No.

Time
Source
Destination
Protocol
Length Info
1 0.000000000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http→49
574 [ACK] Seq=1 Ack
=1 Win=46 Len=1260
Frame 1: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.049930000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.049930000 s
econds
[Time delta fro
m previous captured
frame: 0.000000000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00000000
0 seconds]
[Time since ref
erence or first fra
me: 0.000000000 sec
onds]
Frame Number: 1
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9

0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf174 (61812)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab6 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 1, Ack: 1, Le
n: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 1261 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi

ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x194
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 74 4
0 00 31 06 3a b6 4a
7c 0c 8a c0 a8 .
..t@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 62 2e 9e
87 4e aa 50 10 .
..P..+.b...N.P.
0030 00 2e 19 44 0
0 00 30 82 03 17 4c
37 01 53 d4 2a .
..D..0...L7.S.*
0040 30 70 01 01 6
9 f6 a0 3d 4c f1 22
80 90 aa 44 94 0
p..i..=L."...D.
0050 26 1e 43 06 8
d 17 23 b0 8c 16 23
0c b9 bb 65 83 &
.C...#...#...e.
0060 66 ce 54 44 2
b 6f 40 bd e0 88 2d
61 5e c5 f4 6a f
.TD+o@...-a^..j

0070 a9 b5 14 47 b
a b2 dd a3 2f 6b ab
54 df 0e dc 57 .
..G..../k.T...W
0080 16 c1 fc e5 7
c b6 eb bc b7 86 cb
b9 22 ff fb 92 .
...|......."...
0090 04 e9 8f f2 f
b 29 51 83 79 62 60
60 c4 9a 00 6f .
....)Q.yb``...o
00a0 2f 4a 0b d8 a
5 46 0d e1 e9 81 71
92 68 01 ac 3d /
J...F....q.h..=
00b0 28 6e f0 af 4
b bf 7b ba 36 af ce
6c d0 64 16 1b (
n..K.{.6..l.d..
00c0 be 80 71 c0 2
7 40 02 07 70 ca 28
29 21 20 ad 24 .
.q.'@..p.()! .$
00d0 2d 10 90 41 8
0 30 50 7e 2c 9e a4
4e 5f 75 d8 50 ..A.0P~,..N_u.P
00e0 42 89 39 19 7
3 54 8a bd 72 c8 26
99 ad b4 3d 20 B
.9.sT..r.&...=
00f0 51 0a f2 4e 9
3 4c 9c ab 6f d1 28
52 a5 da 7e 35 Q
..N.L..o.(R..~5
0100 8b 05 70 a4 6
0 6e 7d b8 6c 17 a2
99 8b 39 5d ea .
.p.`n}.l....9].
0110 cf 37 ab 6b 1
2 38 a6 92 4e 9a 9c
b3 46 b0 a1 40 .
7.k.8..N...F..@
0120 84 84 d9 86 0
e 10 fc 0a 1c 64 a1
87 9c 66 c1 5a .
........d...f.Z
0130 c0 8c 7c 18 f
1 61 a5 24 0f 3a b2
59 f4 ba 1a 64 .
.|..a.$.:.Y...d
0140 f4 9d 65 38 d
f a6 94 de 88 3e f1
96 d1 6a 52 c2 .
.e8.....>...jR.
0150 4b 00 82 6c 4
6 b2 e3 0c d2 f8 5b
de 54 33 74 89 K
..lF.....[.T3t.
0160 d3 77 ef 18 1
c a3 6d 70 8d 8f b6
c9 af 55 8a d2 .
w....mp.....U..
0170 4b 55 af 7a c
4 7b 45 8d 95 fc ba
0c 44 23 2f 3d K
U.z.{E.....D#/=
0180 25 cc 41 03 7

2 38 4d fa 38 39 26
04 18 a8 40 2d %
.A.r8M.89&...@0190 08 ba 3b 4c e
1 30 c0 77 5e 66 ec
93 71 95 33 5e .
.;L.0.w^f..q.3^
01a0 31 27 fe 92 0
6 94 da b2 dc 61 29
e3 3d 37 0f d7 1
'.......a).=7..
01b0 30 f8 7e c9 5
3 a9 aa 01 e5 ee a1
fe 3a 76 7d c0 0
.~.S.......:v}.
01c0 78 a2 73 ba e
1 53 26 db 33 ba 6b
d3 5f 70 cd 38 x
.s..S&.3.k._p.8
01d0 6d 65 1c c5 3
5 3d 3a aa 0b 91 16
16 1c dc e8 85 m
e..5=:.........
01e0 95 8d 1d 39 6
2 10 d1 d4 5a 22 44
5f a0 ae 54 64 .
..9b...Z"D_..Td
01f0 ad 0d 9d 48 6
e 21 0f 17 0c 8c 92
38 ab 1b 55 4b .
..Hn!.....8..UK
0200 a8 2a 38 ed 4
c 4d 24 61 b0 dc f7
ba 8d ae ba 37 .
*8.LM$a.......7
0210 ae 8d f4 db 7
b b5 04 ba 09 4e 7e
6d cf 53 85 a3 .
...{....N~m.S..
0220 7f aa 9b 6c e
8 9c a0 00 e1 08 62
51 d2 87 04 ff .
..l......bQ....
0230 fb 92 04 ea 8
f f3 17 29 51 03 79
7a 60 60 a4 b9 .
......)Q.yz``..
0240 f0 6b 4f 4a 0
b b8 a7 46 0d e1 e9
81 70 12 e8 01 .
kOJ...F....p...
0250 ac 3d 28 0e 9
4 7f 5a 9d fc b8 25
e7 5b 9a c6 de .
=(...Z...%.[...
0260 8a 84 04 81 4
0 20 e2 5c 54 0c 51
60 20 0b 95 1a .
...@ .\T.Q` ...
0270 3c 85 b3 3f 4
8 3a 70 6c 69 68 4e
28 ce 84 21 91 <
..?H:plihN(..!.
0280 20 e0 df 19 1
1 01 0b 12 c4 70 fd
7c d9 ca 1f b6
........p.|....
0290 bc ee 36 cc d
1 c0 bd 7c 7f 03 89

31 65 af 7b 36 .
.6....|...1e.{6
02a0 be ff 3a da f
7 ff 39 b7 eb f3 34
a3 8b 0c 43 87 .
.:...9...4...C.
02b0 11 58 e0 c0 2
0 18 4c 89 4f 77 a7
fd 02 3a c5 4a .
X.. .L.Ow...:.J
02c0 34 41 37 48 6
9 8d 24 4b 05 61 7d
fc 59 1c 55 e7 4
A7Hi.$K.a}.Y.U.
02d0 e3 04 35 1a 7
d 54 ab 3b 17 29 06
36 49 f2 e6 da .
.5.}T.;.).6I...
02e0 a4 a4 78 aa 2
5 c2 85 f1 14 97 47
09 c7 46 c8 a0 .
.x.%.....G..F..
02f0 38 49 cd 0d 7
e 49 bc 1d b8 f1 7e
1d e5 9e 7d 3f 8
I..~I....~...}?
0300 a6 7d 77 fd c
e ed 34 07 3c c6 6e
6e 58 62 27 1d .
}w...4.<.nnXb'.
0310 a8 5a 92 68 d
9 e8 72 1d ed 59 04
be b7 e8 11 c6 .
Z.h..r..Y......
0320 55 29 1c 98 1
b 38 50 57 42 05 8e
e0 22 bc 74 16 U
)...8PWB...".t.
0330 18 1f 93 c9 6
8 cb 60 e2 51 e1 7a
86 e4 fd b3 86 .
...h.`.Q.z.....
0340 1e c8 98 80 4
a 8a 2d 3e 4b 15 cb
66 68 58 34 55 .
...J.->K..fhX4U
0350 aa 85 4f c5 b
b 82 c6 84 87 c1 70
98 54 3c 70 d9 .
.O.......p.T<p.
0360 50 ab 56 c0 0
d 2c 51 ca 9d bd 2e
ce 7e 2c df 57 P
.V..,Q.....~,.W
0370 ee d6 fc e1 9
f ea 04 2c 0b 20 13
c5 90 dd d9 21 .
......,. .....!
0380 11 e0 c9 f7 6
0 1f 98 cb 2b 13 1c
14 c0 9a cd 18 .
...`...+.......
0390 34 46 c1 9d 6
1 2f a6 81 1d 24 60
b2 05 e3 61 6f 4
F..a/...$`...ao
03a0 6f 25 4c c5 6
4 6f ff 79 56 77 fa
fc 12 6b ff ff o

%L.do.yVw...k..
03b0 f5 d1 8e 0d 9
b e8 17 9f c8 d7 2f
12 33 8c 9f a9 .
........./.3...
03c0 ea a3 b8 11 7
e cb 96 56 27 3a f4
bf bf b6 bc 77 .
...~..V':.....w
03d0 04 ff fb 92 0
4 ea 8f f2 ed 29 d4
83 4f 4a 60 62 .
........)..OJ`b
03e0 c5 8a 70 61 e
c 4c 0c 34 b5 5a 0c
bc c9 81 60 0f .
.pa.L.4.Z....`.
03f0 ab 41 96 25 2
8 ee d4 b7 41 0c fa
b0 21 60 d6 22 .
A.%(...A...!`."
0400 bc ae 05 7f a
f 47 33 81 0e 43 e8
0f 3c c9 e5 a8 .
....G3..C..<...
0410 44 6e 2d b8 7
4 9c b0 cf d6 09 d1
a2 09 61 68 16 D
n-.t........ah.
0420 00 2f 1b 0b 7
b 34 d2 a5 50 76 7d
fe 77 98 1d 39 .
/..{4..Pv}.w..9
0430 fd 7a 0e ef f
f ff dd 3f a7 07 33
94 f9 fc 54 a5 .
z.....?..3...T.
0440 3d 22 74 99 9
6 8e 5d 52 0f 71 f7
1e a9 99 bb c3 =
"t...]R.q......
0450 a7 bf 5f fd f
b dc ae 78 6a fc 11
b4 8c 88 89 09 .
._....xj.......
0460 4f 24 02 b5 a
7 e4 bf 14 33 ef bb
61 c4 1d b6 bb O
$......3..a....
0470 86 93 4e 86 d
a 36 17 35 29 6c 40
64 d5 ea db 7c .
.N..6.5)l@d...|
0480 b4 c1 96 d9 b
9 c3 6a 7f a9 cb a6
df 9f c9 0a 11 .
.....j.........
0490 a9 7f 0a 11 7
4 d8 de 27 0b e1 99
d9 50 e9 ff ca .
...t..'....P...
04a0 7b 0a b4 9b d
8 3e 17 ee 1e ef b2
ad 5e 44 bb 46 {
....>......^D.F
04b0 c6 1f 54 fd 9
5 11 37 1d e4 9b 10
31 d8 45 75 af .
.T...7....1.Eu.

04c0 c4 a0 91 4d f
2 9a ed 80 39 06 35
d6 49 35 0e 67 .
..M....9.5.I5.g
04d0 9d 3a 1c b4 5
0 d9 75 78 d7 f8 cd
ef c7 8f 79 b5 .
:..P.ux......y.
04e0 bb bc a2 9f e
1 ab c5 d2 33 94 3c
a3 6b 08 d4 bf .
.......3.<.k...
04f0 9a 11 6a 6c 6
f 39 af c3 1d aa 64
6e 71 27 dd 69 .
.jlo9....dnq'.i
0500 d8 f5 cf 4b a
a 65 89 ae c5 4f 91
7c 9f 2a ca b0 .
..K.e...O.|.*..
0510 28 ff 52 7b 2
c 38 24 8d 65 8b f5
9a 0e 3b 71 35 (
.R{,8$.e....;q5
0520 80 fa
.
.
No. Time
Source
Destination
Protocol
Length Info
2 0.000173000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574→h
ttp [ACK] Seq=1 Ack
=1261 Win=39802 Len
=0
Frame 2: 54 bytes o
n wire (432 bits),
54 bytes captured (
432 bits) on interf
ace 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.050103000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.050103000 s
econds
[Time delta fro
m previous captured
frame: 0.000173000
seconds]

[Time delta fro
m previous displaye
d frame: 0.00017300
0 seconds]
[Time since ref
erence or first fra
me: 0.000173000 sec
onds]
Frame Number: 2
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124

-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f16 (20246)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 1261,
Len: 0
Source Port: 49
574 (49574)
Destination Por

t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 1261 (re
lative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39802
[Calculated win
dow size: 39802]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 1]
[The RTT to
ACK the segment wa
s: 0.000173000 seco
nds]

0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 16 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 67 1a 50 10 .
....P..N.+.g.P.
0030 9b 7a 18 d4 0
0 00
.
z....
No. Time
Source
Destination
Protocol
Length Info
3 0.070998000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http→49
574 [ACK] Seq=1261
Ack=1 Win=46 Len=12
60
Frame 3: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.120928000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.120928000 s
econds
[Time delta fro
m previous captured
frame: 0.070825000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07082500
0 seconds]
[Time since ref
erence or first fra
me: 0.070998000 sec
onds]
Frame Number: 3
Frame Length: 1
314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: Not-

ECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf175 (61813)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab5 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 1261, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 1261 (relative
sequence number)
[Next sequence

number: 2521 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x434
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 75 4
0 00 31 06 3a b5 4a
7c 0c 8a c0 a8 .
..u@.1.:.J|....
0020 01 0b 00 50 c

1 a6 2b c8 67 1a 9e
87 4e aa 50 10 .
..P..+.g...N.P.
0030 00 2e 43 47 0
0 00 90 30 2b 83 d6
db c6 59 8e 52 .
.CG...0+....Y.R
0040 21 94 18 b9 1
0 af ab 34 39 50 7d
45 a1 e5 d8 27 !
......49P}E...'
0050 94 42 f3 d9 3
a 3f f4 b6 ed 43 53
e1 9a da 21 3f .
B..:?...CS...!?
0060 b0 88 b2 ad 1
8 dc ac 02 38 d2 d5
fe 64 de 57 63 .
.......8...d.Wc
0070 51 3f 7e 33 6
b 4c 98 56 20 bc 2a
88 a1 48 49 51 Q
?~3kL.V .*..HIQ
0080 62 87 f8 73 2
3 5b 57 ff fb 92 04
ec 8f f3 0d 20 b
..s#[W........
0090 57 83 09 32 5
2 61 83 fa e0 61 86
4a 4b 9d 0b 60 W
..2Ra...a.JK..`
00a0 0c 20 6b 89 8
6 2a ab 81 83 0d 79
85 06 f8 d7 7b .
k..*....y....{
00b0 68 ba 4b e9 3
7 c6 8a 1a 89 6f 80
b3 dd 76 14 98 h
.K.7....o...v..
00c0 f1 e9 3b 35 7
8 eb f0 90 21 07 90
2f bb 9a 85 30 .
.;5x...!../...0
00d0 8d 14 78 f2 c
d 83 da 4b c6 1a bc
70 6d db 62 fc .
.x....K...pm.b.
00e0 33 5b 49 3f b
3 22 3e c8 c6 e5 76
38 72 d5 e6 dd 3
[I?.">...v8r...
00f0 63 ed 2f a5 f
f c3 f5 f2 63 55 fe
1d 26 e1 fc 30 c
./.....cU..&..0
0100 a8 bf 17 1d a
3 6d e6 fa 69 5d 0a
6a 06 fc cf f9 .
....m..i].j....
0110 7b d0 66 e6 3
e 20 50 c0 f7 03 a8
42 c3 50 87 da {
.f.> P....B.P..
0120 38 40 00 0f d
7 3d 65 5e 3d c9 a4
44 5a 41 c9 8a 8
@...=e^=..DZA..
0130 ec 15 48 b2 b
7 ae 5c d9 cd 43 f2

c9 09 24 e2 43 .
.H...\..C...$.C
0140 e2 d4 8c c9 d
7 22 9b dc 87 32 b2
9c ae 83 6a d9 .
...."...2....j.
0150 cb db b6 dd 9
c c2 26 92 6d 00 65
3e b3 22 cb 95 .
.....&.m.e>."..
0160 9e b6 e1 4c f
5 e9 a6 7a f6 59 d4
f5 f1 40 b7 a5 .
..L...z.Y...@..
0170 4d 45 c2 2e a
9 9c 31 50 22 df b7
66 29 14 50 b9 M
E....1P"..f).P.
0180 22 52 b0 8e f
1 a8 f1 32 a4 55 37
46 64 68 6f 58 "
R.....2.U7FdhoX
0190 86 a5 83 05 0
2 86 0a 21 93 a0 0c
2a 95 ca d9 44 .
......!...*...D
01a0 55 7b 9c 7e 4
d 88 7b 69 06 e6 c3
dc a3 e3 24 84 U
{.~M.{i......$.
01b0 c1 c7 02 a5 e
3 58 1d a8 3c 3d 8d
57 5d 10 e4 b5 .
....X..<=.W]...
01c0 52 37 96 a6 b
b eb 87 7e 3f fd 15
34 4a 8e a8 83 R
7.....~?..4J...
01d0 59 a4 e5 36 5
4 c3 c5 ce 0b b6 24
b1 50 8d 54 9d Y
..6T.....$.P.T.
01e0 47 e6 31 cc b
4 49 51 8e 06 0c ed
eb 9c 56 56 5b G
.1..IQ......VV[
01f0 1f eb a1 e2 c
a 44 27 4e b1 03 6a
f0 0e 16 f6 de .
....D'N..j.....
0200 a2 a0 e4 73 8
c 3d c4 59 1a e3 68
7d 04 c2 8c ca .
..s.=.Y..h}....
0210 f0 22 f7 2d 3
1 2a a7 54 af 3b ed
55 f3 1f 13 53 .
".-1*.T.;.U...S
0220 9b 8d b8 71 5
0 b4 d8 d7 16 ff fb
92 04 ea 8f f3 .
..qP...........
0230 1f 3c d6 03 0
9 1a e2 59 a8 ba c0
61 03 5c 4b 80 .
<.....Y...a.\K.
0240 99 52 0c bd 6
9 41 73 92 6a 01 97
a5 28 14 38 e2 .

R..iAs.j...(.8.
0250 0f a4 ba 6a b
f d4 65 88 01 c3 18
95 2a 90 14 c0 .
..j..e.....*...
0260 0c 35 34 94 5
a 0b 63 49 49 68 3b
a7 40 07 49 85 .
54.Z.cIIh;.@.I.
0270 51 35 e2 79 6
1 68 f0 f1 65 6c 22
41 37 5b 44 7f Q
5.yah..el"A7[D.
0280 0a 13 cc 1e b
f 4a 9d 58 96 8a 1d
85 1c a6 39 07 .
....J.X......9.
0290 c0 60 81 9c 5
5 50 55 9e 65 17 78
db 75 3a cc cd .
`..UPU.e.x.u:..
02a0 af 45 65 8a c
6 dc 39 6a 52 40 52
c2 07 1d 20 fa .
Ee...9jR@R... .
02b0 d2 ab 50 f7 7
4 a0 c2 49 80 00 86
1c 32 0f 19 30 .
.P.t..I....2..0
02c0 b0 c4 d6 30 2
4 a7 11 74 0b 08 85
5e a4 73 83 a5 .
..0$..t...^.s..
02d0 f3 4f 6d 2d c
6 25 31 da 9a 8c 5a
b1 35 1f 85 3f .
Om-.%1...Z.5..?
02e0 6f a2 e0 a3 6
c aa 93 ad 85 9c 45
ab 46 3b bb 44 o
...l.....E.F;.D
02f0 38 41 50 41 a
8 b4 da 51 2b 19 96
5a 69 dd db ee 8
APA...Q+..Zi...
0300 7e ae 75 7b b
a 90 19 a1 15 31 43
83 29 69 e1 08 ~
.u{.....1C.)i..
0310 9b 29 62 8a c
f 7e dd da 4c 78 0c
a3 c8 19 43 91 .
)b..~..Lx....C.
0320 33 c3 73 20 8
e 4c 88 ca 94 db 29
48 c9 e2 b6 9e 3
.s .L....)H....
0330 63 ca 38 7a 9
4 8f dd 38 37 c3 7c
ac 69 e7 5c ad c
.8z...87.|.i.\.
0340 70 d4 ab 33 3
6 01 8c 42 96 89 78
2d 27 21 42 51 p
..36..B..x-'!BQ
0350 bc 55 b4 9b 6
e a6 9b 7a a4 1b fb
97 29 c7 64 d6 .
U..n..z....).d.

0360 ea d9 df 1e d
9 69 12 0b 1e 28 28
13 0e 95 55 48 .
....i...((...UH
0370 61 d6 11 87 e
4 25 5a 9f 45 ca 11
2d 31 60 0c f8 a
....%Z.E..-1`..
0380 63 30 5c e4 1
a 2f e9 ae 8e 98 10
a2 e3 0a 15 57 c
0\../.........W
0390 ac 1b a9 4f 1
e a7 fb 6c e7 b3 14
b2 5c a4 b6 6e .
..O...l....\..n
03a0 41 91 67 70 e
e 3c 27 39 05 ec 78
ea e4 2e 2a 9a A
.gp.<'9..x...*.
03b0 8f b4 cd 13 b
8 ee 15 15 f0 71 99
73 26 61 c0 dc .
........q.s&a..
03c0 ec 71 2f 8c 6
7 18 f0 6b 66 bf b8
ff fb 92 04 ee .
q/.g..kf.......
03d0 0f f3 37 33 5
2 83 4f 42 e0 5f e6
6a 60 69 85 5c .
.73R.OB._.j`i.\
03e0 0c 50 a9 4a 0
d e1 29 81 87 14 e9
01 97 a5 30 21 .
P.J..).......0!
03f0 54 0b 24 b1 f
9 76 30 51 cd b7 ee
32 29 c9 8a 38 T
.$..v0Q...2)..8
0400 54 50 e3 0d a
4 85 89 4a a6 d1 4d
9b 51 19 de d6 T
P.....J..M.Q...
0410 36 ea 4b f1 4
f 3f 8d ae da 91 2b
14 33 15 29 22 6
.K.O?....+.3.)"
0420 14 f3 cd a5 8
7 ea 9a 58 f7 4c f5
83 fe 69 62 e5 .
......X.L...ib.
0430 a7 ce d2 9d 4
7 89 eb e6 6e ca cc
6d 64 d9 f7 6e .
...G...n..md..n
0440 ee ed 62 9d a
f 7f 7e d7 62 7a 9e
5c 05 07 02 41 .
.b...~.bz.\...A
0450 40 44 5e 2a e
a ce de bb 19 fc c5
de 93 14 1e 12 @
D^*............
0460 62 34 b0 b3 6
b 06 33 61 93 2d 0b
38 30 e6 6f 16 b
4..k.3a.-.80.o.
0470 30 40 70 a1 9

9 d0 a0 e1 87 41 86
46 2d c6 da 9c 0
@p......A.F-...
0480 fc 45 d7 89 c
a ea 53 d4 88 40 90
ba 06 a3 59 45 .
E....S..@....YE
0490 29 73 36 36 0
d 6a 15 c3 f3 82 89
c1 94 b0 83 21 )
s66.j.........!
04a0 04 38 86 65 c
2 3b d5 9c 6a 18 7b
3b 5e 96 ab 93 .
8.e.;..j.{;^...
04b0 f8 aa 4c 58 a
4 a5 16 fd bd eb 33
c8 00 65 88 0d .
.LX......3..e..
04c0 9a e2 87 20 5
9 8d 36 9e a9 f2 f6
45 c0 da 57 09 .
.. Y.6....E..W.
04d0 0b 8a a9 e9 5
4 c7 10 bd 6d 12 cc
c2 91 74 f6 48 .
...T...m....t.H
04e0 a8 c2 f7 1e 1
d 1b 12 d3 dc aa 64
f6 2f 43 6a 2b .
.........d./Cj+
04f0 64 55 69 d3 c
8 5c 71 9a 9e c7 23
0f ba d8 e9 4a d
Ui..\q...#....J
0500 57 a6 97 ad b
9 cc 9b 4b 0f 34 31
11 53 43 d2 9f W
......K.41.SC..
0510 47 52 6d ff 4
3 17 a1 07 09 18 d8
a9 b4 a9 99 b9 G
Rm.C...........
0520 c1 ab
.
.
No. Time
Source
Destination
Protocol
Length Info
4 0.142005000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http→49
574 [ACK] Seq=2521
Ack=1 Win=46 Len=12
60
Frame 4: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0

(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.191935000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.191935000 s
econds
[Time delta fro
m previous captured
frame: 0.071007000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07100700
0 seconds]
[Time since ref
erence or first fra
me: 0.142005000 sec
onds]
Frame Number: 4
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco

m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf176 (61814)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab4 [validatio
n disabled]
[Good: Fals
e]
[Bad: False

]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 2521, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 2521 (relative
sequence number)
[Next sequence
number: 3781 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set

Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x05e
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 76 4
0 00 31 06 3a b4 4a
7c 0c 8a c0 a8 .
..v@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 6c 06 9e
87 4e aa 50 10 .
..P..+.l...N.P.
0030 00 2e 05 e8 0
0 00 8c ab 41 cf 1d
2a 46 0e 09 1a .
.......A..*F...
0040 02 21 58 44 4
5 5b d4 b3 c4 c5 c2
03 4b 47 19 fe .
!XDE[......KG..
0050 7b 1e 28 7a 2
f 23 b6 f5 be b3 89
f2 93 00 ca 3c {
.(z/#.........<
0060 eb b6 b3 6a 0
b 96 61 5f 56 6d 64
c5 a0 ca dd 9d .
..j..a_Vmd.....
0070 62 fa cb d5 9
8 98 fb cd 22 52 6f
34 4d e6 3f ac b
......."Ro4M.?.
0080 0d ff fb 92 0
4 e7 8f f2 ef 28 52
83 58 7a 50 60 .
........(R.XzP`
0090 a5 3a 30 67 0
c 4c 0b b0 a5 4a 0d
e1 29 81 73 14 .
:0g.L...J..).s.
00a0 e8 c1 a7 b1 3
0 3b bf 0f c5 b6 ae
bf a4 cb 00 d3 .
...0;..........
00b0 9c ed 24 33 0
3 8d 33 7c c6 94 ec
b8 b0 d8 0d 87 .
.$3..3|........

00c0 98 83 93 75 d
a 1c 35 54 07 3a a5
70 6c 37 30 31 .
..u..5T.:.pl701
00d0 3b 5f 91 91 4
e b3 1e 58 42 ec 85
cf 19 ac f0 71 ;
_..N..XB......q
00e0 c6 ad 1e 6a 4
4 89 1a f0 5e b7 53
1b 8f bc b5 ac .
..jD...^.S.....
00f0 c4 a6 37 ed 3
6 08 84 c0 87 c6 a6
35 a6 e9 03 bd .
.7.6......5....
0100 a4 54 b5 53 9
2 bb d0 a2 26 24 4e
63 6d 26 b6 8e .
T.S....&$Ncm&..
0110 77 83 c4 24 0
3 cc 66 eb 16 af a0
d0 0a 58 8f 92 w
..$..f......X..
0120 c2 d8 23 50 5
e 12 d8 cb 25 d7 c6
67 b2 a5 59 1b .
.#P^...%..g..Y.
0130 64 a4 d6 90 5
9 c6 6b d2 78 07 b9
6c 41 12 e4 25 d
...Y.k.x..lA..%
0140 69 25 ba 16 4
b 7f 8d 13 2a 89 d4
cc 57 e8 11 e6 i
%..K...*...W...
0150 73 4e b1 59 4
7 34 47 d2 ed ea c2
99 00 0b 8a 98 s
N.YG4G.........
0160 13 3c da 2a 4
6 14 4b 58 82 7c f5
be ae dd 26 50 .
<.*F.KX.|....&P
0170 99 93 d2 72 4
2 17 70 c6 a2 31 07
44 8a 17 94 38 .
..rB.p..1.D...8
0180 83 28 21 62 1
0 8e 05 1c 9f 82 10
25 7b ed 02 95 .
(!b.......%{...
0190 96 ba 55 38 2
e c3 ba d0 65 f3 2d
76 cc 30 23 28 .
.U8....e.-v.0#(
01a0 2d 8e a3 b2 e
9 2b 89 77 31 8d ce
db c4 ae 78 a4 ....+.w1.....x.
01b0 58 62 27 6c d
3 dd 50 8e bb 36 e7
ab bd 3f 5e d8 X
b'l..P..6...?^.
01c0 b4 a9 90 d1 5
1 08 06 38 71 8d 0e
8e 36 bc ef b1 .
...Q..8q...6...
01d0 bf d0 0b 14 1

8 3b 08 e1 a0 7d 89
c3 0a 8d 0b 98 .
....;...}......
01e0 45 42 ab bb 0
6 3c 38 01 aa 48 a3
b3 7d 37 1c a2 E
B...<8..H..}7..
01f0 96 55 8d 4d 5
5 99 80 e9 a7 a3 14
8c 62 9d c3 61 .
U.MU.......b..a
0200 29 e1 83 c6 3
c 6b cb 04 d0 41 d2
f6 23 f7 af 10 )
...<k...A..#...
0210 ed 37 54 ca c
c 70 eb af 9c 65 2c
41 7e ac 55 72 .
7T..p...e,A~.Ur
0220 ba 5d 5f ff f
b 92 04 ea 0f f2 ee
28 d2 83 78 7a .
]_........(..xz
0230 50 5b a4 6a 3
0 65 ef 4a 0c c0 a5
46 0d bd 89 81 P
[.j0e.J...F....
0240 8e 13 a8 81 a
c 31 28 28 5b 3c a7
f3 b7 ad 11 76 .
....1(([<.....v
0250 8e 17 7f df d
9 50 52 41 95 3e 0e
f6 6c 0f 1c 63 .
....PRA.>..l..c
0260 a7 6c 50 91 2
9 d1 e1 2c b9 5d 14
11 90 ae b7 76 .
lP.)..,.].....v
0270 4a 8e 51 68 0
e 15 21 6e 32 18 36
06 97 6e b4 aa J
.Qh..!n2.6..n..
0280 19 86 ee d5 a
9 75 a1 e3 21 fc 09
20 7b 61 f6 a2 .
....u..!.. {a..
0290 c4 9d a6 b9 5
a 47 68 aa 1f 0f 0f
57 19 f5 7a 7b .
...ZGh....W..z{
02a0 bb ee e1 be a
e 2c d6 d9 3a c1 73
01 41 76 77 df .
....,..:.s.Avw.
02b0 77 29 bb 28 0
d 05 31 d5 33 46 66
33 30 f3 4d 27 w
).(..1.3Ff30.M'
02c0 0e 1c 36 49 d
8 71 7d 98 f8 e0 19
a5 67 9e 7e af .
.6I.q}.....g.~.
02d0 65 62 cd 0c b
6 d4 c4 b3 51 1a 1c
76 b6 a4 50 8a e
b......Q..v..P.
02e0 52 20 52 c7 9
7 45 ab af 0c d8 8a

f8 a8 96 d7 77 R
R..E.........w
02f0 9d 9b 7e 22 b
a 05 6b 5a b4 ee ec
96 81 1e 96 8f .
.~"..kZ........
0300 5a 5b 18 91 c
f e3 7b cc ba dd b5
e1 0a c5 2a 2c Z
[....{.......*,
0310 d6 f3 bf b2 d
5 98 32 26 ce c8 08
a9 d0 44 71 d5 .
.....2&.....Dq.
0320 9c 42 03 c9 1
f a4 c1 46 71 d8 55
0e 6a 33 24 74 .
B.....Fq.U.j3$t
0330 ec be b1 98 1
6 c4 01 06 4f c2 2b
63 8d 67 d9 7a .
.......O.+c.g.z
0340 33 78 62 9c 8
7 45 77 30 79 9a 59
13 af 67 87 23 3
xb..Ew0y.Y..g.#
0350 4d e9 df 49 3
4 d8 8a e7 ba b8 7e
cc f2 7a 8a 81 M
..I4.....~..z..
0360 9c 1f 26 1c 2
a 39 42 84 90 c3 4b
ae 60 a1 56 21 .
.&.*9B...K.`.V!
0370 fb bd ba ea 2
2 35 34 54 11 6f 43
cf 12 39 32 a0 .
..."54T.oC..92.
0380 74 11 d6 d1 1
1 05 a6 80 81 2c c1
06 1d 11 7b e7 t
........,....{.
0390 23 53 bf 69 d
6 d3 d3 22 97 da ad
0b 99 1c 04 76 #
S.i...".......v
03a0 17 06 2e 5b a
3 00 63 73 0d 92 80
dd 02 d5 09 35 .
..[..cs.......5
03b0 cb 40 81 33 8
6 29 3e 74 aa 61 f4
18 4d 97 fc a5 .
@.3.)>t.a..M...
03c0 ab 4d d1 bc 2
d ff fb 92 04 e7 8f
f2 fd 29 51 83 .
M..-........)Q.
03d0 78 62 60 5e 4
5 2a 10 6b 0b 4c 0c
28 af 46 0d e1 x
b`^E*.k.L.(.F..
03e0 e9 81 78 91 2
8 01 ac bd 28 62 e4
d4 b0 f5 ac 84 .
.x.(...(b......
03f0 6c a1 11 1a 3
2 d5 e8 0e aa 71 78
9c c7 01 e6 0e l

...2....qx.....
0400 89 c3 4e 74 9
8 5a f6 84 42 04 5f
42 37 81 33 b5 .
.Nt.Z..B._B7.3.
0410 32 de 67 07 b
f 57 9d ba f4 f0 7e
74 d1 d8 c3 8a 2
.g..W....~t....
0420 d4 a6 ce 40 6
4 51 3c b9 98 3a e8
a5 8a d9 d9 21 .
..@dQ<..:.....!
0430 5b c2 b6 2b 0
b 3a 87 06 07 91 01
fa fc f6 bf a6 [
..+.:..........
0440 63 70 94 42 7
3 8b 8a 06 eb 74 ff
95 7b e9 07 01 c
p.Bs....t..{...
0450 9a 29 31 a9 3
9 9c 62 a0 76 21 9e
0b 1d c3 8b 8a .
)1.9.b.v!......
0460 d6 cc 20 18 d
3 99 7e 39 0d 0b b1
68 8d f8 e3 50 .
. ...~9...h...P
0470 a9 05 4e f2 8
b 56 a5 2a cc 94 72
68 42 fa 21 b0 .
.N..V.*..rhB.!.
0480 27 8d d5 3b c
1 14 ca 89 d2 ef 0c
b3 af 47 b4 b0 '
..;.........G..
0490 24 b5 3d ea b
1 a9 d0 3a ec 3a ef
21 e1 b5 d4 27 $
.=....:.:.!...'
04a0 b8 ae e2 e6 0
3 7a cb 31 51 71 6f
bf b6 a3 06 04 .
....z.1Qqo.....
04b0 49 b1 aa 50 7
4 0b 1a 21 20 98 49
60 b9 12 85 0e I
..Pt..! .I`....
04c0 06 07 15 a5 0
e 0e 33 be e9 0f 26
a4 89 50 42 6a .
.....3...&..PBj
04d0 de 8e 39 97 6
8 21 d8 31 8b bd bd
87 29 18 53 d9 .
.9.h!.1....).S.
04e0 04 62 ed 93 2
a 5b 45 9c 07 6e 33
6e 63 2a bf 5a .
b..*[E..n3nc*.Z
04f0 a5 4c f0 ab b
a 2c 66 9f 2c 35 7b
9f 85 f2 02 20 .
L...,f.,5{....
0500 45 a4 00 75 2
c 64 2e 2c 4f 9e 7d
49 6b 08 d6 e7 E
..u,d.,O.}Ik...

0510 ff d7 31 23 b
3 2d 4c 33 91 b0 da
c3 34 1b 30 e0 .
.1#.-L3....4.0.
0520 13 75
.
u
No. Time
Source
Destination
Protocol
Length Info
5 0.142197000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574→h
ttp [ACK] Seq=1 Ack
=3781 Win=39690 Len
=0
Frame 5: 54 bytes o
n wire (432 bits),
54 bytes captured (
432 bits) on interf
ace 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.192127000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.192127000 s
econds
[Time delta fro
m previous captured
frame: 0.000192000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00019200
0 seconds]
[Time since ref
erence or first fra
me: 0.142197000 sec
onds]
Frame Number: 5
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype

:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab

le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f17 (20247)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 3781,
Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 3781 (re
lative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .

... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39690
[Calculated win
dow size: 39690]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 4]
[The RTT to
ACK the segment wa
s: 0.000192000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 17 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 70 f2 50 10 .
....P..N.+.p.P.
0030 9b 0a 18 d4 0
0 00
.
.....
No. Time
Source

Destination
Protocol
Length Info
6 0.145997000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
458 http→49
574 [PSH, ACK] Seq=
3781 Ack=1 Win=46 L
en=404
Frame 6: 458 bytes
on wire (3664 bits)
, 458 bytes capture
d (3664 bits) on in
terface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.195927000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.195927000 s
econds
[Time delta fro
m previous captured
frame: 0.003800000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00380000
0 seconds]
[Time since ref
erence or first fra
me: 0.145997000 sec
onds]
Frame Number: 6
Frame Length: 4
58 bytes (3664 bits
)
Capture Length:
458 bytes (3664 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),

Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
44
Identification:
0xf177 (61815)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3e0b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 3781, Ack: 1,
Len: 404
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 404]
Sequence number
: 3781 (relative
sequence number)
[Next sequence
number: 4185 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x60f
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 404]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 bc f1 77 4
0 00 31 06 3e 0b 4a
7c 0c 8a c0 a8 .
..w@.1.>.J|....
0020 01 0b 00 50 c
1 a6 2b c8 70 f2 9e
87 4e aa 50 18 .
..P..+.p...N.P.
0030 00 2e 60 f9 0
0 00 2e 5d ce 28 54
30 c2 52 b2 12 .
.`....].(T0.R..
0040 09 b7 7f e1 e
9 a9 64 11 17 8c 3a
71 78 2a 25 8c .
.....d...:qx*%.
0050 dc 52 95 3c e
1 49 c5 05 07 39 75
99 c1 b4 9b 5a .
R.<.I...9u....Z
0060 5d 42 63 63 b
c 66 c5 24 49 56 dc
19 fd 30 f7 2c ]
Bcc.f.$IV...0.,
0070 0c bf 11 b1 9

6 ac c3 cd 71 98 7f
ff fb 92 04 e7 .
.......q.......
0080 8f f2 f8 29 5
0 83 78 62 60 57 04
99 f0 6b 0f 4a .
..)P.xb`W...k.J
0090 0b f0 a3 40 0
d e5 e9 41 91 91 67
81 ac 61 28 72 .
..@...A..g..a(r
00a0 7d 41 15 65 8
d f4 db 5f 49 95 c9
d2 61 8a f8 b3 }
A.e..._I...a...
00b0 01 13 9f c7 9
1 26 80 a0 71 22 21
c0 33 16 b4 12 .
....&..q"!.3...
00c0 82 04 59 f2 c
e 2f ca 15 24 53 75
86 a1 98 5c 4a .
.Y../..$Su...\J
00d0 02 9b ab 38 f
e b5 39 71 c9 d4 04
ac e1 59 48 11 .
..8..9q.....YH.
00e0 92 7c 9f 5c 3
5 c8 e6 b6 de ba 91
82 ed a9 66 8b .
|..........f.
00f0 c6 7a d9 2e a
4 83 e9 3d 33 02 b7
dd 29 99 e7 16 .
z.....=3...)...
0100 b6 0a b3 e9 b
6 bf a4 28 04 56 21
e7 8c 62 d4 9e .
......(.V!..b..
0110 f0 a6 44 a0 1
9 01 69 54 1c 0c 0c
52 35 4e 3a 44 .
.D...iT...R5N:D
0120 ae 35 0c b4 2
7 1d 69 a6 43 d6 a0
cc 06 14 a4 5e .
5..'.i.C......^
0130 e8 61 7a 30 f
4 c0 53 51 40 23 22
a0 4e 45 81 56 .
az0..SQ@#".NE.V
0140 a5 6d 82 f1 b
d a1 b5 42 6b 20 97
cd 35 d2 b3 0e .
m.....Bk ..5...
0150 70 a3 66 f0 a
1 e5 70 e1 7c 3d dd
a9 8c ee ba f2 p
.f...p.|=......
0160 79 24 90 ec f
f f8 b3 5b ff d0 60
00 8c a4 4c 60 y
$.....[..`...L`
0170 2a 33 b2 18 c
c 81 15 31 08 2e f9
6d cb 36 a6 a3 *
3.....1...m.6..
0180 22 a5 a7 88 1
7 e9 cf 5c e9 69 36

d3 99 eb f6 86 "
......\.i6.....
0190 af 7b a0 bd 1
a 5a 03 19 c8 8c 0c
51 10 13 91 00 .
{...Z.....Q....
01a0 7e d6 9d 8b 1
3 2e 12 aa 4c 63 c9
bd 3e a6 56 6d ~
.......Lc..>.Vm
01b0 fb 14 6c e5 f
4 7a b5 3c de d8 40
c1 01 63 a5 31 .
.l..z.<..@..c.1
01c0 a5 8e 4a aa a
a d7 fe 95 8a aa
.
.J.......
No. Time
Source
Destination
Protocol
Length Info
7 0.193888000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http→49
574 [ACK] Seq=4185
Ack=1 Win=46 Len=12
60
Frame 7: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.243818000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.243818000 s
econds
[Time delta fro
m previous captured
frame: 0.047891000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04789100
0 seconds]
[Time since ref
erence or first fra
me: 0.193888000 sec
onds]
Frame Number: 7
Frame Length: 1

314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf178 (61816)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 4185, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 4185 (relative
sequence number)

[Next sequence
number: 5445 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd41
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1664]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 78 4
0 00 31 06 3a b2 4a
7c 0c 8a c0 a8 .
..x@.1.:.J|....

