.7 (2) +0x27d0| 01 01 08 0a 4b 2a 91 85 e4 57| ....K*...W| options: raw bits 0x27d6-0x27e1.7 (12) +0x27e0|7b 99 |{. | + | | | data: raw bits 0x27e2-NA (0) + | | | capture_padding: raw bits 0x27e2-NA (0) +0x27e0| 00 00 | .. | padding: raw bits 0x27e2-0x27e3.7 (2) + | | | options: [0] 0x27e4-NA (0) +0x27e0| 64 00 00 00 | d... | footer_length: 100 0x27e4-0x27e7.7 (4) + | | | [60]: block {} 0x27e8-0x284b.7 (100) +0x27e0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x27e8-0x27eb.7 (4) +0x27e0| 64 00 00 00| d...| length: 100 0x27ec-0x27ef.7 (4) +0x27f0|00 00 00 00 |.... | interface_id: 0 0x27f0-0x27f3.7 (4) +0x27f0| 72 1d 05 00 | r... | timestamp_high: 335218 0x27f4-0x27f7.7 (4) +0x27f0| 7c 06 86 c9 | |... | timestamp_low: 3381003900 0x27f8-0x27fb.7 (4) +0x27f0| 42 00 00 00| B...| capture_packet_length: 66 0x27fc-0x27ff.7 (4) +0x2800|42 00 00 00 |B... | original_packet_length: 66 0x2800-0x2803.7 (4) + | | | packet: {} (ether8023) 0x2804-0x2845.7 (66) +0x2800| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2804-0x2809.7 (6) +0x2800| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x280a-0x280f.7 (6) +0x2810|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2810-0x2811.7 (2) + | | | packet: {} (ipv4) 0x2812-0x2845.7 (52) +0x2810| 45 | E | version: 4 0x2812-0x2812.3 (0.4) +0x2810| 45 | E | ihl: 5 0x2812.4-0x2812.7 (0.4) +0x2810| 00 | . | dscp: 0 0x2813-0x2813.5 (0.6) +0x2810| 00 | . | ecn: 0 0x2813.6-0x2813.7 (0.2) +0x2810| 00 34 | .4 | total_length: 52 0x2814-0x2815.7 (2) +0x2810| 99 89 | .. | identification: 39305 0x2816-0x2817.7 (2) +0x2810| 40 | @ | reserved: 0 0x2818-0x2818 (0.1) +0x2810| 40 | @ | dont_fragment: true 0x2818.1-0x2818.1 (0.1) +0x2810| 40 | @ | more_fragments: false 0x2818.2-0x2818.2 (0.1) +0x2810| 40 00 | @. | fragment_offset: 0 0x2818.3-0x2819.7 (1.5) +0x2810| 40 | @ | ttl: 64 0x281a-0x281a.7 (1) +0x2810| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x281b-0x281b.7 (1) +0x2810| af a6 | .. | header_checksum: 0xafa6 0x281c-0x281d.7 (2) +0x2810| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x281e-0x2821.7 (4) +0x2820|01 8b |.. | +0x2820| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x2822-0x2825.7 (4) + | | | data: {} (tcp) 0x2826-0x2845.7 (32) +0x2820| c7 25 | .% | source_port: 50981 0x2826-0x2827.7 (2) +0x2820| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2828-0x2829.7 (2) +0x2820| 2b ce 36 0e | +.6. | sequence_number: 734934542 0x282a-0x282d.7 (4) +0x2820| 43 54| CT| acknowledgment_number: 1129612941 0x282e-0x2831.7 (4) +0x2830|86 8d |.. | +0x2830| 80 | . | data_offset: 8 0x2832-0x2832.3 (0.4) +0x2830| 80 | . | reserved: 0 0x2832.4-0x2832.6 (0.3) +0x2830| 80 | . | ns: false 0x2832.7-0x2832.7 (0.1) +0x2830| 10 | . | cwr: false 0x2833-0x2833 (0.1) +0x2830| 10 | . | ece: false 0x2833.1-0x2833.1 (0.1) +0x2830| 10 | . | urg: false 0x2833.2-0x2833.2 (0.1) +0x2830| 10 | . | ack: true 0x2833.3-0x2833.3 (0.1) +0x2830| 10 | . | psh: false 0x2833.4-0x2833.4 (0.1) +0x2830| 10 | . | rst: false 0x2833.5-0x2833.5 (0.1) +0x2830| 10 | . | syn: false 0x2833.6-0x2833.6 (0.1) +0x2830| 10 | . | fin: false 0x2833.7-0x2833.7 (0.1) +0x2830| 0f fe | .. | window_size: 4094 0x2834-0x2835.7 (2) +0x2830| 43 eb | C. | checksum: 0x43eb 0x2836-0x2837.7 (2) +0x2830| 00 00 | .. | urgent_pointer: 0 0x2838-0x2839.7 (2) +0x2830| 01 01 08 0a 4b 2a| ....K*| options: raw bits 0x283a-0x2845.7 (12) +0x2840|91 85 e4 57 7b 99 |...W{. | + | | | data: raw bits 0x2846-NA (0) + | | | capture_padding: raw bits 0x2846-NA (0) +0x2840| 00 00 | .. | padding: raw bits 0x2846-0x2847.7 (2) + | | | options: [0] 0x2848-NA (0) +0x2840| 64 00 00 00 | d... | footer_length: 100 0x2848-0x284b.7 (4) + | | | [61]: block {} 0x284c-0x28db.7 (144) +0x2840| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x284c-0x284f.7 (4) +0x2850|90 00 00 00 |.... | length: 144 0x2850-0x2853.7 (4) +0x2850| 00 00 00 00 | .... | interface_id: 0 0x2854-0x2857.7 (4) +0x2850| 72 1d 05 00 | r... | timestamp_high: 335218 0x2858-0x285b.7 (4) +0x2850| dc 0a 86 c9| ....| timestamp_low: 3381005020 0x285c-0x285f.7 (4) +0x2860|70 00 00 00 |p... | capture_packet_length: 112 0x2860-0x2863.7 (4) +0x2860| 70 00 00 00 | p... | original_packet_length: 112 0x2864-0x2867.7 (4) + | | | packet: {} (ether8023) 0x2868-0x28d7.7 (112) +0x2860| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2868-0x286d.7 (6) +0x2860| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x286e-0x2873.7 (6) +0x2870|60 f1 7d 93 |`.}. | +0x2870| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2874-0x2875.7 (2) + | | | packet: {} (ipv4) 0x2876-0x28d7.7 (98) +0x2870| 45 | E | version: 4 0x2876-0x2876.3 (0.4) +0x2870| 45 | E | ihl: 5 0x2876.4-0x2876.7 (0.4) +0x2870| 00 | . | dscp: 0 0x2877-0x2877.5 (0.6) +0x2870| 00 | . | ecn: 0 0x2877.6-0x2877.7 (0.2) +0x2870| 00 62 | .b | total_length: 98 0x2878-0x2879.7 (2) +0x2870| 8d 8b | .. | identification: 36235 0x287a-0x287b.7 (2) +0x2870| 40 | @ | reserved: 0 0x287c-0x287c (0.1) +0x2870| 40 | @ | dont_fragment: true 0x287c.1-0x287c.1 (0.1) +0x2870| 40 | @ | more_fragments: false 0x287c.2-0x287c.2 (0.1) +0x2870| 40 00 | @. | fragment_offset: 0 0x287c.3-0x287d.7 (1.5) +0x2870| 40 | @ | ttl: 64 0x287e-0x287e.7 (1) +0x2870| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x287f-0x287f.7 (1) +0x2880|bb 76 |.v | header_checksum: 0xbb76 0x2880-0x2881.7 (2) +0x2880| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x2882-0x2885.7 (4) +0x2880| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x2886-0x2889.7 (4) + | | | data: {} (tcp) 0x288a-0x28d7.7 (78) +0x2880| c7 25 | .% | source_port: 50981 0x288a-0x288b.7 (2) +0x2880| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x288c-0x288d.7 (2) +0x2880| 2b ce| +.| sequence_number: 734934542 0x288e-0x2891.7 (4) +0x2890|36 0e |6. | +0x2890| 43 54 86 8d | CT.. | acknowledgment_number: 1129612941 0x2892-0x2895.7 (4) +0x2890| 80 | . | data_offset: 8 0x2896-0x2896.3 (0.4) +0x2890| 80 | . | reserved: 0 0x2896.4-0x2896.6 (0.3) +0x2890| 80 | . | ns: false 0x2896.7-0x2896.7 (0.1) +0x2890| 18 | . | cwr: false 0x2897-0x2897 (0.1) +0x2890| 18 | . | ece: false 0x2897.1-0x2897.1 (0.1) +0x2890| 18 | . | urg: false 0x2897.2-0x2897.2 (0.1) +0x2890| 18 | . | ack: true 0x2897.3-0x2897.3 (0.1) +0x2890| 18 | . | psh: true 0x2897.4-0x2897.4 (0.1) +0x2890| 18 | . | rst: false 0x2897.5-0x2897.5 (0.1) +0x2890| 18 | . | syn: false 0x2897.6-0x2897.6 (0.1) +0x2890| 18 | . | fin: false 0x2897.7-0x2897.7 (0.1) +0x2890| 10 00 | .. | window_size: 4096 0x2898-0x2899.7 (2) +0x2890| 3f 60 | ?` | checksum: 0x3f60 0x289a-0x289b.7 (2) +0x2890| 00 00 | .. | urgent_pointer: 0 0x289c-0x289d.7 (2) +0x2890| 01 01| ..| options: raw bits 0x289e-0x28a9.7 (12) +0x28a0|08 0a 4b 2a 91 86 e4 57 7b 99 |..K*...W{. | +0x28a0| 17 03 03 00 29 00| ....).| data: raw bits 0x28aa-0x28d7.7 (46) +0x28b0|00 00 00 00 00 00 06 96 50 96 ef 10 f4 be e9 a0|........P.......| +* |until 0x28d7.7 (46) | | + | | | capture_padding: raw bits 0x28d8-NA (0) + | | | padding: raw bits 0x28d8-NA (0) + | | | options: [0] 0x28d8-NA (0) +0x28d0| 90 00 00 00 | .... | footer_length: 144 0x28d8-0x28db.7 (4) + | | | [62]: block {} 0x28dc-0x2e6b.7 (1424) +0x28d0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x28dc-0x28df.7 (4) +0x28e0|90 05 00 00 |.... | length: 1424 0x28e0-0x28e3.7 (4) +0x28e0| 00 00 00 00 | .... | interface_id: 0 0x28e4-0x28e7.7 (4) +0x28e0| 72 1d 05 00 | r... | timestamp_high: 335218 0x28e8-0x28eb.7 (4) +0x28e0| f8 17 86 c9| ....| timestamp_low: 3381008376 0x28ec-0x28ef.7 (4) +0x28f0|70 05 00 00 |p... | capture_packet_length: 1392 0x28f0-0x28f3.7 (4) +0x28f0| 70 05 00 00 | p... | original_packet_length: 1392 0x28f4-0x28f7.7 (4) + | | | packet: {} (ether8023) 0x28f8-0x2e67.7 (1392) +0x28f0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x28f8-0x28fd.7 (6) +0x28f0| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x28fe-0x2903.7 (6) +0x2900|60 f1 7d 93 |`.}. | +0x2900| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2904-0x2905.7 (2) + | | | packet: {} (ipv4) 0x2906-0x2e67.7 (1378) +0x2900| 45 | E | version: 4 0x2906-0x2906.3 (0.4) +0x2900| 45 | E | ihl: 5 0x2906.4-0x2906.7 (0.4) +0x2900| 00 | . | dscp: 0 0x2907-0x2907.5 (0.6) +0x2900| 00 | . | ecn: 0 0x2907.6-0x2907.7 (0.2) +0x2900| 05 62 | .b | total_length: 1378 0x2908-0x2909.7 (2) +0x2900| e1 51 | .Q | identification: 57681 0x290a-0x290b.7 (2) +0x2900| 00 | . | reserved: 0 0x290c-0x290c (0.1) +0x2900| 00 | . | dont_fragment: false 0x290c.1-0x290c.1 (0.1) +0x2900| 00 | . | more_fragments: false 0x290c.2-0x290c.2 (0.1) +0x2900| 00 00 | .. | fragment_offset: 0 0x290c.3-0x290d.7 (1.5) +0x2900| 40 | @ | ttl: 64 0x290e-0x290e.7 (1) +0x2900| 11| .| protocol: "udp" (17) (user datagram protocol) 0x290f-0x290f.7 (1) +0x2910|a2 a5 |.. | header_checksum: 0xa2a5 0x2910-0x2911.7 (2) +0x2910| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x2912-0x2915.7 (4) +0x2910| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x2916-0x2919.7 (4) + | | | data: {} (udp) 0x291a-0x2e67.7 (1358) +0x2910| fa 90 | .. | source_port: 64144 0x291a-0x291b.7 (2) +0x2910| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x291c-0x291d.7 (2) +0x2910| 05 4e| .N| length: 1358 0x291e-0x291f.7 (2) +0x2920|1e 57 |.W | checksum: 0x1e57 0x2920-0x2921.7 (2) +0x2920| 0d 48 4a 3d 55 c4 39 cd 13 51 30 32 35 01| .HJ=U.9..Q025.| data: raw bits 0x2922-0x2e67.7 (1350) +0x2930|0b f5 37 e5 76 ae 5f 9e 40 35 6f 33 01 a0 01 00|..7.v._.@5o3....| +* |until 0x2e67.7 (1350) | | + | | | capture_padding: raw bits 0x2e68-NA (0) + | | | padding: raw bits 0x2e68-NA (0) + | | | options: [0] 0x2e68-NA (0) +0x2e60| 90 05 00 00 | .... | footer_length: 1424 0x2e68-0x2e6b.7 (4) + | | | [63]: block {} 0x2e6c-0x2edb.7 (112) +0x2e60| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2e6c-0x2e6f.7 (4) +0x2e70|70 00 00 00 |p... | length: 112 0x2e70-0x2e73.7 (4) +0x2e70| 00 00 00 00 | .... | interface_id: 0 0x2e74-0x2e77.7 (4) +0x2e70| 72 1d 05 00 | r... | timestamp_high: 335218 0x2e78-0x2e7b.7 (4) +0x2e70| 62 18 86 c9| b...| timestamp_low: 3381008482 0x2e7c-0x2e7f.7 (4) +0x2e80|4e 00 00 00 |N... | capture_packet_length: 78 0x2e80-0x2e83.7 (4) +0x2e80| 4e 00 00 00 | N... | original_packet_length: 78 0x2e84-0x2e87.7 (4) + | | | packet: {} (ether8023) 0x2e88-0x2ed5.7 (78) +0x2e80| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2e88-0x2e8d.7 (6) +0x2e80| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2e8e-0x2e93.7 (6) +0x2e90|60 f1 7d 93 |`.}. | +0x2e90| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2e94-0x2e95.7 (2) + | | | packet: {} (ipv4) 0x2e96-0x2ed5.7 (64) +0x2e90| 45 | E | version: 4 0x2e96-0x2e96.3 (0.4) +0x2e90| 45 | E | ihl: 5 0x2e96.4-0x2e96.7 (0.4) +0x2e90| 00 | . | dscp: 0 0x2e97-0x2e97.5 (0.6) +0x2e90| 00 | . | ecn: 0 0x2e97.6-0x2e97.7 (0.2) +0x2e90| 00 40 | .@ | total_length: 64 0x2e98-0x2e99.7 (2) +0x2e90| 7b 9e | {. | identification: 31646 0x2e9a-0x2e9b.7 (2) +0x2e90| 40 | @ | reserved: 0 0x2e9c-0x2e9c (0.1) +0x2e90| 40 | @ | dont_fragment: true 0x2e9c.1-0x2e9c.1 (0.1) +0x2e90| 40 | @ | more_fragments: false 0x2e9c.2-0x2e9c.2 (0.1) +0x2e90| 40 00 | @. | fragment_offset: 0 0x2e9c.3-0x2e9d.7 (1.5) +0x2e90| 40 | @ | ttl: 64 0x2e9e-0x2e9e.7 (1) +0x2e90| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x2e9f-0x2e9f.7 (1) +0x2ea0|cd 85 |.. | header_checksum: 0xcd85 0x2ea0-0x2ea1.7 (2) +0x2ea0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x2ea2-0x2ea5.7 (4) +0x2ea0| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x2ea6-0x2ea9.7 (4) + | | | data: {} (tcp) 0x2eaa-0x2ed5.7 (44) +0x2ea0| c7 26 | .& | source_port: 50982 0x2eaa-0x2eab.7 (2) +0x2ea0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2eac-0x2ead.7 (2) +0x2ea0| 91 0a| ..| sequence_number: 2433367640 0x2eae-0x2eb1.7 (4) +0x2eb0|3e 58 |>X | +0x2eb0| 00 00 00 00 | .... | acknowledgment_number: 0 0x2eb2-0x2eb5.7 (4) +0x2eb0| b0 | . | data_offset: 11 0x2eb6-0x2eb6.3 (0.4) +0x2eb0| b0 | . | reserved: 0 0x2eb6.4-0x2eb6.6 (0.3) +0x2eb0| b0 | . | ns: false 0x2eb6.7-0x2eb6.7 (0.1) +0x2eb0| 02 | . | cwr: false 0x2eb7-0x2eb7 (0.1) +0x2eb0| 02 | . | ece: false 0x2eb7.1-0x2eb7.1 (0.1) +0x2eb0| 02 | . | urg: false 0x2eb7.2-0x2eb7.2 (0.1) +0x2eb0| 02 | . | ack: false 0x2eb7.3-0x2eb7.3 (0.1) +0x2eb0| 02 | . | psh: false 0x2eb7.4-0x2eb7.4 (0.1) +0x2eb0| 02 | . | rst: false 0x2eb7.5-0x2eb7.5 (0.1) +0x2eb0| 02 | . | syn: true 0x2eb7.6-0x2eb7.6 (0.1) +0x2eb0| 02 | . | fin: false 0x2eb7.7-0x2eb7.7 (0.1) +0x2eb0| ff ff | .. | window_size: 65535 0x2eb8-0x2eb9.7 (2) +0x2eb0| d0 70 | .p | checksum: 0xd070 0x2eba-0x2ebb.7 (2) +0x2eb0| 00 00 | .. | urgent_pointer: 0 0x2ebc-0x2ebd.7 (2) +0x2eb0| 02 04| ..| options: raw bits 0x2ebe-0x2ed5.7 (24) +0x2ec0|05 b4 01 03 03 05 01 01 08 0a 4b 2a 91 89 00 00|..........K*....| +0x2ed0|00 00 04 02 00 00 |...... | + | | | data: raw bits 0x2ed6-NA (0) + | | | capture_padding: raw bits 0x2ed6-NA (0) +0x2ed0| 00 00 | .. | padding: raw bits 0x2ed6-0x2ed7.7 (2) + | | | options: [0] 0x2ed8-NA (0) +0x2ed0| 70 00 00 00 | p... | footer_length: 112 0x2ed8-0x2edb.7 (4) + | | | [64]: block {} 0x2edc-0x2f3f.7 (100) +0x2ed0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2edc-0x2edf.7 (4) +0x2ee0|64 00 00 00 |d... | length: 100 0x2ee0-0x2ee3.7 (4) +0x2ee0| 00 00 00 00 | .... | interface_id: 0 0x2ee4-0x2ee7.7 (4) +0x2ee0| 72 1d 05 00 | r... | timestamp_high: 335218 0x2ee8-0x2eeb.7 (4) +0x2ee0| 23 7e 86 c9| #~..| timestamp_low: 3381034531 0x2eec-0x2eef.7 (4) +0x2ef0|42 00 00 00 |B... | capture_packet_length: 66 0x2ef0-0x2ef3.7 (4) +0x2ef0| 42 00 00 00 | B... | original_packet_length: 66 0x2ef4-0x2ef7.7 (4) + | | | packet: {} (ether8023) 0x2ef8-0x2f39.7 (66) +0x2ef0| a4 5e 60 f1 7d 93 | .^`.}. | destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2ef8-0x2efd.7 (6) +0x2ef0| 94 10| ..| source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2efe-0x2f03.7 (6) +0x2f00|3e 05 36 d3 |>.6. | +0x2f00| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2f04-0x2f05.7 (2) + | | | packet: {} (ipv4) 0x2f06-0x2f39.7 (52) +0x2f00| 45 | E | version: 4 0x2f06-0x2f06.3 (0.4) +0x2f00| 45 | E | ihl: 5 0x2f06.4-0x2f06.7 (0.4) +0x2f00| 28 | ( | dscp: 10 0x2f07-0x2f07.5 (0.6) +0x2f00| 28 | ( | ecn: 0 0x2f07.6-0x2f07.7 (0.2) +0x2f00| 00 34 | .4 | total_length: 52 0x2f08-0x2f09.7 (2) +0x2f00| 41 28 | A( | identification: 16680 0x2f0a-0x2f0b.7 (2) +0x2f00| 00 | . | reserved: 0 0x2f0c-0x2f0c (0.1) +0x2f00| 00 | . | dont_fragment: false 0x2f0c.1-0x2f0c.1 (0.1) +0x2f00| 00 | . | more_fragments: false 0x2f0c.2-0x2f0c.2 (0.1) +0x2f00| 00 00 | .. | fragment_offset: 0 0x2f0c.3-0x2f0d.7 (1.5) +0x2f00| 35 | 5 | ttl: 53 0x2f0e-0x2f0e.7 (1) +0x2f00| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x2f0f-0x2f0f.7 (1) +0x2f10|52 e0 |R. | header_checksum: 0x52e0 0x2f10-0x2f11.7 (2) +0x2f10| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x2f12-0x2f15.7 (4) +0x2f10| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x2f16-0x2f19.7 (4) + | | | data: {} (tcp) 0x2f1a-0x2f39.7 (32) +0x2f10| 01 bb | .. | source_port: "https" (443) (http protocol over TLS/SSL) 0x2f1a-0x2f1b.7 (2) +0x2f10| c7 25 | .% | destination_port: 50981 0x2f1c-0x2f1d.7 (2) +0x2f10| 43 54| CT| sequence_number: 1129612941 0x2f1e-0x2f21.7 (4) +0x2f20|86 8d |.. | +0x2f20| 2b ce 36 3c | +.6< | acknowledgment_number: 734934588 0x2f22-0x2f25.7 (4) +0x2f20| 80 | . | data_offset: 8 0x2f26-0x2f26.3 (0.4) +0x2f20| 80 | . | reserved: 0 0x2f26.4-0x2f26.6 (0.3) +0x2f20| 80 | . | ns: false 0x2f26.7-0x2f26.7 (0.1) +0x2f20| 10 | . | cwr: false 0x2f27-0x2f27 (0.1) +0x2f20| 10 | . | ece: false 0x2f27.1-0x2f27.1 (0.1) +0x2f20| 10 | . | urg: false 0x2f27.2-0x2f27.2 (0.1) +0x2f20| 10 | . | ack: true 0x2f27.3-0x2f27.3 (0.1) +0x2f20| 10 | . | psh: false 0x2f27.4-0x2f27.4 (0.1) +0x2f20| 10 | . | rst: false 0x2f27.5-0x2f27.5 (0.1) +0x2f20| 10 | . | syn: false 0x2f27.6-0x2f27.6 (0.1) +0x2f20| 10 | . | fin: false 0x2f27.7-0x2f27.7 (0.1) +0x2f20| 01 68 | .h | window_size: 360 0x2f28-0x2f29.7 (2) +0x2f20| 52 2e | R. | checksum: 0x522e 0x2f2a-0x2f2b.7 (2) +0x2f20| 00 00 | .. | urgent_pointer: 0 0x2f2c-0x2f2d.7 (2) +0x2f20| 01 01| ..| options: raw bits 0x2f2e-0x2f39.7 (12) +0x2f30|08 0a e4 57 7b bf 4b 2a 91 84 |...W{.K*.. | + | | | data: raw bits 0x2f3a-NA (0) + | | | capture_padding: raw bits 0x2f3a-NA (0) +0x2f30| 00 00 | .. | padding: raw bits 0x2f3a-0x2f3b.7 (2) + | | | options: [0] 0x2f3c-NA (0) +0x2f30| 64 00 00 00| d...| footer_length: 100 0x2f3c-0x2f3f.7 (4) + | | | [65]: block {} 0x2f40-0x2fab.7 (108) +0x2f40|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2f40-0x2f43.7 (4) +0x2f40| 6c 00 00 00 | l... | length: 108 0x2f44-0x2f47.7 (4) +0x2f40| 00 00 00 00 | .... | interface_id: 0 0x2f48-0x2f4b.7 (4) +0x2f40| 72 1d 05 00| r...| timestamp_high: 335218 0x2f4c-0x2f4f.7 (4) +0x2f50|b4 ec 89 c9 |.... | timestamp_low: 3381259444 0x2f50-0x2f53.7 (4) +0x2f50| 4a 00 00 00 | J... | capture_packet_length: 74 0x2f54-0x2f57.7 (4) +0x2f50| 4a 00 00 00 | J... | original_packet_length: 74 0x2f58-0x2f5b.7 (4) + | | | packet: {} (ether8023) 0x2f5c-0x2fa5.7 (74) +0x2f50| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2f5c-0x2f61.7 (6) +0x2f60|7d 93 |}. | +0x2f60| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2f62-0x2f67.7 (6) +0x2f60| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2f68-0x2f69.7 (2) + | | | packet: {} (ipv4) 0x2f6a-0x2fa5.7 (60) +0x2f60| 45 | E | version: 4 0x2f6a-0x2f6a.3 (0.4) +0x2f60| 45 | E | ihl: 5 0x2f6a.4-0x2f6a.7 (0.4) +0x2f60| 28 | ( | dscp: 10 0x2f6b-0x2f6b.5 (0.6) +0x2f60| 28 | ( | ecn: 0 0x2f6b.6-0x2f6b.7 (0.2) +0x2f60| 00 3c | .< | total_length: 60 0x2f6c-0x2f6d.7 (2) +0x2f60| 41 2b| A+| identification: 16683 0x2f6e-0x2f6f.7 (2) +0x2f70|00 |. | reserved: 0 0x2f70-0x2f70 (0.1) +0x2f70|00 |. | dont_fragment: false 0x2f70.1-0x2f70.1 (0.1) +0x2f70|00 |. | more_fragments: false 0x2f70.2-0x2f70.2 (0.1) +0x2f70|00 00 |.. | fragment_offset: 0 0x2f70.3-0x2f71.7 (1.5) +0x2f70| 35 | 5 | ttl: 53 0x2f72-0x2f72.7 (1) +0x2f70| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x2f73-0x2f73.7 (1) +0x2f70| 52 d5 | R. | header_checksum: 0x52d5 0x2f74-0x2f75.7 (2) +0x2f70| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x2f76-0x2f79.7 (4) +0x2f70| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x2f7a-0x2f7d.7 (4) + | | | data: {} (tcp) 0x2f7e-0x2fa5.7 (40) +0x2f70| 01 bb| ..| source_port: "https" (443) (http protocol over TLS/SSL) 0x2f7e-0x2f7f.7 (2) +0x2f80|c7 26 |.& | destination_port: 50982 0x2f80-0x2f81.7 (2) +0x2f80| 85 02 5f f5 | .._. | sequence_number: 2231525365 0x2f82-0x2f85.7 (4) +0x2f80| 91 0a 3e 59 | ..>Y | acknowledgment_number: 2433367641 0x2f86-0x2f89.7 (4) +0x2f80| a0 | . | data_offset: 10 0x2f8a-0x2f8a.3 (0.4) +0x2f80| a0 | . | reserved: 0 0x2f8a.4-0x2f8a.6 (0.3) +0x2f80| a0 | . | ns: false 0x2f8a.7-0x2f8a.7 (0.1) +0x2f80| 12 | . | cwr: false 0x2f8b-0x2f8b (0.1) +0x2f80| 12 | . | ece: false 0x2f8b.1-0x2f8b.1 (0.1) +0x2f80| 12 | . | urg: false 0x2f8b.2-0x2f8b.2 (0.1) +0x2f80| 12 | . | ack: true 0x2f8b.3-0x2f8b.3 (0.1) +0x2f80| 12 | . | psh: false 0x2f8b.4-0x2f8b.4 (0.1) +0x2f80| 12 | . | rst: false 0x2f8b.5-0x2f8b.5 (0.1) +0x2f80| 12 | . | syn: true 0x2f8b.6-0x2f8b.6 (0.1) +0x2f80| 12 | . | fin: false 0x2f8b.7-0x2f8b.7 (0.1) +0x2f80| a6 2c | ., | window_size: 42540 0x2f8c-0x2f8d.7 (2) +0x2f80| f6 3f| .?| checksum: 0xf63f 0x2f8e-0x2f8f.7 (2) +0x2f90|00 00 |.. | urgent_pointer: 0 0x2f90-0x2f91.7 (2) +0x2f90| 02 04 05 96 04 02 08 0a e4 57 7b c4 4b 2a| .........W{.K*| options: raw bits 0x2f92-0x2fa5.7 (20) +0x2fa0|91 89 01 03 03 07 |...... | + | | | data: raw bits 0x2fa6-NA (0) + | | | capture_padding: raw bits 0x2fa6-NA (0) +0x2fa0| 00 00 | .. | padding: raw bits 0x2fa6-0x2fa7.7 (2) + | | | options: [0] 0x2fa8-NA (0) +0x2fa0| 6c 00 00 00 | l... | footer_length: 108 0x2fa8-0x2fab.7 (4) + | | | [66]: block {} 0x2fac-0x300f.7 (100) +0x2fa0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x2fac-0x2faf.7 (4) +0x2fb0|64 00 00 00 |d... | length: 100 0x2fb0-0x2fb3.7 (4) +0x2fb0| 00 00 00 00 | .... | interface_id: 0 0x2fb4-0x2fb7.7 (4) +0x2fb0| 72 1d 05 00 | r... | timestamp_high: 335218 0x2fb8-0x2fbb.7 (4) +0x2fb0| e8 ec 89 c9| ....| timestamp_low: 3381259496 0x2fbc-0x2fbf.7 (4) +0x2fc0|42 00 00 00 |B... | capture_packet_length: 66 0x2fc0-0x2fc3.7 (4) +0x2fc0| 42 00 00 00 | B... | original_packet_length: 66 0x2fc4-0x2fc7.7 (4) + | | | packet: {} (ether8023) 0x2fc8-0x3009.7 (66) +0x2fc0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x2fc8-0x2fcd.7 (6) +0x2fc0| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x2fce-0x2fd3.7 (6) +0x2fd0|60 f1 7d 93 |`.}. | +0x2fd0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x2fd4-0x2fd5.7 (2) + | | | packet: {} (ipv4) 0x2fd6-0x3009.7 (52) +0x2fd0| 45 | E | version: 4 0x2fd6-0x2fd6.3 (0.4) +0x2fd0| 45 | E | ihl: 5 0x2fd6.4-0x2fd6.7 (0.4) +0x2fd0| 00 | . | dscp: 0 0x2fd7-0x2fd7.5 (0.6) +0x2fd0| 00 | . | ecn: 0 0x2fd7.6-0x2fd7.7 (0.2) +0x2fd0| 00 34 | .4 | total_length: 52 0x2fd8-0x2fd9.7 (2) +0x2fd0| 5a b9 | Z. | identification: 23225 0x2fda-0x2fdb.7 (2) +0x2fd0| 40 | @ | reserved: 0 0x2fdc-0x2fdc (0.1) +0x2fd0| 40 | @ | dont_fragment: true 0x2fdc.1-0x2fdc.1 (0.1) +0x2fd0| 40 | @ | more_fragments: false 0x2fdc.2-0x2fdc.2 (0.1) +0x2fd0| 40 00 | @. | fragment_offset: 0 0x2fdc.3-0x2fdd.7 (1.5) +0x2fd0| 40 | @ | ttl: 64 0x2fde-0x2fde.7 (1) +0x2fd0| 06| .| protocol: "tcp" (6) (transmission control protocol) 0x2fdf-0x2fdf.7 (1) +0x2fe0|ee 76 |.v | header_checksum: 0xee76 0x2fe0-0x2fe1.7 (2) +0x2fe0| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x2fe2-0x2fe5.7 (4) +0x2fe0| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x2fe6-0x2fe9.7 (4) + | | | data: {} (tcp) 0x2fea-0x3009.7 (32) +0x2fe0| c7 26 | .