0020 01 0b 00 50 c
1 a6 2b c8 72 86 9e
87 4e aa 50 10 .
..P..+.r...N.P.
0030 00 2e d4 1f 0
0 00 14 43 30 a2 53
99 1a 3a f1 b3 .
......C0.S..:..
0040 39 1c 12 30 4
4 f2 10 85 2d 51 f0
8e 86 98 bf 34 9
..0D...-Q.....4
0050 de 8b 38 c3 0
3 10 8b 1c 2b b0 ce
5c 1d e5 e2 62 .
.8.....+..\...b
0060 5c af 43 c4 4
1 5e 7c 18 98 a3 23
17 0a 21 d0 40 \
.C.A^|...#..!.@
0070 66 79 c6 46 1
6 89 7e 0f 2d da c6
6d fc 5e 7d ca f
y.F..~.-..m.^}.
0080 90 35 86 3e a
d 82 20 e0 30 ff fb
92 04 e9 8f f2 .
5.>.. .0.......
0090 f5 28 d0 83 7
8 7a 50 5e 24 ba 10
67 2f 4a 0c 64 .
(..xzP^$..g/J.d
00a0 99 42 0d 65 e
9 41 7d 10 68 01 ac
3d 28 12 32 43 .
B.e.A}.h..=(.2C
00b0 78 66 e4 49 f
f fa 04 13 c3 08 1e
72 06 4c b9 8c x
f.I.......r.L..
00c0 14 62 56 03 0
9 8c 0c 40 1c 6c 53
ea 3a 09 0b c7 .
bV....@.lS.:...
00d0 0e 2d 97 79 0
7 90 e9 00 c4 57 b3
b9 04 be 4d 3d .
-.y.....W....M=
00e0 fa ae db a2 c
4 5c 42 18 a5 54 1f
12 0a 23 91 41 .
....\B..T...#.A
00f0 7a 82 94 14 7
d 01 7b 03 8f d1 71
3e fc ef 9f 69 z
...}.{...q>...i
0100 d1 a3 6e 31 8
c b7 03 37 a5 b3 73
be 00 d1 d4 c5 .
.n1...7..s.....
0110 11 72 d0 86 a
7 58 70 20 0b 4c 52
47 b6 0d 61 01 .
r...Xp .LRG..a.
0120 c3 5c 34 f5 0
1 2e f9 0d 21 64 4d
5f ce ea e6 4e .
.....!dM_...N
0130 55 26 f2 27 d

3 da ce 92 fd aa 39
6d 99 de 75 a5 U
&.'......9m..u.
0140 21 83 7f 8c 5
5 b4 a0 f8 3c cf b6
56 24 36 47 ed !
...U...<..V$6G.
0150 6e da d9 5e 3
f a4 8f 59 1f ba 64
dd e0 47 ab f8 n
..^?..Y..d..G..
0160 b2 59 fe ad 2
c 80 e0 58 4d 0e 30
7b 04 6b f7 ef .
Y..,..XM.0{.k..
0170 dd be df fb 7
e 4d 11 45 4b 44 67
58 24 50 85 51 .
...~M.EKDgX$P.Q
0180 32 4c cb 19 d
2 c2 4b 90 4a f3 ac
04 7a 3e 1a 3e 2
L....K.J...z>.>
0190 51 bf ca a8 d
6 33 66 72 38 61 cb
a8 9a f0 c3 24 Q
....3fr8a.....$
01a0 36 81 05 70 3
2 bd d8 0f 0c d0 de
6f 58 f8 a3 a3 6
..p2......oX...
01b0 15 b3 ab df 8
1 65 77 ee bc 00 4c
1c 14 38 5c 30 .
....ew...L..8###BOT_TEXT###
01c0 d1 e9 11 83 e
4 46 48 3c b8 5a b5
d9 20 ee ff ff .
....FH<.Z.. ...
01d0 ff f9 3a 11 0
0 f5 22 3c b4 e5 ab
22 56 36 46 ad .
.:..."<..."V6F.
01e0 6d 07 cb 8d c
8 80 95 70 bc 7c 6e
01 f1 3d 8b 17 m
......p.|n..=..
01f0 cc 74 82 5b 1
3 e3 d3 a1 d1 08 0c
28 20 1c 94 a6 .
t.[.......( ...
0200 62 71 fc dd c
6 b6 5b 74 f1 db 71
88 17 48 7c f7 b
q....[t..q..H|.
0210 59 7d eb 23 c
3 ed db a6 e4 01 00
b5 64 0f 9f 0b Y
}.#........d...
0220 9a 0b be 11 b
1 0f b3 20 e2 84 04
ff fb 92 04 e8 .
...... ........
0230 8f f2 e2 22 5
0 83 6f 62 50 5f 64
f9 f0 6b 0c 4a .
.."P.obP_d..k.J
0240 0c 04 8b 4a 0
c e1 e9 41 73 10 69

41 9c 31 28 6b .
..J...As.iA.1(k
0250 7c 4c fa 20 4
3 9e 82 f3 97 17 f4
a4 61 b1 81 d0 |
L. C.......a...
0260 78 a9 e4 6e 5
b ee a7 30 81 00 99
1a 30 40 b9 b1 x
..n[..0....0@..
0270 71 41 fa 32 7
5 e2 4c cc 32 0f 9b
2b 3b 22 12 08 q
A.2u.L.2..+;"..
0280 08 9c 10 e7 6
7 cd 73 ea 49 ec 6c
3d 20 5a e2 6c .
...g.s.I.l= Z.l
0290 c4 22 18 c4 3
b 6f ee d1 11 71 6e
4f 7c 3a 76 11 .
"..;o...qnO|:v.
02a0 15 07 c1 f0 8
b 1a f3 e1 88 3e 40
4e 07 03 87 e0 .
........>@N....
02b0 fa fb 69 67 8
9 f5 3b e9 28 db 3f
40 77 02 94 09 .
.ig..;.(.?@w...
02c0 42 38 e2 65 3
7 19 aa 6c 11 82 80
e9 3a dd 59 a1 B
8.e7..l....:.Y.
02d0 15 b7 66 c8 2
2 b2 71 74 cd 18 45
18 af 2f 0a a1 .
.f.".qt..E../..
02e0 bd bf ac 40 9
4 4c 6b 3d f7 c9 ab
74 37 5b 6d fc .
..@.Lk=...t7[m.
02f0 cb 75 38 01 2
6 d6 79 a2 63 c6 18
54 c3 9d 73 e7 .
u8.&.y.c..T..s.
0300 de 4c f5 07 2
2 31 57 20 3c f7 be
d5 29 e6 c5 c5 .
L.."1W <...)...
0310 9b 6a d9 09 b
d 3c 73 08 ca 0d 20
46 49 41 1c a4 .
j...<s... FIA..
0320 54 2e 30 ab 6
2 2e 50 47 6d 46 2b
b1 70 99 f5 3c T
.0.b.PGmF+.p..<
0330 13 8b b5 f1 3
9 14 c5 b4 42 53 0c
a6 ab ca 46 b3 .
...9...BS....F.
0340 f7 96 e2 15 7
b ba 80 14 b4 34 15
31 22 f2 56 b4 .
...{....4.1".V.
0350 80 20 18 02 a
8 e3 f9 67 e7 98 13
48 b1 79 c5 87 .

.....g...H.y..
0360 49 d9 8b 34 2
a f2 6e 79 f6 ee 13
ef 7e 65 a8 10 I
..4*.ny....~e..
0370 d5 41 18 50 e
f eb ee fd 3c 69 bf
b6 45 b9 97 4c .
A.P....<i..E..L
0380 69 b0 40 64 5
c a0 63 31 b5 67 2c
6f b5 0a 9d c5 i
.@d\.c1.g,o....
0390 b1 e4 8d 72 b
2 27 ef 24 d2 e7 15
a3 11 29 42 61 .
..r.'.$.....)Ba
03a0 0b 6c 57 10 6
a a0 21 d1 5f 3c d2
65 4b ef 79 e6 .
lW.j.!._<.eK.y.
03b0 97 df cc ff c
b 22 e7 83 41 98 1f
3c c4 ba 77 87 .
...."..A..<..w.
03c0 df 5c fb 5c 7
d fb df d6 aa 99 ff
ce 0e ff fb 92 .
\.\}...........
03d0 04 eb 0f f3 2
1 2d d7 03 0c 32 60
60 85 ba f0 61 .
...!-...2``...a
03e0 26 4c 0b b0 9
f 64 07 a4 c9 41 5c
10 ec c0 f4 99 &
L...d...A\.....
03f0 28 17 08 7e f
f ed 84 8e 15 d2 46
0c 98 f3 1b e7 (
..~......F.....
0400 c9 ee b2 cc 7
8 1c 9f 8a e8 70 60
5d 12 59 4f 94 .
...x....p`].YO.
0410 76 ef b9 47 3
9 98 16 62 fa b8 7f
11 2f b1 29 78 v
..G9..b..../.)x
0420 cf d9 e3 4b 7
6 89 b6 93 46 97 90
37 67 1b eb fc .
..Kv...F..7g...
0430 7c fd fc b4 7
5 89 1a b6 a7 98 58
d3 c3 63 d4 49 |
...u.....X..c.I
0440 27 0c 54 a7 0
2 8c 0b 45 fb 60 06
d2 85 b8 6c ba '
.T....E.`....l.
0450 0e 0a ea 30 c
4 9f 40 e1 41 cd 2a
05 51 51 51 a5 .
..0..@.A.*.QQQ.
0460 64 2d 79 b6 4
9 88 19 36 e7 f2 42
68 a9 41 13 d2 d
-y.I..6..Bh.A..

0470 68 54 b1 3b 4
c 69 04 c6 0e 32 85
31 ea d9 f4 30 h
T.;Li...2.1...0
0480 97 c8 f8 55 e
c 8c a7 70 d7 df ad
f9 58 47 e6 5b .
..U...p....XG.[
0490 3d 9a 9d de 8
5 55 ed ec ee ab 5d
d5 ac 8a d9 4a =
....U....]....J
04a0 97 dd 90 b7 2
d 93 d1 2d f9 3d 59
cb 65 67 a5 76 .
...-..-.=Y.eg.v
04b0 3e c6 b0 5b 7
4 ab 6d 8a 6b 83 9b
59 21 99 66 73 >
..[t.m.k..Y!.fs
04c0 d2 46 6c e0 4
3 ed 2d f4 52 34 8d
3f f0 ed 26 b8 .
Fl.C.-.R4.?..&.
04d0 92 14 8e 4e e
3 e6 d4 ed 5b 10 2a
61 d3 9d 7e 8e .
..N....[.*a..~.
04e0 54 5d f8 67 f
0 f7 da f5 ff da cb
e6 42 38 58 2a T
].g........B8X*
04f0 65 0e 60 1f 1
7 6c c5 06 c5 e8 1a
62 8b 98 21 4a e
.`..l.....b..!J
0500 9c 54 d0 ab 9
0 28 12 75 13 e8 40
68 df 55 90 39 .
T...(.u..@h.U.9
0510 43 c7 1e 6d e
f 30 55 6f 04 64 c9
35 18 2b f0 88 C
..m.0Uo.d.5.+..
0520 f2 86
.
.
No. Time
Source
Destination
Protocol
Length Info
8 0.194066000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574→h
ttp [ACK] Seq=1 Ack
=5445 Win=41265 Len
=0
Frame 8: 54 bytes o
n wire (432 bits),
54 bytes captured (
432 bits) on interf
ace 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.243996000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.243996000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 0.194066000 sec
onds]
Frame Number: 8
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek

.. . ..co rexchange. .....1..com (74...0. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ...12.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. = Don't fragment: Se t .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f18 (20248) Flags: 0x02 (Do n't Fragment) 0..... Src: pc13 . = LG bit: Globally unique address (fac tory default) . . ...dllstx01.. ....168..C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..home (192.... .. ... . = Reserved bit: Not set . Dst: cust-74-124 -12-138.0.. ..0 . ....1 24.. .........1.. .. = Differentiated Ser vices Codepoint: De fault (0x00) .. . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .11 ).

. .. . . .. .... = Reserved: Not set ... . . 0 ... Src Por t: 49574 (49574).0 = Fin: Not set Window size val ue: 41265 [Calculated win dow size: 41265] [Window size sc . . = Urgent: Not s et .] Source: pc13...0 ...1 .. com (74. = Acknowledgmen t: Set .0..dl lstx01.... = Push: Not set .... . .. .. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 5445 (re lative ack number) Header Length: 20 bytes .. ...138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..ho me (192...... 0000 0001 0000 = Flags: 0x010 (ACK) 000. ..0.0. ...... Ack: 5445. . 0....1.. = ECN-Echo: Not set . Seq: 1. 0..124. = Congestion Wi ndow Reduced (CWR): Not set ..... ... .... ...11) Destination: cu st-74-124-12-138.......corexchange..... = Syn: Not set .12. = Reset: Not se t .. . .. .. = Nonce: Not se t . .168. . . D st Port: http (80)..

.000 . 1.@.dx... ..000178000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .`n. No...E.N...J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 77 72 50 10 .223622000 Netgear_2e:1a:0 9 Broadcast HomePlug AV 60 MAC Manag ement. Time Source Destination Protocol Length Info 9 0. (O.... 2014 11:26:5 3...aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 7] [The RTT to ACK the segment wa s: 0..... 0010 00 28 4f 18 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .P. Get Bridge I nformations Confirm ation Frame 9: 60 bytes o n wire (480 bits). 0030 a1 31 18 d4 0 0 00 .. 60 bytes captured ( 480 bits) on interf ace 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.wrP...+..273552000 Romance Standard Time [Time shift for this packet: 0. .

....0. . .. .. ...... .. .... = IG bit: Individua .. ... = IG bit: Group add ress (multicast/bro adcast) Source: Netgear _2e:1a:09 (20:0c:c8 :2e:1a:09) Address: Ne tgear_2e:1a:09 (20: 0c:c8:2e:1a:09) . .. .. = LG bit: Locally a dministered address (this is NOT the f actory default) . = LG bit: Globally unique address (fac tory default) ...273552000 s econds [Time delta fro m previous captured frame: 0.223622000 sec onds] Frame Number: 9 Frame Length: 6 0 bytes (480 bits) Capture Length: 60 bytes (480 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :homeplug-av] [Coloring Rule Name: Broadcast] [Coloring Rule String: eth[0] & 1] Ethernet II........02955600 0 seconds] [Time since ref erence or first fra me: 0..000000 seconds] Epoch Time: 141 5615213.. . .029556000 seconds] [Time delta fro m previous displaye d frame: 0...1.. .1 . ..... . D st: Broadcast (ff:f f:ff:ff:ff:ff) Destination: Br oadcast (ff:ff:ff:f f:ff:ff) Address: Br oadcast (ff:ff:ff:f f:ff:ff) .... .... .... . . .... ...... ......... Src: N etgear_2e:1a:09 (20 :0c:c8:2e:1a:09).0 .

......0 0..! 0010 60 00 00 01 0 5 04 90 01 3b d0 17 e1 04 e5 36 86 ` .. ..... .. 0020 da 3d 84 4b f 5 be 71 b9 00 1f 3a c9 0e 4a 00 00 .....6.... = MSB: STA . . .l address (unicast) Type: Homeplug AV (0x88e1) HomePlug AV protoco l MAC Management Header . ......1 (1) Type: Get B ridge Informations Confirmation (0x602 1) .. 00 00 = Fragment count :0 0000 ... = Fragment index :0 Fragmen t Sequence number: 0 Get Bridge Info rmations Confirmati on Bridging: T rue Bridge Term inal Equipement Ide ntifier: 5 Number of s tations: 4 Bridged Des tination Address: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1) Bridged Des tination Address: A pple_86:da:3d (04:e 5:36:86:da:3d) Bridged Des tination Address: H onHaiPr_be:71:b9 (8 4:4b:f5:be:71:b9) Bridged Des tination Address: H onHaiPr_c9:0e:4a (0 0:1f:3a:c9:0e:4a) 0000 ff ff ff ff f f ff 20 0c c8 2e 1a 09 88 e1 01 21 ..... ...Cen tral Coordinator (0 x00) Fragmentati on Info: 0x0000 .. ..1 = Version: 1.... 01 = LSB: Confirm ( 0x01) ..

corexc hange.q... 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10... 2014 11:26:5 3.385937000 s econds [Time delta fro m previous captured frame: 0.000 000000 seconds] Epoch Time: 141 5615213.. Time Source Destination Protocol Length Info 10 0... No..385937000 Romance Standard Time [Time shift for this packet: 0.. ...11238500 0 seconds] [Time since ref erence or first fra me: 0.336007000 sec onds] Frame Number: 1 0 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] .home TCP 1314 http→49 574 [ACK] Seq=5445 Ack=1 Win=46 Len=12 60 Frame 10: 1314 byte s on wire (10512 bi ts).dllstx01. 0030 00 00 00 00 0 0 00 00 00 00 00 00 00 .J.com pc13.=...:.K..112385000 seconds] [Time delta fro m previous displaye d frame: 0..336007000 cust-74-124-12138.

.124.... . .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ....0.... .. .1.. = LG bit: Globally unique address (fac tory default) . .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .dlls tx01.co m (74..corexchange..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 . Src: cust -74-124-12-138.......[Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .port == 80 || http 2] Ethernet II...0 . .. . .... = Differentiated Ser vices Codepoint: De fault (0x00) ... . .12.. .... ..... ...home (192 ..... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).0.... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.......0 . Dst: pc13. = LG bit: Globally unique address (fac tory default) .168.. ... ...... . .. .138). ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. . ... .

.. Seq: 5445. Dst P ort: 49574 (49574).) Total Length: 1 300 Identification: 0xf179 (61817) Flags: 0x02 (Do n't Fragment) 0. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3ab1 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..dllstx0 1. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 5445 (relative sequence number) [Next sequence number: 6705 (re lative sequence num ber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. Src Por t: http (80).. = Reserved bit: Not set . . . = Don't fragment: Se t .com ( 74.1...1.....12.168.138) Destination: pc 13.corexchange.. 0000 0001 0000 = Flags: 0x010 (ACK) .124..0.home (192... Ack: 1...

0..J|...... . `n. .P.. = Nonce: Not se t .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xb3d 7 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .E. . 0 . = Congestion Wi ndow Reduced (CWR): Not set . ... . ..... = Syn: Not set ..... .0.000. 0..g..1..)#3.c.0 . 0020 01 0b 00 50 c 1 a6 2b c8 77 72 9e 87 4e aa 50 10 ....... . ... ....Y.. ..9DA 0040 45 cc 90 19 b 1 0b 0f 29 23 33 ab 4d 26 1e b0 de E .P... .. = Reset: Not se t .. 0... . ... = Urgent: Not s et .....wr.N.. .... .......dx.. . = Push: Not set . .1 . . . ....... .+. = ECN-Echo: Not set ....y@. .. . .. = Reserved: Not set .:. 0030 00 2e b3 d7 0 0 00 59 b7 63 c5 d4 67 b5 39 44 41 .....M&.... 0010 05 14 f1 79 4 0 00 31 06 3a b1 4a 7c 0c 8a c0 a8 ..... .0...... ..... . = Acknowledgmen t: Set ......

..z. W.....L.N 00f0 87 be ac e5 c d 7d 36 d7 f5 44 97 ae c8 29 cb 2a ..H%C 0110 2a 48 15 39 8 7 d3 85 db 62 cd 1d 3b 04 96 03 ad * H.(.* 0100 51 d2 0e d7 3 5 7a c8 23 31 43 56 12 d0 48 25 43 Q ....U. .N..M.....uf 00e0 52 b3 90 bd 5 6 cb b0 0a 22 91 8e 4e e8 a7 9b 4e R .0050 1c 1b 52 1e b 4 39 92 39 14 7b ee eb 53 37 5a 5d .mG.b..... 0140 fb 57 e6 bf c 0 1a bc b4 90 02 26 b7 93 e7 dd ff .1cId...w'..%.... 00a0 6f 11 ec c1 8 7 99 28 bb a8 9d 6c 96 b7 68 f8 25 o ......_ 0070 93 71 d3 7a b f e1 99 06 ad d7 31 63 49 64 98 e6 .V......vd...BrM. .........9...<...&... ...R.$7. ....h..mr% 0130 6b 07 ca aa e 3 08 25 1e c5 6d 47 cb 77 27 2c 9d k .9..).. 0150 ea ef ee 09 c d 9c 61 b6 dc e2 ae 3c b3 2d 3b 66 ..~T]N 00c0 3e cc f8 e7 9 9 fd a2 4d 12 36 25 93 76 64 8e f6 > .D.. ]%..l.gd.f..(....S7Z] 0060 5c 8f 3a b5 b c 96 67 9b 77 fc 8a f8 db e7 cc 5f \ . ..a..}6..:.6%..$M.... 00d0 9b 6f 8a e1 0 e bf 17 d4 0b 66 94 f9 f6 de 75 66 . 0120 a9 b1 b5 05 8 b ed 9d c9 fb 84 07 27 bb 6d 72 25 .. q. o...9.......w.5z... 0090 e2 5d 25 8b 3 0 3d 86 4c 0c 8d 67 64 0c 24 4d c9 ....... 0080 f5 86 55 ff f b 92 04 ed 0f f3 24 37 d9 03 0f 1a ..{.f 0160 df d2 74 c2 f .#1CV.0=. ......% 00b0 f0 07 85 d4 4 2 72 4d 0f 28 a7 09 c2 7e 54 5d 4e .-.g..."........'.....

..0`s.....V..m. . .....^...F.l. 01b0 ee 6a 2d 3a 0 d 5d 32 c7 e8 48 b9 96 30 c8 54 92 .... .. ..J... ..x. 01a0 19 dd cb b8 3 8 3d 34 99 94 fd b5 99 18 76 79 9d .f f1 6d 13 fc 8d e9 fe 2f ff a0 70 ..5.." 01d0 c6 ca 2a 77 a 1 b5 d4 1c 78 e4 18 e1 4a 13 a5 f9 ... ...3.U@$<O![.I> . 0230 0f 1a e2 5d 8 9 cb 20 3d e2 5e 0c 34 83 60 0c 3d ..T. 01f0 d6 bf 52 b9 6 4 ab 07 06 88 81 b1 4a b4 1d b5 8e ..Nw..F.C 0220 8f a0 ca 9e 7 d ff fb 92 04 eb 0f f3 03 33 d8 83 .... 0180 11 ea 5e e4 0 1 56 dc fd 4e 77 0d 46 a5 35 75 1a .]2........R...W... ... 0200 de 66 37 f9 6 a 64 49 2a 44 02 05 aa 61 61 23 d4 ..a~Ce4..J. ..}. 01c0 92 2a e4 45 4 4 cb 81 a2 eb 84 0f 05 c4 19 cb 22 ..mZH 0250 a1 d0 fb 33 9 5 2d bf 42 88 71 d2 66 18 10 03 44 ..jdI*D..D 0260 e1 50 ce 46 0 5 f4 57 b0 49 3e 20 c6 60 89 1f 7e ....`...`.4..B... j-:..aa#.5u.. 0210 4a 2d a5 97 9 1 58 f0 cb 46 a0 82 e5 0d 58 1e 43 J -...... P...8=4..[. 0190 c6 e6 35 ec 5 5 40 24 3c 4f 21 5b 1d d9 e4 c4 eb ...ED..~ 0270 2c 2d f7 e1 d a 8d c5 14 70 8e 04 .d..X.0. ....3./.g].-..= 0240 29 49 8e 96 6 c 00 fc 19 30 60 73 c8 17 6d 5a 48 ) I.p 0170 13 54 d8 c7 2 f 44 2c 9e 9d 61 7e 43 65 34 af c9 ..f. f7.H.t./D.]... 01e0 8c cf 95 0c c 5 a9 67 5d bb 7f 8d fa 99 5b fc ea ..X. =.q. *. .F. T...^.*w.....vy.

.Ye.C. a.C.o.c 02c0 c6 51 ce 4a 6 5 30 c5 3e ad 3f bc cf ea d2 e5 95 ....T....|...{E 0330 8d 15 85 f4 0 4 54 07 9a c0 75 1f d6 39 89 67 6c .*5 02a0 8c 44 50 38 4 6 46 58 95 43 c0 c1 9b 29 5e 9f 26 .... 0350 de 61 b6 14 9 7 23 10 ac 34 85 bc 54 e1 81 ec 73 .$.. 0370 8a 6e 08 f6 b 6 d5 24 db 43 00 16 e2 4f aa 9a f6 . DP8FFX.O..... 02f0 b1 61 ee c1 7 a 85 61 97 93 59 65 99 3c 48 82 c1 ...<H..T.....0..O... ph.d\ 0290 1a 70 68 cc 0 e d1 65 d6 34 d1 07 3c 22 2c 2a 35 . 0320 77 33 56 0a 8 4 4c 21 db a2 66 f4 ac 5d da 7b 45 w 3V.s 0360 cf 2d 6b 13 4 e bf 40 b3 e3 55 b8 be b5 6a 96 da .. .?. .V.I. . 0300 20 bb 45 98 9 2 14 bc 20 cc 5f 25 b9 30 b7 93 42 .E..2G.9. n.>.$>.9.f.!.N.. .e.gl 0340 f9 85 32 47 0 4 49 d2 7c bf ff eb 3e fa dd aa 9f .D......a...B 0310 d6 fa c1 6c 5 a 0e 93 ac 56 bf 2a 19 24 3e c9 1c .....L!..a.C.../.>..p....j...6gu{b..Nj}.4.<"....!...z..Je0... -k.12 e9 2f e9 e7 ._%.#.. T:.@..].. a.N. t....& 02b0 cf 54 3a e1 a e 21 a3 36 67 75 7b 62 88 4f d4 63 .... .. Q.. 0280 b4 ab de 6f a 8 61 a3 4e 18 44 b5 ed fc 12 64 5c . 0380 82 5c 62 6a f 1 05 ee a2 5c f8 70 75 88 11 37 b8 . .U.Dk...u.)^..C.4.. -..*...lZ. 02e0 5f 61 bb 43 1 8 cc fd 21 80 ab 16 f3 e0 d1 43 80 _ a. 02d0 b9 74 8f 44 6 b 18 12 12 4e 6a 7d 7f 7f 39 db 9f .

.=.'RN..J.pu.. .=.y.D.. 0480 54 9d 96 91 6 e a3 bb d7 89 79 83 94 04 60 34 2a T ....M....`4* 0490 6d 6f 28 3c d 9 b0 5d 70 60 fb 98 09 09 4f 8a b4 m o(<...Z..... 03b0 dc 2a 26 3a 5 9 b6 cb d5 48 68 f3 87 bd 85 44 95 ...J. 0440 0f 08 a4 81 d 3 48 a0 22 ba ca 8a 3d ee 45 95 1d . 0410 6b 3b ae db e e b1 80 4a ea 50 e6 8a 2e b7 9a 57 k . 03a0 38 6f ff 64 c a a7 16 3c 51 85 8c 41 30 2b 0e 00 8 o. ...W 0420 69 7d 26 c7 1 a bc 94 ea a6 5c 47 3b 53 7d c3 5d i }&......G. ......P..4Vg.0. ..........*n."..u...x .d.BP\.....S.._......H...KB\.... 0390 0a ad d7 34 5 6 67 83 d8 fc bd cb ca 8f d4 d2 cf . *&:Y........\.>%..". `.\G. ..).O.E.Hh. .I...5...( 0460 1d 13 16 14 c b 78 20 c0 d4 89 83 f0 93 df af a2 . 0470 66 b6 f1 5f 8 9 22 04 c1 d6 49 a2 43 42 41 35 ab f .S}.M..7...Bh......<Q........ ..]p`... 0450 1e e9 8b 1d d 6 99 f7 2c 99 84 58 56 b7 00 0b 28 ..! 03d0 58 03 18 42 5 0 5c 84 eb 10 3d e8 4a 0b e8 8d 5e X .] 0430 a2 b7 9d 81 c 4 27 52 4e d1 a0 30 92 e0 53 cd 01 ....B 03f0 6b af 2a 6e 0 7 5a e5 42 68 05 b9 29 98 47 cb fa k ....0j.... 03c0 50 a5 c9 15 c c b4 4d ff fb 92 04 e8 0f f2 f1 21 P ..A~....^ 03e0 0c 60 c9 41 7 e 97 ec 01 87 99 30 6a d8 75 cc 42 ..XV...CBA5. 0400 f6 98 8c 4b 4 2 5c 14 3e 25 a0 4d 16 f0 35 bc e5 .n...A0+..\bj..

ACK] Seq= 6705 Ack=1 Win=46 L en=814 Frame 11: 868 bytes on wire (6944 bits )...[)b..... 04e0 fb 9a e8 91 e e 83 c5 40 20 a9 db 56 6d 81 70 a0 . Y'....... 04f0 24 58 59 c3 8 b 1d 4b 56 e3 a9 29 b0 b3 8e 0a d6 $ XY.C.. .B..IL 0520 a5 f6 .. 0500 75 6e 0e b5 9 3 98 ad 2a 17 6a 5a ce 51 0f 2e eb u n.B.Vm... No.....)...@ .342008000 cust-74-124-12138....*.KV. ...Q..000 .f.b 04c0 ac c9 43 67 8 8 a4 05 e4 d4 66 1c 5b cc b0 7d b3 .J.p..V..jZ.. .R.com pc13.04a0 05 59 27 ba b 9 a6 87 4a a5 c3 de d8 c7 a2 e2 ae . 0510 11 72 52 08 e 8 42 d8 aa a2 82 82 2a cd 12 49 4c .391938000 Romance Standard Time [Time shift for this packet: 0.. rR.home TCP 868 http→49 574 [PSH. 04b0 53 41 de 06 e a b9 0b 84 43 cc 85 52 f8 56 0a 62 S A..B+. 868 bytes captur ed (6944 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.[.corexc hange..Cg.dllstx01. 04d0 5d 67 18 98 4 2 8e a5 aa 42 2b a6 2e 5b 29 62 d7 ] g.....*....... 2014 11:26:5 3.. Time Source Destination Protocol Length Info 11 0....}..

. .. ...006001000 seconds] [Time delta fro m previous displaye d frame: 0.. = LG bit: Globally unique address (fac tory default) .. ... .000000 seconds] Epoch Time: 141 5615213.342008000 sec onds] Frame Number: 1 1 Frame Length: 8 68 bytes (6944 bits ) Capture Length: 868 bytes (6944 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..0. = LG bit: Globally unique address (fac tory default) . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .0.. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)........ ..391938000 s econds [Time delta fro m previous captured frame: 0.......... .... .. ..... .port == 80 || http 2] Ethernet II. . . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .. ..... ... .. .. ..00600100 0 seconds] [Time since ref erence or first fra me: 0..0 .

....home (192 .co m (74. = Don't fragment: Se t ....138).home (192. ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 54 Identification: 0xf17a (61818) Flags: 0x02 (Do n't Fragment) 0..corexchange.124. ..138) Destination: pc 13. Src: cust -74-124-12-138.1.. .168.. ..0.....dlls tx01..dllstx0 1.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Dst: pc13. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.168.. 11) [Source GeoIP: Unknown] ....0 ..12..1..124...com ( 74.. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c6e [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.1. = Reserved bit: Not set . .. .. = Differentiated Ser vices Codepoint: De fault (0x00) . ..corexchange.12. .... ..

... 0000 0001 1000 = Flags: 0x018 (PSH... . = Push: Set ...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xa52 7 [validation disab led] . . .. 0.. = Congestion Wi ndow Reduced (CWR): Not set . ....... .... 1 .0 . .. . . . . = ECN-Echo: Not set .. . .. = Reset: Not se t ... = Acknowledgmen t: Set .. . .1 ...... 0.. = Urgent: Not s et . Len: 814 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 814] Sequence number : 6705 (relative sequence number) [Next sequence number: 7519 (re lative sequence num ber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . = Nonce: Not se t . . ..... Seq: 6705.0. = Syn: Not set ..... ....0. .. Dst P ort: 49574 (49574).. = Reserved: Not set .0..... .. Ack: 1..... ...... ACK) 000. Src Por t: http (80).. .[Destination Ge oIP: Unknown] Transmission Contro l Protocol. ... ...........

. . 00a0 28 95 2a 75 0 5 95 da 26 8a c5 8c c2 12 0c 49 14 ( .8... 0030 00 2e a5 27 0 0 00 90 20 56 8b 35 22 ab ba c5 4c .P. ....E...+..q. 0080 04 ea 0f f2 e f 20 d7 03 0f 4a 50 62 a5 5a f0 3d ..3.&..N...= 0090 eb 4c 0c 30 8 5 5a 0c 3d 09 41 67 90 ab c0 f7 a1 ... .e.' 0050 9b 77 84 f4 b b bd c4 33 b6 57 9b 6c 3c 75 e5 56 ...Ag..Z..Y.0V.nw=..I.Nu.. 0020 01 0b 00 50 c 1 a6 2b c8 7c 5e 9e 87 4e aa 50 18 ..|^...:Kn... L. ..W..z@.. 0010 03 56 f1 7a 4 0 00 31 06 3c 6e 4a 7c 0c 8a c0 a8 ..Z. V..0.*u..C.'.&U. . .=...L 0040 e1 8b b3 db a d 87 71 b5 9c a2 8b 2f b5 65 10 27 . ./. 0070 5c 50 fc a8 2 e 3d a5 07 3e 19 41 44 46 ff fb 92 \ P.lg.5".<nJ|..l<u......dx...V 0060 f6 7f 38 db a d bb 4e 75 2c 3f 61 f5 ac b0 e7 e3 . . 00b0 ec 19 59 cb 9 e ea 26 55 0c 17 a6 30 56 c9 dc a8 .>.........ADF.... V..JPb. 00e0 22 c8 a4 f5 b e 44 0e 3c 6b 03 24 ........1. ..[! 00d0 01 19 88 ee 4 3 bf cd 89 fa df 3a 4b 6e e1 ed ec .[Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2074] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . 00c0 1a 0f 6c 67 1 0 dd ac 6e 77 3d da cc a2 92 5b 21 ... `n.......P..?a....=. w..

......0...j.V..WK.l 01a0 9d 89 ef 6c 7 b a5 8e 64 67 f3 b0 21 1a 2a 30 a5 .[..P..kd@k... .._. ...dg.j.<k.-.ER.R=q....e.. 0130 c0 f9 65 bc a a 02 3a 8a 77 30 55 31 d5 0c 80 d7 .!.. . ..: 0100 d3 ff c7 ce a b eb 82 54 a9 a8 0d 7d 33 54 28 2a .8U....*..<.08..... 01b0 bc 81 76 87 4 0 e5 c1 b2 a1 78 a5 87 e9 50 a9 71 . 0150 2b 5d 1e 80 f 4 55 65 e8 a0 9e b2 07 45 52 94 cc + ]..Y.....v..*0. 01d0 1a c6 07 12 5 f aa 44 04 bc 8b 91 6a 3b 57 4b 06 ..3kg 0120 5d ea b3 96 3 8 55 bd f0 74 c4 ce 18 6a 6e c5 ee ] ...1)@U..:.b$Oq@... .w0U1.T...3.. .q-/....l{. 2.ay^.M...@...:.Og.D.t. 0140 12 20 32 cb 2 a f5 52 3d 71 92 cc b2 5a fa 7f a7 .. 01f0 b2 12 f1 90 2 a c2 13 a3 db e3 0a 51 95 09 fe d8 ... .gPv. 0180 55 cb 98 e1 4 f 67 e4 33 13 78 72 bd 0d 85 81 f2 U ........jn.xr..%.~..92 34 1d 3a f4 " . 0170 20 bd 93 f5 3 e ba 81 02 8a dc dc 3c ba e9 2d ee ...D.Z....x..$. 0190 6d da 86 a8 5 3 c4 7e ee 0c 67 50 76 d4 5b af 6c m ... .4....>. . 0160 52 b5 9d 61 7 9 5e ce bd 1d c4 71 2d 2f 01 aa 00 R ...Ue.}3T(* 0110 a6 0e 30 38 2 e 6a a1 60 84 c1 b9 d7 9d 33 6b 67 .........q 01c0 22 9a 59 09 d 5 62 24 4f 71 40 ed 56 e9 4d d1 d0 " .S.`.. 01e0 89 ca b6 f3 2 5 1d db 15 f2 a7 8a f7 e8 f5 ab b1 . 00f0 bf 8e 6b 64 4 0 6b 17 0e 30 ad 31 29 40 55 0a 3a ..

.a.0. 0200 f7 f5 50 dc 8 a bf 76 2b 25 22 e9 18 33 5d cb c5 ...%ao".U ......1H.=.T.`K...$T... 0.....3]....... hA}.j 0230 d0 63 09 4a 0 c 31 0d 58 0c 60 4b 81 96 15 ab 00 .k:KP<.6.....W...... ....2.P}..!a 0250 0d d0 1c e2 8 a e8 b0 1d 50 41 dc 25 61 6f 22 dd ..Z.._ue.E.....Z....)F...... 0300 ae 1d 32 a8 b b ef c0 d0 d3 0c cc 29 3a 46 3b 55 .....X...m..g.&`......W6Y..........=I.. .2$n 02b0 93 5c 20 81 1 4 e0 67 8d c5 44 49 65 6a 76 57 0a .v+%".):F.. 0260 0d 91 fc 57 3 6 59 f2 e5 0b 5b 6f 15 1a 6d 01 a8 . .~ 02a0 84 f5 0a b0 d e 50 7d 09 94 a9 54 a9 7f 32 24 6e .. ..P. 0220 fb 92 04 eb 0 f f3 11 2a d6 03 18 32 60 5a e4 6a ..\. ... 02e0 d2 c5 09 81 c e b4 4e 81 87 53 7b dc 05 a5 49 bd . ..... 0290 0b ce a2 8b d 1 24 54 8d ec c2 a0 1b 91 ec e4 7e .....2`Z.... 02f0 68 11 30 cb 2 9 46 2e fb da 84 bb 2b ee 3d d3 a3 h ..)-..+.. ...[o.PA..N. c...Q.... \ .. 0240 fc 2d 30 a3 e 9 57 fb ee 95 3d 49 00 a5 97 21 61 . u.J.:=9 0280 a5 30 b8 e2 b 6 ee 66 9d 5a 8a 95 b1 f6 36 96 fb ...1.I.. .. 02c0 de b7 5f 75 6 5 d7 13 26 60 16 00 85 5c 03 82 1f .*.....f.DIejvW.S{. .*. 02d0 d5 75 d2 29 2 d a2 e7 f7 fa 8c bf 45 f3 5a 80 c8 .. 0270 a0 68 41 7d 8 8 cc 31 48 0f ff 0d d7 02 3a 3d 39 . 0210 7e a3 b7 bd 6 1 04 a5 c2 17 16 6b 3a 4b 50 3c ff ~ . -0.

0310 69 09 0c d0 6 4 58 b4 01 e4 df bf 6e 7a 5d 5f 98 i ..hb..home cust-74-12412-138..y 0340 37 ad 5b 33 2 5 52 92 49 36 ac d1 60 fa 05 56 1c 7 .J. j(...cor exchange. ..nz]_.....I6. 0330 8c 02 26 68 0 b 23 23 f3 32 3e b2 51 6a 75 aa 79 ..00015700 0 seconds] .&h...}...com TCP 54 49574→h ttp [ACK] Seq=1 Ack =7519 Win=41265 Len =0 Frame 12: 54 bytes on wire (432 bits)..392095000 s econds [Time delta fro m previous captured frame: 0..342165000 pc13..dX...`.* No.392095000 Romance Standard Time [Time shift for this packet: 0.7.dllstx01.2>.Qju.000 000000 seconds] Epoch Time: 141 5615213.. 0350 d1 6a 28 8b 0 7 14 a5 0b bb 4a dc 16 7d 2c b4 fb ..[3%R. 0320 d7 ce ec ba b 6 37 e9 1f 68 62 a9 e1 8e 0b 8c e8 . 2014 11:26:5 3. 0360 76 f4 0a 2a v . 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.000157000 seconds] [Time delta fro m previous displaye d frame: 0..V.##.... . Time Source Destination Protocol Length Info 12 0.

. ..home (192. ...0 ..co rexchange... ....11 ).138) . . Src: pc13 ..com (74.. .. ...... . ..port == 80 || http 2] Ethernet II...168.... . = LG bit: Globally unique address (fac tory default) . .0.. Dst: cust-74-124 -12-138.. ......0 .. .........dllstx01.. . .. ... = LG bit: Globally unique address (fac tory default) . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)..... .0.1.. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .....1 24. .. ..342165000 sec onds] Frame Number: 1 2 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . .... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. . . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4... .[Time since ref erence or first fra me: 0..12.

Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] ... = Differentiated Ser vices Codepoint: De fault (0x00) . = Don't fragment: Se t .....168. Src Por t: 49574 (49574)... com (74. D st Port: http (80).1.. .11) Destination: cu st-74-124-12-138..124.dl lstx01. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .. Seq: 1...Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. = Reserved bit: Not set .0.12. Ack: 7519.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..ho me (192. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13...corexchange..1. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f19 (20249) Flags: 0x02 (Do n't Fragment) 0.. .

. = Congestion Wi ndow Reduced (CWR): Not set .. .... 0 .. . .. 0... = Syn: Not set .. = Reset: Not se t . . . .. .0..... ....0..... 0... .. = Urgent: Not s et ...... .. ........1 ... ..0 = Fin: Not set Window size val ue: 41265 [Calculated win dow size: 41265] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 11] [The RTT to ACK the segment wa s: 0... = Push: Not set . ..[TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 7519 (re lative ack number) Header Length: 20 bytes . ..... ... = Acknowledgmen t: Set .000157000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 . ..0 .... = Nonce: Not se t .. . .....0. = ECN-Echo: Not set . = Reserved: Not set .. 0000 0001 0000 = Flags: 0x010 (ACK) 000.. ... ... . .. ... ..

524944000 s econds [Time delta fro m previous captured frame: 0.. (O..... 0030 a1 31 18 d4 0 0 00 .524944000 Romance Standard Time [Time shift for this packet: 0. . Time Source Destination Protocol Length Info 13 0. ..78 08 00 45 00 ..dllstx01.com pc13. 1.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 7f 8c 50 10 . No.P.+.dx.home TCP 1314 http→49 574 [ACK] Seq=7519 Ack=1 Win=46 Len=12 60 Frame 13: 1314 byte s on wire (10512 bi ts)...E..`n.P.000 000000 seconds] Epoch Time: 141 5615213...N..13284900 0 seconds] [Time since ref erence or first fra me: 0.....corexc hange. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.475014000 sec onds] Frame Number: 1 3 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: ...... 2014 11:26:5 3.@. 0010 00 28 4f 19 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .475014000 cust-74-124-12138.132849000 seconds] [Time delta fro m previous displaye d frame: 0..

11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.0.138). . ..124..12... ........dlls tx01....... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).0 .. .....corexchange.port == 80 || http 2] Ethernet II.. . = LG bit: Globally unique address (fac tory default) . Src: cust -74-124-12-138.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .. . . .. . .. .... .1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . ... ...co m (74.......168.0 .... Dst: pc13.0.. . = LG bit: Globally unique address (fac tory default) .. .1.. . .... . .home (192 ..... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) ..... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .....

11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..138) Destination: pc 13..dllstx0 1. Dst P ort: 49574 (49574). = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aaf [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..0... ..12. .. Src Por t: http (80)....com ( 74. = Reserved bit: Not set ..124.corexchange.168.. .1. = Don't fragment: Se t .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf17b (61819) Flags: 0x02 (Do n't Fragment) 0.. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 7519 (relative sequence number) [Next sequence number: 8779 (re lative sequence num .. = Differentiated Ser vices Codepoint: De fault (0x00) .. .0000 00.1.. Ack: 1. Seq: 7519..home (192..

..0. = Push: Not set .. .... ..dx. = Syn: Not set .. = Reserved: Not set ..0. . 0020 01 0b 00 50 c 1 a6 2b c8 7f 8c 9e 87 4e aa 50 10 ....J|. .. .0 .1...... = Urgent: Not s et .1 .. ..0. .. = Reset: Not se t .. ..... .. . .......... 0 . .. `n. . 0010 05 14 f1 7b 4 0 00 31 06 3a af 4a 7c 0c 8a c0 a8 . . .... = Acknowledgmen t: Set ..... ....... . = Congestion Wi ndow Reduced (CWR): Not set . ..{@... 0000 0001 0000 = Flags: 0x010 (ACK) 000.. . 0.E...:. = Nonce: Not se t ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x572 0 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. .. . . 0...... = ECN-Echo: Not set .. . ........ . .........ber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .

... .]. .P 0060 a7 a5 f1 eb e a 1a 9c c5 30 21 fe 30 ad ef e4 b9 .X. 0080 d1 84 98 e7 b b 5b d4 e2 4f a1 e3 95 75 2d 60 dd ... ...... .y.c......iPZ...8.P. 0.OH?. 00e0 5f 95 16 7c 5 3 67 a8 4e cd e1 1a 7b b4 8a b9 27 _ .....l.......... 0070 f9 66 27 25 8 a e7 73 f8 c1 82 63 c5 83 20 30 8e ...+.N.....P 0110 da 98 69 50 5 a 87 4f 48 3f a6 d2 49 d1 a9 7e 86 ..kC.........2. 0040 2e e7 a6 6b 4 3 15 06 fe e4 39 01 44 70 f5 2b a8 ..[..J.!.... 0050 a5 32 b9 6c a 1 ed 79 b2 b3 d9 16 38 bd ae a9 50 .. /. .O. f'%.~. 00d0 a6 0e dd eb 3 2 88 ed 6c b1 b7 0a c7 18 76 42 ac ...|Sg......E. ..=.0....Tb.c. ..+....' 00f0 dc b1 b5 9e c 7 8c f8 1b f6 89 4f ac fc 5f e3 ca ..L 00c0 85 e4 63 9a b 4 19 40 90 ee cc f1 06 17 0b b5 1c .9...... 0120 94 2f a0 bb 4 5 a2 18 c0 e4 a4 da 13 50 a5 5d db ..f5.._..... 0090 f7 e9 f7 ff f b 92 04 e8 0f f2 c0 21 d6 03 18 4a .W .0!...s.... .u-`..vB.....P... ...~...E. 0130 18 d0 ac dc e f 66 35 14 b6 fe 94 ba 86 e5 ac a4 ... 2..50.N.T....O..J 00a0 50 57 85 0a d 0 3d e8 4a 0c 08 87 54 0c 61 29 41 P W.a)A 00b0 89 95 aa c1 8 c 35 30 af 7e b5 65 4e ba e2 c9 4c .P..KU).Dp. ..l. . .{..@..... 0100 14 1c a3 58 1 0 54 62 92 8e 98 9d eb ad 45 84 50 . ..eN.......... 0030 00 2e 57 20 0 0 00 4b 55 29 03 12 03 91 05 00 1e .I....

01b0 d6 b5 9c dd 7 1 e9 da b1 6d d2 34 4c 6e b8 cf 97 .. 0240 59 62 50 64 4 4 ca 90 63 0f 4a 0b 7c 87 50 0c 65 Y bPdD.!S.L..e. e... ..(<..J...o.Q.q. ..4. 0170 a8 65 c3 3b a 4 b7 f5 ff 47 4b 05 03 01 34 89 82 .56....Z..... 0230 ff a5 68 18 8 3 ff fb 92 04 ed 8f f2 fc 21 d4 83 .. H.....8. ..... 01a0 8a 3a 75 27 4 c ab 44 47 de 0a e2 4c e4 90 cf 8e ..DG.%. :u'L..|{ 0150 7d aa 6f af 2 c 6a e2 91 35 36 9a af 9f 89 38 a0 } .H..|.`.L(.?^b.. 01e0 51 c2 4b d5 4 c 28 0d 49 0a 06 51 65 68 9b 25 f9 Q .h..-*<._.27r..w..NC$5o. . C.h}\ 01d0 3e 99 0c f5 0 c ba c4 ff f1 b5 4e 43 24 35 6f 1e > ..5.#......e 0250 e9 41 7f 13 a .E-. 0190 a7 a5 35 9b b f 3f 5e 62 d4 cc 9e ee 53 b1 76 e3 ......-e.n..0140 f8 65 09 85 a 9 8b d3 b5 21 53 02 a6 0d b5 7c 7b .&.! 0210 9c 91 06 5f e 9 77 bb 64 e9 d2 26 bc 28 3c 94 74 .].P.).GK.S.9......... 01f0 84 43 f0 62 5 2 af 29 ec 23 c5 e1 87 2c d4 6e 95 .Qeh.I. ..c. .A.m.K.....j....v<.d...... 0180 45 15 29 00 4 1 93 90 5d 9a 63 36 39 e4 60 c6 91 E ..v.4Ln..).t 0220 a4 92 45 2d f d f6 bf a4 39 19 d6 32 37 72 19 8f ... 0160 a2 0e c3 a7 4 a 02 ee 12 2d 2a 3c a8 a5 5a 99 db .!. 0200 b9 94 0a f7 b 8 76 3c 92 14 51 f0 f0 48 ca cf 21 . .c69.. 01c0 fd 48 17 0d 8 2 a1 a1 18 65 af 2d 65 96 68 7d 5c ......... e......bR..J...

?? 0310 cb 7e ca 16 b e 99 6d 6d 5b 29 7d ad fa 18 01 6a . s....{..ejl 0260 23 95 b5 02 1 8 aa 8f b4 88 a9 d0 d8 12 f9 53 d6 # ..j 0320 2e 14 9e 86 4 c a4 c3 99 95 02 40 2f 9d 33 88 15 .l<.y.... b.v..r 02e0 7e 6a 20 ea b 4 ed 1f 4c 65 b9 23 0a 29 36 49 f6 ~ j .! 02d0 87 70 d8 96 e 3 8c 0c 49 8c ea cd 0d 0d 37 8e 72 ..G 02a0 ac 44 19 1c 1 9 15 2a 39 85 68 78 a3 ea d3 c7 31 ..... 0280 51 cd 04 96 5 c ca 80 44 4c de f8 c9 c3 85 91 4b Q .....f......a 41 8c 3d 28 8c 90 25 d8 65 6a 6c ... 02f0 17 73 d6 2d d 6 a3 7c 29 62 7e da fe db f0 7f f3 .7... D.I....A..S.L.r..W . 0270 5e 5a 6c 20 c 5 bb 10 b3 49 00 4f 63 f1 56 85 15 ^ Zl ....~]i.K 0290 79 f7 66 8d f 0 72 d3 3d 8f 5f c6 bc 6c 3c da 47 y ..Le.V..YX...... x.. 0330 64 1e 03 b4 0 c 2c 1a 0a 76 96 61 11 a4 38 6f 3c d ..mm[)}.......%.#.....4 02c0 5a 20 60 a0 7 1 a3 2b d1 79 05 42 a6 59 58 ce 21 Z `......@/...=..J..hx.a..\.-. .q...gk....#1 0350 a7 0b d7 7b b 2 fc ac de 0f 9f 7f 04 ea b6 f2 b9 ....3.#.=(...+... ~...DL...8o< 0340 39 10 7e 5d 6 9 93 57 20 cb b8 10 42 d4 23 31 20 9 .|)b~.*9. p.I........B. 0360 8f af 12 36 f 1 4f 6d c0 85 0c 84 ..kM... .. A. 0300 e3 78 d7 b6 e 4 fa cd 23 8a 9f 6b 4d b2 e7 3f 3f ..)6I..Oc.....B._.1 02b0 ec 62 3b 67 6 b a3 4a 0e ff f4 0a 02 0e 1a 2c 34 ...

...Z....40 ee 6a b6 ea ... 03e0 d3 83 59 5a 5 0 64 64 4a 70 67 2f 4a 0c 64 9d 4c ..j..?K..... 0420 ad cf 18 00 3 4 b2 be be 3c d4 d4 f4 0f a9 dc 91 .....@...r. 0460 ff d4 84 82 f c 1a 40 a7 d1 92 95 96 ac c7 b0 29 ...=._?.. 03a0 96 c3 f4 6c c 6 8e 3d 1e 89 3f 4b 2e 6c d1 11 0a ...... .... e. 0430 67 e4 28 a3 b 0 5a f7 6e 70 ed a6 ed 4c bf 0b a4 g .=u..... .F... 0390 ce b0 04 b2 3 d 23 4f 5a 4e 0f 6a fd 46 e7 c5 a5 ...@. .... 0370 2a cf db dc 2 b 24 4b e6 fb 0b a3 ec d4 44 00 11 * .) 0470 0a 06 06 4a 2 8 44 42 2e 33 1c 3a 4a d6 a1 11 06 . 0450 94 e0 f0 50 e 1 aa a4 ea 3d 75 ad a2 95 cf 76 ff .. .M..l.&..j.... .YZPddJpg/J. ..5u 0410 c5 15 3c 26 5 7 34 32 10 8c 2d 34 ad 72 0f 5d 87 ...Om....<&W42.D..L 03f0 0d 65 e9 41 7 e 92 a9 c1 9d 3d 28 ed db 63 d0 2b .. 0380 07 70 a6 cc 2 6 90 24 5e 18 1f 91 9a 08 11 1c 14 ..c.d...dJ..:N. .E. ...P....r. ...]..<. 03d0 49 c2 f5 be b 3 2c c7 ff fb 92 04 ec 8f f2 be 1e I .O 03c0 7d e1 bf 15 d 3 2e be f1 5f 3f 89 72 00 10 5c 37 } . .}.$^. ..L..v..... 0440 06 fd 09 ec 7 d e5 ad cb 3a 4e cd fe 37 f7 e0 05 ..4..-4.A~...=(....l.6..=#OZN.7......+ 0400 f5 fa 9e f5 1 a 81 0b f8 64 4a 89 16 45 cf 35 75 ......... 03b0 66 52 72 4d a d 5f 9c 25 db de 47 fc 91 4d f1 4f f RrM._..np.(..... p...%.+$K.G....

. 880 bytes captur ed (7040 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B .M*kj 0490 6e a4 2a 9c 8 e 72 76 af 65 23 4d 33 e2 6f 02 17 n .s.....0M.490013000 cust-74-124-12138..L.o. 04a0 50 44 9e 19 f a fe de 4c cb 4c c5 ae a8 cd af 5d P D..B. 04f0 97 42 58 2e 3 d 51 53 38 64 b1 69 34 73 31 f6 34 ..C<.. 0480 47 99 64 82 7 4 79 15 24 fe 2e c3 e7 4d 2a 6b 6a G .J(DB. 0520 5b 10 [ .] 04b0 eb 1b c4 54 9 8 1c 01 7d a9 d1 dd dc 2c 89 6f 5f .. ACK] Seq= 8779 Ack=1 Win=46 L en=826 Frame 14: 880 bytes on wire (7040 bits )... ....e#M3...eb@..$.L..}..}V..corexc hange.ty..*.. Time Source Destination Protocol Length Info 14 0.o.home TCP 880 http→49 574 [PSH..JU... BX.R.i4s1.{.T.s.4 0500 52 99 88 04 9 a 08 11 89 d0 73 d5 d0 52 92 5d d4 R ..`A. 04e0 16 ad 6f 1a 7 d 56 ce 03 7b e2 0f 07 54 7d c7 97 .d.rv. .=T..T}..5 04d0 21 21 98 da 7 e 8d fb 3d 54 80 43 3c 99 35 79 d4 ! !.5y... No.].... 0510 cf b3 73 a4 c 7 e7 27 a8 42 11 ff ee f5 4a 55 7f .~.H.=QS8d.'..com pc13..:J..dllstx01...3... .....o_ 04c0 f4 a2 60 41 a 0 81 48 e5 65 62 40 1a 30 4d 97 35 .. .

. .000 000000 seconds] Epoch Time: 141 5615213.. ...... .539943000 Romance Standard Time [Time shift for this packet: 0. 2014 11:26:5 3.014999000 seconds] [Time delta fro m previous displaye d frame: 0. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ....490013000 sec onds] Frame Number: 1 4 Frame Length: 8 80 bytes (7040 bits ) Capture Length: 880 bytes (7040 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..01499900 0 seconds] [Time since ref erence or first fra me: 0...-440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.0. .... ....539943000 s econds [Time delta fro m previous captured frame: 0..0 .. = LG bit: Globally unique address (fac tory default) . . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 ... .port == 80 || http 2] Ethernet II.. ....... .

. Dst: pc13... .... . .co m (74.0....11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.home (192 . .. ...... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c60 [validatio n disabled] [Good: Fals e] [Bad: False ] .. = Reserved bit: Not set .b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .0 .... .. = Differentiated Ser vices Codepoint: De fault (0x00) .138)....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 66 Identification: 0xf17c (61820) Flags: 0x02 (Do n't Fragment) 0..1.. .. Src: cust -74-124-12-138.168.124... .corexchange.... . . . . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..... = LG bit: Globally unique address (fac tory default) ..0. .12.... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00....dlls tx01. ... = Don't fragment: Se t ....1... .

. 0.. . .. Len: 826 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 826] Sequence number : 8779 (relative sequence number) [Next sequence number: 9605 (re lative sequence num ber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . . . . .... .... = Syn: Not set ...12.. .124.......dllstx0 1...0..0 = Fin: Not set Window size val .1... = Acknowledgmen t: Set ......... = Push: Set ..... ... = Reset: Not se t . .... Src Por t: http (80).0. . 0000 0001 1000 = Flags: 0x018 (PSH... ACK) 000..0 . Ack: 1..Source: cust-74 -124-12-138. . = Congestion Wi ndow Reduced (CWR): Not set ...138) Destination: pc 13. . 1 ..corexchange.0. . = ECN-Echo: Not set . . = Nonce: Not se t ... ... . Dst P ort: 49574 (49574).. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. Seq: 8779... ... .1 .. = Reserved: Not set . .168.. ... 0. .. = Urgent: Not s et ....home (192. ...com ( 74... ..

.4. e.@....1.....Z4L.E... `n... 0060 80 d0 3b 11 1 6 85 cc 27 3f 6f b1 cb 9b b5 5b b0 . %.N...... ... 00b0 30 86 9f d4 9 8 5e df e5 0f c0 99 b4 c2 55 0b 55 0 .x... 0010 03 62 f1 7c 4 0 00 31 06 3c 60 4a 7c 0c 8a c0 a8 ....... w....$......ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xa66 9 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2086] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .".. 0090 04 ec 0f f3 2 0 25 d2 83 39 7a 50 5c e4 aa 70 63 ....9zP\.. a.G^......P.n.i.. 0070 83 77 da 81 b e ab 71 fd d0 f3 b6 ce 5e b9 1e 05 .|@.... . . 0030 00 2e a6 69 0 0 00 5c e3 9c ba 14 9b 34 8f 08 15 ...\..At..J...i. 0040 14 65 88 e8 d e 0c 5a 34 4c e3 b0 bb 07 ab b0 ff .dx.q.^..... b...[... 0020 01 0b 00 50 c 1 a6 2b c8 84 78 9e 87 4e aa 50 18 ....}l...P. 0050 35 b0 40 2e f e ed c0 ce 7d 6c a1 6e c0 03 92 c9 5 ..U 00c0 35 0b 9e 00 b . 0080 c4 61 f0 fd 2 2 17 9c 9f a5 24 e2 47 5e ff fb 90 ..'?o.. .pc 00a0 4f 4a 0b e8 9 5 4a 0d 69 e9 41 74 15 e9 81 9c c5 O J..<`J|.+..^..U.......

X.u.N.7.....R.....y.K. 0140 4a e3 0a 1e c 6 6f 21 f0 8c 46 11 f6 a2 57 bf 6c J ...5j..... ...X.....F...].. 0180 6a ea a0 cf e 7 a0 b2 dc bf ec 4e 04 22 24 14 dd j . .... 0110 5c 2f 70 7f b 4 98 7f fe 40 8d 0a ce 8c c2 5a 2c \ /p..3.K. . 0120 eb 2b 6c 05 9 a 48 24 8c 6e 09 df 30 54 2a 4f b2 ..@.\ 01c0 37 92 1a 1f 0 1 28 ca 81 c2 12 5d 80 77 d2 ef d0 7 .Mh... 0160 21 c0 db 24 7 9 59 f8 2e 1b c4 a2 30 7c b0 48 88 ! .n..W 01b0 d7 93 c0 7d d e 4b 98 79 cc f3 4f 34 78 73 f0 5c ... ......x....gcB 00f0 3c 48 71 dc f 3 78 ae b7 8d 1b 52 fa c7 f6 bc 3a < Hq..Z.F...^.C 01a0 d3 c7 83 69 f e e4 33 df c0 91 ff ab 7e 27 8b 57 ....i.... ..4.ZC.:p...j. 00e0 df 83 9d 5e c 8 6e 22 d3 8e 23 28 67 c7 67 63 42 .0|.3/.w.a 75 a3 b4 d2 96 43 8e e9 1e 2b 35 5 .o!.: 0100 88 c8 34 e0 0 c 58 1f 4b d4 64 4e 51 c0 77 d3 ae . .O4xs....n"..+5 00d0 c7 34 04 e9 7 5 04 4d 68 c6 e3 71 b8 dc 5e a6 16 .^.. 4. 0190 e7 d6 c4 33 2 f 9b 94 46 e9 25 f1 85 e6 de 98 43 ..B......w..$yY.dNQ.~'..H$...q.-.."$.C.... 01d0 47 56 2a a1 6 5 4d 2c 64 9a 11 0d ...H... 0170 2c 24 ff d2 3 a 70 08 80 ce 6a ec cd 58 91 2d f6 .W.....%.l 0150 92 04 b3 37 e 6 35 6a fa f8 dc 91 2e c1 5a 43 f1 .'F\.. 0130 77 1e ca 12 1 c 27 46 5c 8b 92 da 38 fc 42 1f 8c w ..8. $...(.0T*O. +l..#(g.u..}......

....%...a%a.#U.bK9. ....L..g..^...9bP`.$>...Ap.....!0Y!..v.... 0220 e6 fe d5 ae b 1 3f 07 04 2b 48 50 de 9b fe ff fb ..a..$ 0200 2b 80 35 10 a 6 a6 48 ce 2c 4c d6 a6 fd 67 df 6b + ... 0250 3d 28 dc 8d 7 f ff a7 ff f7 24 3e b2 0b 95 89 b1 = (.7.?....j|. 0280 d5 47 43 c7 f 1 9c d7 61 25 61 16 44 73 73 82 42 .u4 01e0 03 8a 87 34 e 4 75 d4 61 a9 ba ac 46 27 51 cf 8c .. GC.+A..g.= 02e0 e0 aa 12 e5 4 1 5e c6 16 76 29 e2 33 ba 92 bb 7b . .H...B.a.... 0270 1e 4d 50 b2 2 d 2a 63 c8 97 6a 7c e3 02 f8 37 d0 .....Dss.F'Q..TO.5.0.5..5c 38 ad 75 34 G V*...k 0210 6d ca 86 23 5 5 1e 39 3d 7b 32 9a db 8d 8c 67 eb m ... 0260 a3 d0 f0 db b 2 74 c7 58 cb 21 1b 83 a4 bf 0b 02 .. .. K..7.&.. . 02c0 dd 48 b1 05 a 0 26 11 42 dc 5e c6 29 f8 1f 50 82 ......m. 02a0 07 4b a0 e8 e 1 54 4f 83 21 30 59 21 03 ad 3c 7d . 01f0 6a ce 53 fa 6 e 6e 4d 89 e8 6d 2e 96 d4 76 98 24 j ...P. ..J.d..nnM...S.B 0290 68 56 5c 44 d e b2 ee de e9 db 32 d2 05 1e 3b 8b h V\D...4.<} 02b0 fb d3 b3 5e 3 0 f2 8f fc 9d 9b 37 d1 fb 1c df a4 ....*.)....2.. .... MP....X....u. 02d0 86 8c 62 4b 3 9 86 96 96 20 98 35 fa f6 d2 92 3d .. H..Z.^0. 0240 63 0f 4a 0b 3 0 91 5a 0c 61 e9 41 70 12 2b 41 8c c .. 0230 92 04 eb 8f f 3 1b 25 d3 83 39 62 50 60 04 2a 90 .!.t. .eM. .-*c..9={2.+HP..

3. 0340 54 8e ea d1 6 c f7 74 d5 b3 bd 7c aa a0 6f c1 d4 T ....ED%. . i%S......^Y(.540112000 Romance Standard Time [Time shift for this packet: 0.j No. 0310 ad 6d 7a aa a e 90 50 82 94 78 88 81 b8 65 9f 6a ...H&.P..l..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =9605 Win=40743 Len =0 Frame 15: 54 bytes on wire (432 bits). .. 0330 b6 69 25 53 8 f e3 bd 4d 25 cc 02 29 8c 51 2f 9c ..e.|..t.....Q/....{ 02f0 02 9e d9 de b e 7c 0d f8 3a 93 7f 5a 7f e1 a1 1f ...Z.(.R...q.:.540112000 s ...o.hj. 0350 9b fa d3 fd 4 a 61 16 68 6a 17 8b 3a a6 b3 52 1f ..x.cor exchange... .A^.home cust-74-12412-138.oo.. 0300 2c 85 ea 65 5 e ab ee eb 93 fa 28 a1 4f 55 9c b9 .M%.j 0320 72 60 80 0a 4 5 44 25 03 71 e4 fc a2 a4 48 26 ef r `.. Time Source Destination Protocol Length Info 15 0... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10....OU.e^. 2014 11:26:5 3.dllstx01..).000 000000 seconds] Epoch Time: 141 5615213....490182000 pc13.Ja.... mz..|... 0360 38 dc 5e 59 2 8 df ae cb d0 fd 6f 6f 9d ee f1 6a 8 .:.v).

..... = IG bit: Individua l address (unicast) ..... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. = LG bit: Globally unique address (fac tory default) .econds [Time delta fro m previous captured frame: 0. .. . .......... ..0..490182000 sec onds] Frame Number: 1 5 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .... . . ..... .. .........port == 80 || http 2] Ethernet II.. . ... .0..... = LG bit: Globally unique address (fac tory default) .. ..0 .... . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .... ...... .. .000169000 seconds] [Time delta fro m previous displaye d frame: 0...0 . . .. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .. .00016900 0 seconds] [Time since ref erence or first fra me: 0.

.11) Destination: cu st-74-124-12-138.. com (74..home (192.ho me (192.1 24.11 ). = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13..12.1.168.12.co rexchange.. = Reserved bit: Not set ..0. .dllstx01..com (74.dl lstx01..1..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f1a (20250) Flags: 0x02 (Do n't Fragment) 0.. = Don't fragment: Se t .... = Differentiated Ser vices Codepoint: De fault (0x00) .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. Src: pc13 . . Dst: cust-74-124 -12-138..168.1.Type: IP (0x080 0) Internet Protocol V ersion 4. .. .. D .. Src Por t: 49574 (49574).corexchange.124.

= ECN-Echo: Not set ... ...0... = Push: Not set ... 0.0 ... Seq: 1. .. ........... Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 9605 (re lative ack number) Header Length: 20 bytes .... . ......0... .. .. ..st Port: http (80). 0 ... = Acknowledgmen t: Set ... .. 0000 0001 0000 = Flags: 0x010 (ACK) 000...0 = Fin: Not set Window size val ue: 40743 [Calculated win dow size: 40743] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an .. . . = Urgent: Not s et .. ..1 .. = Syn: Not set ....0.. = Reset: Not se t .. . .. = Nonce: Not se t .. . = Reserved: Not set .. ..... ...... .. . 0. = Congestion Wi ndow Reduced (CWR): Not set .. ... .. Ack: 9605.. .. . .

.+.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 87 b2 50 10 .P.dx..590946000 s econds [Time delta fro m previous captured frame: 0.. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.dllstx01....590946000 Romance Standard Time [Time shift for this packet: 0..000169000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ....000 000000 seconds] Epoch Time: 141 5615213... (O.05083400 0 seconds] [Time since ref .`n. No.050834000 seconds] [Time delta fro m previous displaye d frame: 0.home TCP 1314 http→49 574 [ACK] Seq=9605 Ack=1 Win=46 Len=12 60 Frame 16: 1314 byte s on wire (10512 bi ts). ..541016000 cust-74-124-12138.com pc13.N.. '. 0030 9f 27 18 d4 0 0 00 .. 0010 00 28 4f 1a 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .@.E. Time Source Destination Protocol Length Info 16 0....ACK to the segment in frame: 14] [The RTT to ACK the segment wa s: 0. .P..corexc hange.... 2014 11:26:5 3..

.port == 80 || http 2] Ethernet II. . .... .........0...0.corexchange. ..... ..... ..... = LG bit: Globally unique address (fac tory default) .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .168...124...home (192 . .0 . . Src: cust -74-124-12-138.. . .. ....dlls tx01...erence or first fra me: 0......... .541016000 sec onds] Frame Number: 1 6 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. ... . .. .0 . . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ..11) .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..co m (74.138)... = LG bit: Globally unique address (fac tory default) .12.. . .. .1. Dst: pc13....

home (192. . Seq: 9605. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aad [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...168.corexchange... = Don't fragment: Se t .1.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf17d (61821) Flags: 0x02 (Do n't Fragment) 0.dllstx0 1.com ( 74.. = Reserved bit: Not set . Dst P ort: 49574 (49574).12..124.. ...138) Destination: pc 13.. = Differentiated Ser vices Codepoint: De fault (0x00) .. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: . . Ack: 1..1.. .. Src Por t: http (80).... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.0..

... ... . .... . ... = Urgent: Not s et . . .. .. = Acknowledgmen t: Set ... . ..0 . 0 . . ... ... 0. ...0.... = Congestion Wi ndow Reduced (CWR): Not set .... ... = Syn: Not set ..... ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xb7f 9 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 .. ....... .0. = Reset: Not se t .. . . ....1 ..... = ECN-Echo: Not set ....0] [TCP Segment Le n: 1260] Sequence number : 9605 (relative sequence number) [Next sequence number: 10865 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . = Reserved: Not set .. ..... = Nonce: Not se t .. = Push: Not set .. 0. 0000 0001 0000 = Flags: 0x010 (ACK) 000........ .0.. ...

`n.....+. .P."..E... 0020 01 0b 00 50 c 1 a6 2b c8 87 b2 9e 87 4e aa 50 10 .:... 0030 00 2e b7 f9 0 0 00 87 12 dc 69 84 31 54 2a 6a 02 ... ..Ah..a...*.t..J. 0060 a4 16 b2 32 4 f 1e 93 98 67 ce 92 53 e1 2f 1e 25 .-Z 0050 77 0f dc 09 7 4 cd 8e e5 30 d6 62 d1 cc 1e ca a0 w .:.RI./.pV. .. 00d0 55 95 63 72 4 5 8d b5 39 40 1a 36 da fe 70 56 a8 U .x!u. 00a0 83 18 7a 60 6 4 44 4a d0 61 ef 4a 0a b8 8d 5e 07 .Y 0110 4b 57 91 42 9 c 56 fe 99 55 1b ea a8 8a 95 15 22 K .. 00e0 6c 5c fb 8e 8 c 8a 39 db 23 0a 60 a5 94 24 20 cd l \.?....}@....C..O.. 00c0 be a7 90 0d 2 0 57 11 45 c9 69 0b f2 3c a0 cc b9 ..% 0070 f5 99 2b ed 5 6 ed f6 2c b7 fd 4f de 78 21 75 2c . ....0...G. .Y. 0100 7e a6 cc 3d e a 7f 13 50 77 62 c8 52 e8 f6 dc 59 ~ ... .Pwb....z`dDJ.+._y...N...6.9...=..1..dx..1T*j.b... 0010 05 14 f1 7d 4 0 00 31 06 3a ad 4a 7c 0c 8a c0 a8 ..i.. r.....2O..`... W.#.<+.9@.P...m_*. 0040 6b 2d 19 03 5 f 79 85 92 2a d4 b0 aa a4 b6 2d 5a k -.....crE.W.V..E.S....R. .(...J|.$ .i.^. 00f0 24 34 53 c1 3 f a7 c2 59 87 57 d5 6d 5f 2a a1 aa $ 4S. 00b0 bd e9 41 68 1 1 ab 80 f7 bd 28 e2 22 c9 d7 3a 9d ...g...e1 08 00 45 00 .. . 0080 14 72 8d 52 4 9 c8 9d b5 9d 43 e4 27 53 ef 9d 22 ." 0090 fd 62 a1 a1 4 7 a9 ff fb 92 04 ee 0f f3 3c 2b d6 ..<.... b.'S......

7......0..........a. ].Yw.Z.. ..B.. ..v.. 0190 89 37 54 5c 7 4 a9 42 dd 89 ab 04 c5 2c 0d da 1c ..-..9....... 01d0 d3 ec 36 91 e 6 89 4a 0c 5e 3e 01 52 a8 f1 aa fe .... 0170 8c 9b 91 1e 7 6 7f b2 bd e3 7c 98 f3 44 a5 94 55 . 0150 49 2b 8c b5 e f 25 21 1d 9a e8 99 70 2d 15 1c 27 I +.W..p-.c9.b?..2.<....`. ../(.' 0160 b1 c8 bc 55 f c bd 45 9d 9a b6 a4 f8 c6 ef c7 b5 ... ... 01e0 9f 5d 2e 60 1 1 03 c2 32 b4 1f 74 0c 80 0e 34 60 ..4. 01a0 65 94 ec ae b d 0d 59 88 3a b2 ff b1 76 cb bd 82 e ..D...%!...k..U 0180 87 8d 46 7f 5 8 80 c5 b0 32 00 8a ee 42 12 55 f4 .U.!U.v. Jp....$r. 0220 24 f6 d8 f5 0 3 83 7f 5a fa b2 fa 2e 4a 6a d6 c3 $ .Z.t. 01b0 fa 22 94 b0 8 8 2d d5 39 af c9 ae c6 24 72 d8 62 .TX... H....:...U.Y..... .B.|..c 0130 bc 48 d1 15 4 5 f7 11 f4 98 26 7e 95 d9 b2 c1 cc .Q.Jj..6... 0140 a0 4a 70 c2 8 0 51 b9 d5 e0 d9 6c a1 cc 89 14 0a ...J.4. ........B.. ..V...U..^>. 7T\t." 0120 95 80 62 3f a 9 41 0b 01 06 a0 6b ee 0b 30 88 63 .....z2.6.D....4` 01f0 28 19 7a 32 0 8 37 00 86 61 b6 34 ec 54 58 c5 2d ( ...... 0210 0d 91 b9 2f 2 8 e8 04 71 e0 59 77 f8 44 3b e6 b6 .F.. "..A.b 01c0 a5 8c f1 ce d 5 1e 36 a3 34 19 63 39 f3 3c ce ff ..M...E..X.2.... .R... ..E..l.R.q..0200 0a 09 21 55 d 4 af ec fc 17 4d d8 8d 52 83 5a c3 .&~....

X..C.4A...^... .v 02e0 2a 19 83 02 6 1 b2 ce c3 cb 6a 06 82 e1 fb 77 e8 * .P......h.jA.L 0290 c3 8f ad 1b f b 14 95 0f ce aa 45 ad 34 41 b6 d8 ..`.........d..< 0240 23 55 83 18 7 a 50 63 44 7a b0 63 0f 4a 0b fc 8f # U...1H.... 0250 4e 0c e3 09 4 1 74 11 6a 41 8c 61 28 77 53 db fc N ...J...... SU. 0340 02 db 86 d9 0 .. 0330 07 47 5d 53 9 7 68 10 92 8d 8c 31 48 b3 c6 9a cc .... 0300 f0 55 4a aa 3 d 0e 50 b9 d4 cc da 76 ef e5 41 49 ..zPcDz.a(wS.oYnf...E..f. G]S.. ..t...E. Ic..h............w.n.+... 02a0 23 52 d7 3b 0 8 ec 6f 59 6e 66 07 bd cc 5b 6b 98 # R....At.lY@Ye.. UJ.... 0320 ae 49 63 a6 9 9 43 00 1e 00 f3 6c 59 40 59 65 f8 ..[k.cWi.C.v. 0280 42 05 d2 6c 1 1 03 43 d3 6e a5 1d dc 35 15 e2 4c B .... k.T.=......j........ . 02c0 34 c5 9a d9 6 6 98 17 20 6b d5 9a 64 a7 38 28 28 4 ..Y!.5..@.).8(( 02d0 78 4b 71 92 6 0 e0 c9 36 02 29 fc 24 b5 1e ea 76 x Kq.......a..2.0230 36 ef d8 e6 1 3 74 dc 96 ff fb 92 04 ef 0f f3 3c 6 . 02f0 02 a3 9d 0b 8 9 80 2b 0c 85 a5 89 d4 a3 e6 98 8f ..$. 0260 69 bd 01 e2 5 4 95 bb 59 21 c6 89 47 08 60 a6 90 i .AI 0310 8e 53 55 ab 5 e db a1 76 02 bf d9 0f cf 58 d4 fd ... 0270 c4 bf 45 00 b 8 a3 85 40 84 13 b8 65 81 06 81 9d .`. 02b0 67 01 f6 63 5 7 69 be 93 f5 7d a2 68 d1 a2 32 e5 g ....l.v..c..}..G..6.e.

..I..H.#....d f5 cd 6a bc 8a b4 ed 02 5f cb 51 .Q.DRC.r.7e. ..J....a(. wH.....P. ..p{Bj 0450 4c 24 a2 50 6 d 97 13 52 46 c9 9b .Y...X..).0. . ... 0380 e5 37 e9 51 0 4 fb 36 e0 89 9a 9f c1 0e b1 ba 30 .L.0....M 03a0 33 8c 30 16 5 0 c0 88 9e aa cd 41 af a3 20 90 10 3 .{.. 0400 f7 7f e7 bf 8 b 48 f1 37 65 0c 00 8c 9e ed 1c 43 ..).z.Q[.H 0440 7c 20 d8 92 4 4 52 43 84 40 53 d2 0a 70 7b 42 6a | ...........`..fXBQ... 03e0 f3 0d 26 52 8 3 59 ca 50 5c e4 7a 70 67 38 4a 0c ..b2ye..Xg..... . ....H.. 03b0 db 77 48 e9 c 2 c1 aa a5 66 58 42 51 e9 33 91 be .x.C 0410 99 4c 01 45 3 7 02 74 42 8d a1 08 81 81 e5 89 50 .o...tB...E7..a.P 0420 7a d9 52 af 5 8 e7 4a d1 a2 10 ae b6 19 c9 6e e6 z .zpg8J.. L.. 7.L.X..0)K..Z..c)Au..j... 0430 26 ed b1 a9 b 2 51 5b 84 f3 b8 8e ec 5a 12 0f 48 & .. 0360 9c 60 d2 29 e 8 d3 d3 6f 0d 5d 9e c7 2d 36 98 5e .&R.n.P\...._....k. .Wn..A.@S....0 0390 24 51 2b 09 0 0 85 4c 16 58 c4 84 78 c0 60 8c 4d $ Q+.. 03d0 e5 fa 7b 97 3 0 bd b9 4c 92 be ff fb 92 04 ea 0f .....Q 0350 09 f4 6b b0 c 3 86 1e e7 a4 b9 49 b6 30 29 4b 08 . 03f0 24 8f 48 0d 6 3 29 41 75 92 29 81 9c 61 28 7f 3b $ .3.^ 0370 f8 86 72 4b f d 9d fb 58 67 7f ca 23 0e 07 61 cd .rK.....6..]...R. `.. 03c0 40 a1 72 dd 7 a a0 57 6e 18 a0 62 32 79 65 dc b0 @ ..-6.

Y....KL....RF..&'Z.P(..dllstx01..... 0500 18 64 80 ba a 4 47 0d 01 3d 0b 61 a0 e2 1f 03 7d .corexc hange..home TCP 1308 http→49 574 [PSH.. 0470 0e e0 23 6e 5 4 35 21 24 b0 11 89 b4 a9 84 93 78 .H.... .t..} 0510 07 48 70 a0 8 9 88 b9 52 36 8f a2 b9 89 f9 27 41 .c.`..`... 04c0 5f fd cb fe d 6 00 91 cd fd 4b 4c c8 c1 14 30 f4 _ ..0. 04b0 b4 bc a5 ee 5 7 6d 72 df 60 ab 77 72 d4 f7 d4 cb ...x 0480 98 a1 d3 35 e 1 ad 61 f2 12 59 ea 48 bd b4 b1 a8 .. .com pc13.+.. ....'A 0520 25 6e % n No.a..(.. 0490 ac 2a 22 60 0 7 50 28 02 ab 2b 2c 80 b0 74 fa 51 ... Hp...ca b3 b6 3f 5a L $.....R6. ...Yd....#nT5!$.....~.r].639020000 cust-74-124-12138. . 04e0 49 47 05 8d 0 c ed 00 f5 74 d0 6f 4d d6 7e cc fc I G.... *"`...oM. .. d..i..=.5..Cr.Wmr...."g.Pm.wr.a.. .Q 04a0 c3 09 69 87 9 8 f3 c1 8d ac 06 ea 59 64 d4 12 ba ..t..... ACK] Seq= 10865 Ack=1 Win=46 Len=1254 ..G.. Time Source Destination Protocol Length Info 17 0...Bu....0.%...?Z 0460 9d 94 cf 42 7 5 d7 72 5d 10 90 26 27 5a 06 0b c2 . 04d0 1b 01 e2 a1 0 c 18 d5 e4 60 84 28 01 63 08 e0 e9 .. 04f0 a9 ef b8 aa b 9 25 e3 22 67 f7 88 43 72 1a 30 03 ...

688950000 Romance Standard Time [Time shift for this packet: 0... 2014 11:26:5 3. . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. ...688950000 s econds [Time delta fro m previous captured frame: 0... 1308 bytes cap tured (10464 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.port == 80 || http 2] Ethernet II. . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .. .......Frame 17: 1308 byte s on wire (10464 bi ts).09800400 0 seconds] [Time since ref erence or first fra me: 0. .000 000000 seconds] Epoch Time: 141 5615213.639020000 sec onds] Frame Number: 1 7 Frame Length: 1 308 bytes (10464 bi ts) Capture Length: 1308 bytes (10464 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .098004000 seconds] [Time delta fro m previous displaye d frame: 0.. .0.

...0.. Src: cust -74-124-12-138..138).. . .. .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00..168.. ... . . . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .1....... .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .0.home (192 .corexchange. Dst: pc13.co m (74... ...0 .....0 ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 294 Identification: 0xf17e (61822) Flags: 0x02 (Do n't Fragment) 0....12. . .. = More fragments: No t set Fragment offset :0 Time to live: 4 9 .= LG bit: Globally unique address (fac tory default) .. . ....dlls tx01.124..... = Don't fragment: Se t ..... = LG bit: Globally unique address (fac tory default) . . ... = Reserved bit: Not set ... .. ..... = Differentiated Ser vices Codepoint: De fault (0x00) ........ .. .1.

. = Nonce: Not se t .. Dst P ort: 49574 (49574).. ... ..... Src Por t: http (80)... = ECN-Echo: Not set .. . ..... = Congestion Wi ndow Reduced (CWR): Not set ...corexchange..Protocol: TCP ( 6) Header checksum : 0x3ab2 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. . .. .124....home (192. ... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. ACK) 000.0... ... .12... 0000 0001 1000 = Flags: 0x018 (PSH. ..168. = Acknowledgmen t: Set . .1... .0 .. 1 ..138) Destination: pc 13. . = Reserved: Not set .. . Seq: 10865. Len: 1254 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1254] Sequence number : 10865 (relativ e sequence number) [Next sequence number: 12119 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. . = Urgent: Not s et .....com ( 74.dllstx0 1... Ack: 1 .. 0.1 ..0..

$`..n.u 0060 42 81 4d 3b 3 4 74 ad 85 bc 95 4b 4b 95 40 9d 4d B . = Syn: Not set ..U. ..1 0050 41 c0 70 0b 4 4 d6 44 c3 58 4d 34 fe 57 06 a9 75 A . 0010 05 0e f1 7e 4 0 00 31 06 3a b2 4a 7c 0c 8a c0 a8 ..M 0070 21 59 72 24 4 a b0 3c 66 71 47 97 75 2b 33 75 60 ! Yr$J..... .i...0... .KK.. .$R.D.. ..P...dx....E.... .. .Y..J|.o&..:..<fqG.P.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xc28 f [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2514] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ....M.D... ...N. 0030 00 2e c2 8f 0 0 00 96 93 55 9d 7a bd b4 52 63 84 ...1.. .~@..... ..+.... . 0020 01 0b 00 50 c 1 a6 2b c8 8c 9e 9e 87 4e aa 50 18 .... = Reset: Not se t ..R_.. 0090 ff fb 92 04 e a 8f f3 0e 24 52 83 59 c2 52 5f a5 ..u+3u` 0080 46 f7 6f 26 1 a bd aa 69 fb bb b7 ca b6 b7 10 a3 F ..... . 0040 24 21 86 86 6 e 06 4e d6 1c 24 60 e4 c5 ba 31 20 $ !..W.4t..z...... `n.Rc. 0...N.. = Push: Set ..p.XM4.@.. ....

.. 00f0 8e f4 90 aa 2 0 fb a6 32 87 11 2a 42 dd e0 55 1b .. 0190 12 bc 40 68 4 2 91 62 be e4 5f 8c 81 80 5e 73 95 ..<{.-a.00a0 3a 50 67 33 4 c 0c 20 9d 48 0c e7 09 41 82 14 e9 : Pg3L......d...6._.'..V....) ..v.}T 0140 5e 82 1e 8b 3 e 35 e7 ab d2 25 85 92 01 5d 24 f9 ^ ..b.... r.>.T...m...%.>5.o....P..a..B~. 0100 79 75 26 78 2 4 7c f9 a9 1d 5d df 6a 97 6d f2 21 y u&x$|. . 00d0 28 5e 30 28 0 5 00 af 21 67 d6 9a 26 33 40 7e 7a ( ^0(.0. 00b0 41 ac c9 30 b b a2 29 20 2c 68 80 b0 2a 31 3f 50 A ...2.i. 01b0 fb 2f 59 12 6 ... 0120 ee 72 89 88 5 4 9a ea 40 63 a1 9b 42 c1 92 cc 40 .....~t 0160 ef d5 a1 cb 9 b c7 3b 17 32 fc b1 ca d6 1f fc fa ..........1.@hB.2.j..2......p.]$....5m(.}... 0180 a1 04 a6 70 8 1 d6 36 2c 08 b0 98 a0 70 d8 06 d4 ..h.. ..@ 0130 20 c1 3c 7b 1 5 0f 27 96 3e 1d 42 7e 88 d0 7d 54 . x.*1?P 00c0 80 58 30 39 5 b a1 2d 61 e9 c4 42 c2 13 2c 31 83 .! 0110 47 43 96 ef f b 11 18 35 6d 28 f5 3f b6 8a 1f 96 G C.. ....A.P.B.... 01a0 99 78 c0 69 1 9 14 a6 09 a6 97 da 96 31 ca a8 ee .B.. . ..U... 0170 be 4e 17 16 3 2 0b f7 7d de 9e 6f fc 62 df ff e8 .@c.?..!g.. N..].b.H.^s......p. 0150 7b 88 02 50 9 8 64 9d 91 04 dd eb c3 61 c2 7e 74 { .*B......1. X09[. .......&3@~z 00e0 4f 48 c3 0c 7 6 a1 0f ae 50 f7 13 1a 56 d7 9b a2 O H.