& | source_port: 50982 0x2fea-0x2feb.7 (2) +0x2fe0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2fec-0x2fed.7 (2) +0x2fe0| 91 0a| ..| sequence_number: 2433367641 0x2fee-0x2ff1.7 (4) +0x2ff0|3e 59 |>Y | +0x2ff0| 85 02 5f f6 | .._. | acknowledgment_number: 2231525366 0x2ff2-0x2ff5.7 (4) +0x2ff0| 80 | . | data_offset: 8 0x2ff6-0x2ff6.3 (0.4) +0x2ff0| 80 | . | reserved: 0 0x2ff6.4-0x2ff6.6 (0.3) +0x2ff0| 80 | . | ns: false 0x2ff6.7-0x2ff6.7 (0.1) +0x2ff0| 10 | . | cwr: false 0x2ff7-0x2ff7 (0.1) +0x2ff0| 10 | . | ece: false 0x2ff7.1-0x2ff7.1 (0.1) +0x2ff0| 10 | . | urg: false 0x2ff7.2-0x2ff7.2 (0.1) +0x2ff0| 10 | . | ack: true 0x2ff7.3-0x2ff7.3 (0.1) +0x2ff0| 10 | . | psh: false 0x2ff7.4-0x2ff7.4 (0.1) +0x2ff0| 10 | . | rst: false 0x2ff7.5-0x2ff7.5 (0.1) +0x2ff0| 10 | . | syn: false 0x2ff7.6-0x2ff7.6 (0.1) +0x2ff0| 10 | . | fin: false 0x2ff7.7-0x2ff7.7 (0.1) +0x2ff0| 10 19 | .. | window_size: 4121 0x2ff8-0x2ff9.7 (2) +0x2ff0| ba 07 | .. | checksum: 0xba07 0x2ffa-0x2ffb.7 (2) +0x2ff0| 00 00 | .. | urgent_pointer: 0 0x2ffc-0x2ffd.7 (2) +0x2ff0| 01 01| ..| options: raw bits 0x2ffe-0x3009.7 (12) +0x3000|08 0a 4b 2a 92 83 e4 57 7b c4 |..K*...W{. | + | | | data: raw bits 0x300a-NA (0) + | | | capture_padding: raw bits 0x300a-NA (0) +0x3000| 00 00 | .. | padding: raw bits 0x300a-0x300b.7 (2) + | | | options: [0] 0x300c-NA (0) +0x3000| 64 00 00 00| d...| footer_length: 100 0x300c-0x300f.7 (4) + | | | [67]: block {} 0x3010-0x314b.7 (316) +0x3010|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x3010-0x3013.7 (4) +0x3010| 3c 01 00 00 | <... | length: 316 0x3014-0x3017.7 (4) +0x3010| 00 00 00 00 | .... | interface_id: 0 0x3018-0x301b.7 (4) +0x3010| 72 1d 05 00| r...| timestamp_high: 335218 0x301c-0x301f.7 (4) +0x3020|6e ee 89 c9 |n... | timestamp_low: 3381259886 0x3020-0x3023.7 (4) +0x3020| 1a 01 00 00 | .... | capture_packet_length: 282 0x3024-0x3027.7 (4) +0x3020| 1a 01 00 00 | .... | original_packet_length: 282 0x3028-0x302b.7 (4) + | | | packet: {} (ether8023) 0x302c-0x3145.7 (282) +0x3020| 94 10 3e 05| ..>.| destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x302c-0x3031.7 (6) +0x3030|36 d3 |6. | +0x3030| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x3032-0x3037.7 (6) +0x3030| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x3038-0x3039.7 (2) + | | | packet: {} (ipv4) 0x303a-0x3145.7 (268) +0x3030| 45 | E | version: 4 0x303a-0x303a.3 (0.4) +0x3030| 45 | E | ihl: 5 0x303a.4-0x303a.7 (0.4) +0x3030| 00 | . | dscp: 0 0x303b-0x303b.5 (0.6) +0x3030| 00 | . | ecn: 0 0x303b.6-0x303b.7 (0.2) +0x3030| 01 0c | .. | total_length: 268 0x303c-0x303d.7 (2) +0x3030| 70 0f| p.| identification: 28687 0x303e-0x303f.7 (2) +0x3040|40 |@ | reserved: 0 0x3040-0x3040 (0.1) +0x3040|40 |@ | dont_fragment: true 0x3040.1-0x3040.1 (0.1) +0x3040|40 |@ | more_fragments: false 0x3040.2-0x3040.2 (0.1) +0x3040|40 00 |@. | fragment_offset: 0 0x3040.3-0x3041.7 (1.5) +0x3040| 40 | @ | ttl: 64 0x3042-0x3042.7 (1) +0x3040| 06 | . | protocol: "tcp" (6) (transmission control protocol) 0x3043-0x3043.7 (1) +0x3040| d8 48 | .H | header_checksum: 0xd848 0x3044-0x3045.7 (2) +0x3040| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x3046-0x3049.7 (4) +0x3040| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x304a-0x304d.7 (4) + | | | data: {} (tcp) 0x304e-0x3145.7 (248) +0x3040| c7 26| .&| source_port: 50982 0x304e-0x304f.7 (2) +0x3050|01 bb |.. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x3050-0x3051.7 (2) +0x3050| 91 0a 3e 59 | ..>Y | sequence_number: 2433367641 0x3052-0x3055.7 (4) +0x3050| 85 02 5f f6 | .._. | acknowledgment_number: 2231525366 0x3056-0x3059.7 (4) +0x3050| 80 | . | data_offset: 8 0x305a-0x305a.3 (0.4) +0x3050| 80 | . | reserved: 0 0x305a.4-0x305a.6 (0.3) +0x3050| 80 | . | ns: false 0x305a.7-0x305a.7 (0.1) +0x3050| 18 | . | cwr: false 0x305b-0x305b (0.1) +0x3050| 18 | . | ece: false 0x305b.1-0x305b.1 (0.1) +0x3050| 18 | . | urg: false 0x305b.2-0x305b.2 (0.1) +0x3050| 18 | . | ack: true 0x305b.3-0x305b.3 (0.1) +0x3050| 18 | . | psh: true 0x305b.4-0x305b.4 (0.1) +0x3050| 18 | . | rst: false 0x305b.5-0x305b.5 (0.1) +0x3050| 18 | . | syn: false 0x305b.6-0x305b.6 (0.1) +0x3050| 18 | . | fin: false 0x305b.7-0x305b.7 (0.1) +0x3050| 10 19 | .. | window_size: 4121 0x305c-0x305d.7 (2) +0x3050| b0 b8| ..| checksum: 0xb0b8 0x305e-0x305f.7 (2) +0x3060|00 00 |.. | urgent_pointer: 0 0x3060-0x3061.7 (2) +0x3060| 01 01 08 0a 4b 2a 92 83 e4 57 7b c4 | ....K*...W{. | options: raw bits 0x3062-0x306d.7 (12) +0x3060| 16 03| ..| data: raw bits 0x306e-0x3145.7 (216) +0x3070|01 00 d3 01 00 00 cf 03 03 c0 a6 33 83 e1 1e ec|...........3....| +* |until 0x3145.7 (216) | | + | | | capture_padding: raw bits 0x3146-NA (0) +0x3140| 00 00 | .. | padding: raw bits 0x3146-0x3147.7 (2) + | | | options: [0] 0x3148-NA (0) +0x3140| 3c 01 00 00 | <... | footer_length: 316 0x3148-0x314b.7 (4) + | | | [68]: block {} 0x314c-0x36db.7 (1424) +0x3140| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x314c-0x314f.7 (4) +0x3150|90 05 00 00 |.... | length: 1424 0x3150-0x3153.7 (4) +0x3150| 00 00 00 00 | .... | interface_id: 0 0x3154-0x3157.7 (4) +0x3150| 72 1d 05 00 | r... | timestamp_high: 335218 0x3158-0x315b.7 (4) +0x3150| a2 ee 89 c9| ....| timestamp_low: 3381259938 0x315c-0x315f.7 (4) +0x3160|70 05 00 00 |p... | capture_packet_length: 1392 0x3160-0x3163.7 (4) +0x3160| 70 05 00 00 | p... | original_packet_length: 1392 0x3164-0x3167.7 (4) + | | | packet: {} (ether8023) 0x3168-0x36d7.7 (1392) +0x3160| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x3168-0x316d.7 (6) +0x3160| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x316e-0x3173.7 (6) +0x3170|60 f1 7d 93 |`.}. | +0x3170| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x3174-0x3175.7 (2) + | | | packet: {} (ipv4) 0x3176-0x36d7.7 (1378) +0x3170| 45 | E | version: 4 0x3176-0x3176.3 (0.4) +0x3170| 45 | E | ihl: 5 0x3176.4-0x3176.7 (0.4) +0x3170| 00 | . | dscp: 0 0x3177-0x3177.5 (0.6) +0x3170| 00 | . | ecn: 0 0x3177.6-0x3177.7 (0.2) +0x3170| 05 62 | .b | total_length: 1378 0x3178-0x3179.7 (2) +0x3170| ca 75 | .u | identification: 51829 0x317a-0x317b.7 (2) +0x3170| 00 | . | reserved: 0 0x317c-0x317c (0.1) +0x3170| 00 | . | dont_fragment: false 0x317c.1-0x317c.1 (0.1) +0x3170| 00 | . | more_fragments: false 0x317c.2-0x317c.2 (0.1) +0x3170| 00 00 | .. | fragment_offset: 0 0x317c.3-0x317d.7 (1.5) +0x3170| 40 | @ | ttl: 64 0x317e-0x317e.7 (1) +0x3170| 11| .| protocol: "udp" (17) (user datagram protocol) 0x317f-0x317f.7 (1) +0x3180|b9 81 |.. | header_checksum: 0xb981 0x3180-0x3181.7 (2) +0x3180| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x3182-0x3185.7 (4) +0x3180| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x3186-0x3189.7 (4) + | | | data: {} (udp) 0x318a-0x36d7.7 (1358) +0x3180| fa 90 | .. | source_port: 64144 0x318a-0x318b.7 (2) +0x3180| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x318c-0x318d.7 (2) +0x3180| 05 4e| .N| length: 1358 0x318e-0x318f.7 (2) +0x3190|95 e9 |.. | checksum: 0x95e9 0x3190-0x3191.7 (2) +0x3190| 0d 48 4a 3d 55 c4 39 cd 13 51 30 32 35 02| .HJ=U.9..Q025.| data: raw bits 0x3192-0x36d7.7 (1350) +0x31a0|2a 82 7d 60 fe 3d e8 fa a2 6e 20 72 01 a0 01 00|*.}`.=...n r....| +* |until 0x36d7.7 (1350) | | + | | | capture_padding: raw bits 0x36d8-NA (0) + | | | padding: raw bits 0x36d8-NA (0) + | | | options: [0] 0x36d8-NA (0) +0x36d0| 90 05 00 00 | .... | footer_length: 1424 0x36d8-0x36db.7 (4) + | | | [69]: block {} 0x36dc-0x373f.7 (100) +0x36d0| 06 00 00 00| ....| type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x36dc-0x36df.7 (4) +0x36e0|64 00 00 00 |d... | length: 100 0x36e0-0x36e3.7 (4) +0x36e0| 00 00 00 00 | .... | interface_id: 0 0x36e4-0x36e7.7 (4) +0x36e0| 72 1d 05 00 | r... | timestamp_high: 335218 0x36e8-0x36eb.7 (4) +0x36e0| 52 ef 89 c9| R...| timestamp_low: 3381260114 0x36ec-0x36ef.7 (4) +0x36f0|43 00 00 00 |C... | capture_packet_length: 67 0x36f0-0x36f3.7 (4) +0x36f0| 43 00 00 00 | C... | original_packet_length: 67 0x36f4-0x36f7.7 (4) + | | | packet: {} (ether8023) 0x36f8-0x373a.7 (67) +0x36f0| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x36f8-0x36fd.7 (6) +0x36f0| a4 5e| .^| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x36fe-0x3703.7 (6) +0x3700|60 f1 7d 93 |`.}. | +0x3700| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x3704-0x3705.7 (2) + | | | packet: {} (ipv4) 0x3706-0x373a.7 (53) +0x3700| 45 | E | version: 4 0x3706-0x3706.3 (0.4) +0x3700| 45 | E | ihl: 5 0x3706.4-0x3706.7 (0.4) +0x3700| 00 | . | dscp: 0 0x3707-0x3707.5 (0.6) +0x3700| 00 | . | ecn: 0 0x3707.6-0x3707.7 (0.2) +0x3700| 00 35 | .5 | total_length: 53 0x3708-0x3709.7 (2) +0x3700| 5a 29 | Z) | identification: 23081 0x370a-0x370b.7 (2) +0x3700| 00 | . | reserved: 0 0x370c-0x370c (0.1) +0x3700| 00 | . | dont_fragment: false 0x370c.1-0x370c.1 (0.1) +0x3700| 00 | . | more_fragments: false 0x370c.2-0x370c.2 (0.1) +0x3700| 00 00 | .. | fragment_offset: 0 0x370c.3-0x370d.7 (1.5) +0x3700| 40 | @ | ttl: 64 0x370e-0x370e.7 (1) +0x3700| 11| .| protocol: "udp" (17) (user datagram protocol) 0x370f-0x370f.7 (1) +0x3710|37 63 |7c | header_checksum: 0x3763 0x3710-0x3711.7 (2) +0x3710| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x3712-0x3715.7 (4) +0x3710| ad c2 79 36 | ..y6 | destination_ip: "173.194.121.54" (0xadc27936) 0x3716-0x3719.7 (4) + | | | data: {} (udp) 0x371a-0x373a.7 (33) +0x3710| c7 2d | .- | source_port: 50989 0x371a-0x371b.7 (2) +0x3710| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x371c-0x371d.7 (2) +0x3710| 00 21| .!| length: 33 0x371e-0x371f.7 (2) +0x3720|82 94 |.. | checksum: 0x8294 0x3720-0x3721.7 (2) +0x3720| 1c e0 57 42 2b 58 7f c5 3f bc 11 58 7c 40| ..WB+X..?..X|@| data: raw bits 0x3722-0x373a.7 (25) +0x3730|13 78 17 d5 b1 13 d4 7f 63 8c ca |.x......c.. | + | | | capture_padding: raw bits 0x373b-NA (0) +0x3730| 00 | . | padding: raw bits 0x373b-0x373b.7 (1) + | | | options: [0] 0x373c-NA (0) +0x3730| 64 00 00 00| d...| footer_length: 100 0x373c-0x373f.7 (4) + | | | [70]: block {} 0x3740-0x3ccf.7 (1424) +0x3740|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x3740-0x3743.7 (4) +0x3740| 90 05 00 00 | .... | length: 1424 0x3744-0x3747.7 (4) +0x3740| 00 00 00 00 | .... | interface_id: 0 0x3748-0x374b.7 (4) +0x3740| 72 1d 05 00| r...| timestamp_high: 335218 0x374c-0x374f.7 (4) +0x3750|96 f2 89 c9 |.... | timestamp_low: 3381260950 0x3750-0x3753.7 (4) +0x3750| 70 05 00 00 | p... | capture_packet_length: 1392 0x3754-0x3757.7 (4) +0x3750| 70 05 00 00 | p... | original_packet_length: 1392 0x3758-0x375b.7 (4) + | | | packet: {} (ether8023) 0x375c-0x3ccb.7 (1392) +0x3750| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x375c-0x3761.7 (6) +0x3760|7d 93 |}. | +0x3760| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x3762-0x3767.7 (6) +0x3760| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x3768-0x3769.7 (2) + | | | packet: {} (ipv4) 0x376a-0x3ccb.7 (1378) +0x3760| 45 | E | version: 4 0x376a-0x376a.3 (0.4) +0x3760| 45 | E | ihl: 5 0x376a.4-0x376a.7 (0.4) +0x3760| 28 | ( | dscp: 10 0x376b-0x376b.5 (0.6) +0x3760| 28 | ( | ecn: 0 0x376b.6-0x376b.7 (0.2) +0x3760| 05 62 | .b | total_length: 1378 0x376c-0x376d.7 (2) +0x3760| 99 06| ..| identification: 39174 0x376e-0x376f.7 (2) +0x3770|00 |. | reserved: 0 0x3770-0x3770 (0.1) +0x3770|00 |. | dont_fragment: false 0x3770.1-0x3770.1 (0.1) +0x3770|00 |. | more_fragments: false 0x3770.2-0x3770.2 (0.1) +0x3770|00 00 |.. | fragment_offset: 0 0x3770.3-0x3771.7 (1.5) +0x3770| 35 | 5 | ttl: 53 0x3772-0x3772.7 (1) +0x3770| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x3773-0x3773.7 (1) +0x3770| f5 c8 | .. | header_checksum: 0xf5c8 0x3774-0x3775.7 (2) +0x3770| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x3776-0x3779.7 (4) +0x3770| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x377a-0x377d.7 (4) + | | | data: {} (udp) 0x377e-0x3ccb.7 (1358) +0x3770| 01 bb| ..| source_port: "https" (443) (http protocol over TLS/SSL) 0x377e-0x377f.7 (2) +0x3780|fa 90 |.. | destination_port: 64144 0x3780-0x3781.7 (2) +0x3780| 05 4e | .N | length: 1358 0x3782-0x3783.7 (2) +0x3780| 1c 92 | .. | checksum: 0x1c92 0x3784-0x3785.7 (2) +0x3780| 00 01 8f d0 ba 82 41 2f e5 db| ......A/..| data: raw bits 0x3786-0x3ccb.7 (1350) +0x3790|1a d3 aa 5e 10 5f b8 8d 0f 72 8d 0d ea a9 f6 ac|...^._...r......| +* |until 0x3ccb.7 (1350) | | + | | | capture_padding: raw bits 0x3ccc-NA (0) + | | | padding: raw bits 0x3ccc-NA (0) + | | | options: [0] 0x3ccc-NA (0) +0x3cc0| 90 05 00 00| ....| footer_length: 1424 0x3ccc-0x3ccf.7 (4) + | | | [71]: block {} 0x3cd0-0x425f.7 (1424) +0x3cd0|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x3cd0-0x3cd3.7 (4) +0x3cd0| 90 05 00 00 | .... | length: 1424 0x3cd4-0x3cd7.7 (4) +0x3cd0| 00 00 00 00 | .... | interface_id: 0 0x3cd8-0x3cdb.7 (4) +0x3cd0| 72 1d 05 00| r...| timestamp_high: 335218 0x3cdc-0x3cdf.7 (4) +0x3ce0|bc f3 89 c9 |.... | timestamp_low: 3381261244 0x3ce0-0x3ce3.7 (4) +0x3ce0| 70 05 00 00 | p... | capture_packet_length: 1392 0x3ce4-0x3ce7.7 (4) +0x3ce0| 70 05 00 00 | p... | original_packet_length: 1392 0x3ce8-0x3ceb.7 (4) + | | | packet: {} (ether8023) 0x3cec-0x425b.7 (1392) +0x3ce0| a4 5e 60 f1| .^`.| destination: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x3cec-0x3cf1.7 (6) +0x3cf0|7d 93 |}. | +0x3cf0| 94 10 3e 05 36 d3 | ..>.6. | source: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x3cf2-0x3cf7.7 (6) +0x3cf0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x3cf8-0x3cf9.7 (2) + | | | packet: {} (ipv4) 0x3cfa-0x425b.7 (1378) +0x3cf0| 45 | E | version: 4 0x3cfa-0x3cfa.3 (0.4) +0x3cf0| 45 | E | ihl: 5 0x3cfa.4-0x3cfa.7 (0.4) +0x3cf0| 28 | ( | dscp: 10 0x3cfb-0x3cfb.5 (0.6) +0x3cf0| 28 | ( | ecn: 0 0x3cfb.6-0x3cfb.7 (0.2) +0x3cf0| 05 62 | .b | total_length: 1378 0x3cfc-0x3cfd.7 (2) +0x3cf0| 99 37| .7| identification: 39223 0x3cfe-0x3cff.7 (2) +0x3d00|00 |. | reserved: 0 0x3d00-0x3d00 (0.1) +0x3d00|00 |. | dont_fragment: false 0x3d00.1-0x3d00.1 (0.1) +0x3d00|00 |. | more_fragments: false 0x3d00.2-0x3d00.2 (0.1) +0x3d00|00 00 |.. | fragment_offset: 0 0x3d00.3-0x3d01.7 (1.5) +0x3d00| 35 | 5 | ttl: 53 0x3d02-0x3d02.7 (1) +0x3d00| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x3d03-0x3d03.7 (1) +0x3d00| f5 97 | .. | header_checksum: 0xf597 0x3d04-0x3d05.7 (2) +0x3d00| 4a 7d e4 e3 | J}.. | source_ip: "74.125.228.227" (0x4a7de4e3) 0x3d06-0x3d09.7 (4) +0x3d00| c0 a8 01 8b | .... | destination_ip: "192.168.1.139" (0xc0a8018b) 0x3d0a-0x3d0d.7 (4) + | | | data: {} (udp) 0x3d0e-0x425b.7 (1358) +0x3d00| 01 bb| ..| source_port: "https" (443) (http protocol over TLS/SSL) 0x3d0e-0x3d0f.7 (2) +0x3d10|fa 90 |.. | destination_port: 64144 0x3d10-0x3d11.7 (2) +0x3d10| 05 4e | .N | length: 1358 0x3d12-0x3d13.7 (2) +0x3d10| cd b8 | .. | checksum: 0xcdb8 0x3d14-0x3d15.7 (2) +0x3d10| 00 02 d0 95 f4 2d 7a 1e e0 62| .....-z..b| data: raw bits 0x3d16-0x425b.7 (1350) +0x3d20|95 43 de c9 13 1e ac 8e 74 9c 4f 1b 2c 89 f9 93|.C......t.O.,...| +* |until 0x425b.7 (1350) | | + | | | capture_padding: raw bits 0x425c-NA (0) + | | | padding: raw bits 0x425c-NA (0) + | | | options: [0] 0x425c-NA (0) +0x4250| 90 05 00 00| ....| footer_length: 1424 0x425c-0x425f.7 (4) + | | | [72]: block {} 0x4260-0x42d3.7 (116) +0x4260|06 00 00 00 |.... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x4260-0x4263.7 (4) +0x4260| 74 00 00 00 | t... | length: 116 0x4264-0x4267.7 (4) +0x4260| 00 00 00 00 | .... | interface_id: 0 0x4268-0x426b.7 (4) +0x4260| 72 1d 05 00| r...| timestamp_high: 335218 0x426c-0x426f.7 (4) +0x4270|52 f4 89 c9 |R... | timestamp_low: 3381261394 0x4270-0x4273.7 (4) +0x4270| 52 00 00 00 | R... | capture_packet_length: 82 0x4274-0x4277.7 (4) +0x4270| 52 00 00 00 | R... | original_packet_length: 82 0x4278-0x427b.7 (4) + | | | packet: {} (ether8023) 0x427c-0x42cd.7 (82) +0x4270| 94 10 3e 05| ..>.| destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x427c-0x4281.7 (6) +0x4280|36 d3 |6. | +0x4280| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x4282-0x4287.7 (6) +0x4280| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x4288-0x4289.7 (2) + | | | packet: {} (ipv4) 0x428a-0x42cd.7 (68) +0x4280| 45 | E | version: 4 0x428a-0x428a.3 (0.4) +0x4280| 45 | E | ihl: 5 0x428a.4-0x428a.7 (0.4) +0x4280| 00 | . | dscp: 0 0x428b-0x428b.5 (0.6) +0x4280| 00 | . | ecn: 0 0x428b.6-0x428b.7 (0.2) +0x4280| 00 44 | .D | total_length: 68 0x428c-0x428d.7 (2) +0x4280| 99 84| ..| identification: 39300 0x428e-0x428f.7 (2) +0x4290|00 |. | reserved: 0 0x4290-0x4290 (0.1) +0x4290|00 |. | dont_fragment: false 0x4290.1-0x4290.1 (0.1) +0x4290|00 |. | more_fragments: false 0x4290.2-0x4290.2 (0.1) +0x4290|00 00 |.. | fragment_offset: 0 0x4290.3-0x4291.7 (1.5) +0x4290| 40 | @ | ttl: 64 0x4292-0x4292.7 (1) +0x4290| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x4293-0x4293.7 (1) +0x4290| ef 90 | .. | header_checksum: 0xef90 0x4294-0x4295.7 (2) +0x4290| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x4296-0x4299.7 (4) +0x4290| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x429a-0x429d.7 (4) + | | | data: {} (udp) 0x429e-0x42cd.7 (48) +0x4290| fa 90| ..| source_port: 64144 0x429e-0x429f.7 (2) +0x42a0|01 bb |.. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x42a0-0x42a1.7 (2) +0x42a0| 00 30 | .0 | length: 48 0x42a2-0x42a3.7 (2) +0x42a0| b6 39 | .9 | checksum: 0xb639 0x42a4-0x42a5.7 (2) +0x42a0| 0c 48 4a 3d 55 c4 39 cd 13 03| .HJ=U.9...| data: raw bits 0x42a6-0x42cd.7 (40) +0x42b0|07 5f f3 2a 24 ab f0 88 33 52 36 56 b5 b4 8d d4|._.*$...3R6V....| +0x42c0|50 71 5d 32 5d 13 6a 91 e7 33 a1 30 a7 bd |Pq]2].j..3.0.. | + | | | capture_padding: raw bits 0x42ce-NA (0) +0x42c0| 00 00| ..| padding: raw bits 0x42ce-0x42cf.7 (2) + | | | options: [0] 0x42d0-NA (0) +0x42d0|74 00 00 00 |t... | footer_length: 116 0x42d0-0x42d3.7 (4) + | | | [73]: block {} 0x42d4-0x4863.7 (1424) +0x42d0| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x42d4-0x42d7.7 (4) +0x42d0| 90 05 00 00 | .... | length: 1424 0x42d8-0x42db.7 (4) +0x42d0| 00 00 00 00| ....| interface_id: 0 0x42dc-0x42df.7 (4) +0x42e0|72 1d 05 00 |r... | timestamp_high: 335218 0x42e0-0x42e3.7 (4) +0x42e0| be f5 89 c9 | .... | timestamp_low: 3381261758 0x42e4-0x42e7.7 (4) +0x42e0| 70 05 00 00 | p... | capture_packet_length: 1392 0x42e8-0x42eb.7 (4) +0x42e0| 70 05 00 00| p...| original_packet_length: 1392 0x42ec-0x42ef.7 (4) + | | | packet: {} (ether8023) 0x42f0-0x485f.7 (1392) +0x42f0|94 10 3e 05 36 d3 |..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x42f0-0x42f5.7 (6) +0x42f0| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x42f6-0x42fb.7 (6) +0x42f0| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x42fc-0x42fd.7 (2) + | | | packet: {} (ipv4) 0x42fe-0x485f.7 (1378) +0x42f0| 45 | E | version: 4 0x42fe-0x42fe.3 (0.4) +0x42f0| 45 | E | ihl: 5 0x42fe.4-0x42fe.7 (0.4) +0x42f0| 00| .| dscp: 0 0x42ff-0x42ff.5 (0.6) +0x42f0| 00| .| ecn: 0 0x42ff.6-0x42ff.7 (0.2) +0x4300|05 62 |.b | total_length: 1378 0x4300-0x4301.7 (2) +0x4300| 40 10 | @. | identification: 16400 0x4302-0x4303.7 (2) +0x4300| 00 | . | reserved: 0 0x4304-0x4304 (0.1) +0x4300| 00 | . | dont_fragment: false 0x4304.1-0x4304.1 (0.1) +0x4300| 00 | . | more_fragments: false 0x4304.2-0x4304.2 (0.1) +0x4300| 00 00 | .. | fragment_offset: 0 0x4304.3-0x4305.7 (1.5) +0x4300| 40 | @ | ttl: 64 0x4306-0x4306.7 (1) +0x4300| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x4307-0x4307.7 (1) +0x4300| 43 e7 | C. | header_checksum: 0x43e7 0x4308-0x4309.7 (2) +0x4300| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x430a-0x430d.7 (4) +0x4300| 4a 7d| J}| destination_ip: "74.125.228.227" (0x4a7de4e3) 0x430e-0x4311.7 (4) +0x4310|e4 e3 |.. | + | | | data: {} (udp) 0x4312-0x485f.7 (1358) +0x4310| fa 90 | .. | source_port: 64144 0x4312-0x4313.7 (2) +0x4310| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x4314-0x4315.7 (2) +0x4310| 05 4e | .N | length: 1358 0x4316-0x4317.7 (2) +0x4310| 49 d2 | I. | checksum: 0x49d2 0x4318-0x4319.7 (2) +0x4310| 0c 48 4a 3d 55 c4| .HJ=U.| data: raw bits 0x431a-0x485f.7 (1350) +0x4320|39 cd 13 04 6f 4c 6d 50 81 9f d3 3c 13 d9 36 57|9...oLmP...<..6W| +* |until 0x485f.7 (1350) | | + | | | capture_padding: raw bits 0x4860-NA (0) + | | | padding: raw bits 0x4860-NA (0) + | | | options: [0] 0x4860-NA (0) +0x4860|90 05 00 00 |.... | footer_length: 1424 0x4860-0x4863.7 (4) + | | | [74]: block {} 0x4864-0x4b57.7 (756) +0x4860| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x4864-0x4867.7 (4) +0x4860| f4 02 00 00 | .... | length: 756 0x4868-0x486b.7 (4) +0x4860| 00 00 00 00| ....| interface_id: 0 0x486c-0x486f.7 (4) +0x4870|72 1d 05 00 |r... | timestamp_high: 335218 0x4870-0x4873.7 (4) +0x4870| f8 f5 89 c9 | .... | timestamp_low: 3381261816 0x4874-0x4877.7 (4) +0x4870| d4 02 00 00 | .... | capture_packet_length: 724 0x4878-0x487b.7 (4) +0x4870| d4 02 00 00| ....| original_packet_length: 724 0x487c-0x487f.7 (4) + | | | packet: {} (ether8023) 0x4880-0x4b53.7 (724) +0x4880|94 10 3e 05 36 d3 |..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x4880-0x4885.7 (6) +0x4880| a4 5e 60 f1 7d 93 | .^`.}. | source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x4886-0x488b.7 (6) +0x4880| 08 00 | .. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x488c-0x488d.7 (2) + | | | packet: {} (ipv4) 0x488e-0x4b53.7 (710) +0x4880| 45 | E | version: 4 0x488e-0x488e.3 (0.4) +0x4880| 45 | E | ihl: 5 0x488e.4-0x488e.7 (0.4) +0x4880| 00| .| dscp: 0 0x488f-0x488f.5 (0.6) +0x4880| 00| .