./..e.. 6j..-...&R..H.&l.. ..Qt... 0210 a6 1a df b6 7 c 40 d5 3f f1 fb 30 08 65 0c d5 5b .6.(.z.01f0 9d 95 13 29 8 2 ca c9 00 36 b9 29 6d 3d 16 51 0c . `. 02c0 68 48 48 39 8 6 42 82 4a 56 54 e4 . 01c0 4c 75 45 71 c a 2a 9b 32 87 7a cf 17 87 26 6c 81 L uEq...b*r.....~.M2 0270 02 cb ea 91 1 e 0c 8a ae a0 61 e9 e2 d6 e2 7a bb . 0280 9c a7 0b 8b 9 f 16 e0 cc a0 77 a3 51 74 93 90 52 .....)m=.Q. 0260 50 74 22 e6 8 3 b4 0d 64 30 03 6c 38 5a c4 4d 32 P t".No..S.:Pk8J.N....D.... 3..:R.P 0240 5e a4 3a 50 6 b 38 4a 0c 50 8b 48 0d 67 09 41 81 ^ .[ 0220 ff 47 9f 62 2 a 72 de 28 08 78 b0 00 c2 09 f8 82 .. .. 01e0 68 7e 54 50 1 c 44 04 40 16 05 ad 02 8d bf cd 2d h ~TP.. 01d0 16 36 6a da b a 2f bd 6a ba d3 9b a9 e6 4e ef e4 ..4.. R...|@. .4 a7 0e 00 f2 33 80 dc f8 e9 2e 88 .E0Ol......2... ......z.y.?.w.j. ...x....a.. 0230 cd 60 ff fb 9 2 04 e8 0f f2 ed 20 52 03 79 c2 50 ....A. 02b0 8f b1 c2 0b a f 53 b2 9d 9a 98 99 34 03 f1 95 12 .P. .A..g..l3!..@.....).5 02a0 1e 33 b1 64 f f 8d f1 05 ce da a1 8e 26 52 c2 c1 ..3....0..%....]. ......... .l8Z..d0....d.R 0290 ac d7 3a 52 f 8 a2 4e 6f ab b4 fa e1 5d fe f3 35 . /Y.......*. 0200 c1 ce b6 d4 4 1 f2 6c 33 21 8e d2 25 a2 e9 7e 87 .d.... G.A.. 0250 15 e9 41 ac 4 5 30 4f 6c 98 a9 f2 15 2d 0b 1e b7 ..

...FF@... 0360 82 7c b5 ee 9 e c5 e0 2a 6f d2 24 b4 6d 77 39 06 .K.. |e. 02e0 07 0c 43 89 8 9 a0 83 a5 2d d1 07 5e fa fa e3 77 ..'.. 0370 4c 6e 17 26 f 3 67 1e 30 ba e3 6a 79 56 00 48 e0 L n...fY....t.T. .....JVT..&..".H..DM 03b0 7d a6 d8 94 4 0 22 41 57 46 67 49 49 21 57 58 76 } ... ......X.....5`8.. |... 0320 c4 57 55 81 1 3 58 e0 c0 46 46 40 f0 c7 67 a4 aa ... 0350 ab 7c 65 00 b b 84 a4 e5 ed 51 d7 54 db f5 a9 94 ...=...-...b&).9...aW.$.+g.T.<`9.. 02d0 48 39 b6 18 f a 60 a3 fa f9 f1 ac b7 3f 30 cc 09 H 9..jyV.z 03d0 1a d0 09 e5 c 2 ff fb 92 04 e7 8f f2 d4 1b 55 03 .Y...C...p.S%.94 2b 67 b8 f1 h HH9.<. t... 0390 26 64 49 fd 0 0 fd d3 da c1 3b 25 30 f5 59 83 57 & dI..fH.. 0310 40 86 64 a6 3 5 60 38 b8 a2 d2 07 50 36 2b 61 04 @ .d..+.@"AWFgII!WXv 03c0 78 89 54 ae a 0 66 59 d5 07 2b 18 3c 92 83 aa 7a x ...u...... 0380 48 a7 39 0c 3 c 60 39 92 28 91 05 a0 c7 19 27 8c H .Q....*o.K 0300 4f c3 f9 e1 7 5 86 66 48 0b bd 09 05 16 2e 42 e3 O . WU.. 0330 23 1e 9f e8 b 1 a9 22 1c c6 ff df df 37 72 9e 03 # ..g.$......B. 0340 28 24 1c 70 d 2 62 26 29 0d f8 b2 19 d0 74 a5 f5 ( $.....g..7r.?0.`.m...B..%0.^.(.W 03a0 c1 ec 3d b1 b 4 24 a6 cb 9e 18 61 57 09 cc 44 4d ..0.. ..mw9..P6+a.w 02f0 f6 74 9a 4b d a a3 ae a9 b7 eb 53 25 c4 6d 0e 4b .

.. 0450 ed f3 d3 da b d 86 d6 d5 dd 22 ac 0d 14 21 58 ca .2n.O...= 03f0 69 41 6d 8e a b 01 8c 2d 28 81 fe 3a ca 21 2c e8 i Am.. ..dV..]...C?... 04c0 00 e0 17 0f d 8 18 6a 1c 57 32 9c 12 c2 3c f5 e8 ..". 0490 ba 2f 65 ce e 9 f6 3f 61 1c b8 d5 04 c8 da 3e 4d .Q.*~.!X..c...... FT.... 04d0 b3 7a 10 ff 5 6 b7 b4 28 72 d4 ae 09 90 5d 87 5b ..2.[ 04e0 f7 46 54 df d 7 76 5c 6a b9 a6 e9 43 3f 3b af 76 ....../^ 0430 b6 ac da ca 9 8 e9 d7 ed 4b 12 88 04 48 2a e8 cc . $0.h@FaD+.3...J.?a..].. (\... /e.pS...j. .b.K....J.......4... 0400 0f a3 68 40 4 6 61 44 2b e8 a9 51 d8 4e 15 41 de ......:.H.... .....}X...T.(r...... 0470 bc d7 e1 e7 0 5 92 cf 32 6e e5 5b 29 f9 4f dd 87 . 0460 c4 ce 08 41 0 d 0c 34 8a 09 70 53 fd 19 a3 22 03 .. .g...%).v ..@.C...-(.....J.. 0440 ea 28 5c db a c 3b 1e e8 c5 b9 03 e5 96 13 9a b4 ..../04b0 e0 24 30 a9 2 5 29 15 0c 43 f0 ca c2 63 83 52 9a ... 0420 6a c5 1e c1 1 c 40 e5 c2 f1 19 32 01 33 2e 2f 5e j ..>M 04a0 59 6c ab 64 5 6 ec 04 b0 d1 8a 9b da 54 e9 2f 2d Y l..H*...R..A.v\j..V.U...<...N.A. ... ....... . 0410 08 a8 4a a4 4 8 1e 2a 7e e1 11 ab 62 0e 9a d1 ae .".. 03e0 58 79 c0 5d e 3 fa 90 67 0f 4a 0c 10 7d 58 0c 3d X y...W2.... 0480 59 bb b2 4a 0 6 c8 a3 80 d9 d8 b4 22 b5 9a 19 b7 Y ..[). z...."........!.

00018100 0 seconds] [Time since ref erence or first fra me: 0. No.689131000 s econds [Time delta fro m previous captured frame: 0...X.000 000000 seconds] Epoch Time: 141 5615213. Time Source Destination Protocol Length Info 18 0.rR.689131000 Romance Standard Time [Time shift for this packet: 0..c.04f0 3f 5a 08 85 7 f 6a 40 b8 63 a7 47 96 fe c4 8b bb ? Z.639201000 pc13.000181000 seconds] [Time delta fro m previous displaye d frame: 0.-..dm.>.. . 2014 11:26:5 3...cor exchange. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..9j 0510 91 b6 58 f5 6 7 7f ff f5 6b f5 3e aa .g. .&.k..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =12119 Win=40115 Le n=0 Frame 18: 54 bytes on wire (432 bits).home cust-74-12412-138.639201000 sec onds] Frame Number: 1 8 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke .dllstx01. 0500 c6 da 82 64 6 d 1f 26 19 9a 2d 95 72 52 b2 39 6a ..G.j@.

. ....1... = LG bit: Globally unique address (fac tory default) .12.. .. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .. Src: pc13 .. ........home (192....port == 80 || http 2] Ethernet II. . . ...... . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .com (74.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.....dllstx01..1 24...138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.0. ... .0 . .co rexchange... .. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . = LG bit: Globally unique address (fac tory default) .11 ). ..0 . Dst: cust-74-124 -12-138...... . = Differentiated Ser vices Codepoint: De .. . ....168....0. ... . ..... ....d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . . ..

124. 0000 0001 0000 = Flags: 0x010 . . = Reserved bit: Not set ... ...fault (0x00) . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 12119 (r elative ack number) Header Length: 20 bytes .dl lstx01. com (74.0....12...corexchange.. Seq: 1.. ..1.168.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f1b (20251) Flags: 0x02 (Do n't Fragment) 0...ho me (192.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = Don't fragment: Se t .1... Src Por t: 49574 (49574).. Ack: 12119 ... D st Port: http (80). = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. ..11) Destination: cu st-74-124-12-138.

..... = ECN-Echo: Not set . .. = Congestion Wi ndow Reduced (CWR): Not set .. .. .N.0 ... = Nonce: Not se t ..... . .. 0. .P. ... . .... . . .000181000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ..... . ..1 .. ... = Acknowledgmen t: Set ...0.. .@.. . = Syn: Not set ... ........... = Reserved: Not set ....`n.. . 0....P...... ...+.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 91 84 50 10 . = Push: Not set ..0 = Fin: Not set Window size val ue: 40115 [Calculated win dow size: 40115] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 17] [The RTT to ACK the segment wa s: 0.. . 0010 00 28 4f 1b 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ..0. .....dx.. = Urgent: Not s et ...... . ....... .. 0030 9c b3 18 d4 0 0 00 ..(ACK) 000.. = Reset: Not se t ..E.. (O... 0 . ..0..

... .com pc13. No.dllstx01.home TCP 1314 http→49 574 [ACK] Seq=12119 Ack=1 Win=46 Len=1 260 Frame 19: 1314 byte s on wire (10512 bi ts).000 000000 seconds] Epoch Time: 141 5615213. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.803957000 s econds [Time delta fro m previous captured frame: 0. 2014 11:26:5 3..corexc hange.114826000 seconds] [Time delta fro m previous displaye d frame: 0.11482600 0 seconds] [Time since ref erence or first fra me: 0. Time Source Destination Protocol Length Info 19 0.803957000 Romance Standard Time [Time shift for this packet: 0.754027000 sec onds] Frame Number: 1 9 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule .754027000 cust-74-124-12138..

.. .....12..corexchange..0 .. ..138)........1. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... . . Dst: pc13. .port == 80 || http 2] Ethernet II. = LG bit: Globally unique address (fac tory default) ......String: http || tcp .. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 . = Differentiated Ser vices Codepoint: De fault (0x00) .... . ..124... . Src: cust -74-124-12-138..dlls tx01......... .0.. ..... ... . .. .0 .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ...co m (74..... .168......0... .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .home (192 .. = LG bit: Globally unique address (fac tory default) . .. ...

... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aab [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138... . Src Por t: http (80).12.Identification: 0xf17f (61823) Flags: 0x02 (Do n't Fragment) 0. Ack: 1 .168.0. = Don't fragment: Se t .. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.home (192...com ( 74. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 12119 (relativ e sequence number) [Next sequence number: 13379 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . ... ... Dst P ort: 49574 (49574)..1.1..dllstx0 1.. ... 0000 0001 0000 = Flags: 0x010 (ACK) 000. = Reserved: Not set .... .138) Destination: pc 13.. . Seq: 12119.124.corexchange. = Reserved bit: Not set .

= Congestion Wi ndow Reduced (CWR): Not set .. .0 .. .... .0.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x133 e [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ...m0050 12 b4 3c d1 4 a 9a 0a d6 c4 01 fa 4a 15 29 52 0e . .a 0040 07 58 19 a6 4 a 49 7e 34 00 82 8a 92 d8 09 6d 2d ..0......... .. .. .dx. 0010 05 14 f1 7f 4 0 00 31 06 3a ab 4a 7c 0c 8a c0 a8 ... . = Urgent: Not s et ..JI~4. = Nonce: Not se t ..#ZV.... .E... . `n.... ...... 0030 00 2e 13 3e 0 0 00 12 02 23 5a 56 a4 a8 c0 f8 61 . = ECN-Echo: Not set ..>. .. = Reset: Not se t ..1.. 0 .. .. 0.. .@.... .... ..J|. ......N... X... ..0.... 0020 01 0b 00 50 c 1 a6 2b c8 91 84 9e 87 4e aa 50 10 ..... = Acknowledgmen t: Set .. . 0.+.P... .....1 .....:. . .... .... .. ... = Push: Not set ..... = Syn: Not set ...P..

-[@B" 0150 45 d9 4c 05 1 9 87 2d 63 96 a9 a5 9a fc b2 96 5e E . ..*...t....2\...^ 0160 bb 96 2c c1 3 0 1f 8c fb 9d 8c f1 ee ae e1 bf b5 . 0120 fd bb a8 88 5 a b4 78 18 08 7e 54 9a da a0 6f cc .. .. .. ..... 0060 38 8a a1 ce 2 4 42 32 53 1f 42 4e 0a 00 2e d0 7e 8 ..8.. 0110 a1 ec 30 bf 9 7 7f 1f ad 9f 95 39 f5 07 08 89 7f ..J.0.'....YGC 00d0 06 a8 08 1c a 8 cd 38 8a 31 a6 a2 b1 e5 f2 22 22 ......0C....f 0140 83 09 73 41 6 6 ac c2 63 c0 96 f7 2d 5b 40 42 22 .c...~ 0070 33 43 70 88 e 5 03 4e 6e 14 87 96 74 fa 99 52 d6 3 Cp..a......./a.. .sAf... '.J.R. 0090 08 ff fb 92 0 4 ec 0f f2 f2 15 d5 03 2f 61 c0 5c ....... 00b0 a8 c1 ac e1 2 8 14 58 ab f2 85 c9 b8 fe aa fe b5 .8..c6...BN..j.Nn.Vm..$B2S...F[-.~T.......?............1.... 0100 b1 27 c2 02 c 2 c6 13 56 6d cd cd 38 d9 c5 e5 15 ...)R.... ..A.x.......|}F. 0080 71 9b 8b b2 f 4 e1 49 e7 de e6 f0 84 86 41 e3 88 q .L.... ......0.9. 00c0 2c 0a 63 36 c 2 4d a2 63 1e 84 0c a8 c6 59 47 43 .I.....o..<. 0130 cd c5 b9 27 9 4 8a 92 45 73 4d b3 b9 3f 05 ce 66 ... .c....... 00f0 36 88 fc b4 6 a ae 9b 30 43 89 32 5c 89 74 95 ed 6 ..... ...J.\ 00a0 a3 fa a0 61 e b 4a 0b 7c 7d 46 0d e1 69 41 97 10 .Z...EsM.iA.... ..t...M.(..."" 00e0 6d a6 cb 13 4 6 5b 2d 82 2a bd b3 8f bb 94 dc 9d m .. .X.-c.

....5..@...01a0 21 9c c1 41 d 7 a4 ce 2f ea 9d 02 08 97 17 68 74 ! ..r....ZP. . 01d0 b0 b9 e0 97 f f e8 54 89 0a 76 10 39 e9 fb d0 db ...AnK..v.h. 0230 1e 36 c9 ff f b 92 04 ec 8f f3 2c 23 d0 03 4f 7a ...0170 b0 cb ea 2c a 7 3d 60 fb f5 91 00 18 98 e8 fa 20 .A.L....?2.Z...a(. ...Oz 0240 50 62 e4 8a 0 0 6b 38 4a 4a d8 93 46 0d 63 09 41 P b.v'.<jXI.9.....H.?. 0190 d6 2c 2a 58 e d 48 c2 13 3f 0b c2 90 80 4c 16 2d .......jJ....S..#.? 01f0 37 e1 ca fa 4 0 83 9b 03 ea f3 c2 33 3a 57 ea d7 7 .@.P8..`. 01e0 05 21 35 87 5 2 36 f0 0d 04 42 13 89 76 27 03 3f .... . 0200 c3 c1 93 2b 0 c d1 c2 38 80 05 00 da 68 81 05 24 .F...L...A 0250 73 90 68 01 b c 61 28 a4 a3 ab ff 41 6e 4b 03 07 s ........ !5......8.R6. 0220 32 c1 b1 93 d 6 9b df 32 4a cb 5a fa 98 96 a6 a5 2 . 0280 1e a5 b1 f1 9 . 0180 2a 94 cf c2 4 c 2c bc d1 46 93 1d 98 a8 13 82 af * ...*X......}...3:W.....F..r#Y) .2J...... ..=`....... .....B.T. 0260 00 28 22 2b 1 1 0c 19 40 b8 60 1b 90 bd 5a 50 a4 .$ 0210 52 22 87 cb 8 3 3c 6a 58 49 11 ec 0e 4c 76 2c cd R "..c.k8JJ..ht 01b0 af 62 92 ac 3 5 95 6a 4a b5 72 ca a5 16 3f 32 d7 .. ("+... 0270 84 84 b6 a5 9 4 b7 1f aa b2 e8 72 23 59 29 20 e9 .. b. 01c0 15 c4 53 b4 7 d a9 ba b2 50 38 aa 19 16 02 06 03 .Lv...h..... ..+...../........ 6.

.....k. `.Q.. v.A..E 0340 25 8e 41 b1 5 0 14 86 31 82 4b b8 31 37 f3 2e 06 % . 02e0 04 f6 20 76 d 3 6d 0c e1 50 74 ae cd 0e 07 51 10 .^..0 02c0 2c 60 87 a7 0 0 10 21 82 2e 03 5f 6b ed 7d 68 14 .m. 0370 fc 52 fe d8 9 a 86 00 80 c3 af 9b c2 35 67 ac bd .....!.|M....w... 0360 52 6c ea 24 9 1 dc a9 12 99 87 6b df 7b bd 77 bc R l. aES....@.... R.L.{.. .W.e a9 bd 35 36 31 a0 cb 32 59 52 87 ...$... 4u&M...8. 0290 28 98 0f 0b a 9 02 e1 11 2a a4 4c 15 cf 0d c3 55 ( .K..'@9.....!.MK1~...Q.....Pt... ..Zf"...17. 02d0 01 7f 2a 09 7 c 4d d8 93 65 03 c4 21 87 2e 05 b5 .C.]%^R.P@ 0320 79 d1 43 93 0 f 51 0e 4e 8b 3f 76 d1 08 89 ac 7e y .e.....1.561.N.....*.Q. . 02b0 50 d3 ea 40 b 5 4d 4b 31 7e c9 cf ff a1 00 09 30 P . 0380 cb 61 45 53 9 c 5a 66 22 d5 6b 4c 58 7a 12 e2 10 ..?v.w../ 0310 51 57 64 cc 0 d 9e 93 8b 51 aa 8b 4a 14 84 50 40 Q Wd. ....U 02a0 25 24 c0 57 1 d 89 2c be 64 91 93 d6 9b de a3 89 % $.5g.d. 02f0 f1 34 75 26 4 d 8e 16 74 56 47 0b 0b 27 40 39 10 ........ 0390 5a 2e 96 50 f 4 e1 07 41 a1 87 fb .......*. 0300 52 27 50 29 1 b 8e ea dd 67 4c b7 73 33 4b b5 2f R 'P)..........}h.s3K.....J.kLXz.gL.tVG.2YR.~ 0330 65 97 b3 38 b 4 71 9d a3 9b ff 03 c3 ca c1 0c 45 e .q.P.._k... 0350 ba 12 fd 5e c f 94 eb f6 77 fb 5d 25 5e 52 d9 17 ......

M...=0L.......gK. ..P...C..!Pa.-"w..k.. 03e0 39 92 60 61 2 5 ca 10 6f 10 4c 0b b0 b9 48 0d e2 9 ...dk(....N.W..WS 0400 fe b7 d6 1e 6 7 4b 91 04 61 87 05 01 a8 35 45 44 ..H. . 03d0 87 c0 64 6b 2 8 ff fb 92 04 ed 8f f3 0d 2e d1 83 .n..#4@...Ht. e. .... 04a0 3a 99 94 9d b c 73 25 91 a9 04 20 f2 ca fe ba 58 : .r. .. .D.=d.v....&..`.....^?...h.z.Wb. 0420 ee 65 dc 97 a b d9 90 c8 8c 0a 86 d7 ed 8e 41 84 .. 0480 3f be aa 31 2 4 a6 15 92 9b 61 1d 8c a0 a6 ca 5e ? ..z. 0440 06 d7 94 17 8 6 c3 2f af 3a 87 b9 c2 eb 26 a3 e1 ..........o..q 03b0 79 3e 07 57 f b 1d 76 ec 28 7b a9 46 fb 39 bb e3 y >.{....({.`a%.F...... 03c0 14 a5 18 ad a 3 44 62 10 70 06 a7 ef 29 42 c3 f7 .....J.v 0470 5f 1d 5e 3f 0 8 83 a2 d2 f7 b3 85 50 e3 3d 64 a3 _ .. ...... 0450 39 a5 8b c8 2 1 50 61 e8 6e b0 b1 72 00 4e b7 b9 9 ... .5ED 0410 15 85 80 43 0 b 68 eb 7a 2c 6f 8e f4 7a 93 b6 1f ..3b 7b 3b 1a 5d Z ...^ 0490 b5 98 6f 65 d 9 ac 2d 22 77 ec 85 d0 4d b3 65 f8 ... 0430 07 85 06 12 0 a 44 17 06 d8 23 34 40 82 db 91 02 ..o..A.] 03a0 56 71 9c 95 3 8 3c 21 b8 c1 48 74 e5 2e e6 2c 71 V q.a./.:.....A.a..oe.L....p.Db.........)B. 0460 2c 90 cb fd 0 9 2e 60 09 0a 57 62 e2 6b ad d6 76 .8<!....P... ...e....1$. . 03f0 09 81 88 95 e 8 c1 ac 3d 30 4c f9 4a c0 83 57 53 .9..

...$...home TCP 886 http→49 574 [PSH... ........788028000 cust-74-124-12138.c.dllstx01.000 000000 seconds] Epoch Time: 141 5615213.s%. 886 bytes captur ed (7088 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...iF..... 04e0 e1 70 e8 c4 1 4 94 0f 87 42 19 41 76 28 a8 bc 69 .837958000 s . p.Q.com pc13.. spP..837958000 Romance Standard Time [Time shift for this packet: 0..nyo.3..i 04f0 29 70 eb 0b 9 3 65 20 ae c4 70 b1 04 c1 f2 51 ae ) p.... 0520 d5 21 ..vg#q.tuY..Av(.!._. 2014 11:26:5 3.... ! No.....U. 0500 af 17 19 1a 1 0 21 07 b4 af 06 74 75 59 87 61 66 . .af 0510 7b 6a ac fb 7 d f5 ae d9 6e 79 6f fc 5f ff fb e6 { j.X 04b0 93 23 d8 69 4 6 ed 19 bf 33 d4 d7 b7 63 f8 e3 fe . Time Source Destination Protocol Length Info 20 0.. ACK] Seq= 13379 Ack=1 Win=46 Len=832 Frame 20: 886 bytes on wire (7088 bits )..B..e ....p.... 04d0 ea 73 70 50 f 0 aa da c3 da 08 24 c2 dd d3 55 f7 ...corexc hange..}.. #.. 04c0 bf ff ff ea 8 b 97 d4 64 ec 41 bd 76 67 23 71 e6 .A. .d.

.. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)..034001000 seconds] [Time delta fro m previous displaye d frame: 0....... ... ... ....port == 80 || http 2] Ethernet II. .. . ... = LG bit: Globally unique address (fac tory default) . ....0 .... ... .. ..econds [Time delta fro m previous captured frame: 0........ . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .0.... = LG bit: Globally unique address (fac tory default) .... .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . . .. ...... . ....03400100 0 seconds] [Time since ref erence or first fra me: 0. . ....788028000 sec onds] Frame Number: 2 0 Frame Length: 8 86 bytes (7088 bits ) Capture Length: 886 bytes (7088 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . ..0.. ....0 ... = IG bit: Individua .

1..dllstx0 1..com ( 74. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c56 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .12. .. .. = Differentiated Ser vices Codepoint: De fault (0x00) .dlls tx01..1.. = Reserved bit: Not set . ... = Don't fragment: Se t .1.168...124.138) Destination: pc 13. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.124..138).co m (74....168.l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro . Dst: pc13... Src: cust -74-124-12-138.0.corexchange.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 72 Identification: 0xf180 (61824) Flags: 0x02 (Do n't Fragment) 0..home (192.corexchange.home (192 .12.

l Protocol.. . Len: 832 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 832] Sequence number : 13379 (relativ e sequence number) [Next sequence number: 14211 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .1 ... ... ACK) 000..... = ECN-Echo: Not set ..... Seq: 13379.. . ... . .. = Push: Set . 0. = Acknowledgmen t: Set ... . = Reset: Not se t ......... 1 ...0. .. .. ... = Syn: Not set . .. . . ... . ..... . = Nonce: Not se t . = Congestion Wi ndow Reduced (CWR): Not set ....0 .... . ... ... Ack: 1 . 0. .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x8a7 5 [validation disab led] [Good Check sum: False] [Bad Checks .. . = Reserved: Not set ..0..... 0000 0001 1000 = Flags: 0x018 (PSH... = Urgent: Not s et ..... Src Por t: http (80)... ... .. Dst P ort: 49574 (49574)...0.

UW... 0090 0f f3 04 25 5 7 03 0f 62 50 62 e5 9a f0 61 e9 4c . m....3 0050 34 73 42 f4 4 b 8c 62 c7 08 95 51 a2 c4 f1 9b 56 4 sB.?.u..Ir.E.H.D. 0020 01 0b 00 50 c 1 a6 2b c8 96 70 9e 87 4e aa 50 18 . ..._-.!)z 00b0 49 66 57 96 a d 24 af 35 45 12 86 91 19 4b ea 7a I fW.P. h.p.'..K...0 00d0 29 e8 e3 65 1 9 d3 67 15 bb 07 4c d0 f9 a5 75 ff ) ..... 0010 03 68 f1 80 4 0 00 31 06 3c 56 4a 7c 0c 8a c0 a8 ..N...<VJ|...um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2092] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .@.D.Q.......z 00c0 48 8c d3 a5 1 1 44 a4 55 57 df 54 fa 0b 05 f5 30 H ...j8. 0040 3d f5 a3 53 6 c 9e 15 44 d2 3d 99 3a 85 d0 a0 33 = .V. 00e0 5a 25 bf dd 8 5 27 8c 52 89 3b 1a de 5f 2d aa 69 Z %..^.Sl....bPb.e6K^.V 0060 89 6d fb b0 6 2 79 ce c7 96 35 bc be 5e f7 a4 b2 ..u....1..=...T......R....$..x.....L 00a0 0b e8 a1 64 0 c 31 89 49 72 91 ac c1 86 21 29 7a .b 0080 27 96 48 b0 7 8 dc 1e a6 a5 b6 b3 ff fb 92 04 eb ' .a.5E.g..:....b.1.L.by.E. `n.d.. ..5. .i 00f0 2c 94 65 e3 b ..G.......e.P... 0070 65 df 3f ec c f db c6 bd 56 bd 65 36 4b 5e d1 62 e . .. 0030 00 2e 8a 75 0 0 00 6a 38 af f1 e2 b2 45 e5 47 0e ....dx.......%W.K.+..

~.J.......iF...'%P...C..z... . 0160 2f b1 e0 b8 2 0 05 33 32 1b 7e 87 20 3a 1a bd a9 / ...?..6.6w...(..IG ..y|2.. . .PO.Q$ 0140 c6 dc 82 de 3 5 e5 51 86 28 bb f1 4f 6d fe fb 24 .. .H........3......~.+.(......[.:*...t 01c0 c8 7e c7 83 8 8 4a 2e e8 89 3f 56 82 ec 65 15 ef ... 01b0 60 f9 82 36 d 2 d6 75 a3 99 b7 2c 23 56 c1 0e 74 ` .... 0110 10 49 f4 54 4 f 4c 5e 90 58 85 a9 88 88 1e 22 2a .......g..B# 0130 66 91 19 2d 1 3 c7 58 72 14 97 60 de b9 e8 51 24 f .....V.Q.5. I..e.r 0180 31 18 97 43 8 3 c6 46 91 92 a8 79 7c 32 17 1d a4 1 ..3.Om..b d3 3f 8f 1a e7 56 bd 65 14 e6 b5 .-.. ."* 0120 a7 6c 66 64 4 f 36 0f 0e 1c 27 25 50 c2 ee 42 23 ..0]...-B.. :. 0170 a1 c2 88 d1 a d 2d 42 86 67 0b b5 db 58 b2 f8 72 ...[...u...Q"d 01f0 68 fa 8a c1 a 3 48 8b 99 32 0e 3b aa bb 82 33 ef h .... 01d0 2f ff 8b bf b b e7 fd b3 4d 02 33 ca d9 d2 d7 41 / .... .TOL^.Xr.... 0200 59 3b 94 a5 e 1 a3 2f d1 72 95 3a ..?V.".$ 0150 7f ba f4 f0 e f 5b 2e bd f5 d9 db 36 77 b6 bb ee .8d.e..M. 0100 ed 16 d4 bc f 5 7a ed b9 5b fa da 22 a1 6d ac 0c .32.. .e. 0190 47 48 99 30 5 d 84 2b c1 72 43 70 76 a1 69 46 0d G H.. 01a0 d4 04 49 47 2 0 c3 80 00 08 0e f8 86 af 3a 2a b0 .A 01e0 13 4d 80 e9 d d 28 85 38 64 c8 50 4f 16 51 22 64 .F. lfdO6.#V.X....m.X.2..`... M..rCpv.

9.D3./....._..mQ 02d0 5a f0 9f 31 b 8 e9 b2 47 0a c4 cb c5 58 f6 5a 49 Z ..G...X..! 02b0 63 e3 12 d3 d 0 f5 c3 1f 75 f2 2e d1 68 59 f3 ea c .5c c4 44 33 de Y . ..`.0.H..f.D..)............a 0240 86 5c 0b a8 d 9 62 07 a4 cb 81 8d 1b 2c 01 84 8d .....Wu-^ 0310 76 47 aa 46 6 e 28 63 5a f4 34 9c a8 55 2d 81 e3 v ..b'. 0230 04 ea 0f f2 e 3 36 d9 03 09 32 e0 62 27 fb 10 61 .} 0220 33 fa 73 61 4 b 0e a0 88 36 1d 68 86 ed ff fb 92 3 ..... x.2.i 0260 dd 78 85 8b 0 4 c2 9d 2a 38 fa 8d 07 0c dd 85 f3 ..'. 0250 71 2b 40 33 2 6 59 f6 98 5d 51 ab 90 27 6a b0 69 q +@3&Y....6....J..=..... . \. Ut....]Q. 0280 51 ba f3 4d e 8 d2 95 c3 4d 77 93 8c 99 41 26 b1 Q ..'j..y.... 0290 10 55 74 e4 3 d cd af 03 92 11 19 5e 6d 2a 59 ba . 02c0 56 32 e6 a9 4 4 13 73 24 e1 35 1d f5 7f 02 6d 51 V 2... 0270 86 4a c5 a7 1 9 a1 f2 a5 c5 f5 27 a5 48 b1 9b ad ..G.Mw.. J..^m*Y.... ..r. g..2 02f0 9c fc fe 4a a 7 d5 b6 29 b7 06 04 47 98 1d 7a 5e ......[l.wQ..."XG. .s$.A&..b.saK.ZI 02e0 1c cc 22 58 4 7 7f 20 58 13 86 ef 60 ea db b0 32 ....u. X..hY. 0210 cb bb b6 cc 1 d 66 c6 39 af 9b aa 9b 77 51 0e 7d .:\..M......1..Z...X)...}b..z^ 0300 27 68 c5 5a 1 0 15 79 8d cd 5b 6c ae 57 75 2d 5e ' h..........h...6. 02a0 88 67 a4 5f a 6 58 29 ce 1c 30 0c 7d 62 03 a8 21 .*8..5.

N.{..dllstx01..788201000 pc13..7 0350 a9 8f df f3 c 6 35 56 b3 36 ef 7b df 67 89 06 02 . 0340 83 82 eb 6e 9 0 3c c6 e8 86 3c 9d 1f 59 0c 9f 37 ..<. Time Source Destination Protocol Length Info 21 0. . ..8..5V..000 000000 seconds] Epoch Time: 141 5615213...._i 0330 08 c1 6b ad d 9 e8 de 65 35 17 d8 f5 85 85 7a fc .U-.n. 2014 11:26:5 3.. No.cor exchange. ..k.n.. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..000173000 seconds] [Time delta fro m previous displaye d frame: 0. 0360 cd 17 38 0d b c c1 a1 c1 21 f3 6e 11 38 55 c5 56 .4.838131000 Romance Standard Time [Time shift for this packet: 0..Fn(cZ...V 0370 6a db 57 9a f a 15 j .e5.838131000 s econds [Time delta fro m previous captured frame: 0.z..AS.<.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =14211 Win=40320 Le n=0 Frame 21: 54 bytes on wire (432 bits).g....G.W. 0320 4c 36 0d 0e 4 e 8f 93 15 14 41 53 80 15 eb 5f 69 L 6..!...Y....00017300 .8U.home cust-74-12412-138.6. .....

0 . Src: pc13 ... . .com (74.. .....0 ... . .... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. = LG bit: Globally unique address (fac tory default) ...home (192..1. ...... ......dllstx01.co rexchange.. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . ... ...788201000 sec onds] Frame Number: 2 1 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. .. ...... . . . ...... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ....0.0.1 . .. ..port == 80 || http 2] Ethernet II... .168.... .... = LG bit: Globally unique address (fac tory default) ..... .11 )... .0 seconds] [Time since ref erence or first fra me: 0. Dst: cust-74-124 -12-138. .

138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. = Reserved bit: Not set . .....corexchange.168.dl lstx01....12... Ack: 14211 .11) Destination: cu st-74-124-12-138.0.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f1c (20252) Flags: 0x02 (Do n't Fragment) 0.138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Src Por t: 49574 (49574).. com (74.. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: .. .ho me (192.124... ..1.12. = Don't fragment: Se t .1. Seq: 1. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.24. .. D st Port: http (80). = Differentiated Ser vices Codepoint: De fault (0x00) ..

.0. ... 0000 0001 0000 = Flags: 0x010 (ACK) 000... ...1 . 0 . .. = Push: Not set . = Congestion Wi ndow Reduced (CWR): Not set ...000173000 seco nds] 0000 90 01 3b d0 1 . . .... .0.... .... ... .0. = Nonce: Not se t .. .0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 14211 (r elative ack number) Header Length: 20 bytes . .. ......... ... . 0.... = Reserved: Not set ..... .. = Reset: Not se t . ...... 0. .... . . = Syn: Not set . . .. = ECN-Echo: Not set .. = Urgent: Not s et ....... ...........0 = Fin: Not set Window size val ue: 40320 [Calculated win dow size: 40320] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 20] [The RTT to ACK the segment wa s: 0.0 ... . = Acknowledgmen t: Set ..

..7 e1 08 60 6e 7f 64 78 08 00 45 00 .. Time Source Destination Protocol Length Info 22 0..E...000 000000 seconds] Epoch Time: 141 5615213. .+. ..896737000 s econds [Time delta fro m previous captured frame: 0. . 86 bytes captured (688 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.P..home livebox.`n.846807000 sec onds] Frame Number: 2 2 Frame Length: 8 6 bytes (688 bits) Capture Length: 86 bytes (688 bits .N.124. 2014 11:26:5 3.896737000 Romance Standard Time [Time shift for this packet: 0.in-addr... No.058606000 seconds] [Time delta fro m previous displaye d frame: 0.. 0030 9d 80 18 d4 0 0 00 . 12....@.846807000 pc13.. 0010 00 28 4f 1c 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .a rpa Frame 22: 86 bytes on wire (688 bits).05860600 0 seconds] [Time since ref erence or first fra me: 0..P..dx..74.home DNS 86 Standard que ry 0xaf5a PTR 138.......J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 99 b0 50 10 . (O.

...168....1..... ........ ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.0 .. ....11 )... . . . .. .0...1) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .. Dst: livebox. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.0 .. .home (192. = LG bit: Globally unique address (fac tory default) .. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)...... .. . .. ........1... Src: pc13 ..hom e (192.. = LG bit: Globally unique address (fac tory default) .00 = .. = Differentiated Ser vices Codepoint: De fault (0x00) ....... . .. ... . . ..168...) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II..0.. ..... .. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . . .

.168. .. .1.. Src Port: 4977 9 (49779).Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 7 2 Identification: 0x4f1d (20253) Flags: 0x00 0.. = Reserved bit: Not set ..1. .ho me (192.1) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.... .....0.11) Destination: li vebox..168 . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: UDP ( 17) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13... . = Response .. = Don't fragment: No t set ... Dst Port : domain (53) Source Port: 49 779 (49779) Destination Por t: domain (53) Length: 52 Checksum: 0x83a 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (query) [Response In: 4 5] Transaction ID: 0xaf5a Flags: 0x0100 S tandard query 0......0. .home (192..

..4.. .12.... 74...... 0030 00 00 00 00 0 0 00 03 31 33 38 02 31 32 03 31 32 . 0. .in-add r.. = Z: reser ved (0) ..in-addr......in-addr. Time . . .. ....0....... .. = Non-auth enticated data: Una cceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries 138.1 ..arpa: ty pe PTR...124. = Opcode: Standard query (0) .12.. .. ..... ....124.. .. .. HO. ..12 0040 34 02 37 34 0 7 69 6e 2d 61 64 64 72 04 61 72 70 4 . 0020 01 01 c2 73 0 0 35 00 34 83 a2 af 5a 01 00 00 01 .: Message is a quer y ......arpa [Name L ength: 26] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . class IN Name: 1 38.. = Truncate d: Message is not t runcated .. = Recursio n desired: Do query recursively ....138....s... . 0010 00 48 4f 1d 0 0 00 80 11 00 00 c0 a8 01 0b c0 a8 .... . No. ..74..dx..000 0...Z. .......arp 0050 61 00 00 0c 0 0 01 a ..E... ..12.0 .5.`n..74. ..

2014 11:26:5 3.com pc13.000 000000 seconds] Epoch Time: 141 5615213.957962000 s econds [Time delta fro m previous captured frame: 0.061225000 seconds] [Time delta fro m previous displaye d frame: 0.dllstx01. Src: S .home TCP 1314 http→49 574 [ACK] Seq=14211 Ack=1 Win=46 Len=1 260 Frame 23: 1314 byte s on wire (10512 bi ts). 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.06122500 0 seconds] [Time since ref erence or first fra me: 0.corexc hange.957962000 Romance Standard Time [Time shift for this packet: 0.908032000 cust-74-124-12138.port == 80 || http 2] Ethernet II.908032000 sec onds] Frame Number: 2 3 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .Source Destination Protocol Length Info 23 0.

. .... Dst: pc13.. = LG bit: Globally unique address (fac tory default) .. . . . .agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).124. . = LG bit: Globally unique address (fac tory default) . ..co m (74.dlls tx01..1. ..0 .......138)...0. . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ....... .. Src: cust -74-124-12-138.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.....corexchange. .... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...0. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ....... .12............0 . . .home (192 ... ... = Differentiated Ser vices Codepoint: De fault (0x00) . ........ .168.. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf181 (61825) Flags: 0x02 (Do n't Fragment) . ... .. ....

Dst P ort: 49574 (49574). = Reserved bit: Not set .home (192.. Seq: 14211...corexchange.. . . = Nonce: Not se t . ..... ... Src Por t: http (80).12.0. ...0 . ..168.com ( 74. . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aa9 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.. ...1..1.. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.124. = Don't fragment: Se t ... Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 14211 (relativ e sequence number) [Next sequence number: 15471 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ...... 0.. = Reserved: Not set ....138) Destination: pc 13. .dllstx0 1. ... Ack: 1 .. 0000 0001 0000 = Flags: 0x010 (ACK) 000.0..

....0..}.. .4.1... 0 .h... 0..x[UbvF..N. ... ...~ 0040 79 e9 a2 30 4 3 c1 31 91 a9 89 ce 68 91 db 05 31 y .. 0010 05 14 f1 81 4 0 00 31 06 3a a9 4a 7c 0c 8a c0 a8 .. ..P.. ....1 0050 b2 46 ea 32 d e 68 95 b2 ed 34 fe 04 aa 53 8a f2 .@... 0060 5e 0b 8c 7f 9 b b7 8a bb 6a 46 6a 4a e0 e3 05 81 ^ ...... `n...1..E.1 .2....... . .... ...... = Acknowledgmen t: Set ..... .0.... . 0030 00 2e 7d fa 0 0 00 78 5b 55 62 76 46 a8 bf 12 7e ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x7df a [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ... = ECN-Echo: Not set .. = Syn: Not set .J|. .... . . . . = Urgent: Not s et .h.0C.. .. = Push: Not set .....0...S.. F.. = Congestion Wi ndow Reduced (CWR): Not set . .. = Reset: Not se t . 0020 01 0b 00 50 c 1 a6 2b c8 99 b0 9e 87 4e aa 50 10 ..+..:.dx......P.... . . ..

A 00b0 86 19 70 e7 d c 6d 6f f8 c2 57 d4 a4 89 24 c1 67 ...\.C.H.\.$.. .s 0100 ab eb 3f 19 d d b5 ac eb 72 64 14 5a 8f 12 95 51 ......S.1 0140 fb 6b a5 27 3 3 34 1f 0d ef 5c b2 1b b5 66 14 2c . .. a.8.( 0170 49 5c b6 72 f 7 43 f2 99 63 a4 d1 14 88 66 36 8d I \.W.4....p. b.....-. 0070 93 7b d6 62 e 7 34 9a 90 59 1f 9d 76 cf c1 40 d9 .........mo. k.. .'34...= 00e0 aa 5f cd f0 b b 21 d1 b5 48 d4 95 c2 2e 29 03 7b .. ....@.C.r.s. 0150 77 d7 5d e6 9 3 20 22 36 25 24 a7 18 2c a6 d0 2a w ..{ 00f0 d6 62 e6 0c 4 9 a9 8a db 39 df be 73 8f ef fd 73 .W.. a.Msw.A.9.Y.Z. ..f6..?.$W..."....g 00c0 48 6a ff 42 e 6 e3 dd 10 54 69 f3 24 57 1b 38 13 H j.. .. 00d0 0e 09 4d 73 7 7 ea 3f 85 34 05 f0 27 5a 7d b0 3d ...?..9. 0090 fb 92 04 e9 8 f f2 f3 37 d7 83 09 5a e0 60 07 0a ..* 0160 1a 96 0f 09 1 d d6 b7 6e 72 0e 28 83 f0 22 82 28 .7..... ..nr....4.:o...]. 0080 e4 61 80 aa c 1 41 df 3a 6f c7 39 7f ff ed d5 ff ..-.Ti..f..B..v..`..b.Z.... .jFjJ..rd..).........\....=)A.c. {..!.I...r... _....... 00a0 e0 61 88 5c 0 b 0c 97 5c 0c 3d 29 41 8a 18 eb 41 ... 0120 06 17 8f ce 0 8 c1 09 18 8b 2d ae 15 2d 92 eb d8 .. ..(...1i... "6%$...... 0130 b7 2c 31 69 f c 57 d3 c8 f7 c7 15 e8 ae 90 be 31 ..Q 0110 1c 0b 08 ad f 6 8b 53 ff d4 72 11 80 d1 2e 43 b5 .'Z}.