| ecn: 0 0x488f.6-0x488f.7 (0.2) +0x4890|02 c6 |.. | total_length: 710 0x4890-0x4891.7 (2) +0x4890| 03 ac | .. | identification: 940 0x4892-0x4893.7 (2) +0x4890| 00 | . | reserved: 0 0x4894-0x4894 (0.1) +0x4890| 00 | . | dont_fragment: false 0x4894.1-0x4894.1 (0.1) +0x4890| 00 | . | more_fragments: false 0x4894.2-0x4894.2 (0.1) +0x4890| 00 00 | .. | fragment_offset: 0 0x4894.3-0x4895.7 (1.5) +0x4890| 40 | @ | ttl: 64 0x4896-0x4896.7 (1) +0x4890| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x4897-0x4897.7 (1) +0x4890| 82 e7 | .. | header_checksum: 0x82e7 0x4898-0x4899.7 (2) +0x4890| c0 a8 01 8b | .... | source_ip: "192.168.1.139" (0xc0a8018b) 0x489a-0x489d.7 (4) +0x4890| 4a 7d| J}| destination_ip: "74.125.228.227" (0x4a7de4e3) 0x489e-0x48a1.7 (4) +0x48a0|e4 e3 |.. | + | | | data: {} (udp) 0x48a2-0x4b53.7 (690) +0x48a0| fa 90 | .. | source_port: 64144 0x48a2-0x48a3.7 (2) +0x48a0| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x48a4-0x48a5.7 (2) +0x48a0| 02 b2 | .. | length: 690 0x48a6-0x48a7.7 (2) +0x48a0| 31 58 | 1X | checksum: 0x3158 0x48a8-0x48a9.7 (2) +0x48a0| 0c 48 4a 3d 55 c4| .HJ=U.| data: raw bits 0x48aa-0x4b53.7 (682) +0x48b0|39 cd 13 05 02 33 9a 73 17 03 94 a4 a1 ac ca e1|9....3.s........| +* |until 0x4b53.7 (682) | | + | | | capture_padding: raw bits 0x4b54-NA (0) + | | | padding: raw bits 0x4b54-NA (0) + | | | options: [0] 0x4b54-NA (0) +0x4b50| f4 02 00 00 | .... | footer_length: 756 0x4b54-0x4b57.7 (4) + | | | [75]: block {} 0x4b58-0x4c3b.7 (228) +0x4b50| 06 00 00 00 | .... | type: "enhanced_packet" (0x6) (Enhanced Packet Block) 0x4b58-0x4b5b.7 (4) +0x4b50| e4 00 00 00| ....| length: 228 0x4b5c-0x4b5f.7 (4) +0x4b60|00 00 00 00 |.... | interface_id: 0 0x4b60-0x4b63.7 (4) +0x4b60| 72 1d 05 00 | r... | timestamp_high: 335218 0x4b64-0x4b67.7 (4) +0x4b60| f9 f5 89 c9 | .... | timestamp_low: 3381261817 0x4b68-0x4b6b.7 (4) +0x4b60| c3 00 00 00| ....| capture_packet_length: 195 0x4b6c-0x4b6f.7 (4) +0x4b70|c3 00 00 00 |.... | original_packet_length: 195 0x4b70-0x4b73.7 (4) + | | | packet: {} (ether8023) 0x4b74-0x4c36.7 (195) +0x4b70| 94 10 3e 05 36 d3 | ..>.6. | destination: "94:10:3e:05:36:d3" (0x94103e0536d3) 0x4b74-0x4b79.7 (6) +0x4b70| a4 5e 60 f1 7d 93| .^`.}.| source: "a4:5e:60:f1:7d:93" (0xa45e60f17d93) 0x4b7a-0x4b7f.7 (6) +0x4b80|08 00 |.. | ether_type: "ipv4" (0x800) (Internet Protocol version 4) 0x4b80-0x4b81.7 (2) + | | | packet: {} (ipv4) 0x4b82-0x4c36.7 (181) +0x4b80| 45 | E | version: 4 0x4b82-0x4b82.3 (0.4) +0x4b80| 45 | E | ihl: 5 0x4b82.4-0x4b82.7 (0.4) +0x4b80| 00 | . | dscp: 0 0x4b83-0x4b83.5 (0.6) +0x4b80| 00 | . | ecn: 0 0x4b83.6-0x4b83.7 (0.2) +0x4b80| 00 b5 | .. | total_length: 181 0x4b84-0x4b85.7 (2) +0x4b80| 2d 68 | -h | identification: 11624 0x4b86-0x4b87.7 (2) +0x4b80| 00 | . | reserved: 0 0x4b88-0x4b88 (0.1) +0x4b80| 00 | . | dont_fragment: false 0x4b88.1-0x4b88.1 (0.1) +0x4b80| 00 | . | more_fragments: false 0x4b88.2-0x4b88.2 (0.1) +0x4b80| 00 00 | .. | fragment_offset: 0 0x4b88.3-0x4b89.7 (1.5) +0x4b80| 40 | @ | ttl: 64 0x4b8a-0x4b8a.7 (1) +0x4b80| 11 | . | protocol: "udp" (17) (user datagram protocol) 0x4b8b-0x4b8b.7 (1) +0x4b80| 5b 3c | [< | header_checksum: 0x5b3c 0x4b8c-0x4b8d.7 (2) +0x4b80| c0 a8| ..| source_ip: "192.168.1.139" (0xc0a8018b) 0x4b8e-0x4b91.7 (4) +0x4b90|01 8b |.. | +0x4b90| 4a 7d e4 e3 | J}.. | destination_ip: "74.125.228.227" (0x4a7de4e3) 0x4b92-0x4b95.7 (4) + | | | data: {} (udp) 0x4b96-0x4c36.7 (161) +0x4b90| fa 90 | .. | source_port: 64144 0x4b96-0x4b97.7 (2) +0x4b90| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x4b98-0x4b99.7 (2) +0x4b90| 00 a1 | .. | length: 161 0x4b9a-0x4b9b.7 (2) +0x4b90| 14 92 | .. | checksum: 0x1492 0x4b9c-0x4b9d.7 (2) +0x4b90| 0c 48| .H| data: raw bits 0x4b9e-0x4c36.7 (153) +0x4ba0|4a 3d 55 c4 39 cd 13 06 d6 ed 7f 96 60 64 e0 90|J=U.9.......`d..| +* |until 0x4c36.7 (153) | | + | | | capture_padding: raw bits 0x4c37-NA (0) +0x4c30| 00 | . | padding: raw bits 0x4c37-0x4c37.7 (1) + | | | options: [0] 0x4c38-NA (0) +0x4c30| e4 00 00 00 | .... | footer_length: 228 0x4c38-0x4c3b.7 (4) + | | | [76]: block {} 0x4c3c-0x4d13.7 (216) +0x4c30| 04 00 00 00| ....| type: "name_resolution" (0x4) (Name Resolution Block) 0x4c3c-0x4c3f.7 (4) +0x4c40|d8 00 00 00 |.... | length: 216 0x4c40-0x4c43.7 (4) + | | | records: [8] 0x4c44-0x4d0f.7 (204) + | | | [0]: record {} 0x4c44-0x4c63.7 (32) +0x4c40| 01 00 | .. | type: "ipv4" (1) 0x4c44-0x4c45.7 (2) +0x4c40| 19 00 | .. | length: 25 0x4c46-0x4c47.7 (2) +0x4c40| 4a 7d e4 e3 | J}.. | address: "74.125.228.227" (0x4a7de4e3) 0x4c48-0x4c4b.7 (4) + | | | entries: [1] 0x4c4c-0x4c60.7 (21) +0x4c40| 63 6c 69 65| clie| [0]: string "clients.l.google.com" 0x4c4c-0x4c60.7 (21) +0x4c50|6e 74 73 2e 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d|nts.l.google.com| +0x4c60|00 |. | +0x4c60| 00 00 00 | ... | padding: raw bits 0x4c61-0x4c63.7 (3) + | | | [1]: record {} 0x4c64-0x4c83.7 (32) +0x4c60| 01 00 | .. | type: "ipv4" (1) 0x4c64-0x4c65.7 (2) +0x4c60| 19 00 | .. | length: 25 0x4c66-0x4c67.7 (2) +0x4c60| ad c2 cc bd | .... | address: "173.194.204.189" (0xadc2ccbd) 0x4c68-0x4c6b.7 (4) + | | | entries: [1] 0x4c6c-0x4c80.7 (21) +0x4c60| 71 62 2d 69| qb-i| [0]: string "qb-in-f189.1e100.net" 0x4c6c-0x4c80.7 (21) +0x4c70|6e 2d 66 31 38 39 2e 31 65 31 30 30 2e 6e 65 74|n-f189.1e100.net| +0x4c80|00 |. | +0x4c80| 00 00 00 | ... | padding: raw bits 0x4c81-0x4c83.7 (3) + | | | [2]: record {} 0x4c84-0x4c9b.7 (24) +0x4c80| 01 00 | .. | type: "ipv4" (1) 0x4c84-0x4c85.7 (2) +0x4c80| 11 00 | .. | length: 17 0x4c86-0x4c87.7 (2) +0x4c80| c0 a8 01 8b | .... | address: "192.168.1.139" (0xc0a8018b) 0x4c88-0x4c8b.7 (4) + | | | entries: [1] 0x4c8c-0x4c98.7 (13) +0x4c80| 68 61 64 72| hadr| [0]: string "hadriels-mbp" 0x4c8c-0x4c98.7 (13) +0x4c90|69 65 6c 73 2d 6d 62 70 00 |iels-mbp. | +0x4c90| 00 00 00 | ... | padding: raw bits 0x4c99-0x4c9b.7 (3) + | | | [3]: record {} 0x4c9c-0x4cbf.7 (36) +0x4c90| 01 00 | .. | type: "ipv4" (1) 0x4c9c-0x4c9d.7 (2) +0x4c90| 1e 00| ..| length: 30 0x4c9e-0x4c9f.7 (2) +0x4ca0|ad c2 79 36 |..y6 | address: "173.194.121.54" (0xadc27936) 0x4ca0-0x4ca3.7 (4) + | | | entries: [1] 0x4ca4-0x4cbd.7 (26) +0x4ca0| 69 61 64 32 33 73 32 36 2d 69 6e 2d| iad23s26-in-| [0]: string "iad23s26-in-f22.1e100.net" 0x4ca4-0x4cbd.7 (26) +0x4cb0|66 32 32 2e 31 65 31 30 30 2e 6e 65 74 00 |f22.1e100.net. | +0x4cb0| 00 00| ..| padding: raw bits 0x4cbe-0x4cbf.7 (2) + | | | [4]: record {} 0x4cc0-0x4ce3.7 (36) +0x4cc0|01 00 |.. | type: "ipv4" (1) 0x4cc0-0x4cc1.7 (2) +0x4cc0| 1f 00 | .. | length: 31 0x4cc2-0x4cc3.7 (2) +0x4cc0| 11 fd 0c fd | .... | address: "17.253.12.253" (0x11fd0cfd) 0x4cc4-0x4cc7.7 (4) + | | | entries: [1] 0x4cc8-0x4ce2.7 (27) +0x4cc0| 75 73 6d 69 61 31 2d 6e| usmia1-n| [0]: string "usmia1-ntp-002.aaplimg.com" 0x4cc8-0x4ce2.7 (27) +0x4cd0|74 70 2d 30 30 32 2e 61 61 70 6c 69 6d 67 2e 63|tp-002.aaplimg.c| +0x4ce0|6f 6d 00 |om. | +0x4ce0| 00 | . | padding: raw bits 0x4ce3-0x4ce3.7 (1) + | | | [5]: record {} 0x4ce4-0x4cf3.7 (16) +0x4ce0| 01 00 | .. | type: "ipv4" (1) 0x4ce4-0x4ce5.7 (2) +0x4ce0| 0c 00 | .. | length: 12 0x4ce6-0x4ce7.7 (2) +0x4ce0| c0 a8 01 01 | .... | address: "192.168.1.1" (0xc0a80101) 0x4ce8-0x4ceb.7 (4) + | | | entries: [1] 0x4cec-0x4cf3.7 (8) +0x4ce0| 6b 61 70 6c| kapl| [0]: string "kaplake" 0x4cec-0x4cf3.7 (8) +0x4cf0|61 6b 65 00 |ake. | + | | | padding: raw bits 0x4cf4-NA (0) + | | | [6]: record {} 0x4cf4-0x4d0b.7 (24) +0x4cf0| 01 00 | .. | type: "ipv4" (1) 0x4cf4-0x4cf5.7 (2) +0x4cf0| 12 00 | .. | length: 18 0x4cf6-0x4cf7.7 (2) +0x4cf0| ff ff ff ff | .... | address: "255.255.255.255" (0xffffffff) 0x4cf8-0x4cfb.7 (4) + | | | entries: [1] 0x4cfc-0x4d09.7 (14) +0x4cf0| 62 72 6f 61| broa| [0]: string "broadcasthost" 0x4cfc-0x4d09.7 (14) +0x4d00|64 63 61 73 74 68 6f 73 74 00 |dcasthost. | +0x4d00| 00 00 | .. | padding: raw bits 0x4d0a-0x4d0b.7 (2) + | | | [7]: record {} 0x4d0c-0x4d0f.7 (4) +0x4d00| 00 00 | .. | type: "end" (0) 0x4d0c-0x4d0d.7 (2) +0x4d00| 00 00| ..| length: 0 0x4d0e-0x4d0f.7 (2) + | | | options: [0] 0x4d10-NA (0) +0x4d10|d8 00 00 00 |.... | footer_length: 216 0x4d10-0x4d13.7 (4) + | | | [77]: block {} 0x4d14-0x4d7f.7 (108) +0x4d10| 05 00 00 00 | .... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x4d14-0x4d17.7 (4) +0x4d10| 6c 00 00 00 | l... | length: 108 0x4d18-0x4d1b.7 (4) +0x4d10| 00 00 00 00| ....| interface_id: 0 0x4d1c-0x4d1f.7 (4) +0x4d20|72 1d 05 00 |r... | timestamp_high: 335218 0x4d20-0x4d23.7 (4) +0x4d20| 34 ed 8e c9 | 4... | timestamp_low: 3381587252 0x4d24-0x4d27.7 (4) + | | | padding: raw bits 0x4d28-NA (0) + | | | options: [6] 0x4d28-0x4d7b.7 (84) + | | | [0]: option {} 0x4d28-0x4d47.7 (32) +0x4d20| 01 00 | .. | code: "comment" (1) (Comment) 0x4d28-0x4d29.7 (2) +0x4d20| 1c 00 | .. | length: 28 0x4d2a-0x4d2b.7 (2) +0x4d20| 43 6f 75 6e| Coun| value: "Counters provided by dumpcap" 0x4d2c-0x4d47.7 (28) +0x4d30|74 65 72 73 20 70 72 6f 76 69 64 65 64 20 62 79|ters provided by| +0x4d40|20 64 75 6d 70 63 61 70 | dumpcap | + | | | padding: raw bits 0x4d48-NA (0) + | | | [1]: option {} 0x4d48-0x4d53.7 (12) +0x4d40| 02 00 | .. | code: "starttime" (2) 0x4d48-0x4d49.7 (2) +0x4d40| 08 00 | .. | length: 8 0x4d4a-0x4d4b.7 (2) +0x4d40| 72 1d 05 00| r...| value: "r\x1d\x05" 0x4d4c-0x4d53.7 (8) +0x4d50|24 66 e9 c8 |$f.. | + | | | padding: raw bits 0x4d54-NA (0) + | | | [2]: option {} 0x4d54-0x4d5f.7 (12) +0x4d50| 03 00 | .. | code: "endtime" (3) 0x4d54-0x4d55.7 (2) +0x4d50| 08 00 | .. | length: 8 0x4d56-0x4d57.7 (2) +0x4d50| 72 1d 05 00 24 ed 8e c9| r...$...| value: "r\x1d\x05" 0x4d58-0x4d5f.7 (8) + | | | padding: raw bits 0x4d60-NA (0) + | | | [3]: option {} 0x4d60-0x4d6b.7 (12) +0x4d60|04 00 |.. | code: "ifrecv" (4) 0x4d60-0x4d61.7 (2) +0x4d60| 08 00 | .. | length: 8 0x4d62-0x4d63.7 (2) +0x4d60| 7c 00 00 00 00 00 00 00 | |....... | value: "|" 0x4d64-0x4d6b.7 (8) + | | | padding: raw bits 0x4d6c-NA (0) + | | | [4]: option {} 0x4d6c-0x4d77.7 (12) +0x4d60| 05 00 | .. | code: "ifdrop" (5) 0x4d6c-0x4d6d.7 (2) +0x4d60| 08 00| ..| length: 8 0x4d6e-0x4d6f.7 (2) +0x4d70|00 00 00 00 00 00 00 00 |........ | value: "" 0x4d70-0x4d77.7 (8) + | | | padding: raw bits 0x4d78-NA (0) + | | | [5]: option {} 0x4d78-0x4d7b.7 (4) +0x4d70| 00 00 | .. | code: "end" (0) (End of options) 0x4d78-0x4d79.7 (2) +0x4d70| 00 00 | .. | length: 0 0x4d7a-0x4d7b.7 (2) +0x4d70| 6c 00 00 00| l...| footer_length: 108 0x4d7c-0x4d7f.7 (4) + | | | [78]: block {} 0x4d80-0x4deb.7 (108) +0x4d80|05 00 00 00 |.... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x4d80-0x4d83.7 (4) +0x4d80| 6c 00 00 00 | l... | length: 108 0x4d84-0x4d87.7 (4) +0x4d80| 01 00 00 00 | .... | interface_id: 1 0x4d88-0x4d8b.7 (4) +0x4d80| 72 1d 05 00| r...| timestamp_high: 335218 0x4d8c-0x4d8f.7 (4) +0x4d90|3b ed 8e c9 |;... | timestamp_low: 3381587259 0x4d90-0x4d93.7 (4) + | | | padding: raw bits 0x4d94-NA (0) + | | | options: [6] 0x4d94-0x4de7.7 (84) + | | | [0]: option {} 0x4d94-0x4db3.7 (32) +0x4d90| 01 00 | .. | code: "comment" (1) (Comment) 0x4d94-0x4d95.7 (2) +0x4d90| 1c 00 | .. | length: 28 0x4d96-0x4d97.7 (2) +0x4d90| 43 6f 75 6e 74 65 72 73| Counters| value: "Counters provided by dumpcap" 0x4d98-0x4db3.7 (28) +0x4da0|20 70 72 6f 76 69 64 65 64 20 62 79 20 64 75 6d| provided by dum| +0x4db0|70 63 61 70 |pcap | + | | | padding: raw bits 0x4db4-NA (0) + | | | [1]: option {} 0x4db4-0x4dbf.7 (12) +0x4db0| 02 00 | .. | code: "starttime" (2) 0x4db4-0x4db5.7 (2) +0x4db0| 08 00 | .. | length: 8 0x4db6-0x4db7.7 (2) +0x4db0| 72 1d 05 00 24 66 e9 c8| r...$f..| value: "r\x1d\x05" 0x4db8-0x4dbf.7 (8) + | | | padding: raw bits 0x4dc0-NA (0) + | | | [2]: option {} 0x4dc0-0x4dcb.7 (12) +0x4dc0|03 00 |.. | code: "endtime" (3) 0x4dc0-0x4dc1.7 (2) +0x4dc0| 08 00 | .. | length: 8 0x4dc2-0x4dc3.7 (2) +0x4dc0| 72 1d 05 00 24 ed 8e c9 | r...$... | value: "r\x1d\x05" 0x4dc4-0x4dcb.7 (8) + | | | padding: raw bits 0x4dcc-NA (0) + | | | [3]: option {} 0x4dcc-0x4dd7.7 (12) +0x4dc0| 04 00 | .. | code: "ifrecv" (4) 0x4dcc-0x4dcd.7 (2) +0x4dc0| 08 00| ..| length: 8 0x4dce-0x4dcf.7 (2) +0x4dd0|00 00 00 00 00 00 00 00 |........ | value: "" 0x4dd0-0x4dd7.7 (8) + | | | padding: raw bits 0x4dd8-NA (0) + | | | [4]: option {} 0x4dd8-0x4de3.7 (12) +0x4dd0| 05 00 | .. | code: "ifdrop" (5) 0x4dd8-0x4dd9.7 (2) +0x4dd0| 08 00 | .. | length: 8 0x4dda-0x4ddb.7 (2) +0x4dd0| 00 00 00 00| ....| value: "" 0x4ddc-0x4de3.7 (8) +0x4de0|00 00 00 00 |.... | + | | | padding: raw bits 0x4de4-NA (0) + | | | [5]: option {} 0x4de4-0x4de7.7 (4) +0x4de0| 00 00 | .. | code: "end" (0) (End of options) 0x4de4-0x4de5.7 (2) +0x4de0| 00 00 | .. | length: 0 0x4de6-0x4de7.7 (2) +0x4de0| 6c 00 00 00 | l... | footer_length: 108 0x4de8-0x4deb.7 (4) + | | | [79]: block {} 0x4dec-0x4e57.7 (108) +0x4de0| 05 00 00 00| ....| type: "interface_statistics" (0x5) (Interface Statistics Block) 0x4dec-0x4def.7 (4) +0x4df0|6c 00 00 00 |l... | length: 108 0x4df0-0x4df3.7 (4) +0x4df0| 02 00 00 00 | .... | interface_id: 2 0x4df4-0x4df7.7 (4) +0x4df0| 72 1d 05 00 | r... | timestamp_high: 335218 0x4df8-0x4dfb.7 (4) +0x4df0| 40 ed 8e c9| @...| timestamp_low: 3381587264 0x4dfc-0x4dff.7 (4) + | | | padding: raw bits 0x4e00-NA (0) + | | | options: [6] 0x4e00-0x4e53.7 (84) + | | | [0]: option {} 0x4e00-0x4e1f.7 (32) +0x4e00|01 00 |.. | code: "comment" (1) (Comment) 0x4e00-0x4e01.7 (2) +0x4e00| 1c 00 | .. | length: 28 0x4e02-0x4e03.7 (2) +0x4e00| 43 6f 75 6e 74 65 72 73 20 70 72 6f| Counters pro| value: "Counters provided by dumpcap" 0x4e04-0x4e1f.7 (28) +0x4e10|76 69 64 65 64 20 62 79 20 64 75 6d 70 63 61 70|vided by dumpcap| + | | | padding: raw bits 0x4e20-NA (0) + | | | [1]: option {} 0x4e20-0x4e2b.7 (12) +0x4e20|02 00 |.. | code: "starttime" (2) 0x4e20-0x4e21.7 (2) +0x4e20| 08 00 | .. | length: 8 0x4e22-0x4e23.7 (2) +0x4e20| 72 1d 05 00 24 66 e9 c8 | r...$f.. | value: "r\x1d\x05" 0x4e24-0x4e2b.7 (8) + | | | padding: raw bits 0x4e2c-NA (0) + | | | [2]: option {} 0x4e2c-0x4e37.7 (12) +0x4e20| 03 00 | .. | code: "endtime" (3) 0x4e2c-0x4e2d.7 (2) +0x4e20| 08 00| ..| length: 8 0x4e2e-0x4e2f.7 (2) +0x4e30|72 1d 05 00 24 ed 8e c9 |r...$... | value: "r\x1d\x05" 0x4e30-0x4e37.7 (8) + | | | padding: raw bits 0x4e38-NA (0) + | | | [3]: option {} 0x4e38-0x4e43.7 (12) +0x4e30| 04 00 | .. | code: "ifrecv" (4) 0x4e38-0x4e39.7 (2) +0x4e30| 08 00 | .. | length: 8 0x4e3a-0x4e3b.7 (2) +0x4e30| 00 00 00 00| ....| value: "" 0x4e3c-0x4e43.7 (8) +0x4e40|00 00 00 00 |.... | + | | | padding: raw bits 0x4e44-NA (0) + | | | [4]: option {} 0x4e44-0x4e4f.7 (12) +0x4e40| 05 00 | .. | code: "ifdrop" (5) 0x4e44-0x4e45.7 (2) +0x4e40| 08 00 | .. | length: 8 0x4e46-0x4e47.7 (2) +0x4e40| 00 00 00 00 00 00 00 00| ........| value: "" 0x4e48-0x4e4f.7 (8) + | | | padding: raw bits 0x4e50-NA (0) + | | | [5]: option {} 0x4e50-0x4e53.7 (4) +0x4e50|00 00 |.. | code: "end" (0) (End of options) 0x4e50-0x4e51.7 (2) +0x4e50| 00 00 | .. | length: 0 0x4e52-0x4e53.7 (2) +0x4e50| 6c 00 00 00 | l... | footer_length: 108 0x4e54-0x4e57.7 (4) + | | | [80]: block {} 0x4e58-0x4ec3.7 (108) +0x4e50| 05 00 00 00 | .... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x4e58-0x4e5b.7 (4) +0x4e50| 6c 00 00 00| l...| length: 108 0x4e5c-0x4e5f.7 (4) +0x4e60|03 00 00 00 |.... | interface_id: 3 0x4e60-0x4e63.7 (4) +0x4e60| 72 1d 05 00 | r... | timestamp_high: 335218 0x4e64-0x4e67.7 (4) +0x4e60| 46 ed 8e c9 | F... | timestamp_low: 3381587270 0x4e68-0x4e6b.7 (4) + | | | padding: raw bits 0x4e6c-NA (0) + | | | options: [6] 0x4e6c-0x4ebf.7 (84) + | | | [0]: option {} 0x4e6c-0x4e8b.7 (32) +0x4e60| 01 00 | .. | code: "comment" (1) (Comment) 0x4e6c-0x4e6d.7 (2) +0x4e60| 1c 00| ..| length: 28 0x4e6e-0x4e6f.7 (2) +0x4e70|43 6f 75 6e 74 65 72 73 20 70 72 6f 76 69 64 65|Counters provide| value: "Counters provided by dumpcap" 0x4e70-0x4e8b.7 (28) +0x4e80|64 20 62 79 20 64 75 6d 70 63 61 70 |d by dumpcap | + | | | padding: raw bits 0x4e8c-NA (0) + | | | [1]: option {} 0x4e8c-0x4e97.7 (12) +0x4e80| 02 00 | .. | code: "starttime" (2) 0x4e8c-0x4e8d.7 (2) +0x4e80| 08 00| ..| length: 8 0x4e8e-0x4e8f.7 (2) +0x4e90|72 1d 05 00 24 66 e9 c8 |r...$f.. | value: "r\x1d\x05" 0x4e90-0x4e97.7 (8) + | | | padding: raw bits 0x4e98-NA (0) + | | | [2]: option {} 0x4e98-0x4ea3.7 (12) +0x4e90| 03 00 | .. | code: "endtime" (3) 0x4e98-0x4e99.7 (2) +0x4e90| 08 00 | .. | length: 8 0x4e9a-0x4e9b.7 (2) +0x4e90| 72 1d 05 00| r...| value: "r\x1d\x05" 0x4e9c-0x4ea3.7 (8) +0x4ea0|24 ed 8e c9 |$... | + | | | padding: raw bits 0x4ea4-NA (0) + | | | [3]: option {} 0x4ea4-0x4eaf.7 (12) +0x4ea0| 04 00 | .. | code: "ifrecv" (4) 0x4ea4-0x4ea5.7 (2) +0x4ea0| 08 00 | .. | length: 8 0x4ea6-0x4ea7.7 (2) +0x4ea0| 00 00 00 00 00 00 00 00| ........| value: "" 0x4ea8-0x4eaf.7 (8) + | | | padding: raw bits 0x4eb0-NA (0) + | | | [4]: option {} 0x4eb0-0x4ebb.7 (12) +0x4eb0|05 00 |.. | code: "ifdrop" (5) 0x4eb0-0x4eb1.7 (2) +0x4eb0| 08 00 | .. | length: 8 0x4eb2-0x4eb3.7 (2) +0x4eb0| 00 00 00 00 00 00 00 00 | ........ | value: "" 0x4eb4-0x4ebb.7 (8) + | | | padding: raw bits 0x4ebc-NA (0) + | | | [5]: option {} 0x4ebc-0x4ebf.7 (4) +0x4eb0| 00 00 | .. | code: "end" (0) (End of options) 0x4ebc-0x4ebd.7 (2) +0x4eb0| 00 00| ..| length: 0 0x4ebe-0x4ebf.7 (2) +0x4ec0|6c 00 00 00 |l... | footer_length: 108 0x4ec0-0x4ec3.7 (4) + | | | [81]: block {} 0x4ec4-0x4f2f.7 (108) +0x4ec0| 05 00 00 00 | .... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x4ec4-0x4ec7.7 (4) +0x4ec0| 6c 00 00 00 | l... | length: 108 0x4ec8-0x4ecb.7 (4) +0x4ec0| 04 00 00 00| ....| interface_id: 4 0x4ecc-0x4ecf.7 (4) +0x4ed0|72 1d 05 00 |r... | timestamp_high: 335218 0x4ed0-0x4ed3.7 (4) +0x4ed0| 4c ed 8e c9 | L... | timestamp_low: 3381587276 0x4ed4-0x4ed7.7 (4) + | | | padding: raw bits 0x4ed8-NA (0) + | | | options: [6] 0x4ed8-0x4f2b.7 (84) + | | | [0]: option {} 0x4ed8-0x4ef7.7 (32) +0x4ed0| 01 00 | .. | code: "comment" (1) (Comment) 0x4ed8-0x4ed9.7 (2) +0x4ed0| 1c 00 | .. | length: 28 0x4eda-0x4edb.7 (2) +0x4ed0| 43 6f 75 6e| Coun| value: "Counters provided by dumpcap" 0x4edc-0x4ef7.7 (28) +0x4ee0|74 65 72 73 20 70 72 6f 76 69 64 65 64 20 62 79|ters provided by| +0x4ef0|20 64 75 6d 70 63 61 70 | dumpcap | + | | | padding: raw bits 0x4ef8-NA (0) + | | | [1]: option {} 0x4ef8-0x4f03.7 (12) +0x4ef0| 02 00 | .. | code: "starttime" (2) 0x4ef8-0x4ef9.7 (2) +0x4ef0| 08 00 | .. | length: 8 0x4efa-0x4efb.7 (2) +0x4ef0| 72 1d 05 00| r...| value: "r\x1d\x05" 0x4efc-0x4f03.7 (8) +0x4f00|24 66 e9 c8 |$f.. | + | | | padding: raw bits 0x4f04-NA (0) + | | | [2]: option {} 0x4f04-0x4f0f.7 (12) +0x4f00| 03 00 | .. | code: "endtime" (3) 0x4f04-0x4f05.7 (2) +0x4f00| 08 00 | .. | length: 8 0x4f06-0x4f07.7 (2) +0x4f00| 72 1d 05 00 24 ed 8e c9| r...$...| value: "r\x1d\x05" 0x4f08-0x4f0f.7 (8) + | | | padding: raw bits 0x4f10-NA (0) + | | | [3]: option {} 0x4f10-0x4f1b.7 (12) +0x4f10|04 00 |.. | code: "ifrecv" (4) 0x4f10-0x4f11.7 (2) +0x4f10| 08 00 | .. | length: 8 0x4f12-0x4f13.7 (2) +0x4f10| 00 00 00 00 00 00 00 00 | ........ | value: "" 0x4f14-0x4f1b.7 (8) + | | | padding: raw bits 0x4f1c-NA (0) + | | | [4]: option {} 0x4f1c-0x4f27.7 (12) +0x4f10| 05 00 | .. | code: "ifdrop" (5) 0x4f1c-0x4f1d.7 (2) +0x4f10| 08 00| ..| length: 8 0x4f1e-0x4f1f.7 (2) +0x4f20|00 00 00 00 00 00 00 00 |........ | value: "" 0x4f20-0x4f27.7 (8) + | | | padding: raw bits 0x4f28-NA (0) + | | | [5]: option {} 0x4f28-0x4f2b.7 (4) +0x4f20| 00 00 | .. | code: "end" (0) (End of options) 0x4f28-0x4f29.7 (2) +0x4f20| 00 00 | .. | length: 0 0x4f2a-0x4f2b.7 (2) +0x4f20| 6c 00 00 00| l...| footer_length: 108 0x4f2c-0x4f2f.7 (4) + | | | [82]: block {} 0x4f30-0x4f9b.7 (108) +0x4f30|05 00 00 00 |.... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x4f30-0x4f33.7 (4) +0x4f30| 6c 00 00 00 | l... | length: 108 0x4f34-0x4f37.7 (4) +0x4f30| 05 00 00 00 | .... | interface_id: 5 0x4f38-0x4f3b.7 (4) +0x4f30| 72 1d 05 00| r...| timestamp_high: 335218 0x4f3c-0x4f3f.7 (4) +0x4f40|51 ed 8e c9 |Q... | timestamp_low: 3381587281 0x4f40-0x4f43.7 (4) + | | | padding: raw bits 0x4f44-NA (0) + | | | options: [6] 0x4f44-0x4f97.7 (84) + | | | [0]: option {} 0x4f44-0x4f63.7 (32) +0x4f40| 01 00 | .. | code: "comment" (1) (Comment) 0x4f44-0x4f45.7 (2) +0x4f40| 1c 00 | .. | length: 28 0x4f46-0x4f47.7 (2) +0x4f40| 43 6f 75 6e 74 65 72 73| Counters| value: "Counters provided by dumpcap" 0x4f48-0x4f63.7 (28) +0x4f50|20 70 72 6f 76 69 64 65 64 20 62 79 20 64 75 6d| provided by dum| +0x4f60|70 63 61 70 |pcap | + | | | padding: raw bits 0x4f64-NA (0) + | | | [1]: option {} 0x4f64-0x4f6f.7 (12) +0x4f60| 02 00 | .. | code: "starttime" (2) 0x4f64-0x4f65.7 (2) +0x4f60| 08 00 | .. | length: 8 0x4f66-0x4f67.7 (2) +0x4f60| 72 1d 05 00 24 66 e9 c8| r...$f..| value: "r\x1d\x05" 0x4f68-0x4f6f.7 (8) + | | | padding: raw bits 0x4f70-NA (0) + | | | [2]: option {} 0x4f70-0x4f7b.7 (12) +0x4f70|03 00 |.. | code: "endtime" (3) 0x4f70-0x4f71.7 (2) +0x4f70| 08 00 | .. | length: 8 0x4f72-0x4f73.7 (2) +0x4f70| 72 1d 05 00 24 ed 8e c9 | r...$... | value: "r\x1d\x05" 0x4f74-0x4f7b.7 (8) + | | | padding: raw bits 0x4f7c-NA (0) + | | | [3]: option {} 0x4f7c-0x4f87.7 (12) +0x4f70| 04 00 | .. | code: "ifrecv" (4) 0x4f7c-0x4f7d.7 (2) +0x4f70| 08 00| ..| length: 8 0x4f7e-0x4f7f.7 (2) +0x4f80|00 00 00 00 00 00 00 00 |........ | value: "" 0x4f80-0x4f87.7 (8) + | | | padding: raw bits 0x4f88-NA (0) + | | | [4]: option {} 0x4f88-0x4f93.7 (12) +0x4f80| 05 00 | .. | code: "ifdrop" (5) 0x4f88-0x4f89.7 (2) +0x4f80| 08 00 | .. | length: 8 0x4f8a-0x4f8b.7 (2) +0x4f80| 00 00 00 00| ....| value: "" 0x4f8c-0x4f93.7 (8) +0x4f90|00 00 00 00 |.... | + | | | padding: raw bits 0x4f94-NA (0) + | | | [5]: option {} 0x4f94-0x4f97.7 (4) +0x4f90| 00 00 | .. | code: "end" (0) (End of options) 0x4f94-0x4f95.7 (2) +0x4f90| 00 00 | .. | length: 0 0x4f96-0x4f97.7 (2) +0x4f90| 6c 00 00 00 | l... | footer_length: 108 0x4f98-0x4f9b.7 (4) + | | | [83]: block {} 0x4f9c-0x5007.7 (108) +0x4f90| 05 00 00 00| ....