...T.wg 0270 98 28 67 02 7 2 04 66 43 f3 b1 5d 50 8a 3e da b2 ..M. .fC..\...AU..' 0260 08 a1 59 a9 3 a 05 e4 f1 8c 07 38 ab 0b e5 77 67 ...*.A.a.>...:.. 0290 62 33 ee d6 8 ..[ 01c0 49 0a d0 2f 5 6 95 78 8c 2e 45 89 68 7c 92 b0 b4 I .......e.zRa 0240 06 9a c0 61 8 f 5c 0a 58 85 58 07 bd 89 41 67 9b .f9]...Y...X.X. 0220 fa 01 db ed d b f6 c6 65 dd eb f4 a7 e3 eb 3a 93 .. 01d0 4d a4 4e c0 8 a ad ad 32 59 dd 72 18 dc 2a f4 fd M . ..._..pt.8F..2Y.. 01b0 cd 4a a5 ed 4 1 55 b3 e9 26 8a cd 19 41 97 eb 5b .x...f 01a0 64 eb 52 8c c c 8c 6b 75 22 71 27 73 a6 2b 6a 9a d .....R...cA 0200 88 e7 f7 85 d 3 1d 3c 7d 2c 5f 78 8a fe 90 b5 04 .._x.. 0280 ee e9 a4 ed 2 a dc 7e c2 dd 61 83 bc c7 8d 98 d0 . . (g.*.>.../V.ku"q's.....8..#.. 01f0 d9 16 85 0f b 4 62 7b 6d d5 f8 38 46 da d6 63 41 ..&.N. 0250 6a c1 86 35 7 0 e7 71 44 8f e4 62 e0 a7 a9 92 27 j .m..... ..%... .<}..a... .....r.....b{m. J.... 0190 f2 85 3e b5 2 e 52 a7 0e e3 04 b4 54 e4 9a da 66 .....E..... 0230 37 ff fb 92 0 4 eb 8f f2 ef 23 d6 03 0f 7a 52 61 7 .. .b..#.r.....Ag.]P. ~.....qD.(..5p..:. .h|. .0180 1d e5 a0 fe 2 8 e5 3b 8f 23 a2 06 18 9f a8 5f 02 ..+j.~.... 0210 30 25 a3 4d 8 0 66 39 5d 12 70 74 04 e3 d9 20 91 0 %... 01e0 96 7e a8 25 d a dc b1 f4 ec ab d9 0f e3 6d b3 2c ..R..

.LP. 0340 45 71 7a 36 6 e 94 9d ff 15 07 d0 89 cc f9 f9 ac E qz6n. 0300 c3 85 02 2c 0 a 03 4c 50 e2 69 61 a4 9a 21 65 a4 ..^..&=<noN...{.m.BVu..5 77 b3 47 a3 46 71 88 b1 f5 0b 59 b 3.. 0380 05 b8 3c 62 8 f 26 3d 3c 6e 6f 4e ad 9a b2 fc 96 ..... 02e0 d9 ad 62 c3 e 1 96 bd c7 03 8d ce 0d da d1 d1 b7 . 0310 86 18 79 a6 2 1 e3 7b 9f d3 39 1d 02 05 9a 82 e3 ..D 0330 d2 26 96 53 0 d 93 59 4b 0d 9e ad 81 cb 08 15 fd ... ..._..y.Fq..+].G........ ..f..[.w...c....[. 03a0 75 1a a4 57 b 7 8a f4 b3 85 ba 84 . 0390 5c 1d 66 97 9 5 5e fa d0 ec 4f 4a 22 c5 2b 5d ec \ ..........*Y.. 02f0 15 b0 b8 13 6 a 63 fd fc c5 f0 13 79 ce 2c cb ff ..m..d.... &..Hq.eiv.!.N 02b0 76 2c f5 f6 8 6 5b b4 5b 2c b7 6d 08 ff 3b 5f fb v ........@.\{Y... .Y 02a0 83 e0 94 34 d 8 06 63 95 d1 0f 07 40 4e 3d 92 4e .@N=.. . 02d0 79 5b 67 b9 9 c 2a 59 f2 d9 88 ac 83 b7 b0 9b 8a y [g...5....!e.. SE....OJ".Q.9. 0360 b1 53 45 80 a 1 84 b0 fb 49 38 03 0b 30 ad ba dd .YK... ..u.. ......0.. 0370 da 99 cf 4a 7 1 4b ea 65 69 76 81 e9 06 00 40 a8 ..b.. 02c0 70 56 db 42 5 6 75 84 48 71 c1 ca a0 9a 51 c7 b3 p V....S.I8....<b..)\..y..8. ..jc..ia....... 0350 53 c4 6d dc 5 c 7b 59 98 1d a0 8c 8b ec 1c 38 99 S ..4... 0320 c6 95 97 64 8 6 b1 29 5c d8 35 0f ca e4 75 c8 44 ..... ....JqK..

.JK\.u. 0480 fc 88 93 37 5 6 92 79 12 ae 70 8b 47 84 9f 50 23 . ... .D....._. ..+ 04a0 17 db 6c 98 8 5 8f fd f1 5f 13 62 cc 70 78 1f 24 . .J.y? 0440 76 99 af 50 0 8 93 5c 0d 05 44 e1 05 07 42 22 c7 v ..Qo..B#.Z!. 03c0 fc 85 59 d6 4 1 55 86 5a 12 4a e1 6d 7f ee 47 f1 .....1..$ 04b0 f4 96 4d ca 5 2 65 29 a9 95 b8 7f 30 e4 1c a6 0f ....AU.s_.p...u.7V...f%.. 03d0 af e4 b2 ff f b 92 04 f4 8f f3 66 25 d4 03 18 7a ...... ..o.!.y.......M.T...B"..Z.l. 0460 ac 00 43 c4 6 3 30 86 2b 83 77 4a 92 6f 4d c5 ee . ..T.7q...)2.A 03f0 63 12 2a 41 8 6 31 28 fb be de f7 cb 18 10 ec 64 c . 0420 09 96 3e f8 b 1 f9 eb 3b c1 a8 f3 0b 75 09 0d 18 ..y. 0410 0b ab 11 5a 2 1 13 04 2c a7 12 75 03 21 bc 1a 14 ...O2)..>.d\... 0430 a5 cb ff 79 e a e6 13 51 6f d6 54 d3 9a fc 79 3f .z 03e0 52 69 44 da 8 0 61 ef 4a 4b 5c 91 54 0c 61 e9 41 R iD.s.P# 0490 bf 2e 42 23 0 b 5f ae bc 98 64 5c a0 b7 5e f1 2b .. .. ..P..px.\..$^.a...5...oM.+. 03b0 57 fe e6 12 a 7 3b ba ca 9a 73 5f 8e 35 ee da fd W ..... 0450 8d be d0 ac 8 b 24 5e f1 4f 32 29 ea 7f 12 b5 9c . 0470 d0 af 77 eb b 6 2c 96 07 6f f2 ce 4d 1a 9a 9c b0 . ....H. .w... .^.c0... .wJ.m._....C..Y.... .....G..1(..*A....W.....a...G...aa 86 31 ad ff u ....b.d 0400 e3 80 48 d1 7 3 08 29 32 fc 37 71 c2 83 c1 b6 94 ..

..... 0520 aa 06 .. 891 bytes captur ed (7128 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..937034000 cust-74-124-12138..)....corexc hange.M..(UpP.... .. .W .Z..ic.<q^..com pc13. 04f0 50 b5 9b ae a 3 c0 91 e2 95 cb df b6 38 45 cc fb P .. Time Source Destination Protocol Length Info 24 0. 2014 11:26:5 3....986964000 Romance Standard Time [Time shift for this packet: 0...0.. 0510 42 98 c7 99 3 8 c6 33 6a 13 cd 55 72 10 c8 bf 08 B ...c.:^.2 04e0 fe 0b 63 b4 e a 99 d4 d0 20 14 f7 81 3c 71 5e 1b .. No..000 000000 seconds] Epoch Time: 141 5615213...3j. ACK] Seq= 15471 Ack=1 Win=46 Len=837 Frame 24: 891 bytes on wire (7128 bits ).029002000 .home TCP 891 http→49 574 [PSH... 04c0 89 18 1c 80 d a 03 57 20 dc 3a 5e 1c 99 91 ee 4a .986964000 s econds [Time delta fro m previous captured frame: 0.. -...8E......Ur..dllstx01. 0500 79 a9 29 ff b c 95 f1 07 8a 20 b8 0d 69 63 c3 af y .J 04d0 13 2d 0a bc 5 a 99 be ba bb 2c 28 55 70 50 82 32 ... ... .8.Re). ....

. ....... ....0... = LG bit: Globally unique address (fac tory default) . .. .. = LG bit: Globally unique address (fac tory default) . ......... .... .. .......0 .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ....0 .0. .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... .. . .937034000 sec onds] Frame Number: 2 4 Frame Length: 8 91 bytes (7128 bits ) Capture Length: 891 bytes (7128 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. . .port == 80 || http 2] Ethernet II.... .02900200 0 seconds] [Time since ref erence or first fra me: 0.... . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .. ..... ..... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..seconds] [Time delta fro m previous displaye d frame: 0. ..... .. .

124..corexchange..1. Dst P ort: 49574 (49574)..12. Seq: 15471. Src Por t: http (80).dlls tx01...co m (74.. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.home (192 . = Differentiated Ser vices Codepoint: De fault (0x00) .. Src: cust -74-124-12-138.1. . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c4f [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..home (192.corexchange...0....com ( 74. Dst: pc13. = Reserved bit: Not set . ..168...dllstx0 1.124.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. = Don't fragment: Se t . Ack: 1 . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 77 Identification: 0xf182 (61826) Flags: 0x02 (Do n't Fragment) 0.1.12..138) Destination: pc 13.138).168. .ersion 4.

...0. = Syn: Not set .... .... .. = Reserved: Not set ... .0 ... .. ... .. ACK) 000..0. .0..... = Congestion Wi ndow Reduced (CWR): Not set .... = ECN-Echo: Not set . 0. = Reset: Not se t . . = Urgent: Not s et . = Push: Set .......... ... = Acknowledgmen t: Set ... ... 1 ...... Len: 837 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 837] Sequence number : 15471 (relativ e sequence number) [Next sequence number: 16308 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . . ... .1 .. ........ 0. ... = Nonce: Not se t .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xffe 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys . .... .. . . .. . ... 0000 0001 1000 = Flags: 0x018 (PSH. .......

..I 0050 b6 d6 9a de 5 9 41 4d 0f ba 9b 14 80 86 0d e3 c5 .....1.....P.R`$....C 00b0 cb 31 cb 55 e f 73 d6 e8 14 36 1e 41 78 53 78 dd . P.. 0010 03 6d f1 82 4 0 00 31 06 3c 4f 4a 7c 0c 8a c0 a8 ..U.00f0 8c d2 da 84 d 6 dd 6f d7 97 f1 7d 65 fb c0 9a 8b .6..... 0060 87 14 01 a1 9 0 eb 2b 84 3c 58 51 47 23 d9 3a 88 . . .....m^.. 00c0 2c 28 03 fd 1 3 78 c1 6d 5e a8 dc be b0 1a 9f 3b ..y..+ 0040 8c 03 47 6e b a 80 39 37 ea d3 b4 d5 39 9c d5 49 .. .<OJ|..<...p...k.. 0030 00 2e ff e2 0 0 00 b0 35 81 dc 9f 8e c3 24 00 2b ....!b. . 0100 24 17 68 b1 b .......97... ..0R.YAM..1. `n.x... . 00d0 09 a8 ff fc 9 0 be 6b 19 f9 79 c8 f6 31 e2 d1 8d .. .9....o.is] [Bytes in f light: 2097] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .@..+.w.........$.s... 0090 1f 25 54 03 1 8 c2 52 60 24 9a 80 61 38 4a 0b fc ...".+..Gn.<XQG#...AxSx... m... .. (.E...a8J.}e...+..a.. 0070 d2 04 ba c8 e 2 22 a7 65 94 cd 2b ea ba d6 9d 6a ....y. 00a0 a7 50 0c 61 e 9 81 79 14 a9 c1 87 bd 30 52 1f 43 ..:...dx.. %T. 0020 01 0b 00 50 c 1 a6 2b c8 9e 9c 9e 87 4e aa 50 18 .P......N..... X}iq9. 1.Z.5..j 0080 73 e9 a6 ca 3 c fc c9 c9 5a ff fb 92 04 ee 8f f3 s ... 00e0 91 58 7d 69 7 1 39 04 70 84 77 dc 21 62 f6 2e 2d ..e.

e 0170 d5 0f d6 d7 4 4 78 27 23 ce f3 9c 30 ac f9 d0 34 ......._In..4y<. 0140 3d 3c 2d 40 4 8 cd 0f 1d 2d 09 ed 17 38 66 12 91 = <-@H.. ..W......L#B. . ..r..45) 01a0 92 22 cf 27 5 6 81 4c 23 42 81 d0 75 a2 f7 3e 58 ....z.&..Dv.uZgu. ".b 0120 44 a7 1f a8 b 4 08 38 44 a7 46 2d 1b 9a 69 2d ff D ..i-.. 0160 a6 fe 93 d6 a 6 7a 9d cf 3d e9 9f 94 0a bd 0d 65 .u..RB|AU.....D.G 01e0 0a 60 fb 34 7 9 3c dd 64 92 7f bb 7a a1 08 8a 7b .. `.e.. 0110 30 ea 1e 97 3 d 35 fa 1e 44 46 5e 8b 1c 1e c3 62 0 .......:N.DF^..0 7c 20 76 59 69 5a 52 1f 41 b2 cc $ ..d.4.=.>X 01b0 1d 8c 8b 38 a b 3e 7d 35 14 4d e8 b5 27 ad 46 a8 . :.H. 0200 18 e2 26 92 4 5 c1 01 34 18 2d 48 13 82 a9 48 f2 ...4.....h.... 01c0 e9 b9 e7 5a 6 a 37 79 40 6d f2 44 76 b1 72 ba d6 ..-.0.F..l{.Dx'#..c....8f.A....Zj7y@m.=5.8..>}5.E. 01d0 4e 53 14 16 2 e 0d 08 00 59 ce 10 65 17 17 d2 47 N S...z........ 0130 e1 81 01 1d 6 c 7b aa ea fe 5f 49 6e f5 e6 fa fc . ..-H...'.d.E..8D....{ 01f0 3d 5c 83 19 4 5 2c 57 98 08 86 8d 64 fb d1 8b f0 = \....4 0180 d5 d3 11 75 5 a 67 75 08 af dc 91 44 12 d1 f0 fb ..Y. ... .M.. 0150 02 3a 09 ca a 7 eb 52 42 7c 41 55 0a 3a 4e 9a 8b . .| vYiZR..F-..'V. 0210 c6 79 49 a0 9 8 d4 12 57 45 d1 19 .... 0190 64 54 ef 63 b 2 9e ef b6 87 34 94 83 a7 34 35 29 d T..

.x>.. 0310 47 d5 0c ec e c ae ea 56 28 19 c3 65 02 36 14 a4 G ... H... .. t...DM4.. 0230 0f f3 1f 31 5 3 83 18 8a 60 60 64 8a 60 65 8f 4a .t...8(..*.N.e.... .UJA2.Ih....b. ........`e.... yI...S. 0260 fa 2a 00 46 1 4 02 46 ab 49 b6 1c 8b ab 38 e8 77 ...8.``d.$ 02a0 91 fd 91 5b 2 f 4d 7c e9 e5 52 e6 c9 ae f7 6b a3 .bD.J 0240 0b 74 bf 4e 0 c 62 49 81 74 17 69 81 87 c5 30 5b ... 02b0 52 9a 83 90 8 5 c4 09 08 1e c6 4e 30 39 5b 26 70 R .. .Q. 0280 0b 4e 24 d2 3 0 3c 2e 05 26 a4 43 89 02 60 2a 94 .[/M|.6...%$+r...`*.......nBP...e..C...V(.YS 0300 cd 48 99 55 4 a 41 32 b2 fa 1d 24 1d d2 ad ae 8d ..w 0270 10 dc d7 0b c 7 24 ce ad 18 2a 15 51 cf f7 31 9d ...$.a:U-..k.%..bI.B..0<. 0320 43 40 70 d0 d 3 55 4b b6 8c ee 28 fa ae a7 a8 b1 C . 02e0 8c d9 13 c8 1 2 61 3a 55 2d 1c 0d d0 c1 38 74 77 .....$..X.0[ 0250 c5 fe 9a 90 9 a 62 92 98 65 b0 6b a0 98 58 05 1a .I.k. 02d0 77 c9 84 bf c 9 25 b5 05 98 b1 49 68 1a 12 dc a7 w .A..F.. 0290 90 71 f4 a5 a 0 e3 e0 78 3e d4 48 22 66 9a c9 24 .H"f. *.2}o. q...WE./....44 4d 34 89 25 .i....&...R.. ....% 0220 23 fb 32 7d 6 f e8 9f 38 28 c7 8f ff fb 92 04 ec # .1S. N$.......8tw 02f0 88 e0 05 62 4 4 09 25 24 2b 72 d4 d5 42 b0 59 53 .N09[&p 02c0 d8 18 cd 41 c c 2f b6 af 6e 42 50 0a b4 d3 53 d5 .1. ...F. .

.000155000 seconds] [Time delta fro m previous displaye d frame: 0. d..937189000 sec .@p.s.987119000 Romance Standard Time [Time shift for this packet: 0.+M No.q 0350 08 64 98 ef 0 e 80 01 e4 82 11 2a 88 b9 e4 d1 93 .(.R.t. ...I#.home cust-74-12412-138.cor exchange.. Time Source Destination Protocol Length Info 25 0. fg..00015500 0 seconds] [Time since ref erence or first fra me: 0.*.. 0340 10 91 ec bf 0 e cb 47 48 28 85 d2 74 aa 52 0d 71 ..987119000 s econds [Time delta fro m previous captured frame: 0... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10....dllstx01...sk....<]A$..UK. 2014 11:26:5 3..... 0330 57 0d ab 73 6 b 06 a2 14 7f 31 d6 73 10 b3 41 1a W .. ..0370 b4 66 67 d5 3 8 34 c8 bf d7 2b 4d .000 000000 seconds] Epoch Time: 141 5615213..937189000 pc13. 0360 44 4d 27 b1 3 c 5d 41 24 16 49 23 d0 e9 20 9d 2d D M'.A.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =16308 Win=39795 Le n=0 Frame 25: 54 bytes on wire (432 bits).1.84..GH(.....

= IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ... . .. ..... .home (192.onds] Frame Number: 2 5 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . ........ . . . = LG bit: Globally unique address (fac tory default) .. Src: pc13 ..... . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. ....168.. .com (74.port == 80 || http 2] Ethernet II...... Dst: cust-74-124 -12-138...... . .. ..... .. = LG bit: Globally unique address (fac tory default) .1.....co rexchange. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. . .0.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..0 .dllstx01. ......1 24...0.....0 .. .11 ).. .. ..138) Version: 4 Header Length: 20 bytes .12.

Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..1..11) Destination: cu st-74-124-12-138.12.. .ho me (192. . ...... = Don't fragment: Se t .corexchange. com (74. = Differentiated Ser vices Codepoint: De fault (0x00) . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. D st Port: http (80). Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number ..dl lstx01.1.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f1e (20254) Flags: 0x02 (Do n't Fragment) 0...124..168.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = Reserved bit: Not set .. Src Por t: 49574 (49574). Ack: 16308 .... .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.0.. Seq: 1.

.. .`n. .0...... = ECN-Echo: Not set ... 0000 0001 0000 = Flags: 0x010 (ACK) 000.... . ... . . ...... .0 = Fin: Not set Window size val ue: 39795 [Calculated win dow size: 39795] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 24] [The RTT to ACK the segment wa s: 0.dx.. . .0 . ....... = Congestion Wi ndow Reduced (CWR): Not set .. = Nonce: Not se t ... .: 1 (relative se quence number) Acknowledgment number: 16308 (r elative ack number) Header Length: 20 bytes ..... .... 0010 00 28 4f 1e 4 . = Syn: Not set .. = Reset: Not se t .. . .. . . .. ..1 ...E. = Push: Not set .0... = Urgent: Not s et ...000155000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . 0. . .. = Reserved: Not set ... .. .. 0..... ....0.... = Acknowledgmen t: Set ....... 0 ... ......

000 000000 seconds] Epoch Time: 141 5615213... Time Source Destination Protocol Length Info 26 0..net TLSv1 .00031200 0 seconds] [Time since ref erence or first fra me: 0. 95 bytes captured (760 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10....P..1e100.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 a1 e1 50 10 . No.987431000 Romance Standard Time [Time shift for this packet: 0.+. (O.. s. .0 00 80 06 00 00 c0 a8 01 0b 4a 7c ....937501000 pc13.2 95 Applicat ion Data Frame 26: 95 bytes on wire (760 bits).000312000 seconds] [Time delta fro m previous displaye d frame: 0.home par03s14-inf31.937501000 sec onds] Frame Number: 2 6 Frame Length: 9 5 bytes (760 bits) Capture Length: 95 bytes (760 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f ..@....P.. 0030 9b 73 18 d4 0 0 00 . 2014 11:26:5 3..987431000 s econds [Time delta fro m previous captured frame: 0.N.

net (173 .... ... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.... ... = LG bit: Globally unique address (fac tory default) .11 ).. Src: pc13 .0 . = Differentiated Ser vices Codepoint: De fault (0x00) .. ..63) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. Dst: par03s14-in -f31.... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..... ...... .1.. .168.. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). .home (192..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) . . ..... .0... .... . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .41.. ..0 . ..0... ... . ... .194.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. ... .....rame: eth:ethertype :ip:tcp:ssl] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II..... .....1e100. ..... = LG bit: Globally unique address (fac tory default) .

.. Src Por t: 51639 (51639). Ack: 1.Total Length: 8 1 Identification: 0x4f1f (20255) Flags: 0x02 (Do n't Fragment) 0...1e100 .1.. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. ....net (173. . .. . ... Len: 41 Source Port: 51 639 (51639) Destination Por t: https (443) [Stream index: 1] [TCP Segment Le n: 41] Sequence number : 1 (relative se quence number) [Next sequence number: 42 (rela tive sequence numbe r)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . Seq: 1.0.168..63 ) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = Reserved bit: Not set ...ho me (192. D st Port: https (443 )...11) Destination: pa r03s14-in-f31.. 0000 0001 1000 = Flags: 0x018 (PSH.194. = Don't fragment: Se t . = Reserved: Not .. ACK) 000....41.1.

set . = Congestion Wi ndow Reduced (CWR): Not set .. ... ......... .... ... .0 .. .0 = Fin: Not set Window size val ue: 16635 [Calculated win dow size: 16635] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x98f 8 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 41] Secure Sockets Laye r TLSv1.E.... ... ... .0..0. = Reset: Not se t ...... .... = ECN-Echo: Not set ..2 (0x0303) Length: 36 Encrypted A pplication Data: 00 00000000000002e0178 69bbdfbcea66d4b3fe8 77eb01a8. 0.dx............ .. = Urgent: Not s et ..... 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . ... . = Syn: Not set . = Acknowledgmen t: Set . = Push: Set ..... = Nonce: Not se t .... ... . .1 .. . .. 0. .0. 1 .. 0010 00 51 4f 1f 4 0 00 80 06 00 00 c0 ... . ...2 Record Layer: Application Data Protocol: spdy Content Typ e: Application Data (23) Version: TL S 1. ..`n.

.. 2014 11:26:5 3. 0030 40 fb 98 f8 0 0 00 17 03 03 00 24 00 00 00 00 00 @ .2 95 Applicat ion Data Frame 27: 95 bytes on wire (760 bits).w 0050 eb 01 a8 c4 f 0 5d ac 74 dd c9 ae a4 0c 0f 0a ...t. . 95 bytes captured (760 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...1e100. QO... 0020 29 3f c9 b7 0 1 bb 0a 53 43 09 be 85 68 96 50 18 ) ?.... No.... .mK?. Time Source Destination Protocol Length Info 27 0.@.a8 01 0b ad c2 ...987565000 s econds [Time delta fro m previous captured frame: 0.937635000 pc13.......P.net TLSv1 .$....937635000 sec onds] Frame Number: 2 7 Frame Length: 9 5 bytes (760 bits) Capture Length: ........ 0040 00 00 02 e0 1 7 86 9b bd fb ce a6 6d 4b 3f e8 77 .000 000000 seconds] Epoch Time: 141 5615213...000134000 seconds] [Time delta fro m previous displaye d frame: 0...987565000 Romance Standard Time [Time shift for this packet: 0..SC.....00013400 0 seconds] [Time since ref erence or first fra me: 0.home ham02s12-inf24..h...]...

= IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .95 bytes (760 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:ssl] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II..0. ...... ... ......11 ).. ......168.... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. . .184) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..... .0 . .0.1e100.......194... .... . .. .. Src: pc13 ..113. ..net (173 ... . .1.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.... ... .home (192. = LG bit: Globally unique address (fac tory default) . Dst: ham02s12-in -f24. . = Differentiated Ser vices Codepoint: De . = LG bit: Globally unique address (fac tory default) ... ......... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .0 .. .. ..

. = Don't fragment: Se t . ...0..... = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.. Seq: 1. Len: 41 Source Port: 51 501 (51501) Destination Por t: https (443) [Stream index: 2] [TCP Segment Le n: 41] Sequence number : 1 (relative se quence number) [Next sequence number: 42 (rela tive sequence numbe r)] Acknowledgment number: 1 (relat ive ack number) ...fault (0x00) . = Reserved bit: Not set ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 1 Identification: 0x4f20 (20256) Flags: 0x02 (Do n't Fragment) 0.1e100 .1 84) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. ..194..11) Destination: ha m02s12-in-f24. .net (173. Ack: 1. .ho me (192..168..1. Src Por t: 51501 (51501). D st Port: https (443 ).113.1..

. . .. .. = ECN-Echo: Not set . .. . 0...2 (0x0303) Length: 36 Encrypted A pplication Data: 00 0000000000004c43c1c 12232e92000affc96dc d865955d. . ... = Urgent: Not s et ..... . . . ... = Push: Set .. . = Reset: Not se t ... = Nonce: Not se t .. . . ..Header Length: 20 bytes ...... .. ...1 .... ..0. .. .....0 .....0... .. = Reserved: Not set ......... = Syn: Not set . 0000 0001 1000 = Flags: 0x018 (PSH......2 Record Layer: Application Data Protocol: spdy Content Typ e: Application Data (23) Version: TL S 1.....0........ = Congestion Wi ndow Reduced (CWR): Not set ..0 = Fin: Not set Window size val ue: 16648 [Calculated win dow size: 16648] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xe17 1 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 41] Secure Sockets Laye r TLSv1. = Acknowledgmen t: Set . 1 . . . . .. 0. ACK) 000...

.. 0040 00 00 4c 43 c 1 c1 22 32 e9 20 00 af fc 96 dc d8 ..-. 2014 11:26:5 4..in-addr.dx.953172000 pc13.......003102000 s econds [Time delta fro m previous captured frame: 0.1 .7..P. 0050 65 95 5d df 7 f c3 e7 2d 2e fa b0 6f 5a 4d cf e .003102000 Romance Standard Time [Time shift for this packet: 0..home DNS 85 Standard que ry 0xc7e2 PTR 11.$.LC.ar pa Frame 28: 85 bytes on wire (680 bits)......000 000000 seconds] Epoch Time: 141 5615214.... No."2...E.. Time Source Destination Protocol Length Info 28 0.oZM...`n...0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .168... 0010 00 51 4f 20 4 0 00 80 06 00 00 c0 a8 01 0b ad c2 . 0020 71 b8 c9 2d 0 1 bb c8 47 4e a3 37 c0 00 05 50 18 q .01553700 0 seconds] .GN. ..015537000 seconds] [Time delta fro m previous displaye d frame: 0.... 0030 41 08 e1 71 0 0 00 17 03 03 00 24 00 00 00 00 00 A ...home livebox....]..192. .-. 85 bytes captured (680 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...q. QO @.. .

......1) Version: 4 Header Length: 20 bytes Differentiated .0...... .. .. = LG bit: Globally unique address (fac tory default) . Dst: livebox.. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). . ... ... . .hom e (192... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..168. ..... Src: pc13 ... = LG bit: Globally unique address (fac tory default) .. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .1.. .. .1....home (192...0. . . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4...0 .168. ..... . ..... . . . ...... .....0 .[Time since ref erence or first fra me: 0.953172000 sec onds] Frame Number: 2 8 Frame Length: 8 5 bytes (680 bits) Capture Length: 85 bytes (680 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II....11 )..... ..

.0.. . .ho me (192.. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: UDP ( 17) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.1. = Reserved bit: Not set ..Services Field: 0x0 0 (DSCP 0x00: Defau lt...home (192. Src Port: 4977 9 (49779). = Differentiated Ser vices Codepoint: De fault (0x00) .168.......1.0.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 7 1 Identification: 0x4f21 (20257) Flags: 0x00 0. ..168 . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .. = Don't fragment: No t set .11) Destination: li vebox.. Dst Port : domain (53) Source Port: 49 779 (49779) Destination Por t: domain (53) Length: 51 Checksum: 0x83a 1 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] ...1) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col..

= Recursio n desired: Do query recursively ...11. = Response : Message is a quer y .. .19 2.in-addr....1. . 0030 00 00 00 00 0 0 00 02 31 31 01 31 03 31 36 38 03 ..000 0....168........3. .. ....s. 0010 00 47 4f 21 0 0 00 80 11 00 00 c0 a8 01 0b c0 a8 ....arpa: typ e PTR.. .... ... .5. . .. .... . . .. GO!...0 .. ... ...arpa [Name L ength: 25] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ..... ..... 0020 01 01 c2 73 0 0 35 00 33 83 a1 c7 e2 01 00 00 01 .168....... .. = Opcode: Standard query (0) .. .....0.. = Z: reser ved (0) .in-addr ..168.. .. = Truncate d: Message is not t runcated .. 0.. . class IN Name: 1 1..... .Domain Name System (query) [Response In: 2 9] Transaction ID: 0xc7e2 Flags: 0x0100 S tandard query 0..E.1.192.. . .....dx.1...... = Non-auth enticated data: Una cceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries 11.`n. .1 ....

004857000 seconds] [Time delta fro m previous displaye d frame: 0.in-addr.958029000 sec onds] Frame Number: 2 9 Frame Length: 1 08 bytes (864 bits) Capture Length: 108 bytes (864 bit s) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] ..00485700 0 seconds] [Time since ref erence or first fra me: 0.007959000 s econds [Time delta fro m previous captured frame: 0. 2014 11:26:5 4.. 108 bytes capture d (864 bits) on int erface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.home DNS 108 Standard que ry response 0xc7e2 PTR pc13.0040 31 39 32 07 6 9 6e 2d 61 64 64 72 04 61 72 70 61 1 92.home Frame 29: 108 bytes on wire (864 bits) .. No.home pc13. Time Source Destination Protocol Length Info 29 0.958029000 livebox.arpa 0050 00 00 0c 00 0 1 .007959000 Romance Standard Time [Time shift for this packet: 0. .000 000000 seconds] Epoch Time: 141 5615214.

. .. ...... .. . Dst: pc13. Src: live box. = LG bit: Globally unique address (fac tory default) .168..0 ........ .168..... = ..0.....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 9 4 Identification: 0x0000 (0) Flags: 0x02 (Do n't Fragment) 0. = LG bit: Globally unique address (fac tory default) . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .. .. . . ... . .. ..... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..home (192.. ...1 .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00..... ..1.home (192. . .. ..0...... ... ....Ethernet II. .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt....... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. = Differentiated Ser vices Codepoint: De fault (0x00) ..0 ......1).. ... ..

.. .. ... Dst Port: 49779 (49779) Source Port: do main (53) Destination Por t: 49779 (49779) Length: 74 Checksum: 0x500 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (response) [Request In: 28 ] [Time: 0.Reserved bit: Not set ...0..1) Destination: pc 13.. . . = Opcode: Standard query (0) . .... . ... .168.. = Don't fragment: Se t . .1. Src Port: doma in (53). .home (192....1.168..000 0.home (192. . No error 1. = Authorit ative: Server is an ..1.... ... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col..004857 000 seconds] Transaction ID: 0xc7e2 Flags: 0x8580 S tandard query respo nse.1. = More fragments: No t set Fragment offset :0 Time to live: 6 4 Protocol: UDP ( 17) Header checksum : 0xb732 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: livebox ...... .. = Response : Message is a resp onse ...

. class IN. . pc 13.. .19 2. = Non-auth enticated data: Una cceptable ...authority for doma in .168. ... .arpa [Name L ength: 25] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Answers 11.in-addr .1... = Answer a uthenticated: Answe r/authority portion was not authentica ted by the server ..... ..168. ... 0.arpa: typ e PTR. ..192.1 ..192........ .168.in-addr . . ..arpa: typ e PTR..... 0000 = Reply co de: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries 11.. .... . ....home Name: 1 1. ..19 2...1. = Recursio n available: Server can do recursive q ueries ...168..in-addr..0. = Recursio n desired: Do query recursively . = Z: reser ved (0) .arpa Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Time to live: 0 Data le . 1 .1.. .... .... . ..0. class IN Name: 1 1. ...1........in-addr. = Truncate d: Message is not t runcated .. . .... ..0 ...

home.home 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . ^.s. . ... Time Source Destination Protocol Length Info 30 0.......pc13. 0030 00 01 00 00 0 0 00 02 31 31 01 31 03 31 36 38 03 ... No.@..in-addr....corexc hange. 2014 11:26:5 4.. 0010 00 5e 00 00 4 0 00 40 11 b7 32 c0 a8 01 01 c0 a8 .JP..ngth: 11 Domain Name: pc13...@.. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.dllstx01. 0060 0b 04 70 63 3 1 33 04 68 6f 6d 65 00 .E.arpa 0050 00 00 0c 00 0 1 c0 0c 00 0c 00 01 00 00 00 00 00 .home TCP 1314 http→49 574 [ACK] Seq=16308 Ack=1 Win=46 Len=1 260 Frame 30: 1314 byte s on wire (10512 bi ts).... `n.. 0040 31 39 32 07 6 9 6e 2d 61 64 64 72 04 61 72 70 61 1 92..168..11..012958000 s econds .5....963028000 cust-74-124-12138.2..com pc13.dx....1.012958000 Romance Standard Time [Time shift for this packet: 0.. .. ... 0020 01 0b 00 35 c 2 73 00 4a 50 03 c7 e2 85 80 00 01 ...000 000000 seconds] Epoch Time: 141 5615214..

...... ......[Time delta fro m previous captured frame: 0..... . . .... .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. .dlls tx01........ . = LG bit: Globally unique address (fac tory default) .. . . .... Src: cust -74-124-12-138. . . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..... .... .0 ... = LG bit: Globally unique address (fac tory default) .0.0 ..00499900 0 seconds] [Time since ref erence or first fra me: 0...004999000 seconds] [Time delta fro m previous displaye d frame: 0.. .co .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .corexchange. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..... .... ... ... ...0.. ....963028000 sec onds] Frame Number: 3 0 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] Ethernet II.. .

. ..dllstx0 1..1. Ack: 1 .com ( 74. Src Por t: http (80). .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Dst P ort: 49574 (49574).... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.1.m (74. Dst: pc13.1.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf183 (61827) Flags: 0x02 (Do n't Fragment) 0.home (192 ..124.....138) Destination: pc 13. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.home (192.. = Reserved bit: Not set .. .138).12..0.168. = Don't fragment: Se t .124. Seq: 16308.corexchange...12. = Differentiated Ser vices Codepoint: De fault (0x00) . Len: 1260 Source Port: ht tp (80) .168... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aa7 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. .

= Nonce: Not se t . = Congestion Wi ndow Reduced (CWR): Not set .0.. = ECN-Echo: Not set ... . . = Reserved: Not set ... 0...0. = Push: Not set ... ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x355 9 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] ...1 .. .. ..... .. .. ...Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 16308 (relativ e sequence number) [Next sequence number: 17568 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ...0 .... = Syn: Not set .. . = Reset: Not se t . = Urgent: Not s et . .. . .... ..... ... .. .. ..... .. . ... .. . 0000 0001 0000 = Flags: 0x010 (ACK) 000. .... = Acknowledgmen t: Set ........ 0....0... 0 . .......

Q.B...`.N...J}.1. 0070 95 82 60 0d b 7 34 26 5a 31 1d 4d 12 a3 bd 42 e5 ... ......A.. 0090 2f 53 03 39 9 2 60 5d 65 da 50 65 f3 4c 0c d4 bd / S.......% 00b0 1c da 9f e8 f 4 34 c1 96 4d 99 8d e3 d2 b8 dc a4 .......4.M.M.. .P.+.P.o..lB..J|... 0030 00 2e 35 59 0 0 00 81 30 2a 02 31 81 45 40 1c 11 .0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..1.. .I0... 00c0 8a 98 19 a4 3 2 d4 30 86 b8 84 d7 7c 3a a2 f8 4d . 0040 a6 28 35 87 5 1 ed 2f 31 3c 36 d0 bb 1c 65 f4 58 ... ..L.e.. ...E../1<6. 0020 01 0b 00 50 c 1 a6 2b c8 a1 e1 9e 87 4e aa 50 10 ..... `n...`]e..2....@. ..X 0050 4b aa a0 db 4 1 b5 8d 79 4a af 80 b0 b7 42 93 ef K .fi...-l]h...B.0.M 00d0 61 2f 54 ee 1 b f4 a8 d7 49 42 51 b7 93 f4 35 32 a /T.G&.I..dx.0*....52 00e0 dc a7 0c 80 0 3 0d 2b 90 f2 2c 98 80 e2 71 3c 4d . (5...9......yJ.... 0060 ec 76 9a 6c 4 2 00 47 26 c5 32 69 10 e8 c7 09 ab ..IBQ. 0080 3f 46 74 ac b 5 6f d0 53 ff fb 92 04 ec 8f f2 fa ? Ft..|:. . 00a0 4a 0d 66 69 8 1 8d 97 a9 01 9c 49 30 d5 af ce 25 J ..5Y..E@.2i.....+. 0100 4b 6b 46 53 2 f 22 85 4a 7d 07 49 92 cc c5 80 e0 K kFS/"........4&Z1..S.....Pe....:.. v.. .q<M 00f0 92 e1 08 00 2 d 6c 5d 68 c8 d6 eb 12 02 fa b8 9e . . 0010 05 14 f1 83 4 0 00 31 06 3a a7 4a 7c 0c 8a c0 a8 .....

.5./....... ..tv2...j.. 0170 6f ff e9 6c c a 5c 16 10 b8 4c bc e1 10 c3 7d 28 o ..... 01e0 5f 8b 15 19 3 5 ec af 25 03 dd cd cb 99 02 6c d8 _ .( 0200 4c 70 f6 b7 c 2 e7 4b 0c 90 1e 05 d0 3a d9 ad 51 L p...%.l....T...0110 b1 78 7e 8c 9 6 86 48 a5 0b 12 8c 23 49 c6 48 61 .G@..Lh..... 1....[5 0220 15 3a d6 8d 6 ...H...... 01b0 6a 63 9d 9b b 0 dc 39 cc c7 28 b7 69 64 fb ad 2a j c.:. 0190 35 1f a7 ea d 5 d3 13 72 aa 2f 18 2d 2b 68 96 b0 5 ...(......K...%.* 01c0 2e b5 39 86 a a cd 9d 59 cb d1 59 f6 db a1 53 05 .... d......... 0160 8f d0 a2 56 4 d 6f 45 d6 a9 c6 a5 73 f7 d2 be 81 . 0140 ee 97 c4 6a 9 2 81 9d b5 38 56 a8 52 26 44 57 36 ..Y..S.%..^..VMoE..2-..#I...\.}( 0180 a5 64 00 25 e c a0 25 85 8a 0b d2 e0 ee d1 a1 03 ..Z..=...L.S.9.-+h. 01d0 70 ba 4c 68 0 3 26 34 d9 cd 10 18 b0 b5 47 40 95 p ...&9.c.V~ 0130 f3 dd 30 89 e f 3d 9d c4 64 8e 54 d4 5a c7 53 05 ..d..ET.....8V..id. ...uf..Y.s..v.... .R&DW6 0150 2b 06 b8 14 8 c 5e ce 0c 96 5f 61 14 26 39 98 b8 + .... x~.Q 0210 40 b4 ba 80 8 a 14 b5 1e 0f 32 2d 8e 84 91 5b 35 @ .Ha 0120 45 ca 1e 75 6 6 10 91 26 62 93 8e b6 12 b4 56 7e E . ...&4. $...9.0.. -..l.. 01a0 da 31 ca 74 7 6 32 0c 17 64 99 bb 90 20 2d 08 9e .. 01f0 d5 24 a9 2c 6 3 0f 76 e4 85 45 54 80 a2 d3 ab 28 ...d._a...&b.r..

8].w@ 0330 90 24 ad bf 9 2 4c be 56 07 01 37 .u..3 0290 05 b3 97 74 4 5 22 d2 eb 11 c3 89 3c b8 1a 6a 2b ..`.... w..Ct... B.. 0240 b0 c9 4a 0d 6 2 8b 81 6b 18 e9 01 97 d1 70 a8 b6 .#./S.S.R 0320 bd d0 1c 77 8 0 60 82 89 0c 61 80 a8 cd 1a 77 40 .E.... 0300 13 77 8d 43 7 4 13 69 16 41 48 d6 9a 4f 59 75 f5 .].. . 0250 af 42 c2 1a 0 0 e6 60 11 6c 52 e4 d9 0f 30 d1 97 ..i. 02c0 48 7e 1c 82 1 4 c4 a9 05 12 d5 9a 11 29 a0 53 36 H ~...l...0....J.luN.j+ 02a0 65 93 07 d1 4 5 91 a3 48 eb b7 5d ed 2f b2 4d 59 e .J.X.......v. \vi..b.. ..q. 0260 54 a5 75 a7 e b 9a 42 88 94 d4 10 f0 b9 f2 8d 4f T .[!dbZ.... 0310 fe 5c 76 69 c 3 6c 75 4e af fa 90 e2 1c f8 0a 52 ...a.`..H... 02f0 4a 92 00 11 2 0 1b 71 a9 82 29 89 f9 b2 c0 7e 05 J ....)...x.............tE".MY 02b0 5a 8d 08 a5 d b fd 29 2a af 86 00 e2 06 c4 0c b8 Z ..~.....<....lR.q.)./...S6 02d0 5d c9 04 71 0 e 0f 75 8b 7e ed b8 34 d2 e8 1e a9 ] ...... .. :...O 0270 25 33 1e c2 9 a cc f2 78 dc 6c f4 f1 e4 b4 ca 25 % 3.~.c b4 b4 16 53 a5 ff fb 92 04 e8 0f .0e...... ...... ........4.% 0280 16 9d 66 41 9 7 9e a4 e5 00 c9 23 06 4a 1b 02 33 ..k.fA..``e. 02e0 74 da 0c a2 5 b 21 64 62 5a a9 76 92 38 5d dd 20 t .w...OYu.. .)*....L. 0230 f2 d9 2f 53 0 3 58 92 60 60 65 8a 30 65 f3 4c 0b ...l.AH.p.u..B.

QmQq+.. .d..u..@. ...la 0350 84 a9 96 11 4 1 9d 1e 40 10 40 5f 48 a0 8a 62 b6 .-.E 0410 58 e6 68 57 9 a 6c ee 4e 11 3c 78 69 b7 f3 df 23 X ...b.<..N..d5..*a. $..@_H. ). 0390 25 98 0e 24 d 9 a8 62 76 dc 29 06 bf 39 95 3f 6f % . ....# 0420 26 fd a9 fa e d 82 95 d4 34 b4 f6 8f b0 77 3e c5 & .v(..V...G:.I../.7*...q.h.$... 0340 ad a9 e8 be d 4 93 7b 52 86 75 99 8b 2a dd 6c 61 ........ 0430 29 47 be fb d c 2d e2 9b 6c de 6f 7c 44 31 38 f0 ) G.v.*... 03c0 24 46 3a d3 7 5 15 19 07 7a 48 21 5d ff fb 92 04 $ F:....w>.l..l...kt..2a 8b d6 76 db .... 0400 40 6e 82 f5 f 0 b4 82 e9 0f 6f 8e 2d ec eb a5 45 @ n.?o 03a0 2e d7 18 3c b f 08 f5 b1 76 28 04 09 95 99 8a 31 . 0440 06 63 96 00 c f 35 be fa 0f 7c 03 35 d1 fe 23 ff ...u.J k...bv... . 0380 2a 9a 28 d0 0 c bc 84 49 d7 86 48 4a b1 e3 be 0f * .X..|....o.(.bk.hW.........-..~.....Mp 03f0 3e 83 d4 9c c 1 94 64 35 bd 0e e4 19 e7 d4 7e 84 > .9.2R.......ku 0370 6b 35 f5 de b 9 51 6d 51 71 2b 9e a5 2a 61 ac 16 k 5.. ...o|D18. .A.1 03b0 bd 12 68 10 f 1 62 c7 8c 08 aa 6b 74 c8 71 f3 88 .... 03d0 ed 0f f2 fd 3 2 52 03 58 a2 e0 64 c6 4a 20 6b 14 ... 0360 ec 29 8a 2f 9 b 2c 5a 07 b4 1d 96 47 3a 8c 6b 75 ..b.. 03e0 5c 0c 7c c7 4 8 0d 62 6b 81 87 98 e8 81 9c 4d 70 \ .<xi....L.H.{R..).....4.Z.HJ.zH!].

net pc13....hom e TCP 60 https→ 51639 [ACK] Seq=1 A .k.L.hr_... 04e0 ac 0b 89 c4 6 6 c9 16 91 23 83 79 28 a4 62 70 ce .Ui........'Z.....N.b. 7'.(~..Cb.5. .Ksf.. 0500 5f b8 d8 08 b 8 7c 51 22 01 4b 73 66 cc 8f 8a 59 _ .bp.y>..]..#..../..7..c.. Time Source Destination Protocol Length Info 31 0.l...5...z..|Q". 0480 0c 37 27 c7 1 9 c0 d9 79 3e 12 d9 61 a6 8f 1d 00 ....`... 0460 54 e3 28 4d 3 8 21 76 2e f0 80 1a ea 43 7f 6c 09 T .b...KmA\Vq.....(M8!v.%.|H..Y 0510 5b 40 a5 8f 6 8 72 5f f5 55 69 2c a2 03 48 36 56 [ @.|. 04f0 bc aa e4 7c a 5 a8 e9 25 b0 37 e7 49 43 23 5e 15 . .U.y(.g%..IC#^. 04a0 f9 ff 2f bd b a 6b 9f 4c a4 fb 8f 0c a4 9c fa b2 ..C.964022000 par03s14-in-f31 .'. .. ....iV 04d0 c6 08 4a cb b a ac 6e c2 a3 60 7f 62 17 09 89 0b . 0470 44 fb 43 62 b 2 ca 0b b8 55 dd 97 27 5a 91 4e ba D .R...1e100.f. No..`{.J.. 0450 78 09 fe 7f c 7 68 03 ff cf e0 87 c5 67 25 ab 16 x . 04b0 7c d8 cc 52 c 6 5d bf ff f4 94 60 7b 07 c9 62 1c | .. 04c0 6d 44 fc d2 2 7 85 fc 7c 48 bc af 7a d9 d5 69 56 m D..... 0490 75 36 ac 0a 2 e c7 4b 6d 41 5c 56 71 ac 28 7e 0b u 6...h....H6V 0520 6a 1b j .a....n...#..|..

...013952000 Romance Standard Time [Time shift for this packet: 0..00099400 0 seconds] [Time since ref erence or first fra me: 0.000 000000 seconds] Epoch Time: 141 5615214.. = LG bit: Globally unique address (fac tory default) .964022000 sec onds] Frame Number: 3 1 Frame Length: 6 0 bytes (480 bits) Capture Length: 60 bytes (480 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] Ethernet II. 2014 11:26:5 4.ck=42 Win=344 Len=0 Frame 31: 60 bytes on wire (480 bits). .0. = IG bit: Individua .. ..... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). .0 . ... ...013952000 s econds [Time delta fro m previous captured frame: 0. ... .... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. .... . .000994000 seconds] [Time delta fro m previous displaye d frame: 0...... .. 60 bytes captured (480 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...

.. Src: par0 3s14-in-f31.1e100. = Reserved bit: Not set . = Differentiated Ser vices Codepoint: De fault (0x00) . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.1.. ....0... .....0......194... . . . ...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x6028 (24616) Flags: 0x00 0.41.. .. = Don't fragment: No t set .n et (173. ...0. ... ..l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..... ... . . = LG bit: Globally unique address (fac tory default) . .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .. Dst: pc13.......168...63).home (19 2. = More fragments: No t set Fragment offset :0 Time to live: 5 5 Protocol: TCP ( 6) Header checksum : 0x8af3 [validatio n disabled] [Good: Fals ....0 .... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Padding: 000000 000000 Internet Protocol V ersion 4.

= ECN-Echo: Not set . ...194... Dst Port: 51639 (51639 ).. = Congestion Wi ndow Reduced (CWR): Not set .....0 . = Nonce: Not se t ..63) Destination: pc 13.... ... 0..... = Urgent: Not s et . = Acknowledgmen t: Set .0 = Fin: Not set Window size val ue: 344 [Calculated win ...net (173. .. = Reserved: Not set .. .. .1 . = Reset: Not se t .. ........0. . 0 ... . . .home (192... ... ...... Ack: 42. Seq: 1.... = Syn: Not set . 0000 0001 0000 = Flags: 0x010 (ACK) 000......0... . . Src Por t: https (443). ... . ....41.. ...1. .. .0.1e100. . . .168...... = Push: Not set .. 0.e] [Bad: False ] Source: par03s1 4-in-f31. Len: 0 Source Port: ht tps (443) Destination Por t: 51639 (51639) [Stream index: 1] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 42 (rela tive ack number) Header Length: 20 bytes . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. ..

......net pc13.dx...E...)?.. Time Source Destination Protocol Length Info 32 0...dow size: 344] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xd5b 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 26] [The RTT to ACK the segment wa s: 0.014005000 Romance Standard Time [Time shift for this packet: 0.. 2014 11:26:5 4.. (`(.... No.. 0010 00 28 60 28 0 0 00 37 06 8a f3 ad c2 29 3f c0 a8 ..7.026521000 seco nds] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . X....1e100.SC2P.000 .964075000 par03s14-in-f31 .. 95 bytes captured (760 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.h. `n..... 0020 01 0b 01 bb c 9 b7 be 85 68 96 0a 53 43 32 50 10 . 0030 01 58 d5 b3 0 0 00 00 00 00 00 00 00 .hom e TLSv1 . .2 95 Applicat ion Data Frame 32: 95 bytes on wire (760 bits)..

. ..0. . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .................. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ...0 ... .... .014005000 s econds [Time delta fro m previous captured frame: 0.. .. .0. ... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... ..000000 seconds] Epoch Time: 141 5615214. .. ..0 ...000053000 seconds] [Time delta fro m previous displaye d frame: 0.. .. ...... . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).... ..00005300 0 seconds] [Time since ref erence or first fra me: 0.. ...... ... . . ... . = LG bit: Globally unique address (fac tory default) . .964075000 sec onds] Frame Number: 3 2 Frame Length: 9 5 bytes (760 bits) Capture Length: 95 bytes (760 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:ssl] Ethernet II..... = LG bit: Globally unique address (fac tory default) ..

168.41.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. Dst Port: 51639 (51639 ).194.63)..1e100..0. Src Por t: https (443).n et (173. = More fragments: No t set Fragment offset :0 Time to live: 5 5 Protocol: TCP ( 6) Header checksum : 0x8ac9 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: par03s1 4-in-f31. = Don't fragment: No t set . . = Differentiated Ser vices Codepoint: De fault (0x00) ..home (19 2. Src: par0 3s14-in-f31. Ack: 42....1. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 1 Identification: 0x6029 (24617) Flags: 0x00 0... Dst: pc13. .168..0.net (173.41. Seq: 1..194. = Reserved bit: Not set .home (192.. .. Len: 41 Source Port: ht tps (443) ...ersion 4.63) Destination: pc 13. .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.1..1e100..

. 0..0.. . 1 .. .. = Urgent: Not s et . 0000 0001 1000 = Flags: 0x018 (PSH. .......0. . . ...... ......... 0.. . = Reset: Not se t . . ..... = Syn: Not set .0 = Fin: Not set Window size val ue: 344 [Calculated win dow size: 344] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xdf5 c [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 41] . ACK) 000.. = Nonce: Not se t ... . . ...1 .. ... .. .... . = Push: Set . ... = ECN-Echo: Not set ...Destination Por t: 51639 (51639) [Stream index: 1] [TCP Segment Le n: 41] Sequence number : 1 (relative se quence number) [Next sequence number: 42 (rela tive sequence numbe r)] Acknowledgment number: 42 (rela tive ack number) Header Length: 20 bytes .. = Acknowledgmen t: Set .. .. = Reserved: Not set .0 ....... ......... . .... = Congestion Wi ndow Reduced (CWR): Not set ..0. .... .

v).. 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . 0030 01 58 df 5c 0 0 00 17 03 03 00 24 00 00 00 00 00 ..)?... Q`).h..... X..Pv.. 2014 11:26:5 4...@_. 0040 00 00 02 f3 6 5 6a 51 ed 50 76 0a 11 76 29 12 0f .7... 0050 75 c8 01 4d 0 8 40 5f 8e 9e 72 df 97 eb 28 d3 u ..E... No...dx.034650000 Romance Standard Time . ... 95 bytes captured (760 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.M..SC2P.(. .net pc13...2 95 Applicat ion Data Frame 33: 95 bytes on wire (760 bits)...\.$.1e100. `n....2 Record Layer: Application Data Protocol: spdy Content Typ e: Application Data (23) Version: TL S 1.. 0020 01 0b 01 bb c 9 b7 be 85 68 96 0a 53 43 32 50 18 .. Time Source Destination Protocol Length Info 33 0. 0010 00 51 60 29 0 0 00 37 06 8a c9 ad c2 29 3f c0 a8 ..hom e TLSv1 .......2 (0x0303) Length: 36 Encrypted A pplication Data: 00 00000000000002f3656 a51ed50760a11762912 0f75c801.Secure Sockets Laye r TLSv1..ejQ.r.984720000 ham02s12-in-f24 .

= IG bit: Individua l address (unicast) Type: IP (0x080 .... = LG bit: Globally unique address (fac tory default) . .. ......02064500 0 seconds] [Time since ref erence or first fra me: 0.. .... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ... ..0 ...........[Time shift for this packet: 0.. .. .. = LG bit: Globally unique address (fac tory default) .. ..020645000 seconds] [Time delta fro m previous displaye d frame: 0... .. ... . .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .0... .. .... ...... . .... .....984720000 sec onds] Frame Number: 3 3 Frame Length: 9 5 bytes (760 bits) Capture Length: 95 bytes (760 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:ssl] Ethernet II.0 .. .0.000 000000 seconds] Epoch Time: 141 5615214.034650000 s econds [Time delta fro m previous captured frame: 0... .. .. ..

0...184) Destination: pc 13.194..113...home ( 192.. = More fragments: No t set Fragment offset :0 Time to live: 5 1 Protocol: TCP ( 6) Header checksum : 0x5524 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: ham02s1 2-in-f24.net (173. Seq: 1.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 1 Identification: 0x5155 (20821) Flags: 0x00 0.n et (173.1. Dst Port: 51501 (51501 ).. . = Differentiated Ser vices Codepoint: De fault (0x00) .. Len: 41 ..113. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. Dst: pc13.1e100. ..... = Don't fragment: No t set .168...0) Internet Protocol V ersion 4.168.184 )..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. Src: ham0 2s12-in-f24. .. = Reserved bit: Not set . Src Por t: https (443).194. .0. Ack: 42.1. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.home (192.1e100.

.... ... = Congestion Wi ndow Reduced (CWR): Not set .. .... = Push: Set ..0 = Fin: Not set Window size val ue: 1373 [Calculated win dow size: 1373] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xc5b 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] .... ...... . .... .. = Reserved: Not set . = Urgent: Not s et ..0.... ... = Syn: Not set . ... .0 . 0.. ...... .0. ACK) 000. ... .0.. .. ........ = Nonce: Not se t . 1 .... 0000 0001 1000 = Flags: 0x018 (PSH. = ECN-Echo: Not set . .. = Reset: Not se t . 0. .1 ........ .Source Port: ht tps (443) Destination Por t: 51501 (51501) [Stream index: 2] [TCP Segment Le n: 41] Sequence number : 1 (relative se quence number) [Next sequence number: 42 (rela tive sequence numbe r)] Acknowledgment number: 42 (rela tive ack number) Header Length: 20 bytes .. .... . .. .... = Acknowledgmen t: Set .. ...

2 Record Layer: Application Data Protocol: spdy Content Typ e: Application Data (23) Version: TL S 1...047085000 seco nds] [Bytes in f light: 41] Secure Sockets Laye r TLSv1...$. 0050 5e cb c0 64 2 c 33 7d dd 92 2d bf 60 9a 5c ea ^ .dllstx01..P..3}. 0040 00 01 7f d0 0 5 a4 88 1e 3d 6a 6d 0f 76 51 de 13 .\...=jm.dx...vQ. ...3.E.-7.. 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..`.. 0020 01 0b 01 bb c 9 2d 37 c0 00 05 c8 47 4e cc 50 18 ..home TCP 876 http→49 574 [PSH.-.GN...2 (0x0303) Length: 36 Encrypted A pplication Data: 00 0000000000017fd005a 4881e3d6a6d0f7651de 135ecbc0.[This is an ACK to the segment in frame: 27] [The RTT to ACK the segment wa s: 0...com pc13. Time Source Destination Protocol Length Info 34 1.q.......corexc hange.d. 876 bytes captur ....085039000 cust-74-124-12138. 0030 05 5d c5 b3 0 0 00 17 03 03 00 24 00 00 00 00 00 .. ].U$... `n. QQU.... No. 0010 00 51 51 55 0 0 00 33 06 55 24 ad c2 71 b8 c0 a8 ... ACK] Seq= 17568 Ack=1 Win=46 Len=822 Frame 34: 876 bytes on wire (7008 bits )... .

...134969000 s econds [Time delta fro m previous captured frame: 0..ed (7008 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..134969000 Romance Standard Time [Time shift for this packet: 0.. = LG bit: Globally unique address (fac tory default) ... ..... .. ..... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ...10031900 0 seconds] [Time since ref erence or first fra me: 1..085039000 sec onds] Frame Number: 3 4 Frame Length: 8 76 bytes (7008 bits ) Capture Length: 876 bytes (7008 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] Ethernet II...100319000 seconds] [Time delta fro m previous displaye d frame: 0. . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) ..0 . 2014 11:26:5 4. .000 000000 seconds] Epoch Time: 141 5615214. ..... . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). ..0. . .....

12.0........home (192 .. ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 62 Identification: 0xf184 (61828) Flags: 0x02 (Do n't Fragment) 0... = Reserved bit: Not set .... Src: cust -74-124-12-138..... ..0. .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. = Differentiated Ser vices Codepoint: De fault (0x00) .1. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c5c [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 .168..... .dlls tx01........ .124. = Don't fragment: Se t ..... .corexchange.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ... ....co m (74. .138).. .0 .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .. Dst: pc13. ..... .Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..1. = LG bit: Globally unique address (fac tory default) . . ..

0 = Fin: Not set Window size val ue: 46 ....1 . . .... = Congestion Wi ndow Reduced (CWR): Not set ..0.dllstx0 1. = Syn: Not set .0 ..124.. = ECN-Echo: Not set . .168. . .. ...... .. Dst P ort: 49574 (49574).... ... ACK) 000..home (192. ............ 1 .. . . 0. = Nonce: Not se t . ...-124-12-138..1. 0... .0... ... = Reset: Not se t ... = Urgent: Not s et . = Push: Set .. .. Seq: 17568.. .. = Reserved: Not set ...com ( 74.. Src Por t: http (80). Len: 822 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 822] Sequence number : 17568 (relativ e sequence number) [Next sequence number: 18390 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. . ....corexchange. . ... .. . 0000 0001 1000 = Flags: 0x018 (PSH. Ack: 1 ...138) Destination: pc 13...0.. = Acknowledgmen t: Set . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. . .12.....

A 0060 62 6a bd d0 d 7 38 b4 c5 b2 9c 88 fe d1 95 76 7f b j.. .. a..v.k... 0070 16 4d d5 ba 3 6 37 fd 73 5a e7 e2 ff 3f 1f 10 fc ... 0010 03 5e f1 84 4 0 00 31 06 3c 5c 4a 7c 0c 8a c0 a8 . Y.. 0080 ff 00 ff fb 9 2 04 e6 8f f2 e7 2e d4 03 38 92 60 .< 0050 be 61 16 22 0 5 0e a2 20 59 8a 55 82 19 1f b3 41 .| 00a0 16 2b c0 f7 a 5 30 99 26 13 36 a9 e1 6b ad fe af .67..U. +...VKV. ...E.... 0040 a7 19 dc 4e d c 5a 8d 32 95 75 01 fe 72 df 11 3c .P. .. .z.` 0090 5c a4 7a a0 3 d ef 4a 4b d4 b1 5c 0c 3d 89 81 7c \ .....+.8..X 00c0 4b 88 4f 3f 1 c 87 f2 29 70 ae 18 .....n..N...u....Z.....P.N.... . 0020 01 0b 00 50 c 1 a6 2b c8 a6 cd 9e 87 4e aa 50 18 . 00b0 fe 81 15 16 0 1 6f 09 b2 56 4b 56 1b 55 c7 81 58 .=...."..@....[Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x5fb c [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2082] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..2.... ^.... M.8...r.U...o..JK.=....1.sZ.\..6.&.<\J|...0...._.dx....?.. 0030 00 2e 5f bc 0 0 00 2c 80 e4 ca f0 1d 81 6e a8 2e . `n..

..L 0180 34 12 60 46 9 c 87 82 89 3b 2a 1b cf 7b c2 de 34 4 . 0120 8a 63 38 08 c e c4 60 ca 32 5b 50 db 13 38 34 de ..*...R.*..6 0150 ee 0b 37 89 a a 53 75 ac 95 0b 2a 1a 63 16 e6 52 .. 00d0 d2 71 e1 0a 4 9 31 bd 29 52 24 b9 98 94 65 86 16 .R*S#Q<[.~.I1...az 01b0 ff f7 5d 49 2 d d8 94 04 09 bd aa 5d e6 2d d7 2a . q.j. ...... . ..m...R 0160 41 cb ed b9 c 9 4d 93 1a de da df cf fb 3f eb fd A ...... .. 00e0 5f 49 1e e7 e c 78 b4 93 19 56 52 1c 09 dd da 3e _ I..... \.2[P.. 0130 2c e5 1f 24 4 c 60 3a 21 c8 82 c2 67 8f 03 48 9f ...CB.`.x..+7y....VR.?.....c..* 01c0 88 19 ea a3 b 5 7b f9 7f 57 ff fa 55 5a 7d 5d 67 .W..%!Q. ...rUa0(.[.]......84...{.e....a6 b4 3b bc d1 K .O?. .. 0170 ec 43 45 28 2 a c3 21 62 9b 31 f8 75 e3 7e e7 4c .. 0140 c4 58 72 43 e 6 c4 6a 15 09 ba 6b 11 5b d0 fd 36 ..........)p..?. =R. CE(*.]I-.g..7. c8. 01a0 1d 9e 25 21 5 1 10 b7 4d 49 58 6c fa 6d cd 61 7a ..UZ}]g 01d0 f9 70 a5 38 f 9 53 da 3a dd df 41 64 41 a4 12 c8 ...`.[. XrC.$L`:!. 0100 05 5c 1b 72 5 5 61 30 28 0c a8 95 dd f8 a7 fb fd ...)R$.`F.k...I.4 0190 ee 3d 52 af 8 3 60 ea 52 2a 53 23 51 3c 5b ec e3 .-.!b..u..>.Su..MIXl.{.1.. ..M...> 00f0 b1 ba c9 ba 5 b ea b0 43 42 c1 d7 0c 14 3e f7 9f ... 0110 bf aa 52 f6 3 f cb a4 49 80 2b 37 79 1c 10 ec a2 . .H.

:....L...0.=.#.B.... 0270 a9 72 40 42 4 a 44 0f 0a 12 fd 32 63 6b 37 ce aa .J..AD.u...8..n.Dm.. 02a0 cc dd c5 bd 6 4 76 3c b6 5d 0e 2a e3 66 51 31 ae .*. 0280 51 3b df c7 b b 25 6b 0a 0d 69 1f 54 73 60 8c e8 Q .p.m. ..{f.K.. 0230 7a 60 60 44 b a f0 3d 8f 4a 0b fc 8f 5c 0c 3d e9 z ``D...P...... 0250 df 1e a0 d0 1 e 04 d4 83 38 b2 30 9d 27 9a 40 d6 ....fi. 02b0 45 22 cc 50 9 7 49 a4 41 44 9c 75 18 42 e3 4a 47 E ".......-..2e=D. 0240 41 6c 12 2b 8 1 87 bd 28 15 eb 23 b2 59 7a 0c 10 A l.. 02d0 02 40 86 45 0 e c5 53 7e 42 c6 08 b2 b1 87 9b 26 .\... 0290 32 b1 40 2b c d 07 2e 4b c3 b5 15 73 68 be 84 0f 2 . 01e0 82 1a 8c 23 e a 6f 6c 90 a5 da bd 56 15 1e 41 57 . @... .%k.2ck7..... 0260 52 11 33 10 e a a6 2c 6e aa e0 66 69 9c 35 00 a7 R .AdA.8..fQ1..Yz..i.I.. 0220 6e 4c 05 73 f f fb 92 04 e9 8f f3 04 2d d7 03 0f n L..=.JG 02c0 15 81 b3 0b 0 8 3b a1 80 43 db a9 51 ec 9f 83 a4 ...u.S. .../.AW 01f0 52 c4 44 6d 0 0 a5 04 41 a2 2e 53 1e d6 75 1e 0e R .A......S...C. ...+...s... .@...Ts`.#.(..V...5...].& 02e0 63 76 65 f9 d 7 81 32 55 28 7f 2f ad c9 4c 13 85 c ve..ol.. 0200 b8 ee b6 ff a b 7b 66 a6 c4 17 ba 8f e4 73 c7 c4 .... .@+..E....S~B... 0210 37 03 22 71 4 2 a7 cd 32 65 3d 44 83 6d e7 a8 bd 7 .'. r@BJD.dv<..."qB..3.sh..2U(.Q...s...

....135151000 s econds .*a.U No..f 0310 5a a8 8c 82 b 1 27 51 aa 10 11 83 37 46 6e a3 95 Z .&X..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =18390 Win=39275 Le n=0 Frame 35: 54 bytes on wire (432 bits).. ..h 0300 91 73 20 36 8 0 0c 40 31 cc ea 67 20 23 b4 85 66 ...#......C....02f0 6e 5d 83 2c c c 76 6a 9b 2b 5f 67 42 30 5a f0 68 n ].h. 0350 2b 46 f1 58 0 e 9e 26 58 f0 2a 0e ad e8 10 91 2a + F....* 0360 d2 2c 21 5c 8 9 cf 06 9d c2 ae f4 55 .... 0320 61 96 99 8a c 2 e4 9d 9d c2 a5 69 da f2 68 c2 70 a .B".000 000000 seconds] Epoch Time: 141 5615214.*. 2014 11:26:5 4. s 6..g #. .... Time Source Destination Protocol Length Info 35 1.!\.i. ....Zj... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..7Fn.'Q.dllstx01..135151000 Romance Standard Time [Time shift for this packet: 0...home cust-74-12412-138.085221000 pc13...vj..+_gB0Z.. 0340 db 86 0c 23 1 e de 16 20 ae e9 bb e5 e4 5a 6a 14 .p 0330 37 82 e5 2a 6 1 ac 16 42 22 7f 05 cc 43 fe ac f7 7 .X.cor exchange.....@1.

... ....0. ... Src: pc13 .168.... = LG bit: Globally unique address (fac tory default) ... . .. . . .......11 ). ..... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . ..home (192..0 ......1...... . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)...... ..0.co ...... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . .000182000 seconds] [Time delta fro m previous displaye d frame: 0.dllstx01.. ....... Dst: cust-74-124 -12-138..085221000 sec onds] Frame Number: 3 5 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] Ethernet II... = LG bit: Globally unique address (fac tory default) .[Time delta fro m previous captured frame: 0.. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .... .. .. . . . .0 .00018200 0 seconds] [Time since ref erence or first fra me: 1. .

= Reserved bit: Not set . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13... Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) .corexchange.1.....138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = Differentiated Ser vices Codepoint: De fault (0x00) . = Don't fragment: Se t .0.dl lstx01.. Src Por t: 49574 (49574).168.rexchange.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f23 (20259) Flags: 0x02 (Do n't Fragment) 0.ho me (192.11) Destination: cu st-74-124-12-138. D st Port: http (80). .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. Seq: 1.. Ack: 18390 . com (74.1 24...1..124....12. . ..com (74.12. . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...

.....0... . .0.. .000182000 seco nds] . . . 0. . .. = Urgent: Not s et ... . 0 ..........[Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 18390 (r elative ack number) Header Length: 20 bytes . .. 0000 0001 0000 = Flags: 0x010 (ACK) 000..... = Reserved: Not set .. 0. ... . .. = Nonce: Not se t ... .. ..0.. .. ...0 .... ........0 = Fin: Not set Window size val ue: 39275 [Calculated win dow size: 39275] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 34] [The RTT to ACK the segment wa s: 0... . . = ECN-Echo: Not set .. . . = Reset: Not se t . = Syn: Not set ...... ... = Congestion Wi ndow Reduced (CWR): Not set . = Push: Not set ....... = Acknowledgmen t: Set .......1 . . .

E..00280700 0 seconds] [Time since ref erence or first fra me: 1..home TCP 1314 http→49 574 [ACK] Seq=18390 Ack=1 Win=46 Len=1 260 Frame 36: 1314 byte s on wire (10512 bi ts)..137958000 Romance Standard Time [Time shift for this packet: 0.`n.dllstx01.0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ... 2014 11:26:5 4. . No..P.002807000 seconds] [Time delta fro m previous displaye d frame: 0.088028000 sec onds] Frame Number: 3 6 Frame Length: 1 314 bytes (10512 bi . 0010 00 28 4f 23 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ..N..137958000 s econds [Time delta fro m previous captured frame: 0.P.. 0030 99 6b 18 d4 0 0 00 ....com pc13.088028000 cust-74-124-12138. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...dx....corexc hange. Time Source Destination Protocol Length Info 36 1..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 aa 03 50 10 . k...+. (O#@.000 000000 seconds] Epoch Time: 141 5615214.... .

.. ..... Dst: pc13..ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] Ethernet II.124.. ...0 ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .0 .. .. ... .corexchange.... .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . ... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)..138).0..1..... ... . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . Src: cust -74-124-12-138.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.... ... ..12...dlls tx01. ....co m (74.0.... ... .. = Differentiated Ser vices Codepoint: De fault (0x00) .... = LG bit: Globally unique address (fac tory default) .. .. .. .home (192 ..... . = LG bit: Globally unique address (fac tory default) .. ... ..168...

Dst P ort: 49574 (49574).. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 18390 (relativ e sequence number) [Next sequence number: 19650 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) .. . . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.1.168. = Don't fragment: Se t .0.124..corexchange.. ... Seq: 18390..home (192. = Reserved bit: Not set ..12.com ( 74... Src Por t: http (80).... Ack: 1 .138) Destination: pc 13...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf185 (61829) Flags: 0x02 (Do n't Fragment) 0..1.. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aa5 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.dllstx0 1. ..

. = Syn: Not set ... 0. . 0010 05 14 f1 85 4 0 00 31 06 3a a5 4a 7c 0c 8a c0 a8 .. .0 .... = Nonce: Not se t .. = Reserved: Not set .. ...dx....... .......P... . . = Push: Not set .J|.... ...+.. .. 0.0. `n.. ..E.0.. .... .. ....1 .......... ..Header Length: 20 bytes .1. .... 0020 01 0b 00 50 c 1 a6 2b c8 aa 03 9e 87 4e aa 50 10 . ..... = Acknowledgmen t: Set ... . . ..0. . ...N.....@..... . = Urgent: Not s et .... 0030 00 2e ee f4 0 0 00 8c a0 11 62 96 b8 ce 0c 3a c2 .... . ..P... = Reset: Not se t .. 0 . = Congestion Wi ndow Reduced (CWR): Not set .... . 0000 0001 0000 = Flags: 0x010 (ACK) 000. .:... .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xeef 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . = ECN-Echo: Not set ..

#D 0120 ef 55 2d a0 e 8 84 51 14 14 63 8a 9d d0 80 e3 2f ...t...h..b..DU: 00c0 49 aa 61 34 7 8 89 02 42 78 94 15 b1 a8 13 88 a1 I ..M.. .Bx.......C. 00f0 01 ae 73 c5 d b 5b 4e 25 c3 b0 b7 8f 4d fa 9f cf ..... .!...@. e..e. 00d0 ca b9 43 89 8 c f0 21 ad 65 06 97 b5 e8 12 ac a6 ../ 0130 92 65 ba 81 5 3 a3 89 29 20 79 18 95 ab 89 1e 40 .:.."... U-..&........M.A.......s..) y..=(.R$. 0040 4c 98 68 b2 b 7 30 b0 b9 09 a8 9b 4d f2 4b 0f 2d L .W9` 0060 08 f1 a0 26 1 8 a1 50 30 5a 6d 26 0a 80 86 0e 9a . 0110 e7 74 ce 22 d 4 3c 13 6a 08 8d 24 38 6e 0f 23 44 .R..K...S.c. .*.s..@ 0140 5e 1a 89 cb 2 b c7 51 29 3b 8d 2a bc 5a 09 80 4a ^ .j.0..Q)...........b.zP[$ 00a0 2a d0 3d ef 4 a 0c 14 8f 52 0d 63 09 41 84 91 aa * .58..q. 0100 77 8e db 5b f b 43 f0 ac dd 8c fc 66 f6 b5 35 9c w .0050 5b 04 93 5d 1 4 af 35 38 12 86 96 62 ac 57 39 60 [ ....$8n.P0Zm&... ....}.pHs@.].=...Ju.....#V. 00e0 e6 f3 ce 70 4 8 73 40 86 52 24 fb e2 9d c5 b4 fd .. 0090 ff fb 92 04 e a 8f f2 ea 23 56 83 0f 7a 50 5b 24 ... t...5..Z... 0070 04 a3 8f c2 e e 4a 75 0d 22 dc fe 1d f9 b6 bd 57 .[..J...+."......sL.<. .C...Q.. 00b0 81 8c 3d 28 a c 73 4c 92 00 8e 40 ad 1f 44 55 3a ....[N%... .....W 0080 bb ba d6 71 9 b fa d3 7d ad f2 ad 73 bf 74 db 0e . ....J ..f.a4x...c. .

..:r. 0210 ef 7b fe 45 2 4 a7 43 fe 3a 72 0a d0 a9 98 d6 55 .. 0170 f7 27 3b cd e 7 86 7f f9 7d d1 74 06 d4 e4 c6 1f ... 0180 76 fa 2b 72 0 4 6c 5e a5 dc 1a 00 b2 93 e5 7c 32 v ... . ...1.. ..+r...B...x<. ..*k 01e0 88 64 24 05 2 b 4d 88 d3 90 40 99 b4 69 76 c0 00 ..P...X 01d0 95 01 b1 84 8 d a9 c1 f6 a7 a1 23 fe ae 94 2a 6b . 0160 42 ee 55 6d a d 5c cb 38 35 c9 bd f9 dc 6e 9b b9 B . 01a0 d7 f4 b2 9a 3 a 89 f4 c1 04 34 01 78 3c 02 5e 34 ..t..4..P 0240 64 c5 9a 80 6 3 0f 4c 0c 14 9b 50 0d 63 09 41 6c d .\..+M...0150 0a 18 9f eb f 9 47 91 2d 60 91 33 4d cb ea 42 ab .L...od......:. 01c0 52 49 9d 21 a 7 9d d4 4c 2d 4e 60 5a b5 e7 ed 58 R I....n..}.E$...C...... ?... {.%... 0200 f9 1a bd dc e 7 d5 cc a2 c9 8c 30 48 8c a9 9a 9d .X...G... 0260 64 16 a8 08 3 .L-N`Z. d$.0H. 0230 6c 36 ff fb 9 2 04 ec 0f f3 1d 25 d4 03 58 c2 50 l 6.c.. jA.#.. 01f0 89 93 08 81 4 c 59 0e e1 9a 87 c7 01 91 69 a4 89 .l^..LY....3M...(\{.Z..Um...U 0220 e4 3f bf b5 2 5 6e 98 ff f5 87 de cd e4 47 b5 18 .c...&I.Al 0250 92 6a 41 87 c 1 28 5c 7b 09 c6 31 ec 3f 27 ff a9 ....?'.^4 01b0 86 b0 6f 64 0 8 32 c2 03 5a 89 b2 8a ea 26 49 e7 ....E...!........%n.-`..85..t..2.@.... .......iv... '.&A.....|2 0190 47 e4 45 d1 a 1 26 41 a7 c1 14 9f 0f 74 10 9a 13 G ..i.G... .....

..= 0330 23 18 bb 0f 2 2 8d 96 e2 e5 20 85 40 4b d4 f2 b4 # . . . ....9.....y....p8...J.. 0270 25 7f 15 40 9 e 6b 6d 30 9d 75 80 be 80 ac 5a 34 % .h 0320 83 4c 4a 20 7 f c5 ce 07 82 b7 c1 b3 20 e0 0f 3d .a..k.".J.X.@K.3 12 08 a2 46 c2 71 b4 86 fd a2 10 d . ..F. 02c0 cb bc 16 9c 0 d 61 88 78 3e 48 e2 42 26 0a 4f 15 ..1. .-Rz........wF].. 0290 9f 03 91 86 1 9 ee 0a f7 18 f1 ab 24 f7 65 f5 f1 ...l.X.. 02a0 b2 90 d5 2f 1 9 0b d5 f7 6c 66 d2 e4 f3 a5 4a a5 .I..!J.e.....E.... 02d0 9c a8 a6 d9 1 d 45 c1 28 03 26 b8 20 b7 9b 3b cb .km0..Z4 0280 aa ed 1d 89 1 b 39 c2 70 38 ed e0 6b 8b d1 96 ce ..Z.. ....M...lf.. .. 0340 92 00 32 19 1 3 9e dd 26 c6 98 c6 2e aa b1 15 29 .H..B&...P.A...[....q..&...... LJ ........x>H. .x/ 0360 23 d6 2d 52 7 a ad a1 ab 21 4a fa 8e 31 b1 af 18 # ..(.arU./..@..) 0350 c8 08 e0 20 0 1 79 1c d9 61 72 55 d9 09 85 78 2f .. ....2.&..2..O..^| 0310 66 92 15 00 9 a 5b 12 55 cd 11 6c a5 14 b4 03 68 f . ......U..3....< 02f0 3b c6 e0 50 0 1 c1 1c 98 b9 bc 41 e4 f0 cc af f5 .. ..2.....u.... . 0370 31 64 dc 24 0 3 3a 39 e2 a1 35 2b ... .... 02b0 2d 15 34 40 8 9 32 c1 58 8d ec a1 b9 dd 4d 01 20 .... 02e0 5e 7e db 1e 5 a d0 fd 18 0a 91 c7 4a 16 1f a3 3c ^ ~..$.4@. 0300 df c4 49 97 5 8 9f 32 97 48 ef 77 46 5d e3 5e 7c ...

~ 0440 fd 8f c3 76 2 2 71 8a 6c 37 a8 ac e6 58 56 3a 17 ....r.A.XV:.)M..e.... ... . 0380 87 07 80 41 1 6 6c db 0c 3d c1 0c a8 b8 29 4d 96 ...hN.6.n T......k. 0430 65 13 6f a7 4 a 00 b1 54 cf b0 e4 8f 50 7c d5 7e e .% 0420 63 03 8d d6 7 f ac c6 9d 97 f6 e1 41 e1 82 ab a0 c .%o.. 0450 2c e0 98 04 3 4 5a 2e b0 01 e9 f9 90 a3 e7 ba db ...o.. 0390 08 73 4c 18 5 1 4b 89 72 14 b5 95 13 3a 2a 17 44 .....l...... .:*. 0470 49 6e 8b 78 3 2 a6 d8 bc c1 95 74 51 43 31 02 70 I n..W....J.L..p 0480 57 8b 8e 9a b c cb c2 ba e4 d9 09 86 68 31 44 c8 W ..Z=D... ..D 03a0 6c 91 30 dc b 2 57 8c 3c b3 65 f8 06 6e 20 54 f4 l ...._.(.J.x2.~.......5+......b6 c8 a2 aa 83 1 d.P|.... sL....m.$Y.:9...l7.... 03b0 41 46 d4 2e 5 a 3d 44 00 a3 3f 1d 88 5e 50 7d 69 A F.=(...QK...@...tQC1.... 0460 30 a1 2b b0 1 4 f1 d1 59 ae b9 80 93 28 12 5c 02 0 ..$.<. 03f0 41 84 91 e9 8 1 8c 3d 28 ad ae 68 4e ab 13 59 fd A ..A.. .... 0410 0a a8 5f c4 2 4 59 ec 40 a4 8e e1 7e da e0 c8 25 ..g.Y.X 03e0 c2 50 5d a4 6 a 70 63 0f 4a 0b f8 91 4c 0c e1 e9 . P]...jpc.T. %.v"q... 03d0 b6 25 d2 68 f f fb 90 04 e8 8f f2 e6 1f d3 83 58 ...4Z.\..^P}i 03c0 5e f2 b1 8e 1 7 67 1f 17 f2 9b 0d dc 72 67 32 c2 ^ .?. 0400 d4 ce a0 84 f a 25 6f 01 a8 6d 80 6b b5 36 a8 c8 ..0..rg2..+....Y.h....=.

bE. .net pc13..... Time Source Destination Protocol Length Info 37 1.m_...95.. 2014 11:26:5 4....I>.h1D.........f. .213044000 par03s14-in-f31 ..T..N* 04e0 68 a7 e4 f1 d 7 66 c3 7e fc d3 03 b3 90 04 89 e0 h .... 95 bytes captured (760 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...M..q.......a... 04a0 94 b3 b4 d8 4 4 7c 0e d3 b1 10 4e 71 5d 8c b7 70 .M#.... 0520 fd 55 .. .hom e TLSv1 ._.Q 04c0 05 e4 53 80 4 9 3e 02 3a 43 2a a0 b2 61 a4 8f 02 .2 95 [TCP Ret ransmission] Applic ation Data Frame 37: 95 bytes on wire (760 bits)..1e100.D|........ O.r. 04f0 87 e9 c6 c6 9 b 29 58 54 33 26 65 18 a8 f7 5f 8d .262974000 Romance . .Nq]..... U No.:C*..[. 0500 5c a7 c7 98 e a ac 99 ee e6 5b a9 0f d8 9b fc 2c \ .D....~.. 0510 77 2f d5 4d 2 3 82 d3 06 4d 95 6d 5f 7f c2 7f bf w /......S..)XT3&e... 04d0 99 4f 16 20 a f 90 e0 a1 09 be 02 04 14 00 4e 2a ..p 04b0 c8 a7 c7 71 c 4 44 d4 72 fb e7 fe eb 39 35 b3 51 .... .. 0490 49 72 b0 bc 0 a 62 45 b4 fe ea ca a4 a9 0a 54 13 I r......

.... ..... ....... ...... . = LG bit: Globally unique address (fac tory default) . .000 000000 seconds] Epoch Time: 141 5615214.. ..... = IG bit: Individua l address (unicast) . .0.. ..Standard Time [Time shift for this packet: 0. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ....0 ....... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). . ...... . . ......213044000 sec onds] Frame Number: 3 7 Frame Length: 9 5 bytes (760 bits) Capture Length: 95 bytes (760 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:ssl] Ethernet II. = LG bit: Globally unique address (fac tory default) . . ..0.0 ..125016000 seconds] [Time delta fro m previous displaye d frame: 0.. .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ....12501600 0 seconds] [Time since ref erence or first fra me: 1.262974000 s econds [Time delta fro m previous captured frame: 0. .. .. . ..... .....

...1. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. Dst Port: 51639 (51639 ). Seq: 1.. Ack: 42.home (19 2.n et (173.168. .194..Type: IP (0x080 0) Internet Protocol V ersion 4. = Don't fragment: No t set .1. .home (192.. .net (173..168. = Differentiated Ser vices Codepoint: De fault (0x00) .0..63).00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 1 Identification: 0x602a (24618) Flags: 0x00 0.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Src: par0 3s14-in-f31.. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol... Src Por t: https (443). Dst: pc13.1e100. = More fragments: No t set Fragment offset :0 Time to live: 5 5 Protocol: TCP ( 6) Header checksum : 0x8ac8 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: par03s1 4-in-f31. . ...63) Destination: pc 13. = Reserved bit: Not set ....0.194.1e100..41.41.