| type: "interface_statistics" (0x5) (Interface Statistics Block) 0x4f9c-0x4f9f.7 (4) +0x4fa0|6c 00 00 00 |l... | length: 108 0x4fa0-0x4fa3.7 (4) +0x4fa0| 06 00 00 00 | .... | interface_id: 6 0x4fa4-0x4fa7.7 (4) +0x4fa0| 72 1d 05 00 | r... | timestamp_high: 335218 0x4fa8-0x4fab.7 (4) +0x4fa0| 56 ed 8e c9| V...| timestamp_low: 3381587286 0x4fac-0x4faf.7 (4) + | | | padding: raw bits 0x4fb0-NA (0) + | | | options: [6] 0x4fb0-0x5003.7 (84) + | | | [0]: option {} 0x4fb0-0x4fcf.7 (32) +0x4fb0|01 00 |.. | code: "comment" (1) (Comment) 0x4fb0-0x4fb1.7 (2) +0x4fb0| 1c 00 | .. | length: 28 0x4fb2-0x4fb3.7 (2) +0x4fb0| 43 6f 75 6e 74 65 72 73 20 70 72 6f| Counters pro| value: "Counters provided by dumpcap" 0x4fb4-0x4fcf.7 (28) +0x4fc0|76 69 64 65 64 20 62 79 20 64 75 6d 70 63 61 70|vided by dumpcap| + | | | padding: raw bits 0x4fd0-NA (0) + | | | [1]: option {} 0x4fd0-0x4fdb.7 (12) +0x4fd0|02 00 |.. | code: "starttime" (2) 0x4fd0-0x4fd1.7 (2) +0x4fd0| 08 00 | .. | length: 8 0x4fd2-0x4fd3.7 (2) +0x4fd0| 72 1d 05 00 24 66 e9 c8 | r...$f.. | value: "r\x1d\x05" 0x4fd4-0x4fdb.7 (8) + | | | padding: raw bits 0x4fdc-NA (0) + | | | [2]: option {} 0x4fdc-0x4fe7.7 (12) +0x4fd0| 03 00 | .. | code: "endtime" (3) 0x4fdc-0x4fdd.7 (2) +0x4fd0| 08 00| ..| length: 8 0x4fde-0x4fdf.7 (2) +0x4fe0|72 1d 05 00 24 ed 8e c9 |r...$... | value: "r\x1d\x05" 0x4fe0-0x4fe7.7 (8) + | | | padding: raw bits 0x4fe8-NA (0) + | | | [3]: option {} 0x4fe8-0x4ff3.7 (12) +0x4fe0| 04 00 | .. | code: "ifrecv" (4) 0x4fe8-0x4fe9.7 (2) +0x4fe0| 08 00 | .. | length: 8 0x4fea-0x4feb.7 (2) +0x4fe0| 00 00 00 00| ....| value: "" 0x4fec-0x4ff3.7 (8) +0x4ff0|00 00 00 00 |.... | + | | | padding: raw bits 0x4ff4-NA (0) + | | | [4]: option {} 0x4ff4-0x4fff.7 (12) +0x4ff0| 05 00 | .. | code: "ifdrop" (5) 0x4ff4-0x4ff5.7 (2) +0x4ff0| 08 00 | .. | length: 8 0x4ff6-0x4ff7.7 (2) +0x4ff0| 00 00 00 00 00 00 00 00| ........| value: "" 0x4ff8-0x4fff.7 (8) + | | | padding: raw bits 0x5000-NA (0) + | | | [5]: option {} 0x5000-0x5003.7 (4) +0x5000|00 00 |.. | code: "end" (0) (End of options) 0x5000-0x5001.7 (2) +0x5000| 00 00 | .. | length: 0 0x5002-0x5003.7 (2) +0x5000| 6c 00 00 00 | l... | footer_length: 108 0x5004-0x5007.7 (4) + | | | [84]: block {} 0x5008-0x5073.7 (108) +0x5000| 05 00 00 00 | .... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x5008-0x500b.7 (4) +0x5000| 6c 00 00 00| l...| length: 108 0x500c-0x500f.7 (4) +0x5010|07 00 00 00 |.... | interface_id: 7 0x5010-0x5013.7 (4) +0x5010| 72 1d 05 00 | r... | timestamp_high: 335218 0x5014-0x5017.7 (4) +0x5010| 84 ed 8e c9 | .... | timestamp_low: 3381587332 0x5018-0x501b.7 (4) + | | | padding: raw bits 0x501c-NA (0) + | | | options: [6] 0x501c-0x506f.7 (84) + | | | [0]: option {} 0x501c-0x503b.7 (32) +0x5010| 01 00 | .. | code: "comment" (1) (Comment) 0x501c-0x501d.7 (2) +0x5010| 1c 00| ..| length: 28 0x501e-0x501f.7 (2) +0x5020|43 6f 75 6e 74 65 72 73 20 70 72 6f 76 69 64 65|Counters provide| value: "Counters provided by dumpcap" 0x5020-0x503b.7 (28) +0x5030|64 20 62 79 20 64 75 6d 70 63 61 70 |d by dumpcap | + | | | padding: raw bits 0x503c-NA (0) + | | | [1]: option {} 0x503c-0x5047.7 (12) +0x5030| 02 00 | .. | code: "starttime" (2) 0x503c-0x503d.7 (2) +0x5030| 08 00| ..| length: 8 0x503e-0x503f.7 (2) +0x5040|72 1d 05 00 24 66 e9 c8 |r...$f.. | value: "r\x1d\x05" 0x5040-0x5047.7 (8) + | | | padding: raw bits 0x5048-NA (0) + | | | [2]: option {} 0x5048-0x5053.7 (12) +0x5040| 03 00 | .. | code: "endtime" (3) 0x5048-0x5049.7 (2) +0x5040| 08 00 | .. | length: 8 0x504a-0x504b.7 (2) +0x5040| 72 1d 05 00| r...| value: "r\x1d\x05" 0x504c-0x5053.7 (8) +0x5050|24 ed 8e c9 |$... | + | | | padding: raw bits 0x5054-NA (0) + | | | [3]: option {} 0x5054-0x505f.7 (12) +0x5050| 04 00 | .. | code: "ifrecv" (4) 0x5054-0x5055.7 (2) +0x5050| 08 00 | .. | length: 8 0x5056-0x5057.7 (2) +0x5050| 00 00 00 00 00 00 00 00| ........| value: "" 0x5058-0x505f.7 (8) + | | | padding: raw bits 0x5060-NA (0) + | | | [4]: option {} 0x5060-0x506b.7 (12) +0x5060|05 00 |.. | code: "ifdrop" (5) 0x5060-0x5061.7 (2) +0x5060| 08 00 | .. | length: 8 0x5062-0x5063.7 (2) +0x5060| 00 00 00 00 00 00 00 00 | ........ | value: "" 0x5064-0x506b.7 (8) + | | | padding: raw bits 0x506c-NA (0) + | | | [5]: option {} 0x506c-0x506f.7 (4) +0x5060| 00 00 | .. | code: "end" (0) (End of options) 0x506c-0x506d.7 (2) +0x5060| 00 00| ..| length: 0 0x506e-0x506f.7 (2) +0x5070|6c 00 00 00 |l... | footer_length: 108 0x5070-0x5073.7 (4) + | | | [85]: block {} 0x5074-0x50df.7 (108) +0x5070| 05 00 00 00 | .... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x5074-0x5077.7 (4) +0x5070| 6c 00 00 00 | l... | length: 108 0x5078-0x507b.7 (4) +0x5070| 08 00 00 00| ....| interface_id: 8 0x507c-0x507f.7 (4) +0x5080|72 1d 05 00 |r... | timestamp_high: 335218 0x5080-0x5083.7 (4) +0x5080| 89 ed 8e c9 | .... | timestamp_low: 3381587337 0x5084-0x5087.7 (4) + | | | padding: raw bits 0x5088-NA (0) + | | | options: [6] 0x5088-0x50db.7 (84) + | | | [0]: option {} 0x5088-0x50a7.7 (32) +0x5080| 01 00 | .. | code: "comment" (1) (Comment) 0x5088-0x5089.7 (2) +0x5080| 1c 00 | .. | length: 28 0x508a-0x508b.7 (2) +0x5080| 43 6f 75 6e| Coun| value: "Counters provided by dumpcap" 0x508c-0x50a7.7 (28) +0x5090|74 65 72 73 20 70 72 6f 76 69 64 65 64 20 62 79|ters provided by| +0x50a0|20 64 75 6d 70 63 61 70 | dumpcap | + | | | padding: raw bits 0x50a8-NA (0) + | | | [1]: option {} 0x50a8-0x50b3.7 (12) +0x50a0| 02 00 | .. | code: "starttime" (2) 0x50a8-0x50a9.7 (2) +0x50a0| 08 00 | .. | length: 8 0x50aa-0x50ab.7 (2) +0x50a0| 72 1d 05 00| r...| value: "r\x1d\x05" 0x50ac-0x50b3.7 (8) +0x50b0|24 66 e9 c8 |$f.. | + | | | padding: raw bits 0x50b4-NA (0) + | | | [2]: option {} 0x50b4-0x50bf.7 (12) +0x50b0| 03 00 | .. | code: "endtime" (3) 0x50b4-0x50b5.7 (2) +0x50b0| 08 00 | .. | length: 8 0x50b6-0x50b7.7 (2) +0x50b0| 72 1d 05 00 24 ed 8e c9| r...$...| value: "r\x1d\x05" 0x50b8-0x50bf.7 (8) + | | | padding: raw bits 0x50c0-NA (0) + | | | [3]: option {} 0x50c0-0x50cb.7 (12) +0x50c0|04 00 |.. | code: "ifrecv" (4) 0x50c0-0x50c1.7 (2) +0x50c0| 08 00 | .. | length: 8 0x50c2-0x50c3.7 (2) +0x50c0| 00 00 00 00 00 00 00 00 | ........ | value: "" 0x50c4-0x50cb.7 (8) + | | | padding: raw bits 0x50cc-NA (0) + | | | [4]: option {} 0x50cc-0x50d7.7 (12) +0x50c0| 05 00 | .. | code: "ifdrop" (5) 0x50cc-0x50cd.7 (2) +0x50c0| 08 00| ..| length: 8 0x50ce-0x50cf.7 (2) +0x50d0|00 00 00 00 00 00 00 00 |........ | value: "" 0x50d0-0x50d7.7 (8) + | | | padding: raw bits 0x50d8-NA (0) + | | | [5]: option {} 0x50d8-0x50db.7 (4) +0x50d0| 00 00 | .. | code: "end" (0) (End of options) 0x50d8-0x50d9.7 (2) +0x50d0| 00 00 | .. | length: 0 0x50da-0x50db.7 (2) +0x50d0| 6c 00 00 00| l...| footer_length: 108 0x50dc-0x50df.7 (4) + | | | [86]: block {} 0x50e0-0x514b.7 (108) +0x50e0|05 00 00 00 |.... | type: "interface_statistics" (0x5) (Interface Statistics Block) 0x50e0-0x50e3.7 (4) +0x50e0| 6c 00 00 00 | l... | length: 108 0x50e4-0x50e7.7 (4) +0x50e0| 09 00 00 00 | .... | interface_id: 9 0x50e8-0x50eb.7 (4) +0x50e0| 72 1d 05 00| r...| timestamp_high: 335218 0x50ec-0x50ef.7 (4) +0x50f0|8e ed 8e c9 |.... | timestamp_low: 3381587342 0x50f0-0x50f3.7 (4) + | | | padding: raw bits 0x50f4-NA (0) + | | | options: [6] 0x50f4-0x5147.7 (84) + | | | [0]: option {} 0x50f4-0x5113.7 (32) +0x50f0| 01 00 | .. | code: "comment" (1) (Comment) 0x50f4-0x50f5.7 (2) +0x50f0| 1c 00 | .. | length: 28 0x50f6-0x50f7.7 (2) +0x50f0| 43 6f 75 6e 74 65 72 73| Counters| value: "Counters provided by dumpcap" 0x50f8-0x5113.7 (28) +0x5100|20 70 72 6f 76 69 64 65 64 20 62 79 20 64 75 6d| provided by dum| +0x5110|70 63 61 70 |pcap | + | | | padding: raw bits 0x5114-NA (0) + | | | [1]: option {} 0x5114-0x511f.7 (12) +0x5110| 02 00 | .. | code: "starttime" (2) 0x5114-0x5115.7 (2) +0x5110| 08 00 | .. | length: 8 0x5116-0x5117.7 (2) +0x5110| 72 1d 05 00 24 66 e9 c8| r...$f..| value: "r\x1d\x05" 0x5118-0x511f.7 (8) + | | | padding: raw bits 0x5120-NA (0) + | | | [2]: option {} 0x5120-0x512b.7 (12) +0x5120|03 00 |.. | code: "endtime" (3) 0x5120-0x5121.7 (2) +0x5120| 08 00 | .. | length: 8 0x5122-0x5123.7 (2) +0x5120| 72 1d 05 00 24 ed 8e c9 | r...$... | value: "r\x1d\x05" 0x5124-0x512b.7 (8) + | | | padding: raw bits 0x512c-NA (0) + | | | [3]: option {} 0x512c-0x5137.7 (12) +0x5120| 04 00 | .. | code: "ifrecv" (4) 0x512c-0x512d.7 (2) +0x5120| 08 00| ..| length: 8 0x512e-0x512f.7 (2) +0x5130|00 00 00 00 00 00 00 00 |........ | value: "" 0x5130-0x5137.7 (8) + | | | padding: raw bits 0x5138-NA (0) + | | | [4]: option {} 0x5138-0x5143.7 (12) +0x5130| 05 00 | .. | code: "ifdrop" (5) 0x5138-0x5139.7 (2) +0x5130| 08 00 | .. | length: 8 0x513a-0x513b.7 (2) +0x5130| 00 00 00 00| ....| value: "" 0x513c-0x5143.7 (8) +0x5140|00 00 00 00 |.... | + | | | padding: raw bits 0x5144-NA (0) + | | | [5]: option {} 0x5144-0x5147.7 (4) +0x5140| 00 00 | .. | code: "end" (0) (End of options) 0x5144-0x5145.7 (2) +0x5140| 00 00 | .. | length: 0 0x5146-0x5147.7 (2) +0x5140| 6c 00 00 00 | l... | footer_length: 108 0x5148-0x514b.7 (4) + | | | [87]: block {} 0x514c-0x51b7.7 (108) +0x5140| 05 00 00 00| ....| type: "interface_statistics" (0x5) (Interface Statistics Block) 0x514c-0x514f.7 (4) +0x5150|6c 00 00 00 |l... | length: 108 0x5150-0x5153.7 (4) +0x5150| 0a 00 00 00 | .... | interface_id: 10 0x5154-0x5157.7 (4) +0x5150| 72 1d 05 00 | r... | timestamp_high: 335218 0x5158-0x515b.7 (4) +0x5150| 93 ed 8e c9| ....| timestamp_low: 3381587347 0x515c-0x515f.7 (4) + | | | padding: raw bits 0x5160-NA (0) + | | | options: [6] 0x5160-0x51b3.7 (84) + | | | [0]: option {} 0x5160-0x517f.7 (32) +0x5160|01 00 |.. | code: "comment" (1) (Comment) 0x5160-0x5161.7 (2) +0x5160| 1c 00 | .. | length: 28 0x5162-0x5163.7 (2) +0x5160| 43 6f 75 6e 74 65 72 73 20 70 72 6f| Counters pro| value: "Counters provided by dumpcap" 0x5164-0x517f.7 (28) +0x5170|76 69 64 65 64 20 62 79 20 64 75 6d 70 63 61 70|vided by dumpcap| + | | | padding: raw bits 0x5180-NA (0) + | | | [1]: option {} 0x5180-0x518b.7 (12) +0x5180|02 00 |.. | code: "starttime" (2) 0x5180-0x5181.7 (2) +0x5180| 08 00 | .. | length: 8 0x5182-0x5183.7 (2) +0x5180| 72 1d 05 00 24 66 e9 c8 | r...$f.. | value: "r\x1d\x05" 0x5184-0x518b.7 (8) + | | | padding: raw bits 0x518c-NA (0) + | | | [2]: option {} 0x518c-0x5197.7 (12) +0x5180| 03 00 | .. | code: "endtime" (3) 0x518c-0x518d.7 (2) +0x5180| 08 00| ..| length: 8 0x518e-0x518f.7 (2) +0x5190|72 1d 05 00 24 ed 8e c9 |r...$... | value: "r\x1d\x05" 0x5190-0x5197.7 (8) + | | | padding: raw bits 0x5198-NA (0) + | | | [3]: option {} 0x5198-0x51a3.7 (12) +0x5190| 04 00 | .. | code: "ifrecv" (4) 0x5198-0x5199.7 (2) +0x5190| 08 00 | .. | length: 8 0x519a-0x519b.7 (2) +0x5190| 04 00 00 00| ....| value: "\x04" 0x519c-0x51a3.7 (8) +0x51a0|00 00 00 00 |.... | + | | | padding: raw bits 0x51a4-NA (0) + | | | [4]: option {} 0x51a4-0x51af.7 (12) +0x51a0| 05 00 | .. | code: "ifdrop" (5) 0x51a4-0x51a5.7 (2) +0x51a0| 08 00 | .. | length: 8 0x51a6-0x51a7.7 (2) +0x51a0| 00 00 00 00 00 00 00 00| ........