.. .1 ........... .. . = Reserved: Not set .. 0...... . .0. . .. .. = Syn: Not set ... = Congestion Wi ndow Reduced (CWR): Not set .. ...0.. . ......0 = Fin: Not set Window size val ue: 344 [Calculated win dow size: 344] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xdf5 c [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys .... ... ACK) 000.. = Urgent: Not s et . = Nonce: Not se t ..Len: 41 Source Port: ht tps (443) Destination Por t: 51639 (51639) [Stream index: 1] [TCP Segment Le n: 41] Sequence number : 1 (relative se quence number) [Next sequence number: 42 (rela tive sequence numbe r)] Acknowledgment number: 42 (rela tive ack number) Header Length: 20 bytes . = Reset: Not se t ....... ..... . . = ECN-Echo: Not set ... = Acknowledgmen t: Set . 0. = Push: Set .... .... .....0 .. . ..0.. . . .... 0000 0001 1000 = Flags: 0x018 (PSH.. .. 1 ..

... ..E.. . Q`*... X.v)..M.dx...h.2 Record Layer: Application Data Protocol: spdy Content Typ e: Application Data (23) Version: TL S 1..2 (0x0303) Length: 36 Encrypted A pplication Data: 00 00000000000002f3656 a51ed50760a11762912 0f75c801..SC2P.@_..(...ejQ..... 0030 01 58 df 5c 0 0 00 17 03 03 00 24 00 00 00 00 00 . 0040 00 00 02 f3 6 5 6a 51 ed 50 76 0a 11 76 29 12 0f .r. 0050 75 c8 01 4d 0 8 40 5f 8e 9e 72 df 97 eb 28 d3 u ..is] [Bytes in f light: 41] [TCP Analys is Flags] [Expert Info (Note/Sequenc e): This frame is a (suspected) retran smission] [Th is frame is a (susp ected) retransmissi on] [Se verity level: Note] [Gr oup: Sequence] [The RT O for this segment was: 0...\.. 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..Pv... `n.7. 0010 00 51 60 2a 0 0 00 37 06 8a c8 ad c2 29 3f c0 a8 ... 0020 01 0b 01 bb c 9 b7 be 85 68 96 0a 53 43 32 50 18 ...248969000 se conds] [RTO ba sed on delta from f rame: 32] Secure Sockets Laye r TLSv1.. Time Source .. No.....$...)?..

2014 11:26:5 4.213117000 sec onds] Frame Number: 3 8 Frame Length: 6 6 bytes (528 bits) Capture Length: 66 bytes (528 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II.1e100.home par03s14-inf31.Destination Protocol Length Info 38 1. 66 bytes captured (528 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.net TCP 66 51639→ https [ACK] Seq=42 Ack=42 Win=16625 Le n=0 SLE=1 SRE=42 Frame 38: 66 bytes on wire (528 bits).000 000000 seconds] Epoch Time: 141 5615214. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).263047000 Romance Standard Time [Time shift for this packet: 0.00007300 0 seconds] [Time since ref erence or first fra me: 1.263047000 s econds [Time delta fro m previous captured frame: 0. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) .000073000 seconds] [Time delta fro m previous displaye d frame: 0.213117000 pc13.

......... ...41.. .194.. ..0. . Dst: par03s14-in -f31. = LG bit: Globally unique address (fac tory default) .. .............. Src: pc13 .. .11 ).... . ...0 .. . ... = LG bit: Globally unique address (fac tory default) . ... ..home (192. = Differentiated Ser vices Codepoint: De fault (0x00) . .. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.... ..63) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .0. .1..... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00... . .....1e100.....Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ...... = Don't fragment: Se t . .0 .net (173 .. . . . ... ......00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 5 2 Identification: 0x4f24 (20260) Flags: 0x02 (Do n't Fragment) 0...1. = Reserved bit: Not set .168. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ...

.... = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13...... Src Por t: 51639 (51639)... Ack: 42 .. = Congestion Wi ndow Reduced (CWR): Not set . D st Port: https (443 ). Seq: 42... = Acknowledgmen . .net (173. .. .0... 0.. 0000 0001 0000 = Flags: 0x010 (ACK) 000. = Reserved: Not set .0.168.1e100 .0.....41.. ... = ECN-Echo: Not set .194...63 ) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..1 ... . ... Len: 0 Source Port: 51 639 (51639) Destination Por t: https (443) [Stream index: 1] [TCP Segment Le n: 0] Sequence number : 42 (relative s equence number) Acknowledgment number: 42 (rela tive ack number) Header Length: 32 bytes . .... .. .. = Urgent: Not s et .1. . . ..... . = Nonce: Not se t ..11) Destination: pa r03s14-in-f31.0 ... . ...ho me (192..

= Push: Not set . 0 .... No-Operation (NOP).. .. ...t: Set ... = Syn: Not set . .0 = Fin: Not set Window size val ue: 16625 [Calculated win dow size: 16625] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x98d b [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 Options: (12 by tes)... 0 0001 = Number: No -Operation (NOP) (1 ) No-Operatio n (NOP) Type: 1 0. = Reset: Not se t .. ..... .. . ... = Copy on fr agmentation: No .... .. = Class: Con trol (0) . 0..00 . ... .. = Class: Con trol (0) ... .. . 0 0001 = Number: No -Operation (NOP) (1 ) SACK: 1-42 Kind: S ACK (5) Length: 10 left ed ge = 1 (relative) right e dge = 42 (relative) [TCP SA CK Count: 1] [SEQ/ACK analys is] . ....... .00 .... SACK No-Operatio n (NOP) Type: 1 0. = Copy on fr agmentation: No .0. .... No-Operation (NOP).....

.249042000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .. 0020 29 3f c9 b7 0 1 bb 0a 53 43 32 be 85 68 bf 80 10 ) ?.....corexc hange.000 000000 seconds] Epoch Time: 141 5615214..279976000 Romance Standard Time [Time shift for this packet: 0. ..com pc13... 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...016929000 seconds] . 2014 11:26:5 4..... 0030 40 f1 98 db 0 0 00 01 01 05 0a be 85 68 96 be 85 @ .dllstx01......230046000 cust-74-124-12138..E.SC2....[This is an ACK to the segment in frame: 32] [The RTT to ACK the segment wa s: 0.h.. Time Source Destination Protocol Length Info 39 1. 0040 68 bf h .`n. No...home TCP 1314 http→49 574 [ACK] Seq=19650 Ack=1 Win=46 Len=1 260 Frame 39: 1314 byte s on wire (10512 bi ts)..279976000 s econds [Time delta fro m previous captured frame: 0..h.... 0010 00 34 4f 24 4 0 00 80 06 00 00 c0 a8 01 0b ad c2 ..dx. 4O$@..

. ..01692900 0 seconds] [Time since ref erence or first fra me: 1.. ... . .. ...0 .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ..[Time delta fro m previous displaye d frame: 0. .... .... = LG bit: Globally unique address (fac tory default) ...0. ... ..port == 80 || http 2] Ethernet II..0 ... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. . ......0...... ....230046000 sec onds] Frame Number: 3 9 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. . ... . .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4............. . .. = LG bit: Globally unique address (fac tory default) . .. . .... Src: cust .

. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aa4 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.. .124.1.. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..168. .138) Destination: pc 13...home (192 . Len: 1260 .corexchange. Seq: 19650.1.124.. Dst: pc13..0.co m (74.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.-74-124-12-138....corexchange. = Reserved bit: Not set ..168.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf186 (61830) Flags: 0x02 (Do n't Fragment) 0. .dlls tx01.dllstx0 1.12.. = Differentiated Ser vices Codepoint: De fault (0x00) .home (192.1..138).com ( 74.. Src Por t: http (80).11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. = Don't fragment: Se t ..12.. . Dst P ort: 49574 (49574). Ack: 1 .

... = Nonce: Not se t ... ...0. .. .. .. . = Push: Not set ....... ....0. ...1 . .. 0.. .. . . 0000 0001 0000 = Flags: 0x010 (ACK) 000.. ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x987 d [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] .. = Congestion Wi ndow Reduced (CWR): Not set ...... ... .. = Acknowledgmen t: Set . . .. = Syn: Not set .. ... = ECN-Echo: Not set . 0 ..... 0..... = Urgent: Not s et ...0..... . = Reserved: Not set .. ....... . = Reset: Not se t . . ..Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 19650 (relativ e sequence number) [Next sequence number: 20910 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . ...... ....0 .

1xf...E.....1.J`...S. ..X..H..P..c. 0070 f5 c8 2d c8 a a c8 3e 62 ff 3f 54 ee d3 cb 9f e1 .N.[.-.+.... .... 00d0 58 6a e1 c2 4 8 9b e8 76 8c 0c 92 35 12 ab a9 63 X j.O.u..v.q..7.. !S..-.[Bytes in f light: 2520] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .........s. J.P.... 0040 a0 10 a3 06 3 7 14 e0 0a c5 96 92 22 07 25 20 76 ..... 0030 00 2e 98 7d 0 0 00 6b 8c 30 4b 13 05 93 f2 13 c2 ...i..k.U.... $.dx.( 0060 80 5e 92 08 e 7 6b a9 da 8c 55 81 c1 a9 52 d9 bc ..?T. 0100 7f 0c d8 fd b c 72 d6 7d c7 fe c3 ...:..J. ..0K..)U...% v 0050 d7 31 78 66 8 7 45 40 23 16 74 18 fc e3 0e 87 28 . LI....}..a).. 00a0 c9 4a 0c e1 6 b 81 8c 12 29 01 9c 61 29 c2 a3 1d . 0080 d5 47 7e ce 5 a c7 f1 ff b1 ff fb 92 04 e9 0f f2 .^..).t..".. 00c0 4c f4 38 ce 2 d c5 12 75 00 05 e7 63 a4 2c 73 92 L ..E@#.....P^$...0...c 00e0 95 24 b0 69 1 4 a8 2b 96 f5 29 55 15 00 71 d8 13 . .. 0020 01 0b 00 50 c 1 a6 2b c8 ae ef 9e 87 4e aa 50 10 ..J|..D..k.+..`c. 00f0 1b a4 a7 93 5 b 85 4a 60 ef b1 df fd 53 c3 4f ef .@... 0090 f1 21 53 03 5 8 c2 50 5e 24 1a 60 63 18 4a 0b dc ..... ..k.5.Z.. G~....>b.k.. . 00b0 14 4c 49 b3 3 b 5e 8f eb 6b 02 44 03 99 19 30 ce .. 0010 05 14 f1 86 4 0 00 31 06 3a a4 4a 7c 0c 8a c0 a8 . ^..R. `n.8...

.I. ....C..m.....M.5R. . ..T%.s 01b0 07 15 98 53 b 6 3b fb 85 ea 67 29 ba 3f fd ea 3f . u..?....g)...A#....... .....r....S.U*...r.u. . 0140 5f 1f 32 8d 7 7 82 91 26 bb 01 6d 99 9a 83 09 85 _ ....... ]..@..`j.+..eo 01d0 0e 1c 9c 35 5 2 aa 4d a9 40 08 e0 30 e2 a6 40 e2 ..iSN."..... 0150 4e a7 d9 ec f d d8 1f e1 dd 5b 93 ff fe 9b 1c 7a N .a.w.....d.? 01c0 04 5d ce b4 1 7 01 5f b9 dc ac 75 82 c1 e0 65 6f . V.. 0190 cd c3 2b eb 6 2 26 94 e8 a9 69 53 4e 1d 8f 4b 33 .. ...h..{ 01f0 85 56 0e 72 a a 84 32 98 08 e9 52 62 c2 b0 af f1 . 01e0 7d 9a 68 83 0 3 1d 54 25 8c 03 00 08 8b e4 96 7b } ... 0210 76 0b 6e b9 6 d 4e 49 f5 03 ee 17 c9 4d 26 3f 76 v .0. /.&...V..K3 01a0 b4 c5 60 6a 1 3 13 e0 61 8b 8f 0d 68 bf 4d dd 73 ..k 0120 5c c0 80 06 0 5 64 08 8c 49 0a 8c 90 9c b7 93 9c \ .. ...M.[.2...83 44 2a 4c 5d ..D*L] 0110 d5 1b af 17 f a 55 2a 1b 18 a1 26 c9 d8 95 e3 6b .......r.}... .:.. 0170 cb 0f c5 07 2 c b3 ed df 53 34 03 16 22 aa 0a b8 .....b&.. ..S4...S.2. 0200 d5 2f 80 e0 4 3 2e 1b b0 8a 41 23 95 95 a7 a8 a9 ... . .............Rb..2.@._..+Acs.. 0130 a3 e9 20 f2 d 3 82 32 e6 53 de 2b 41 63 73 ca b6 ..h.....m.....&.z 0160 de 75 9b 1b 3 a ce e7 72 b1 ec 16 0f 01 56 f0 e1 .. 0180 12 2c dc 9b 0 c 6d 06 01 80 09 02 20 8b ae 3a e7 ..:...

..Q.Sb.. 5... N.T...|.'....@b 0320 c3 82 a3 91 8 1 31 26 c0 a1 53 7a 05 14 00 54 f2 .g..Y.!.. . 0310 c9 15 9e 13 2 1 fa 76 58 7b d7 fd 49 5a 0e 40 62 .EAC(f.x 02f0 87 72 63 a5 0 8 1a 5d 26 15 a6 e5 4d 76 06 af 73 .266....... .. ..... ...r).0...8. 02d0 77 12 b0 84 4 5 41 43 28 66 05 ed a7 30 49 8c 0e w ....&.. 0260 30 8f 83 59 b 0 aa 07 23 81 98 30 04 95 20 2d 70 0 .s 0300 ed 4e f3 f1 9 6 c1 50 46 f3 e5 67 16 73 7c b9 98 ... . . .x. 0280 b0 35 04 cf e 2 cb e1 b8 38 0b 87 48 45 01 a5 20 .a(. 0290 5b f6 b2 50 1 8 98 6c 06 d4 3b 27 bb 2f dc 2f 18 [ .n. 0230 8f f2 f0 24 5 2 83 38 ca 50 5d 44 7a 40 67 18 4a .......vX{.......A}... ..IZ. e./..PL..HE...1&....Mv../....#.J 0240 0c 6c 87 48 0 d 67 09 41 7d 90 e8 c1 ac 61 28 2e .g.... 0250 73 f7 f7 fe e 9 d4 8e e5 32 36 36 bf fd 45 e1 15 s ...E.+..l.)..mNI.c.w. l...Sz..$R.P]Dz@g.. 02a0 cd 8f fd ce d 2 bc 7c ee aa ae 1c 2b fe 15 b9 ce ....T.. 02b0 dd fb ff 77 1 8 19 95 07 78 e4 2f 6f ff a1 1e 42 .F..H. 02e0 11 1a 92 d9 a d 2c 82 1f d8 c8 51 fa 63 0e e5 78 .... rc...M&?v 0220 cc 65 eb ef 7 2 82 53 62 c5 7f c3 ff fb 92 04 e8 . ..RT.r.P..PF.0I. -p 0270 14 1c a9 06 d 8 aa 92 e9 29 88 72 29 0c 46 ac 89 ..8...]&....B 02c0 c2 9d e1 09 5 0 4c 98 15 54 10 b4 26 f2 52 54 b9 ...s|....../o.......

.. .X.V! 0410 5b 8a c4 25 4 0 38 f5 30 0f b5 94 80 a2 d0 19 49 [ . . c......./.......rTF$r.+.I 0420 41 79 92 02 e d 2c ec fc 12 d7 dd 83 0a 27 69 fa A y..(.T.. .. .H...v....2.C. J.q.0330 97 0e b1 71 0 e 0c 25 0e 82 4e cb 4c 61 94 10 12 ..1#. 0440 31 1c ab f7 7 ..B 0390 ac c8 5e a2 8 1 b8 b7 10 56 50 01 90 44 60 bb c8 . 0430 27 41 28 55 d 4 68 38 e9 f0 9b f9 be d1 49 5c d6 ' A(U...a.. .v..F.S.....%...P`d..... 03d0 04 e8 8f f3 0 b 25 51 83 58 ca 50 60 64 ba 20 67 .%Q.h8.. 0380 98 04 84 31 2 3 80 a0 a4 a2 32 8a 1c 17 a8 8a 42 ..^.'i..I\...5.r 0350 62 e6 12 b5 2 b 94 7a f3 76 a6 a1 91 53 d2 76 6b b ... 03b0 8f 0a 5c 5b 7 4 ac 4e f9 f8 94 e4 ae 55 ee ef 69 ..D`...La.@)tA.....#....e 03f0 28 4f 8c 26 6 6 30 83 b7 76 ff df fc 48 84 0f 3a ( O..+g..wz 0370 ef dd 61 63 5 a 7b 2c 67 ad 2f 48 e0 f3 9e 68 df ...%@8.N.g....vk 0360 f9 f8 d9 ad 2 8 e7 fc a9 fd b1 9f 2b 67 cd 77 7a ....../H.acZ{...0...z..'.)Au.....\[t....&f0... ..N..: 0400 3b 63 cd 9a 6 1 11 72 54 46 24 72 f2 06 80 56 21 .i 03c0 f7 fd b9 9e 5 4 92 ca bc b9 07 c8 35 97 ff fb 92 . 0340 1e 99 c2 b4 e 3 c4 e4 c3 23 9d c8 03 43 b8 87 72 . ... .VP. .. 03a0 59 5e 59 3b 2 f 8c b0 f7 40 29 74 41 b7 27 8a 2e Y ^Y... g 03e0 18 4a 0b b4 8 5 46 0c e7 29 41 75 92 a8 81 ac 65 ......h.....U.

0510 5d cf 59 3f 6 8 49 57 0e 41 82 80 5f b0 e2 c2 24 ] .. ..Wq 04a0 a6 ee 37 6e 5 6 82 e0 ea 93 b5 2d ca 6a 61 bb 99 .-.W 04e0 cb 97 ef 2e 0 0 31 92 64 50 22 70 6e e2 48 7f 50 ..IYG.hh#.3.. 04d0 2a 03 7a 5c a 1 30 c6 cb 2d 19 4b 72 e8 b7 f1 57 * .....!..&.n... .. Time Source Destination Protocol Length Info 40 1.H....$ 0520 e3 dc . 0490 42 86 ba 48 2 6 4d 09 81 ad 39 98 c2 2a c3 57 71 B ....z\...H&M.home cust-74-12412-138.-.....<zk...H..d a9 9e 52 49 cc 71 d4 0d 21 a8 95 1 ..q._..RI.M(.P 04f0 98 c1 a1 99 1 5 33 d9 84 26 95 f6 af 56 9b 3c 6b ... .'. 0480 ad b6 10 e4 d 5 05 03 15 16 68 68 23 11 17 82 f3 ....Kr. ......r.. ...<k 0500 d6 d4 dc 82 e 4 b6 a6 72 9a 98 6e e6 4d 28 e2 a0 .dllstx01.. 0460 e5 86 ba 48 b 8 1d 56 82 9e e1 10 a0 f9 48 a3 83 ...@. 0470 11 46 3a 21 9 2 4b 3a 16 d6 1b 05 1c ea 8e 82 8f ....:..^".H..7nV.ja..Y?hIW.S....... ..=..*..H. 04c0 9b 00 81 01 1 9 5e 22 a1 dd d4 f2 27 a1 2a 8a f6 .. .... .9... 04b0 34 a0 05 00 5 3 ca e9 f8 48 ba 2c 84 3d 9a 40 8d 4 .*.}....K:.V. .cor .V.....230221000 pc13.A..dP"pn..0...1. No. 0450 85 85 83 3c 7 a 6b a5 3a da ce 84 49 59 47 e9 84 ... F:!.

280151000 Romance Standard Time [Time shift for this packet: 0.280151000 s econds [Time delta fro m previous captured frame: 0.exchange. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =20910 Win=42525 Le n=0 Frame 40: 54 bytes on wire (432 bits).00017500 0 seconds] [Time since ref erence or first fra me: 1.000175000 seconds] [Time delta fro m previous displaye d frame: 0.000 000000 seconds] Epoch Time: 141 5615214. 2014 11:26:5 4. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa .230221000 sec onds] Frame Number: 4 0 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .port == 80 || http 2] Ethernet II. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).

.. .. .... .... . Src: pc13 . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ..... . . ... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt...0 .. ... Dst: cust-74-124 -12-138.com (74..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f25 (20261) Flags: 0x02 (Do n't Fragment) 0... .. . ... .168... .............. ..11 ).... . = More fragments: No t set .. ..... .. ..gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .dllstx01. = LG bit: Globally unique address (fac tory default) .home (192. . = Differentiated Ser vices Codepoint: De fault (0x00) .1 24.12...0 .0.1......1... = LG bit: Globally unique address (fac tory default) . ...... ....co rexchange.... = Reserved bit: Not set ...0. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..0... .. = Don't fragment: Se t ...

. = Urgent: Not s et . Seq: 1.......... = Push: Not set ... . ..corexchange.11) Destination: cu st-74-124-12-138..... ..0. .138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13... Src Por t: 49574 (49574)..168.. . = Acknowledgmen t: Set .... .. .. = Congestion Wi ndow Reduced (CWR): Not set ... .12..dl lstx01. . ..ho me (192.... D st Port: http (80).. 0. . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 20910 (r elative ack number) Header Length: 20 bytes . = Reserved: Not set .124.0 ... .. com (74. 0 . . = Nonce: Not se t .... Ack: 20910 ..1 . .0. 0000 0001 0000 = Flags: 0x010 (ACK) 000. = ECN-Echo: Not set . .1...... ..

... .. = Syn: Not set .. ACK] Seq= 20910 Ack=1 Win=46 Len=827 Frame 41: 881 bytes on wire (7048 bits ).0 = Fin: Not set Window size val ue: 42525 [Calculated win dow size: 42525] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 39] [The RTT to ACK the segment wa s: 0.. ... 0030 a6 1d 18 d4 0 0 00 .E.dx.home TCP 881 http→49 574 [PSH.. .. 0010 00 28 4f 25 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ..`n..+..corexc hange.. . ..... ..P.. ..dllstx01. Time Source Destination Protocol Length Info 41 1..P.... 881 bytes captur ed (7048 bits) on i ...N.0......J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 b3 db 50 10 .. .... 0..000175000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ..... . (O%@. .... . = Reset: Not se t . No.232999000 cust-74-124-12138..com pc13.

.... ..232999000 sec onds] Frame Number: 4 1 Frame Length: 8 81 bytes (7048 bits ) Capture Length: 881 bytes (7048 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..000 000000 seconds] Epoch Time: 141 5615214. .002778000 seconds] [Time delta fro m previous displaye d frame: 0........0.port == 80 || http 2] Ethernet II.. ..282929000 Romance Standard Time [Time shift for this packet: 0...... .00277800 0 seconds] [Time since ref erence or first fra me: 1. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . . ..282929000 s econds [Time delta fro m previous captured frame: 0.. .. .nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. ... . ..... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... 2014 11:26:5 4. = LG bit: Globally unique address (fac tory default) .0 . .

....... ...... ...= IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .corexchange.. ..1. ...... .... .. = LG bit: Globally unique address (fac tory default) .12. Src: cust -74-124-12-138..124.0 .. . . Dst: pc13...dlls tx01.. .0.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..1.co m (74.168.. .....0. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c54 [validatio n disabled] . .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.138)..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 67 Identification: 0xf187 (61831) Flags: 0x02 (Do n't Fragment) 0.. = Reserved bit: Not set . . = Don't fragment: Se t .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...... . .home (192 ... ... = Differentiated Ser vices Codepoint: De fault (0x00) .

. Dst P ort: 49574 (49574).1... Len: 827 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 827] Sequence number : 20910 (relativ e sequence number) [Next sequence number: 21737 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . Seq: 20910... .... .[Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. ........ Src Por t: http (80). .....0 .138) Destination: pc 13.. = Reset: Not se t .....corexchange.0. .dllstx0 1.. . = Nonce: Not se t .. = Push: Set . = Reserved: Not set .1 ... . . = Congestion Wi ndow Reduced (CWR): Not set ...... . ACK) 000. . 0.. 0... ... ..... Ack: 1 .... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. . .. .. 1 . ... .com ( 74...0...124. . . = Acknowledgmen t: Set . ... = ECN-Echo: Not set ..home (192.12. = Urgent: Not s et .... 0000 0001 1000 = Flags: 0x018 (PSH.168. ....

.... 0070 97 3b 9f 27 e b d0 d5 54 f3 d6 66 2f 52 5c 15 69 ........m..=f... _LQ./....P.O...k8J.+.. 0040 80 f4 4f 01 b 2 12 e4 1e 6d a4 18 05 b4 d1 80 54 ..Y. 0010 03 63 f1 87 4 0 00 31 06 3c 54 4a 7c 0c 8a c0 a8 ..T 0050 05 5f 4c 51 d f 97 15 0a 0e 10 08 ec 80 91 a1 dc ....... . . 00b0 a4 f1 10 26 1 ....0. 0030 00 2e a8 30 0 0 00 91 e0 00 21 69 82 65 1a 60 18 .. . ..f/R\.{.[.. ...0..T.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xa83 0 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 827] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..B...<TJ|... .... ...@.. c...i 0080 b5 07 5c ff f b 92 04 e9 0f f2 fa 1f d0 83 59 c2 ...!i. . `n.'......P......... 0020 01 0b 00 50 c 1 a6 2b c8 b3 db 9e 87 4e aa 50 18 ..A 00a0 74 10 e8 01 a c 61 28 d3 2f ac 2c f1 31 c4 ff f9 t . . = Syn: Not set .dx....N..\..1... 0060 01 00 7b 2e b a 5b f5 ea 9e ca 13 3d 66 86 87 1a ....E... 0090 52 5e 43 fa 0 0 6b 38 4a 0b c8 87 42 0c e7 09 41 R ^C.`.a(.....1.e..

.:.....ET. .S. 0120 1f 62 04 45 a f 35 d8 c2 ca 47 79 c3 8e 88 bf 98 .+..T 01c0 c7 3a c3 ac 2 e 6d 2e 35 59 e3 62 . .... 0140 95 bd 2b c4 4 b 50 30 4b ae 4a 12 87 40 18 45 a9 .Gy.. 0100 dc a9 8d 25 4 c 82 e6 c7 08 8d 2c 81 b4 44 e9 58 .v32\jV.QV. b. .5 38 c8 44 62 20 4c 20 fc 96 c2 dd .. mJ.J.P0=..5..oH. . w.4k.. 0150 ba 83 e1 40 c 8 6f 48 86 8b 11 50 30 3d 0b 78 4d .(###BOT_TEXT###.)....[2_."....... 0130 97 6b 89 69 1 c 51 56 a7 1e 98 80 1a 29 82 0c 99 . .) 00f0 a9 d9 76 33 3 2 5c 6a 56 ee 7c 97 d7 a1 a5 5d f3 .uG.0x.|. ..C.........O8.xM 0160 88 66 aa 48 e 1 35 32 a5 77 6c fb df ad 75 31 fd .%L..*..v5+.u1....&...i...@... 00d0 03 05 75 47 0 3 45 54 ba 98 91 5f 9f 18 30 78 00 ....KP0K..8..0.&...A..].D....m 01a0 cc 5d a5 b2 4 f b9 4b 24 aa 87 b2 6b 7d 6c 56 26 .EP.52.H. 0180 09 9e c4 5b 3 2 5f 8b d9 9b a0 76 35 2b a2 95 a4 .K$..u... z.._. 0190 f4 77 13 b5 8 f c7 a2 10 03 75 2c 9c 81 a5 c1 6d ..Db L ... k.X 0110 31 f6 7f b7 f 4 2a 14 aa 30 b4 45 50 e1 8c c2 0a 1 . .....wl. 0170 e6 6d 4a 15 2 8 5c 30 a0 4f 38 9e 26 81 43 c3 b9 .k}lV& 01b0 a4 7a 81 f9 c 9 9b 15 2e e5 05 bc 53 d3 b9 cd 54 .O.... 00c0 59 60 98 41 d 6 05 90 22 aa 34 6b 88 ec 14 26 e8 Y `...&.... f. 00e0 63 70 29 28 4 3 38 06 01 34 61 f4 f7 94 3a 12 29 c p)(C8.E....E.@..4a.... ].

0240 a9 81 76 10 a 8 c1 9c 61 28 94 0c 5c 08 52 82 80 .4./..S....'.K..Y 0220 9b d9 06 00 c f ff fb 92 04 eb 8f f3 14 20 51 03 ..X 01f0 6c 51 cd 5b b d 56 24 08 4b b3 ca 10 a0 04 51 72 l Q...dl..0@.V$..\..v 02a0 92 2e 38 b3 e c 02 3c b0 27 c3 f8 ed fe 0e cc 84 ... ........F.5Y...n.. .<. Q..0. .Qr 0200 c7 88 06 08 e c 8e 3f d9 0a 14 03 43 b0 6e c8 22 ...... ..g8J... 02d0 6b 6c ac 26 1 1 be 96 56 54 1a 03 c1 00 8e 25 aa k ...7.:.. ...3 01e0 0e 73 49 80 8 6 22 d4 6a 43 7d db 7e cd c4 e4 58 ...jC}.p.!. 0290 0e 01 a1 84 0 a 53 18 89 f0 63 be ef a1 6f 15 76 .t:. 0280 a2 8c 30 40 1 4 11 cf d0 f7 17 64 6c 0f 01 70 8f ......'..vW%.. .o.....X.2.{..^4.[.!oQ.w... ./sn..bwH.D.c. 0250 85 f2 eb 44 c 3 34 e2 2f 73 6e c9 e0 27 82 58 ec ........m." 0210 31 02 94 2f 0 2 88 88 f0 9b bd c6 5d a6 f7 14 59 1 .L. . 01d0 a5 5a 20 14 8 9 09 74 3a 8b 5e 34 dd 20 16 18 33 .... Z . 02c0 0a 0a 32 e1 c e 1a 7b 0b 0a 77 cc 4b 0e db 97 93 . ...pT. 02b0 73 82 30 10 7 0 54 81 98 aa 05 d3 93 76 57 25 05 s . :.~.. 0230 59 c2 50 64 a 4 1a 10 67 38 4a 0b c4 bb 46 0c e5 Y .. sI.C.v.".R.. . 0260 0c d3 4c 9f 2 1 05 21 6f 51 a7 0e f9 37 04 dc 6c .?.8...........].77 48 ae cf d1 ....K.l 0270 56 41 6e 73 3 8 54 70 55 87 e2 1b 3a 8a 10 a0 2c V Ans8TpU....Pd.........a(.

....8.Q 0320 26 17 41 9b 6 4 73 b2 c1 2d 0c a4 6a 8c 84 39 2b & . m..{1] 02f0 af a9 8a 3e 6 9 55 53 d2 ba 73 dc ab ac 8b 68 4b .. 02e0 40 e0 83 6e 8 4 52 52 c5 a8 8b 8e 03 82 7b 31 5d @ ..RR.. 0350 9a 4f 63 2d 4 9 9f 8b f4 11 5e 76 fb 7f 37 47 91 .&.%...net TCP 54 51501→ https [ACK] Seq=42 Ack=42 Win=16638 Le n=0 Frame 42: 54 bytes on wire (432 bits).... Oc-I...j..n.].. .e...l......-..VT....7G. Time Source Destination Protocol Length Info 42 1....245114000 pc13.v.. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. 0370 2a * No.ds...Y.s.... .}~.T.>iUS......`` 0340 e6 93 0a 23 3 8 6a d0 91 78 b3 22 67 3c 9d 59 e4 ."g<.2@DsC'.A.c.hK 0300 0d 9e 92 5d e b d4 7e cf 76 ff fc 63 bf 89 3e 7e . 2014 11:26:5 4..home ham02s12-inf24.~.'>.1e100.^v. 0360 7c 59 d3 54 c 0 f1 7d 7e f2 ea 7b d2 ff ff ff fe | Y..9+ 0330 7d 93 11 e0 2 7 3e 2c 32 40 44 73 43 27 a1 60 60 } ..>~ 0310 c9 6d d0 0c d 3 9c 16 38 ca 65 c9 b8 f9 e0 8a 51 ..x.{.#8j.295044000 Romance ..

....000 000000 seconds] Epoch Time: 141 5615214.0... = LG bit: Globally unique address (fac tory default) ........ ...... . .295044000 s econds [Time delta fro m previous captured frame: 0. . .. . .. ...245114000 sec onds] Frame Number: 4 2 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II. .012115000 seconds] [Time delta fro m previous displaye d frame: 0............ Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). .Standard Time [Time shift for this packet: 0.0 ... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .0.. ... .. ... .01211500 0 seconds] [Time since ref erence or first fra me: 1... . .. = LG bit: Globally unique address (fac tory default) ..

.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f26 (20262) Flags: 0x02 (Do n't Fragment) 0.. . .1. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.0.. .......113. = Differentiated Ser vices Codepoint: De fault (0x00) .1 84) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] . .168.184) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..1. .0 . Src: pc13 . ... Dst: ham02s12-in -f24. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.11 ). .1e100 ... .home (192. = Don't fragment: Se t ...194. = Reserved bit: Not set ..1e100.......113..net (173......1.ho me (192.194.168.11) Destination: ha m02s12-in-f24..net (173 ......

. ... .. . ....0.. = ECN-Echo: Not set . . .0 = Fin: Not set Window size val ue: 16638 [Calculated win dow size: 16638] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xe14 8 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 .. = Reserved: Not set . = Urgent: Not s et ..... . Len: 0 Source Port: 51 501 (51501) Destination Por t: https (443) [Stream index: 2] [TCP Segment Le n: 0] Sequence number : 42 (relative s equence number) Acknowledgment number: 42 (rela tive ack number) Header Length: 20 bytes . 0 .0..1 ..... Seq: 42. ... Ack: 42 ..... ....... ... Src Por t: 51501 (51501). D st Port: https (443 ). ..... = Nonce: Not se t ... ... = Push: Not set ....... .. ...0.. .. .. ..Transmission Contro l Protocol. 0. = Syn: Not set .. . . ... = Acknowledgmen t: Set . = Congestion Wi ndow Reduced (CWR): Not set ..... 0. = Reset: Not se t .......0 .. .. 0000 0001 0000 = Flags: 0x010 (ACK) 000. . ...

.418979000 s econds [Time delta fro m previous captured frame: 0.home TCP 1314 http→49 574 [ACK] Seq=21737 Ack=1 Win=46 Len=1 260 Frame 43: 1314 byte s on wire (10512 bi ts)..000 000000 seconds] Epoch Time: 141 5615214.GN.369049000 cust-74-124-12138. 2014 11:26:5 4..P.. Time Source Destination Protocol Length Info 43 1...`n.. 0030 40 fe e1 48 0 0 00 @ .260394000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .... No....E....com pc13. .dx. (O&@.7.-. 0010 00 28 4f 26 4 0 00 80 06 00 00 c0 a8 01 0b ad c2 ...418979000 Romance Standard Time [Time shift for this packet: 0.dllstx01..H. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. 0020 71 b8 c9 2d 0 1 bb c8 47 4e cc 37 c0 00 2e 50 10 q ....[SEQ/ACK analys is] [This is an ACK to the segment in frame: 33] [The RTT to ACK the segment wa s: 0..corexc hange.123935000 seconds] [Time delta fro m previous displaye .

..... . .. ..port == 80 || http 2] Ethernet II.dlls tx01.. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ........ . . Src: cust -74-124-12-138.. . . ... . . ...... = LG bit: Globally unique address (fac tory default) .0.... . .. .. ...d frame: 0.0 .... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. ... ... = LG bit: Globally unique address (fac tory default) ..369049000 sec onds] Frame Number: 4 3 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .... . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)..corexchange.... .. . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..0 .... ..0...12393500 0 seconds] [Time since ref erence or first fra me: 1..co . .........

...168. ..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.m (74.corexchange.. Dst P ort: 49574 (49574).home (192 . ... = Differentiated Ser vices Codepoint: De fault (0x00) . .. Seq: 21737.1. = Don't fragment: Se t . Src Por t: http (80).1.168.. Dst: pc13. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aa2 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.12.138) Destination: pc 13..138).. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. Len: 1260 Source Port: ht tp (80) .home (192.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf188 (61832) Flags: 0x02 (Do n't Fragment) 0.0. Ack: 1 .124...1.dllstx0 1..12.. ....com ( 74. = Reserved bit: Not set .124.

..... . .... 0...... = Reserved: Not set ... . . . . ... 0000 0001 0000 = Flags: 0x010 (ACK) 000..0.0.. .. = Acknowledgmen t: Set .... . .. .... = Urgent: Not s et ... .... .. = Push: Not set . ........... 0 ... = ECN-Echo: Not set .. ..... . = Syn: Not set .. ...... = Congestion Wi ndow Reduced (CWR): Not set . . = Reset: Not se t . .... .. .. ...... .Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 21737 (relativ e sequence number) [Next sequence number: 22997 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . = Nonce: Not se t .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x00f 9 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2087] ..1 .0 . 0...0. .

0020 01 0b 00 50 c 1 a6 2b c8 b7 16 9e 87 4e aa 50 10 ...fP..".. 0040 7c 5f 67 d2 1 e 66 e0 18 cc 08 0f 09 69 51 38 19 | _g...P.T..2.&. . 0010 05 14 f1 88 4 0 00 31 06 3a a2 4a 7c 0c 8a c0 a8 ..?.. ..2"....S..7D.IE. 0090 e9 0f f2 eb 3 0 56 03 0f 42 60 5c 65 ea c0 61 e8 ...... 00e0 72 89 c2 ac 1 d d4 4a 22 40 c8 57 7c d8 bf 59 98 r . 0050 45 00 aa 66 5 0 d3 26 d0 3c 54 b9 9e 54 f4 18 55 E .". . .....%1 00b0 13 24 e1 3f a 7 a0 cb be a2 53 aa 07 6a 03 84 c5 .<T....P. 00d0 4b b3 8d 26 f 4 0d 22 9a 19 11 a0 a8 5c 97 38 d1 K .Y.N.a.t.....J"@.. . .iQ8.8...+...... `n.W|.f.@....R 0070 ec 8e 88 83 6 8 e2 63 0a ea 94 c1 a4 22 ae c8 8e .B`\e..Hg..J|..... .... 00a0 4c 4b d4 bb 5 c 0c bd 09 89 8b 17 2b 81 86 25 31 L K... 0080 8c 88 44 de 4 9 45 c5 07 0f 1c aa db ff fb 92 04 ..... 00c0 6b 44 e2 b3 f 7 ea 02 56 65 04 d9 5e 26 89 64 83 k D....s..E..h....!..... $. 0030 00 2e 00 f9 0 0 00 21 ba 16 37 44 80 73 da 53 05 .+...&...0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .^&. .....>..U 0060 69 a8 44 3a 8 2 88 00 4d 51 58 c2 32 0a b8 a9 52 i ..1.\...0V.dx...S.i..:.j.. ... 00f0 c8 e5 3e 90 a 9 6d a8 74 b5 48 67 fd db b1 79 27 ..D.c..D:....d..MQX.\....y' 0100 e0 88 c8 ec 1 6 32 22 ff 0f 05 69 e5 e7 ff d0 c0 .m..Ve....

0170 b7 bd 28 ea 0 2 4b 77 7f 21 99 14 b2 ac 0b 16 92 .%...Kw...h...%...". 0180 e6 60 e2 17 0 4 cf 32 92 28 c0 93 25 ee e4 66 07 ..M. q. 0160 7c 58 4c 20 6 d 47 12 20 08 b8 3e a6 51 fe ef 2e | XL mG.e.Q....~~vC}. 01c0 4a a6 aa db d c 3d ca 54 fd 0f f8 a8 32 a8 f2 f5 J .. 0140 fc 69 7d f5 6 5 d5 22 d0 ff 61 a3 f6 2b 32 91 df ...5... %.2. ..v..{...jzhQT. 0150 31 94 99 3b 6 d fe 37 c7 9b 87 78 3d b2 35 f7 ba 1 ..7. 01b0 89 25 e2 ba b 9 4b b1 c8 68 fb c7 fc c5 ea ed 13 .....d>?..I 0120 23 e4 76 b6 c a 4b 21 5b 23 73 b6 38 bc a3 cd 2d # .m]7. 01a0 5c 84 22 91 f 8 c6 17 19 37 bc de 34 73 5d 25 0c \ ....~^..=..RRP....T.I....$6 0220 07 44 b3 a0 7 ..9.:... i}.D. ..B.f./t 0200 8e 4c 2e 42 a 9 7e 7e 76 43 7d b1 ff a5 57 bd ee ....m.. ..zZ%. 0210 b6 6a b7 7e 5 e 17 42 89 f3 3b a9 b6 f8 d3 24 36 ....W.h..K..v.-..4s]%..(. L.+2..0110 cd 8b 60 23 8 2 9d 1d 0c 1d 7b 0a 7a 5a 25 03 49 .0130 29 b6 aa 25 b 3 39 aa a5 c6 e8 a2 76 9d ec d2 7f ) .1K 01e0 56 c5 7b d3 4 4 e9 08 52 52 50 9c 34 f1 55 72 71 V .2..4. 01d0 6e e9 90 90 f 5 d2 99 3a 8a 1d 4d c7 71 10 31 4b n . `..B..."..>..x=.....{.8...(. 0190 a9 71 c7 6a 7 a 68 51 54 94 49 8d 68 ec 20 1e d6 ..K![#s.... .!..`#...Urq 01f0 39 ad 2d ca a 9 6d 5d 37 df 90 64 3e 3f c9 2f 74 9 .7...a....q. j.

..<>.K.. 0290 dd a9 b7 2f 2 f 89 ce 8f c6 8a 4b f8 26 a8 c1 0b ..fc..3..g. 02c0 fd 3e 29 87 4 e 3a 36 82 87 28 8c a7 08 0b 29 d5 . . va.`.... 0240 61 26 5c 4c 7 9 05 62 0c 24 cb 81 94 a3 ec 41 83 a &\Ly. Xm.. >).2 dd 4b a9 d2 1a 47 97 b1 bb ff fb . .. 02b0 ee 4d b1 1a 6 a f3 df 6e de 9d ff 96 0d 9d fe ef .. TG.. ..H..%4.. ...V&k..8.c0.j.. 0230 92 04 ea 0f f 2 f4 39 58 03 09 2a e0 56 26 6b 10 .(.K.&. 0320 01 58 6d 0a 3 6 a0 e5 dd eb 26 fd b3 eb 6e 99 a9 . M..J...Q.. 0250 21 70 37 6e d e 16 d7 f8 95 8e eb d9 33 f4 ad 01 ! p7n...I.\s..7. .).. D. 0260 b8 83 3c 3e c b 8a 1c ac 51 f0 33 f4 98 45 44 9f .3.{.~..b. y{..vo.&7._.//.h..}8.r.n.$..'..t...(TT 02f0 32 94 e8 3f 3 2 6d 41 31 89 29 0f 37 cc d4 bd ab 2 .6........)... 02a0 1a 76 61 8a 8 d 8c 38 ff 33 a0 68 10 74 b7 5f 2c .9X.b.ED..?2mA1......A...kF...n.. 0270 d2 c3 48 c2 6 7 d5 07 3b 9b dd 27 f5 7d 38 19 ac . 0300 b9 55 9a 5c 7 3 1a 08 49 a0 4a ca 83 c6 54 25 b2 . 0330 01 a9 ca 7c 2 7 8e ee 80 16 43 74 .. 02d0 84 54 47 d5 a 4 78 d7 62 ef 3b 55 ad 1d 66 2b 59 ..&.T%..*...x....3........ 0310 94 ed 6b 46 8 8 8f 76 6f f8 c2 08 7e c1 25 e1 f8 ..%... 0280 5f 2f 72 d5 7 b e3 66 63 de 26 37 ee 7f 25 34 b7 _ /r...f+Y 02e0 e4 79 7b 16 e 1 63 30 bb 98 60 82 a6 90 28 54 54 ..U....G. U...N:6.