| value: "" 0x51a8-0x51af.7 (8) + | | | padding: raw bits 0x51b0-NA (0) + | | | [5]: option {} 0x51b0-0x51b3.7 (4) +0x51b0|00 00 |.. | code: "end" (0) (End of options) 0x51b0-0x51b1.7 (2) +0x51b0| 00 00 | .. | length: 0 0x51b2-0x51b3.7 (2) +0x51b0| 6c 00 00 00| | l...| | footer_length: 108 0x51b4-0x51b7.7 (4) diff --git a/format/pcap/testdata/many_interfaces.pcapng b/format/pcap/testdata/many_interfaces.pcapng new file mode 100644 index 0000000000000000000000000000000000000000..6fa742f47d820602f10f2c1007b5d5d67e75c0b3 GIT binary patch literal 20920 zcmeHv2Ur!$vhFN$Qpuo*Bqhg1mYfmENrIA*93&_iB`Hdhq=-sJl7NUr1q4Y7D1r!L zKoJlSksOuRO)$XT``r8P+xt83ey6qQ=~-*$ufM9gx@UT35$xJU5P=|wnmETk6sXrW z3ns#asF_>RYv|A$(DU(fgZ~1Y^cJ3Wj#l)10tx~`^sMscZfESAL5o{}o0kn7i-iav z@}5qvmgcVXeB69!Zt$hk8yj4_TsGF$d?zifh3HSZxj4}~nY(*fyK%u!;h_lB0pfdX z*6?f?2qt3f%!}ZIPjJ9~LWB%KY+c+v==ns^+cMET;-r$OhSh(3)*;xO5e7Eqn>J3~x_6zgoh!s7f^J>!vsj2L+VyXXr7eDcVqf$> zVc&JCoB7GnJNSMD~}rBo9#UQ-956!1Lg==pg*LB?OOH0Hk5c`No=96U;2%5 zKN|EVlH&=RF@~zwMFbH6ESnijFeic25>PO~R0G9_38o#GVETb;=gehpW#xut?&fL^ z(;xU2#Dn(pgI@;);z|QtBd`r+8*Uw<>dXvdn>`BRl6)ijhWLViBCLT-7zCdYWEUZb zr+K))&(}h{_T!EAK3^;0+kwx*VO{oYv>4O@Z1!_}8<-F~1_&$=yQJ8@)fH?**WF*KEsPk6B^N zULn^H{oP*w{g`F4arhCl+w8@Ps6u-QkXWn2xLl8$^_U&gIEcalF}q%rlr(kRL2RD6 z{Ov)@R*b@0xu(%?y{;_+gBt87+c~oU?5%#f4I4p}H+|Le(^r7C0O@7@(9qytW8}Za z*<({(7$Z3X&aJwj4P_fHE28+M2|?IM!m)4Hw>^NIQPpj&2znrZcoJpZTX{p-hk>&y zch}t!liHVW%LBx`S-h`?GEC~|9t}Vy3h`G|rjb=; z)$lW>8^TA5la>?oc}|_pnZQ4y{3NbE6q78~Q}K&xgN!l9A8~yOFt_}=lWV*w@GMDg zEaVDt+gef8h`_}ZqM3x~gnYsJvGW0zq;ejQ)}GwDX(pM|Fxmf>b@+AC(c3{+3S_wV*}cd|3*<8tKW<ehI@&qeU|PC3A-{ZY7nX;elQp)vtE;1RoyL#8|ErI#-*W%qqaF5AGyz{- zBk9xIijA*LAU4pi(wX9Z#s-S-uX@3jk0KyNP+(jX6}Y$Bfo&+;`T&9$Z}z==0CRJ^ z0H{iOXr{POXe$5=QsrM_Zdm|)5g*q9n8w_}8Xg68*xolvTipL*tO)9b{7Wac__yHz z{z9!9pV2@0WAcfJVxoBkz-SFbn15&Q@Y=+^4wV1}+CUQJ(dq-Xq3p1Mb z8^q&&Mz6=qx()s{?xr13BpC=L!6^$aFqJq7l*Q(==HunX1Xtn!8|nmY0>^Gxpl(-* zLs~V!Hk2JPA(H?-L}Ko-Ws@XFU=uD(pVYpeHo>!Ww6k{ha2LX{adEM6v|bO)b>~4G zh$phnVFQoRJ*1Tiw4rRb1qy%D7Pvoc0TAchMN<3LZ9xQ1hWsfWFah>@$Pgn$xSL9$ z9P23R_%=gn6v0yQ|2VjSd_NQ&_;ce~FZS9ZS+C$sgU)Jrl-A_Rt zA+73wJ(L}OlBN`tMx=4jlh99)V)G$XHAe^cMQE>LjI}j|kKl>{3%eABiHVIu;Sn5V zzsvwX!&=WqTYdtexL#mf1owxus(==hZGK`!#HBwVh#-#6fpv4Pk6q1&Ob*O4Lopu-9x zJmB(g4M1H6gs2fp1R>k%Z`>RGjT;UGRNzx4q;zyhW8bV3ueZse+>@MS33q3b`rel7 zx?i}IITMLfgnBR}@cvMX;KUWd`v*v6rUZqbn2}bl<;~ z6MEg3?>vg^0<6e!P&gnou`#hwSeTd~R4`B&n4mjjucr=vn7v4W5F@k*4W6xshbs@b zO^fI5YURzt&&`Kzi{|1Jz_3Mw+qoFv2m%mdSimOK2nAvY4*Q!5jIZsn>?$4lBbImc z8v*Hw^?pOMt>5r*bnwQUB}VBP4{pR6h+}8aXT*NS^6VxD*k4X4gtm5rHk2J0P10W= zhW3R&#Gpp$)q-IF_LnUTN=!_|2r$vd#MFB>w3cs`&aWjR85L0ptjBRWK}X z<_JB=`=?#6ZYl-sdQ>sA)f2R#?7*<`ONSV3Mt_JwO-z0b?{|zpAkJeYJ=Zv1bkym- zv}?R6%fTN1fyZV;!DKFk28xGCWZVHR)CY3^Rj&ZG(AG0xACw(>**&6xdWF2(rdPu{ zcc2%$!wu%d0w5hE@O3m=UKb5c?2{I%N0( z9rgPTl3?5)dc|)XxSqEIfnFY<4P}R3CkHE_Ue*fR^jh4~Yr1-;UR;}J$M|}G+4nnR zBnb%(pv1Xl9M`6{Ca7F4XSMfum}O;k9bF3?sHn@2$(o&`F=F$T&GolG## zLY)-Ce%FbQeM={*)SWsV+B`ev<=L-=(y#3#&rYWSPON4 zx-4RCd>!gypdQ-V1KLow>w?u%u@CAJac-L~x?8%aC+*M$D|%BGtgD7AetlIP&274G z{W_~y6Q&&qBN~*ksA0>jkR=DJr#%=mmYZ1@xg@>fv;JIp%!dS93 zvwp0n?*1CdIRVmyjmQhG6Vj1-CI0wMg3l!cizGOYIZ_U z`#8!NuXl;P|3;1eRCIq$3v)T=eCBt1BD&l6?ox(+6}N4-Q|^EEao=|or=E%ANk6(G zZ#U0DInTB?r_kp01mfdMFY<(ot-cJMupP893Hp*c7)~tF_$m|cxTEN&aQ0vcU({on zY=b@DzJIz)9DXWF{be$i1@3!5kuhsVAcP;6?I53_ydtRi8A}c$Y$RB51 zKa5TdCz`=N?(VM1wa1x6S#e4E4$HXSF9|zQxc1Dej>$w0oFGnnZ8O5vO5f%9$mpAuW5aWG zyf8EUI+w(6&0OIWQiKU<5_WnX`pns$-X^^p6?0FuL+{+gFr^RX?9;G#mC-u0mkU+9hcGBd_p-=c zd+Lz&ErIlH^K9GgtY(&iJ_gUI>sK)3eM)XSEmIMw$F<(inBgZ1BfD96QpfI-YxotM z*buLYzP^`8kdg!Dx9UUfVu?3wgoX7NOHMpW=zlxrkc)TX;f$N-s7{)U=cwUaOsi~R z8LLlub~MLnPN9O#Z+wJ*EqUJ7*&oVy6^NOO*gq~Z^&K4{iWTeSrhxtzw9jbQpEgnGFAJW_`U49 z3re`BKiGdrzyFwQ7ukK>OJ}0LRA*PdwNfkjI9+jgcGM^>knCD~YowS4udv(um%+X2 zUii|ikI3aL_+ zb`N?3Q)S7&;y5NpNVYz{l{0e{16c&AGySLo@8Kx3!kmB$8N z&Neb$$qarYp@)O_C6p$wXrdNS5EUUfYC#zK*D z1*dM=9drGj9=EOn3O!16>_~H~`Q?!>VsDeKuX3Hl>reh3ylD90L3a~dV)C3uR};VZ zE|oIhTD9(}BUSml0hvP!UoB}v79USb=NC|vr*NVA35C|)Vtln_j|zHc$gRjuxOhoH zQeHeUUovs5GFFjJw4uuQ9-j-q^c za<=Fqiu2|e1E>6xw4(tXOJ&Qaj6#ng*xXH(FGPI^e20kG$PQpy22s$Chnz8@F?Tvo zbBk8H~BWtHQq5f4ine!v5@iR|Kq3Xyxw7daL}B`op9U&%l9pp-U_dt8e!wYz>X8DqjN z1Qf##;EE;V1|%t`pWhmTE^IP^V~{-1#TK-o?9jzXdTm{o!QXWWIkcq<>g^9*qPFbB zuz7aO2gJ8B)%{sZRrE4M`>pQ!6iR&LULB7**$DBs$3!yFRrwBjgakAW;OUd_nV^39Z2Pe#6KEuW; z?z_O{FE)4W*q5ql(>FJ!=I+p-s&+rPyX7-Yj1Bj~*x|zoYvl!PDBEKPgHZ;2Q4mLK z-?rE}x)nQ);96kwIwNT_c2J|6v4i!LR%0;e8g9tVc^Aj)v(t=?BwgZVvL`E4ZA0T; zJpZUdHT#ee&(G?~fS}1+|7YV%qcaie*N29SBzcahQLj>WUX+k`8L{_f5Q#my-LH`wv5u3^jOR>cJ13|W55@-?`0f^O+%ZPfVAb8+QH)RVRv( z{RE?H=)b4Z1G>j+*#{nc7DgK zMR8O0KuC+))$Rdio1)Y}Ly3{wdWR{pqn0F$-F0t-SEngqo1<*-jOFhXSS+DTiX)ub zG@T{yDAWseiY)HymmZBhmM%p{t|%~=y!)EoxO%<&+k~o*q+B0P_i(YBK8aX@aRhU~ zuW>B^;>i~5gR(uI5F;7XdMTlX#cEzHO3+Xg#p2bw9%Q#|=iz4QQdTh^)u0S7Iupi2f{w`2X3j2F3 z?eG0vXt$hhm?+38h`hv){vHZ)Be-gSIq|=TQFRSsM6It?L*5(r57#kF&l2xhli%bF z`te_2`28i1q;QB)l>G-hA_2yCx$!^a0c{2g^xbQMpT65+D~rfW5Tp9^A7W4wBT{BR zFv6g%U~c^3yF|^zN#fa>(bRZT+?va6Rt zNCor(Z7AFI!M1p>g@F6#=~-L)EXSa#vDFV8+oh}`q4!9%olJ`tEr=qV6COHUXnIpx z(1jnBibAmDlvOq09X(AMc_bNh3mx?%NFl6sk0PHyt*@Ysd&aKD1Cz6iKADyJxSOdQlYpq2(T z*MG{ts|Ehx=5eV_Y8yX&!?Nm^S_AQLG_~RPnvh8HO5^)O3n4B=EZ6;?t5R?~yS!zP zdLiUScDwtY%w&B`q4O!XuI%%dY8kDpr8dp3+PHr?zv8=qSnAf=6|&c?7`oz1(O4UU2u8pVyG#OLJX($3pqVE81V0T<~D` zG7#hyg?AATfbCCviLP*}u(ijReHLG<$GPz;FyM(<$?aFO!J0-?(pt=*3m|gf5ekm? z=k}gGQkz4n^i56n@(`Xhp>IrXq4zl5djw&BiznokTd-z;-lx*@Da7MWq{i)${EwWM zEKd^;WVKW%ygOtyNQ{SX#bH7fW8X(ky_9@mC73vU@nZk0C}++X*IQ?=k5Hf_-FjBS z3;6}!4N-a15D`qr7hYMZnW2akOz0gaWb2Vww!b*@F0$xs`Y=uwi^ovK9I2hSllYV+ zQoN{WAFk5ZeLX|Ms7RORxT{Ata?tGnLFt6@sJ!CQ$xU{tFg>c^Hm! zuAAS5txTsskW_?g~QK&Unl$Znu96e z=h(etE+HVpx;~fKcC8l{$ob&#@a`Kf(ezm3|KYi?uizFwX|_ zl^4IvSC~UFOy>YEL%0?<57x(iS&MrFaKit5E$$P*k_EU>wvT6sfKes1-xTUd z0p2{Ai|nleD|{Q*P_e;ae0}tjk2vh3pg=y(U&34Aivdu!W1xs!_dtwZe`#jy}wF!)^XT{d~)J2B^EyNUt4QK zfFJ(lS{rzj?*HAom8T{^+`e{&K%2q%{&l{Q4s7@5^Nq(~=|Y;M^2a^pjrm5x=x_54 z4E7*@v+ok0meZZ--TpJ*_;($t|99y1pZUgr<{Kb|{jVrn^NnA}f9=WeRyn{9%J#7g z5i|l9m(nD{mT)Y)UGFW_%mto7WC)7iKX6Qz!yvFx>OP5qpEQ{l)r&i1-GP=7kAGad z|C;j?r+?=B?Q;xlizF~a2$IaT{2c$6W3bit$0DfcXH`KmJVX8ay7EkjO)DbzxJB+7 z%bhPEoZwHC#!q`ed4*?b#Mm2SXzxCq)YIwj!u!ItCL2-X`~v~PPhUCuvSb8UJASh7 z#xH(o;yP3+bH(Q3rD`_ZclaD7#iSBrkGdsT8rXv4y5vnN3_~aLBE?-^GaU>FGOb&V z7k=XOoK&eRDH!h{`e1|o4eBhPGQ%QOmhluMW9jmO1bGQNng4|ql^gQvw*xMX>bnfg z%o(TftA%H(Mhn#veP9mF#Hm^JC!6QLrs3Y<`Y~5fW>;Kf?QBA9ZtJ->++le_Co8*o z3t6;6FGWb}nVL*z+ImdT5R(UlNQh$nXl?;xW1UBGVD6F|KgXB*~~zt@~^b_ zUL|_H>t`Fj;Z3ppYR;fXtNM9PY=6wW^}O9Yuh6SYVTW6vFCk>LhkN{Ncv!|8^^Ojl zR6YAZgT`Fee^4z`=Ii3{xwb0%)X$>0-4i;cI<5wDVUx>GtBy05i8E*}%bO2Njfq?y z?d@MB@(-bV=C3`e{G9R~qlv_zIJ;3{q{#D^PTykLhRH&|OVVddGBxhm`-*v%I6mC% zk+{C`$sV1YT?+D9OP5IV-DJjxv12NUTGFVTvI87cTylo5f5!LjlDwlM)Z#3n$BlF1 zDpq@eG*?L-$wSnb-gzx;rq*u?u2fW$dtOlL(f4cTym`|)zwf-wr)$@;-h|~%oNPVj zm)*NqD@nHtdmxsR2J^iaGp#bttHvV-ERL)>o*pZCz@B>mm#=LyN|g6#MfX>+DTk7j zT=}^0XGff$V8?2U6?r}M@!3{HEEf^M%LN&pw{fO|y{%%;<|@Cz+%kU%cmg z=xYV@y-$AGnH{6S^PeY*Kg-xJR~2@HA%xzDPr%{ zIjtKb{Jn%XnqY*VxrgcHE&Y;{#StSFOT$7qiF;aGy9*sp&GiasQN72LSEH(tax?WR zW3I7AwRy^aqaY-;>T);K=_|pp^it6UkGN$pS|fFzxv)_)j#OBX+hzSQ>k z3fGfYVueyTh?qf^e24LBmOU}^@SK8c%A{3hB$ZB(*~7Fqq50!a32`_qIV)=ZD;xptEf#W>8Hp=K7+2I>s-aViI* zuL|9j9(}j)zOJ*ad!mCeA?}>1U{bDctr?fanO8ls*oIF(^m0G68cy3yN6TT^>N*r_ zUeS13cD!!D+e`m)*8!o_h<5z){-tL4tK_d5vJenaJq=JT-q)=(ByF9{J&ZlRZ$?`F({@ z6^EliGvEAa-E>yS1FcLqK`qDfE1}9I=@ye#W0~i2n^L2lbg(;}jta67PwHX3e8O{v zZqR@&K-gc=ZSkGcw10$HAL(^VvStsm(PWCM==dkW$VlAr{f7;?4p>#cU3uKU5Z2ih z`;heruBL{oGJ!;7OM}r9xkG#vR(-No<+Vh%6m%#6y&H1kgQ9v286j9MxnbGU;eqN3`u2SfYh+OlUV z(To@FmF1>-2RainLE?q{I+amtJd<0v*-Tw^SZsANf`J?cDI-PdtHKTGe$`e6tEoh1 zP0qE4n0Zuk7!|XWKD;;dMCk5`_s?CtqbN?P)U&^BRft3n9R8%4)liCx&C<8t!@@3O z-M6;*=G<cfS{LtIDds%G|? zqmp$jdmEFJX?WEY5|fd~X`ij?*Y>j#aRu(1d0g}Ad9fOgLJRbvJ~iB;-)?mHV2j8|dNm14G3a0-R+So1RK8KE^MV-^g=o^*bgt55L0aGBM;y?OWdzPorc znDveVY)mS{%KJ=5PBE2ul^9+P@yjh9?wxS?c0RQ)>qfFOuH6J#x7Q^fe%t7q5)q1t zxCN}0S}k+>ohu&$6HU7auX0DGF)Zessbo0*!P%|lMfFHLsR|lH?a7^~kfpVoi;4E{ zGE}`zL{4Q(PvM$$*SuL^k}J>1?U$j-Z@{`3xHq+(j#|oHnf?W;zWu@VUF|o=C4EHr zR2)wXzTPLx)H#Kd9yoa^P?5pyW=#A1@h058z34~pCl*8xkMqxYWPCZ!bS$cPv`e5< z$U$&V`pT>6N1{PBwELe1%@jI{4BK(9Oz2yxb72YivB@8HmJ4v2z#Ms#M0dxbDtp%k|;r` zk){d5RpQ%g&wWjY`V~8~^^{8&^7dUhcBSc}k@(AdCqo{`E+03RvhX3&ds0_3eq;id z-tADFI~DW8J@|~8B;5DL6E)^BG=?u6vj3$2{@tfLgcYZQJeBs%S$;XORN}c*h^zI2 zpB|@8|8*(GQ;7tO*4V}}x0JKSl&YqxT4@oh!!9cjgN2C zZhi0Mc5R6ZgilVrJy4x9-aH^)_k_bCyDdn@pwW(VnfjyF=eWIJ9Tu-fE3JLGf9nhB zLxrf7*Y*}wqNg>U`p~GBQR>e*XUTboDe1jB;p1U8oZTc(l{YogONSO)DwGYlh;M6K zQ|-ORq3}g@H8&yV@cbMxPnW`h+*8!eXYg9Eht_zXo_l=foTBz!{{7+)7;W{Wr>}LB zZslY6%polBev^--q-wJ3Wg=i^f4P$a%-aa}n@?JZo(o|q#U z+IUCzFLT$%vxP4`eLp$)+~k5ID#&_rz%2v_AuXdW3tJ0V#av=VGO zH%PIz-x;NuwO>K1T$m~ghnR}woaDej_@OKFJ@ibt>DQG*&e3_(CLCp-sfvj894)SS zu`HV*UYzc4Ep%`oS~YE;vwKWwxcEI)jX}SMNhV*D`q4bGQ)v}ieZ1t{%Q`6W!j)5g zM*6L|T=X&Jt*`Rgr_Y)171r3(#JkFqW0tsjwqGwsGtbPFCV+Z%a4e!pN)$Cs8)7ER zS72$?mbdz5hNI03ua(wX$y4N>s z@kiqxw~s4UOUh3hWDy?j;;_#ueBLy?QD&9 ztVt89DqTCZ#JTryr{x9Fhb+g-muzjOI+RwL!+q*VIxA7kVPlC_xNq?rM{sZv<^Lv|uhK`?<{7be;Kc4W5%rvdd1L&fXQ<2$S1q0%x@y6*Kot{*w(^?i zQq0WfP+YdR^B%zqK8}B=_2m&Soy7{~7E|}4L^x?f@HGenmnDrE z5>?(}mZj?{g`^}k_3t~&&5tw_85c2i*b>>YjVMM5xxOjG$mtckFnHR#H#LApRny*! z`^#XUQgl`T+p)3lir=66PRrd|xNMnxxs!yk%6W#NN0n03;IQNU)8}u{_V(}n!cf35 z*}5c!=598fIHfh+DAG-!rrY0MJCzki$Ezlr7ts@FeZNCG>xq|E*@@R=0@!Es_-Lb! zeiFYHK~Wj_wkS?kI%4XBVCuyylFC_$hP{0b-$bViMtVbozs<+$(oug*jPMIwzR%30 zNqT*>Sv9Ts(Rn4a^U=MJ`W}qWHnCi}7RrJp`=IYZr`QO`6xm6gcr2cW?`U0~Mcq7} zhQZ?aY3=zOie^G~=;>~3Z-Y~r9n0?`vXtWTn{W9i%(0dQ7w|G0swf1VpCzKODTts$ zNbBjpolEIY8g(F=Y7Irnv6(NW?9=bA6HwRR-;l+cXtp}&SnDGB=zBusvNi2^_o$|a zOb^p&a$9|bW|(c~=+^?`Ui*7qK;JdGEtueiL2K6_bxDLuhfFj_M*7+ ze*e^EhrP*I>FB*3iIe-hIh}WmT*(p%$(BsA}XRVY*C9``vb)!E(Z5hL_uBd7Gn{K^j<{sO*B^Wg3P_lf+S*6dvRw~8y;Kv(QjEFzPy?u zk1hDH^7zu($D}t|JC~1DE$YXrd>^L}dZ?wftcQWw8R9{hS)8e+l2FDU!4%Wi%#afH z@s>j!w#!YwI;uAZIOtjD$L0LJZ@eea)VY@^9=P1+t1YZWcTUmCr*wIESI5xRJ%@9e zuFPsVA@|tVKImqbuFjfhZ;b)7Ug%f}ccdn+x{S`_R6b zp?tRcnbJ*-#9)q(3Z-#oA9KBLmhh}P%kVcD%M)$yJj`J!$uCWJD78MrWrp7 zBuXzLnSU|d!bW!Ko#Vu)2C6HD%kN6;s!P|BgF-<2QED3bzGll3yEwuj8g5qU92Ab2 zKy;STrI-T>tkjhBt|IZ`bMM)&A8UR0wau!*QznuiVMf2(YJc`qkw=5=ECW}*_nhD zNB1(R^6Pmo)Z<7WsyK*6aJtoqRYt!`KZ`nZnNR7lRc1xY-5X|ji##SbpFKVsiP@9# z=ozEXSp^ro3j^dh}h;3qO8e1wjCX$VBifNUIM_@SU&B7?vpqGsQYH1gbaIe|hy<8Ki zHp_O`5*rimAL!e&r@qXwIU&+wNR8*sUf(Y9g8q*3u~%XSg{Xw6ciySm+(X8m38V^6 z4-egt73-c(x>QEKKNj7WG9OT6(3_kwjorPdc27R2GKPYK8?iZ#J=`ji`2Lpo!;JSr zEkXANDzz0GE<5Vn&QN9umuj}_%Eh9@r9cReoi{cn@A-adD4JLx!w%1uM<`E|)cpBq zvFydShk4Qd6v1BfFxKH56r*jG_x9rxvcv1lbpkyu^4|0!xv%}CbEK^(|GcwDb;6$>D>jJYVLANtCj745*VS# z)Tc+5+u~U86_@zi&6s}d32VzEsm70XnV+=e<1?FCCeCF{5Xc{+Y!oL>6a0{>l&VMi z$v|{}YpJN&aE8{jW$h=+lp^`PD!U5QcDss1`MjD*;b*RS&Uz`F#p&caH!Q%V7YGX3 zi@+=B&GiFr$6w!e+x#59)&28TSMK#!UAZ@2bp^+hAdtE3)(=QHS*$M;qrd|N@J_6q zxfPn<9WAu}qAVKx@)vwhcJp8qLWjU#BKZBqYwpb#uh-wV1Lr4#=SOY5a*P7+r@>#x zv2b%Sx3UC3L