.. 0400 c4 24 b1 16 7 b 7d 8d 30 86 32 4d 3a ec a1 48 47 . w\. .. $.... 2r.... 0440 8d 8d 1d 2e 1 d 15 0e aa f0 1a 0d 4a 8d ad 56 91 .Mx....w.. 03c0 c9 df 7a 02 b 2 0b 35 78 26 2e f8 de de 10 ad 64 .$k....R. 03f0 00 c3 19 70 2 f 49 f0 a4 98 a9 d2 fd 19 be 15 d1 . ..5x&. 0340 b1 24 39 b1 2 e 55 b6 9d 65 a9 37 77 9a ac de 51 . .Y.... 03a0 9b 77 5c b0 6 b 1c 76 66 67 c2 d9 fc e6 2d ee 3c . .`.vfg. ..[.. 0380 0c 32 72 bc d e a3 48 44 b3 1c a7 e3 b9 e3 25 a5 .~`p....[....%..<. .jC.2bcE 03e0 fb 10 3c c9 4 c 4b 0c df 60 0c 24 6b 81 77 a3 ec ....I..k..Q 0350 58 e7 be 67 2 4 a8 89 fe 4d 78 ef a6 1f f2 59 ff X ..z..U.....9.. ...Q3.tA.Ct..HD..0.a(.df 2b 22 ec e9 . $9.< 03b0 6c 69 93 de d 1 ca d4 79 fd e1 95 5b 1f bc a3 f3 l i.Yc..|'..7w.....d 03d0 ff fb 92 04 e a 0f f3 0f 30 d8 81 e9 32 62 63 45 .=..0.e..HG 0410 73 8c b1 3d b 2 8e 12 28 bc cf aa 1c 5b 96 28 21 s ...LK. 0360 fb 91 df c7 d f 16 ef af 52 8e 7f a7 7e 60 70 ba .......-.y... 0370 8a a5 9a 59 6 3 f5 62 95 83 84 03 6a 43 09 8b ba .. ..g$..................{}.. .(! 0420 b0 d0 07 16 0 6 8f 74 41 c3 49 81 ea 61 28 e2 b7 ..... 0430 54 b2 96 b2 7 c 94 37 c9 1c 51 33 f4 39 ea 7c ea T ..|..|....7.w. 0390 19 fe ca a9 0 d ce 77 d8 6b 6e 53 6e 68 bd bf f3 ....knSnh. .(....p/I.2M:.b.+".

d..cor exchange.~A......^..........uc.)d.com TCP 54 49574→h .F.|.=.e.kfss......9>..m 0490 54 e6 c6 d6 f 3 07 5e 95 d7 2c ef f6 65 fc d7 9e T .w 0510 3f f5 aa 66 2 5 7c 5c e3 0d a0 87 e9 4d b7 59 15 ? ...HO. ..^.s 04e0 74 52 8c 97 5 7 45 ce a8 f0 13 5e af 66 3e 2f c7 t R..._. ...V....M.k...f%|\.. 0480 4a 36 93 b7 0 6 b2 8a 09 a8 64 d1 7e 41 f3 1f 6d J 6.....jqu 0470 15 c4 08 03 a a aa c4 cf 33 0e 1f 1e 46 c6 6b aa ..t. *.....J......1...... .....75+..\... 04a0 e5 2a fb b1 e 0 d8 72 5c 4c b1 34 e0 22 18 7c f5 .K6 0500 7b 38 42 bf a 7 b3 7f 6a 51 8c a5 04 b3 ef ff 77 { 8B. ...369229000 pc13....*..c...A.f>/.e 0460 f4 ad 29 64 0 8 a0 4d c2 c9 21 3e 4a c7 6a 71 75 . 0450 79 87 af d0 e 9 41 0b b9 5c 91 0c 42 78 0e 82 65 y ...4. 04f0 c1 f1 3d f0 a b 39 3e ee 6b 66 73 73 e9 bc 4b 36 .Z...home cust-74-12412-138.dllstx01. No.$..".jQ. Time Source Destination Protocol Length Info 44 1.Bx..!>J.M.. 0520 82 88 . .Y..... 04d0 59 e0 ed b1 1 1 75 63 0d 31 1e 8d 18 9d 74 aa 73 Y . 04b0 43 40 8c 2a b f ce 7f 5a e8 bb 24 81 a0 85 a7 94 C @...r\L.WE.. 04c0 2e a3 37 35 2 b 9c 63 93 c0 f2 48 4f 99 5f 1e 9c .3.

Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).369229000 sec onds] Frame Number: 4 4 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . 2014 11:26:5 4.ttp [ACK] Seq=1 Ack =22997 Win=42003 Le n=0 Frame 44: 54 bytes on wire (432 bits).419159000 Romance Standard Time [Time shift for this packet: 0. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .000180000 seconds] [Time delta fro m previous displaye d frame: 0.419159000 s econds [Time delta fro m previous captured frame: 0.port == 80 || http 2] Ethernet II.00018000 0 seconds] [Time since ref erence or first fra me: 1.000 000000 seconds] Epoch Time: 141 5615214.

. .. ... = LG bit: Globally unique address (fac tory default) ... ... = Differentiated Ser vices Codepoint: De fault (0x00) . ..0.... ... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00..... .11 ).... . ....... . . Dst: cust-74-124 -12-138..12.0.... = LG bit: Globally unique address (fac tory default) ...138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..1... = Don't fragment: Se t ..... .. ..dllstx01..1 24. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..0 .com (74...co rexchange...... .. . = More fragments: No t set Fragment offset :0 .1.. . . .....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f27 (20263) Flags: 0x02 (Do n't Fragment) 0..... .... ..home (192....0..... . .... .. . = Reserved bit: Not set .. Src: pc13 .. ...168.0 .

0... = ECN-Echo: Not set . Src Por t: 49574 (49574).. ..1 .dl lstx01. Seq: 1. . ..... = Congestion Wi ndow Reduced (CWR): Not set .. .0 . = Urgent: Not s et .138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. com (74.. = Nonce: Not se t .. = Reset: Not se . = Push: Not set . . 0000 0001 0000 = Flags: 0x010 (ACK) 000.. . ...... . ..... . . ...12. ....0.Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13... Ack: 22997 .... D st Port: http (80)....... 0. = Acknowledgmen t: Set ... .168.11) Destination: cu st-74-124-12-138.corexchange..... = Reserved: Not set . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 22997 (r elative ack number) Header Length: 20 bytes . 0 .. .. ....0...ho me (192... .1.124... ...

.... Time Source Destination Protocol Length Info 45 1..000180000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ... ... 0010 00 28 4f 27 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ...corex change. 0030 a4 13 18 d4 0 0 00 .P...+.... 143 bytes captur ed (1144 bits) on i nterface 0 Interface id: 0 ... (O'@... .. .home DNS 143 Standard que ry response 0xaf5a PTR cust-74-124-12 -138....`n..dllstx01.P.385049000 livebox.home pc13. ..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 bc 02 50 10 . . ... ...0 = Fin: Not set Window size val ue: 42003 [Calculated win dow size: 42003] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 43] [The RTT to ACK the segment wa s: 0..E...dx..N. ..com Frame 45: 143 bytes on wire (1144 bits ).. = Syn: Not set ..t . . No.0.

.0 ..385049000 sec onds] Frame Number: 4 5 Frame Length: 1 43 bytes (1144 bits ) Capture Length: 143 bytes (1144 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II. ... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 ... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .... ..015820000 seconds] [Time delta fro m previous displaye d frame: 0.. .(\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.. ..000 000000 seconds] Epoch Time: 141 5615214. . 2014 11:26:5 4.. ....434979000 s econds [Time delta fro m previous captured frame: 0.. ...01582000 0 seconds] [Time since ref erence or first fra me: 1... .. ..0....434979000 Romance Standard Time [Time shift for this packet: 0... = LG bit: Globally unique address (fac tory default) . .. ..

.. ..168.1.. . . . = Reserved bit: Not set ..home (192... .home (192........ = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 29 Identification: 0x0000 (0) Flags: 0x02 (Do n't Fragment) 0.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. = More fragments: No t set Fragment offset :0 Time to live: 6 4 Protocol: UDP ( 17) Header checksum : 0xb70f [validatio n disabled] [Good: Fals e] [Bad: False ] Source: livebox .1 .0 .. ..1) ...1.home (192.. . .... ..0. = LG bit: Globally unique address (fac tory default) ...........168.b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... = Differentiated Ser vices Codepoint: De fault (0x00) ... . Src: live box. . = Don't fragment: Se t .. Dst: pc13..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .1. ....1).. ...168.0. ...

...0..... .Destination: pc 13.. ... .... Src Port: doma in (53). = Response : Message is a resp onse .000 0... = Authorit ative: Server is no t an authority for domain ...... 0.... No error 1... .... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col...... 1 . . . = Opcode: Standard query (0) ... . . . .. .. Dst Port: 49779 (49779) Source Port: do main (53) Destination Por t: 49779 (49779) Length: 109 Checksum: 0x0bf c [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (response) [Request In: 22 ] [Time: 0. = Truncate d: Message is not t runcated .1 . ....... .. = Answer a uthenticated: Answe r/authority portion was not authentica .....0.... . = Recursio n available: Server can do recursive q ueries . .168.0..... ..... . = Recursio n desired: Do query recursively .. .home (192.... .. = Z: reser ved (0) ... .. . ..538242 000 seconds] Transaction ID: 0xaf5a Flags: 0x8180 S tandard query respo nse.. . ...1.. .. .. ..

. = Non-auth enticated data: Una cceptable ..com Name: 1 38.s..ted by the server .... 0030 00 01 00 00 0 0 00 03 31 33 38 02 31 32 03 31 32 .124.... `n.. 0000 = Reply co de: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries 138.5..in-add r. class IN Name: 1 38. . 0010 00 81 00 00 4 0 00 40 11 b7 0f c0 a8 01 01 c0 a8 ....in-addr..in-addr.corexchange . .com 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .12.12.....74. ...124.. ...12... 74.124.74..arpa: ty pe PTR.dllstx01.arpa: ty pe PTR. c ust-74-124-12-138..124..dx... . ..in-add r..0 ...@.@. .12.core xchange...arpa [Name L ength: 26] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Answers 138.arpa Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Time to live: 86400 Data le ngth: 45 Domain Name: cust-74-124-1 2-138..m. .Z.. 74. class IN. 0020 01 0b 00 35 c 2 73 00 6d 0b fc af 5a 81 80 00 01 ..E.d llstx01. ..

com.dllstx01.arp 0050 61 00 00 0c 0 0 01 c0 0c 00 0c 00 01 00 01 51 80 a .12. 84 bytes captured (672 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.192..471907000 s econds [Time delta fro m previous captured frame: 0.in-addr.home livebox..arp a Frame 46: 84 bytes on wire (672 bits).74...000 000000 seconds] Epoch Time: 141 5615214. 168.....471907000 Romance Standard Time [Time shift for this packet: 0... 2014 11:26:5 4..cust-74-124-1 0070 32 2d 31 33 3 8 08 64 6c 6c 73 74 78 30 31 0b 63 2 -138.in-addr.036928000 seconds] [Time delta fro m previous displaye d frame: 0..138. -.03692800 0 seconds] [Time since ref erence or first fra me: 1....421977000 pc13..1.Q.c 0080 6f 72 65 78 6 3 68 61 6e 67 65 03 63 6f 6d 00 o rexchange..12 0040 34 02 37 34 0 7 69 6e 2d 61 64 64 72 04 61 72 70 4 ..home DNS 84 Standard que ry 0x69b5 PTR 1.421977000 sec onds] . No. 0060 00 2d 12 63 7 5 73 74 2d 37 34 2d 31 32 34 2d 31 . Time Source Destination Protocol Length Info 46 1.

. .. .0 . .....hom e (192.home (192. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .0.. ...168... .. ECN: 0x00: NotECT (Not ECN-Capabl .. = LG bit: Globally unique address (fac tory default) . ...1) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..168... ..11 ).. ... .... Src: pc13 .0 . ....Frame Number: 4 6 Frame Length: 8 4 bytes (672 bits) Capture Length: 84 bytes (672 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II.1.... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... ...1.. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . . ...... .... .... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. .. = LG bit: Globally unique address (fac tory default) . . ... Dst: livebox.0...... .... .. ...

.. = Don't fragment: No t set .. = Differentiated Ser vices Codepoint: De fault (0x00) .....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 7 0 Identification: 0x4f29 (20265) Flags: 0x00 0. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: UDP ( 17) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.168. .0.ho me (192..e Transport)) 0000 00.0.home (192. . ..11) Destination: li vebox.. ....1...1.. = Reserved bit: Not set .1) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col. Src Port: 4977 9 (49779).168 .. Dst Port : domain (53) Source Port: 49 779 (49779) Destination Por t: domain (53) Length: 50 Checksum: 0x83a 0 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (query) [Response In: 4 7] ..

..168.. ... ... .dx. .Transaction ID: 0x69b5 Flags: 0x0100 S tandard query 0... 0030 00 00 00 00 0 0 00 01 31 01 31 03 31 36 38 03 31 ... .1 0040 39 32 07 69 6 e 2d 61 64 64 72 04 61 72 70 61 00 9 2..... class IN Name: 1 .in-addr..in-addr... = Response : Message is a quer y ... = Truncate d: Message is not t runcated . . ...2... ....1..0... = Non-auth enticated data: Una cceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries 1.s..in-addr.. . ... ..000 0. ...1..i.. = Z: reser ved (0) . ...arpa: type PTR.. .... .......E. = Recursio n desired: Do query recursively .1..arpa.... 0020 01 01 c2 73 0 0 35 00 32 83 a0 69 b5 01 00 00 01 ....192 .. .. .. ..192....`n. = Opcode: Standard query (0) .. FO).168.. .. 0010 00 46 4f 29 0 0 00 80 11 00 00 c0 a8 01 0b c0 a8 . .... 0......... . .168.5.1.0 .... ... .1 . arpa [Name L ength: 24] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .

No..434055000 livebox.000 000000 seconds] Epoch Time: 141 5615214.483985000 s econds [Time delta fro m previous captured frame: 0.483985000 Romance Standard Time [Time shift for this packet: 0.home pc13. 2014 11:26:5 4.434055000 sec onds] Frame Number: 4 7 Frame Length: 1 10 bytes (880 bits) Capture Length: 110 bytes (880 bit s) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] . 110 bytes capture d (880 bits) on int erface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.home DNS 110 Standard que ry response 0x69b5 PTR livebox..0050 00 0c 00 01 .home Frame 47: 110 bytes on wire (880 bits) . Time Source Destination Protocol Length Info 47 1.01207800 0 seconds] [Time since ref erence or first fra me: 1.012078000 seconds] [Time delta fro m previous displaye d frame: 0. .

. Src: live box..... .168.... ......... .... ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 9 6 Identification: 0x0000 (0) Flags: 0x02 (Do n't Fragment) 0.... . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... = .......... . = LG bit: Globally unique address (fac tory default) ....home (192. . = LG bit: Globally unique address (fac tory default) .0 .168.. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.1. . ... . ..Ethernet II.0.. .....1 . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.home (192... ... .. .. ... .. ..1)... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .0 ...... Dst: pc13. . ... .0. = Differentiated Ser vices Codepoint: De fault (0x00) ... . . ...

.. = More fragments: No t set Fragment offset :0 Time to live: 6 4 Protocol: UDP ( 17) Header checksum : 0xb730 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: livebox . . Src Port: doma in (53). . ...0....168..... .Reserved bit: Not set . ...1.. = Response : Message is a resp onse . ....1) Destination: pc 13..1. .. Dst Port: 49779 (49779) Source Port: do main (53) Destination Por t: 49779 (49779) Length: 76 Checksum: 0x5fe 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (response) [Request In: 46 ] [Time: 0. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.. No error 1.. ..1.home (192. .. .168....home (192. ...000 0... ... = Opcode: Standard query (0) . .. = Don't fragment: Se t ..012078 000 seconds] Transaction ID: 0x69b5 Flags: 0x8580 S tandard query respo nse. = Authorit ative: Server is an .1.

home Name: 1 .. .. .. = Recursio n available: Server can do recursive q ueries .... = Z: reser ved (0) . .....0 .. .arpa: type PTR.. ..........in-addr.. arpa [Name L ength: 24] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Answers 1... .. .0.in-addr.. .. arpa Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Time to live: 0 Data le ...1.... . .192. .0... liv ebox.. .... = Non-auth enticated data: Una cceptable . class IN Name: 1 .. . ....192..192 .. .1 .....168.... 0.1.192 . .arpa: type PTR.in-addr.. . .authority for doma in .168.. = Answer a uthenticated: Answe r/authority portion was not authentica ted by the server . = Recursio n desired: Do query recursively ..168. ... . = Truncate d: Message is not t runcated ..... 0000 = Reply co de: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries 1.1...in-addr... 1 . class IN. .1. ....168.

. 0020 01 0b 00 35 c 2 73 00 4c 5f e3 69 b5 85 80 00 01 ...com pc13...E.dllstx01.000 000000 seconds] Epoch Time: 141 5615214..ngth: 14 Domain Name: livebox. 0060 07 6c 69 76 6 5 62 6f 78 04 68 6f 6d 65 00 .. 2014 11:26:5 4. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.1.5.489978000 Romance Standard Time [Time shift for this packet: 0.. ..arpa....L_.440048000 cust-74-124-12138..... 0010 00 60 00 00 4 0 00 40 11 b7 30 c0 a8 01 01 c0 a8 ..in-addr.... `..@.dx... ..home 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .@.489978000 s econds . 0050 00 0c 00 01 c 0 0c 00 0c 00 01 00 00 00 00 00 0e .1 0040 39 32 07 69 6 e 2d 61 64 64 72 04 61 72 70 61 00 9 2.0.home...1.s. Time Source Destination Protocol Length Info 48 1.. No....i.. `n... . livebox...corexc hange.home TCP 1314 http→49 574 [ACK] Seq=22997 Ack=1 Win=46 Len=1 260 Frame 48: 1314 byte s on wire (10512 bi ts)...168. 0030 00 01 00 00 0 0 00 01 31 01 31 03 31 36 38 03 31 ..

.... .. = LG bit: Globally unique address (fac tory default) .. ... ....0 . .port == 80 || http 2] Ethernet II. .. .440048000 sec onds] Frame Number: 4 8 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . . ..00599300 0 seconds] [Time since ref erence or first fra me: 1...... ...0. .. .005993000 seconds] [Time delta fro m previous displaye d frame: 0... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... .... .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. .. = IG bit: Individua l address (unicast) ...[Time delta fro m previous captured frame: 0...0.........0 .. .. . ........ .. = LG bit: Globally unique address (fac tory default) ... .. .... ...

.138) Destination: pc 13. = Differentiated Ser vices Codepoint: De fault (0x00) ...com ( 74. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aa1 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.138). 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Dst: pc13... Src: cust -74-124-12-138.. .corexchange.1.0.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.124.Type: IP (0x080 0) Internet Protocol V ersion 4. Src Por ..12.corexchange.home (192 .168. = Don't fragment: Se t ..co m (74.1.dlls tx01. = Reserved bit: Not set .168.12.home (192..... ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf189 (61833) Flags: 0x02 (Do n't Fragment) 0..dllstx0 1.124... .1.

.. .0 ... = Nonce: Not se t . . .... = ECN-Echo: Not set .. = Congestion Wi ndow Reduced (CWR): Not set ... . .. ... ....0... 0. Seq: 22997. 0...1 .0. . .. = Syn: Not set . ... . .t: http (80)..... Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 22997 (relativ e sequence number) [Next sequence number: 24257 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ........... = Acknowledgmen t: Set .. .. .. Ack: 1 ......... = Push: Not set . .. ... = Reserved: Not set .... .. . Dst P ort: 49574 (49574).. .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xe41 9 [validation disab led] [Good Check sum: False] [Bad Checks um: False] . ...0. . = Reset: Not se t . .. ... . = Urgent: Not s et ..... 0 .. 0000 0001 0000 = Flags: 0x010 (ACK) 000....

.k........ 0060 ae fe 58 b8 a 8 d9 ce 64 be d3 4b 3e 10 41 b5 ed ...X:r...$@. ...... 0030 00 2e e4 19 0 0 00 6a 4a 45 ff 9b a0 86 aa 53 1a ....Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .y...VJ-....x.....X. ..N.(Q.a':... 00a0 24 cb 81 91 a 2 6b c0 f4 a5 70 07 ac b2 9b 40 2f $ .. `n..P. ..+.....+. 0020 01 0b 00 50 c 1 a6 2b c8 bc 02 9e 87 4e aa 50 10 ....... . .. ......... 00f0 c8 70 4c 8a f 2 ee e5 33 3a 1a 3a . 00d0 76 77 a5 2c 2 4 92 cc 0d 76 26 1e c5 b1 13 13 06 v w. X.. 0040 9c 02 17 7a 9 1 1a 82 56 4a 2d e7 b0 83 04 67 61 ..@..'.jJE.F..dx.$..{ 0080 01 58 00 58 3 a 72 ff fb 92 04 eb 0f f2 b6 3b d7 ....z..... 0090 83 09 32 e0 6 1 27 3a f0 3d 28 5c 0c 78 e7 5c 0c ...d..... 00e0 00 80 e0 f5 b 9 8e 86 b0 d3 12 87 2e 41 37 6c a4 .P.p..E. 0010 05 14 f1 89 4 0 00 31 06 3a a1 4a 7c 0c 8a c0 a8 .1..2..^...K>..n.k....J|.:......p....ga 0050 ba d0 79 db 6 e c5 dd 1a c7 ae b1 1c 28 51 2c 13 . ..S. . 0070 26 fe eb a6 e 8 f8 df d7 98 5e 14 05 11 82 ad 7b & ..\... .=(\...A7l...v&... 00c0 4a 66 90 46 d 9 24 40 9a ac 92 0f b8 b8 10 70 16 J f..A..@/ 00b0 fa ca b1 e4 2 b 82 a1 0a 27 a7 3b 12 9b 6b 84 b8 ....

t. 01f0 3b b1 1e cf 4 c 15 8c 0f c4 95 90 86 22 13 65 05 .Y...Y....E`.j.....a/........#.... . 0100 58 51 15 cf 2 1 18 6d f1 23 d7 ef 82 87 d4 b9 6a X Q. 01a0 49 88 be 0f b 8 d1 ae a9 da f5 55 2f 87 75 9b 17 I .L..} .j 0110 e2 db cc 2f 1 5 84 45 60 b2 a1 0d 19 5b a8 ad 5f ..aI5..u.3:.....q.H. Rd.+@..)..4e:.... pL.. 01b0 c2 f5 52 ae f f 8a a3 f0 eb bf 44 da 99 df 13 0d . ... 01c0 29 b8 59 ff 2 e be e7 e1 ce bf 87 9c 50 d9 66 6b ) ...N 0180 5a 0c 7f cd c 4 61 49 35 15 4e 57 2c 1d 1a b9 48 Z .=I 0170 6a fd 07 e9 8 8 39 05 e9 c2 9b 37 20 f6 e3 f1 4e j .@....NW..p...."..X..N.... 0130 66 5a 6e 24 c 4 fb d5 ec 61 2f e3 75 fc cc 97 0c f Zn$..9.U/....R.r.m.....e... 01e0 24 f3 48 2e 7 f 70 ba a6 e3 29 98 4e e4 88 17 93 $ ....I.. x......D...H 0190 da ad 34 65 3 a b8 bb 7d 20 9b 58 b3 8b cb 84 cf ..u._ 0120 a4 a1 2a 39 c 2 f2 86 b9 d0 8b 56 8a 12 b8 74 c4 ....p.0..z 0150 b8 78 ee 6a f 7 7c 75 33 2e 71 8a 03 2b 40 a0 51 .... .7...... .b8 71 88 37 92 ..P../. .fk 01d0 bb e8 70 08 4 0 af 1d c1 30 03 d0 f9 72 95 49 02 .q.. ..7 .....!....# .... 0140 58 71 5c cb 8 7 de 59 8b 11 fc be ea ca 89 d7 7a X q\.....:.V....*9...|u3..Q 0160 a0 52 64 8f c 2 89 23 20 82 c7 c7 ca 86 0f 3d 49 .. 0200 58 55 c4 45 8 a b7 5c e2 25 88 6e 5a a7 96 91 c7 X ...[.

.. 0250 ac 5c b6 05 5 b 2b 63 ae d6 f1 c7 05 24 52 24 5b .m 02b0 5f 0d 26 ba f 3 83 19 22 a4 01 bf a6 00 6e ce 09 _ .. ..H.x..u.T .|* 02f0 18 ff ff fb e 7 bf 48 a8 39 5f cf c9 bf 9f 54 67 ..x.2...........U.x. 0310 d2 6c 5b fe f a 94 8b e3 9c 54 20 c5 28 be 61 bb ..$.&.... 0210 52 53 25 8b 6 b 79 a6 a7 54 3b 19 24 ce 93 36 97 R S%.Tg 0300 6d 33 45 0f 1 c 0f 18 15 65 4d 28 e7 5e f6 a8 c2 m 3E..-p2.cn.".h<.....&.nZ.... 02d0 6b ec d3 c5 6 e 13 78 91 ef 96 21 33 90 8a 44 c9 k ... ........V.z..<.n..k"*.a....... 0290 04 ba 78 09 d c 26 11 a8 7a d9 31 6b 70 84 c5 ac ..E.r.T..a.%.z..6........... 0280 07 bb 89 85 c 1 69 c3 5c cd 26 9c 63 6e 83 b2 c4 .. 0220 18 bc 91 78 9 0 35 58 9c ff fb 92 04 ea 0f f2 ea .(.... 02e0 26 fa 72 9a b 7 ae d1 9d 17 a8 d4 e6 63 b5 7c 2a & ..\....VBS.. ...^.... 0270 48 84 75 1d d c 06 bf a6 0a e4 0f c6 56 42 53 0b H ..!3.i.c..9_...D..\. 0240 5c 0c 24 cb 8 1 7e a3 eb c0 f3 2d 70 32 a0 56 d0 \ .[+c.....n..2. l[.. ..b.. 02a0 5c c0 e3 ed b 7 2e d4 6b 22 2a d7 ca f7 f2 f2 6d \ ..A.$...1kp. \.&...$R$[ 0260 eb ab 19 8c 8 d c6 68 3c f3 70 b9 53 77 b3 62 ee ...5X..ky....)].....Sw.. . 0230 39 d7 03 06 3 2 e0 61 e8 9a e0 3c c8 5c 0b e8 df 9 .p.~.. 02c0 20 d8 a9 29 5 d ca f5 32 9d ca 8c d1 7a 86 41 b3 .... .eM(.\.

.....F{..F..i 0420 86 9b cc cb b 2 10 5b 1b 02 e2 c1 31 bd dd ae e3 ...=V.%....._ 0360 90 fb fd 5c d 4 fe ea 24 92 4f 7b c2 6d 6c 59 20 . 0430 0f d8 d0 3e f .mlY 0370 37 94 76 ef c 2 6a a0 53 24 31 31 45 c7 f5 bf 2c 7 ..B...9.. ..... 0330 5f 29 63 22 d 9 08 a4 4c b2 df 4a 53 1d 9f 72 71 _ )c".u.........[.. .U. 03c0 9a df 69 df 7 b 18 d3 9f fd 55 ff fb 92 04 ea 0f . 0410 6c db 3e b1 c 0 9e ae 87 54 5b 5c 48 8a 67 da 69 l .g.. 03f0 eb 32 c3 0e 8 1 92 7d 27 28 67 6d 9a f0 62 6a 56 ...i.... 03d0 f3 17 3d 56 8 1 e9 42 e0 62 e8 fa e0 3d 28 5c 0b ...^auY...$.O{..\..P.+.1... . 2.JS..0320 0a 48 8b 19 e b eb 39 06 c5 6b f9 c6 17 88 2d e6 . 0350 2d cb c6 5b 6 7 e9 f6 17 fe 75 d2 13 ad 83 9f 5f ...}'(gm.p.W.>..G'V.bjV 0400 34 59 a5 a9 0 f f6 b5 da 92 66 23 96 ad bd 46 dd 4 Y.. C'S..L.. 0380 9a 82 e7 6a a 4 47 27 56 87 9c 5e 61 75 59 fa aa ..T[\H.!.. ..........D{...w.[g..j...k.b.\.-. ..h.$.........8 03b0 4a 35 df b6 2 1 f0 dc f4 ec ed ef 6f 0e 46 7b e1 J 5..f#...... .. 03e0 30 dd 5c 0c 2 4 cb 81 80 a0 2b 80 f4 99 70 f3 c0 0 .... ..o.....hG.v.j.S$11E. 03a0 fb 20 43 27 5 3 03 11 87 fb d7 77 ab 68 47 ef 38 .rq 0340 f1 10 11 25 1 2 7f a5 b2 68 fb c0 b5 50 11 1c bf . 0390 0b b2 a4 0b 4 4 7b d8 c1 13 a7 f1 57 d3 ec 8c e2 ..... H...{...=(\.

j0. ... Time Source Destination Protocol Length Info .h. 0490 eb c4 39 5b a e f0 cf 15 bf fd cd 5e 67 6a ab 6e .F.'.. ..F.Q. ....9[._..>.k....s..0. ui..@.. 0480 bf 75 69 0b a 0 6b 9d b5 23 f1 95 bf fc 68 10 82 ..ZAo. z. 0510 f9 ba ea 86 5 6 00 70 24 2a 63 c5 96 97 44 66 65 ..:!:. .]....| 0470 d8 62 12 93 1 a d4 90 73 cd 46 05 17 cc f2 79 03 ....Dfe 0520 92 fc ... 0450 46 3e 90 5d f 5 9e 68 a4 cb 95 ea 5c 82 18 10 a0 F >. 0440 d1 2c 6f b7 0 5 27 0c d7 32 72 4c df ff 15 d5 dc .e..h....+.......1 0a cb bb 9e 46 09 bc 5f c8 2b 86 .p$*c.+.. G.....C$.%......\. b. 04c0 ea de d6 e2 7 2 3a 55 99 53 6d c6 0c 43 24 c4 c7 .. ?k_......#...h......\.. 0500 ee ad 07 82 8 d 58 49 8e 0b 99 1e 80 a3 c8 40 2c ... . 04d0 a4 c6 99 6a 3 0 18 27 cc 9a 5a 41 6f dd 0f 1a 76 .|..s.. .o.... ..2rL.Z.. 0460 68 83 c8 30 1 2 93 f6 dc f0 f3 3a 21 3a d5 1b 7c h .'. ..XI. No.. 04b0 ed e4 88 73 1 a 65 97 2b c0 25 8a c4 20 7a d2 90 ..n 04a0 cd 3f 6b 5f b 6 e7 be f9 ff fe f1 1a c9 2b 5e e0 .^gj. .V.u4TB...Sm..r:U....f.v 04e0 b9 3f 92 5a 1 2 8f df a8 a4 f8 75 34 54 42 e0 de . ?.y..... 04f0 fd 47 8f 7c 8 d fd 5c 0b f7 68 fb 51 db e7 66 8b ......+^..

Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).000 000000 seconds] Epoch Time: 141 5615214.567922000 Romance Standard Time [Time shift for this packet: 0.517992000 pc13.173.517992000 sec onds] Frame Number: 4 9 Frame Length: 8 6 bytes (688 bits) Capture Length: 86 bytes (688 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II.home livebox.in-addr.07794400 0 seconds] [Time since ref erence or first fra me: 1. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .194.567922000 s econds [Time delta fro m previous captured frame: 0.home DNS 86 Standard que ry 0xc783 PTR 63.4 1. 2014 11:26:5 4.a rpa Frame 49: 86 bytes on wire (688 bits).49 1.077944000 seconds] [Time delta fro m previous displaye d frame: 0. 86 bytes captured (688 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.

..168..0... . ...hom e (192.... ...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 7 2 Identification: 0x4f2b (20267) Flags: 0x00 0.... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. = More fragments: No t set Fragment offset :0 .. .. . ...... .......... ...0...1...11 ). .....168.. = LG bit: Globally unique address (fac tory default) ..0 ...home (192... .. . .Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . = Don't fragment: No t set ... .. ..... . . Dst: livebox. = LG bit: Globally unique address (fac tory default) ... .. ..0.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. Src: pc13 ..0.1) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. . .0 ..1. ... ...... = Reserved bit: Not set .. ... = Differentiated Ser vices Codepoint: De fault (0x00) ...... .. . ..

168 . ..... . .000 0. .. .Time to live: 1 28 Protocol: UDP ( 17) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. = Opcode: Standard query (0) ..0 ..... ...... .168. = Recursio n desired: Do query recursively . ... Src Port: 4977 9 (49779)......... 0....ho me (192.1 ........ . .......1... = Truncate d: Message is not t runcated . = Response : Message is a quer y .... .. ... . Dst Port : domain (53) Source Port: 49 779 (49779) Destination Por t: domain (53) Length: 52 Checksum: 0x83a 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (query) [Response In: 5 2] Transaction ID: 0xc783 Flags: 0x0100 S tandard query 0..1.11) Destination: li vebox.0.. .home (192. . = Non-auth enticated data: Una cceptable Questions: 1 . . . = Z: reser ved (0) ... . .1) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.. ...

.... No....194..arpa [Name L ength: 26] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . 881 bytes captur ed (7048 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 . ACK] Seq= 24257 Ack=1 Win=46 Len=827 Frame 50: 881 bytes on wire (7048 bits ).. 0010 00 48 4f 2b 0 0 00 80 11 00 00 c0 a8 01 0b c0 a8 .in-addr.41.63...... . 0020 01 01 c2 73 0 0 35 00 34 83 a2 c7 83 01 00 00 01 ...arp 0050 61 00 00 0c 0 0 01 a .41. HO+.in-addr.. Time Source Destination Protocol Length Info 50 1... 173.in-add r. 0030 00 00 00 00 0 0 00 02 36 33 02 34 31 03 31 39 34 .1 73.....194 0040 03 31 37 33 0 7 69 6e 2d 61 64 64 72 04 61 72 70 ..E...`n.dllstx01.dx.s.173. .arpa: ty pe PTR.home TCP 881 http→49 574 [PSH....Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries 63.corexc hange.com pc13..5.. class IN Name: 6 3.194..4. ..41.518054000 cust-74-124-12138..

0 .... = IG bit: Individua l address (unicast) Source: Sagemco .567984000 Romance Standard Time [Time shift for this packet: 0.. .. .00006200 0 seconds] [Time since ref erence or first fra me: 1. . .... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .port == 80 || http 2] Ethernet II. .000062000 seconds] [Time delta fro m previous displaye d frame: 0.....000 000000 seconds] Epoch Time: 141 5615214.. .. .8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. . .. = LG bit: Globally unique address (fac tory default) ...... ..0.567984000 s econds [Time delta fro m previous captured frame: 0...... 2014 11:26:5 4.. .....518054000 sec onds] Frame Number: 5 0 Frame Length: 8 81 bytes (7048 bits ) Capture Length: 881 bytes (7048 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).

...home (192 . .. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c51 [validatio n disabled] [Good: Fals e] [Bad: False . ..... ..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. .... = Reserved bit: Not set .co m (74... .....12.. .0.. . .. = Differentiated Ser vices Codepoint: De fault (0x00) . ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.0 . = Don't fragment: Se t .. Dst: pc13...corexchange.... ....168...dlls tx01. = LG bit: Globally unique address (fac tory default) ... Src: cust -74-124-12-138...124.. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 67 Identification: 0xf18a (61834) Flags: 0x02 (Do n't Fragment) 0.. .1. ..0.1... ...138).. .m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ...

. = Reserved: Not set . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. .corexchange... = Push: Set .. 0. . . = Acknowledgmen t: Set . ... ... . = Congestion Wi ndow Reduced (CWR): Not set . .. ...0 .. Seq: 24257. . 1 .. .124.0. ACK) 000. ... = ECN-Echo: Not set ... .... . = Reset: Not se t ... .0.. = Urgent: Not s et . 0.. Len: 827 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 827] Sequence number : 24257 (relativ e sequence number) [Next sequence number: 25084 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .home (192.168.1 .. ...138) Destination: pc 13..... = Syn: Not set ...1...... 0000 0001 1000 = Flags: 0x018 (PSH.. Ack: 1 ..0... . . ...... Dst P ort: 49574 (49574)... = Nonce: Not se t ... ..com ( 74.0 = Fin: Not set ....] Source: cust-74 -124-12-138.. ......... Src Por t: http (80). .... .dllstx0 1.12. . ...

. ....2..... 0080 ff fb 92 04 e 9 0f f3 12 42 56 83 0c 32 e0 5e c8 .a.2~..P.. 0090 9a e0 61 88 5 c 0b 69 13 5a 07 a4 cb 81 70 1d eb . 0050 bd 69 69 3e 3 1 87 a2 6d 5d ff dc 91 b2 51 9a fb ......d..B. ..i..@L... 0020 01 0b 00 50 c 1 a6 2b c8 c0 ee 9e 87 4e aa 50 18 ..Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xa7a 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2087] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .1...p.3H. 0060 f4 ba a7 87 d 8 0a ad db e8 6f 66 e5 a6 c8 c7 fd .Q...S/fCR. 0010 03 63 f1 8a 4 0 00 31 06 3c 51 4a 7c 0c 8a c0 a8 .BV........ 0070 91 ae f0 f3 4 c ef 3b b9 ff f7 9e 8e e1 40 49 e5 .E.......r. ..W.m].. .L.hX.....w.\.P. c.. .. 0030 00 2e a7 a2 0 0 00 0a 8b b1 e9 02 17 d1 33 48 fb . 00b0 3f 01 0e 9e 5 7 8b 64 f1 72 e2 8b 68 58 d6 96 d3 ? . 00a0 80 f4 99 70 d b 40 4c f9 b2 ab 53 2f 66 43 52 b4 ..+...... ii>1...Z..@I. `n...<QJ|..^..p...........N.... 0040 2b 26 cd b2 4 2 9e 9a c1 dc 32 7e e7 9e 77 f3 81 + &.dx...@. .. ... .of..

.W.@... 0160 79 40 40 f9 4 8 b4 75 83 59 a2 a9 1a a9 15 50 10 y @@..*.Y. 00e0 b2 4e 6e 52 5 e d6 92 4d 8e 66 2d 32 49 ef fb e9 .. 01d0 18 e2 ad 5d 2 . .Hs/K. 01a0 de dd 8f cc 0 8 16 9e 95 fa 42 2a a3 31 14 77 26 ...WM..g..f-2I....`.....B*....pM..Y. NnR^..6.?o 01c0 28 fb 9e d2 5 7 4d 06 5a ba 70 4d 83 54 0b 40 95 ( .e.. 9... 0170 55 62 7c d4 5 e cd 05 88 f3 61 a6 c6 6c 86 06 ea U b|...[. 6.3.~..w& 01b0 8d 39 a1 b8 8 1 f2 3b 60 ef e9 61 38 bf e9 3f 6f ...X....a8....00c0 39 d5 6a 44 f 5 96 cd b1 09 80 bf c7 01 60 96 fa 9 ........^. .....r.P...Qf...8y....... ..g.6. 0140 a8 45 0c b9 8 8 b3 1e c7 f2 48 73 2f 4b 0e d7 63 ....k 0130 c8 36 19 ca c 2 fc 65 cb cc cc 0e 36 81 ea 18 82 .&(.I%Z...Z......`. ..3 0120 62 98 1b 95 9 5 51 66 bf 4c 5f fa 5c 1d 1f a9 6b b ....^.~.l.......... E..c 0150 ee e2 b7 f1 b b f7 1f 10 7e b1 33 86 9a 26 28 b0 . 0110 1a e0 71 4c 7 2 63 a2 04 aa d8 85 49 25 5a c9 33 .1..a.jD.\..M. 0180 d5 20 94 be 5 9 fa 67 d0 0a 7e a5 c6 90 6c 35 a2 .......l5.. 0190 f2 bb e1 f1 b c ca c1 0a 85 ca 0d 36 b9 38 79 e3 .qLrc...T.L_. 00f0 2f ba 5b ee 3 f 69 77 d3 31 0a b5 b4 90 67 d7 fe / .r.. .... 0100 55 95 57 dd 5 8 fd 0b 0e 81 5e 87 85 bb 72 1a a7 U .1.. 00d0 29 44 5e b3 1 5 e9 de aa 93 9d 91 2a 14 86 72 ee ) D^.?iw....u.H.

0290 52 37 fe b4 9 3 ff f6 66 68 2e f3 b9 51 19 99 df R 7..B. 0230 60 a8 9a d0 3 d 26 5c 0b a0 df 58 0c 25 0b 81 71 ` ... 0280 7a f3 58 c6 a 5 e1 2e 93 81 3d 3c 97 9d aa 2e 8d z . ....>.... ......Q.... 0200 8d f3 26 45 3 c 25 73 59 df 9b be 67 73 be 63 c7 .q 0240 22 ab 41 84 a 1 70 57 9a 7b ed 00 a9 c4 63 04 82 " .. 0210 6d 6e c5 d9 2 c f6 d3 8b d7 7f f1 ff 37 0a d2 0e m n.... ..<. ..........2.. 02b0 ff f5 45 15 3 b 12 0a cd 70 81 00 d3 1f 19 b9 4e .]#=a...6o...... 02a0 fe ca 50 04 2 0 71 67 0f b4 aa 85 09 91 2c dd dd .3 3d 61 dd bb 4a e8 f8 f6 cb 0e b3 . 0220 16 04 ff fb 9 2 04 eb 8f f3 1d 42 d6 03 0b 32 e0 ....gs.. 0260 b4 f6 db 0c c b 3b fe 92 56 d0 91 90 b1 1f 9f 05 ....R.c.. a.. 02e0 95 d2 2f ba 7 f b2 e8 ac a2 bf b2 . .p...`..X.>..=&\...|.... 01e0 ba e2 4c 7e e 4 86 3e c4 7c b5 14 b5 dd e1 df 1b . ...%...A.f.7.=<.J.. qg.... 01f0 fe 87 b5 53 a 1 90 ce 91 52 c7 73 f2 b9 22 eb e7 ..jj.&E<%sY.pW.c.. 02d0 e1 61 e4 2a 7 8 da c9 b6 77 5f 4b 4f d9 3e b0 08 ....fh......*x.Q.....w_KO..........".r...L~.S. ....V.... .N 02c0 78 26 77 8a 7 2 fe 36 6f b7 e9 e6 6a 6a c0 60 cc x &w.{.P.....s... 0270 6e 7e 73 0e 2 a 79 f4 3b eb 3c 66 2b 92 66 d0 8f n ~s..u..X.E......*y..../..<f+. 0250 41 d6 a6 fc 2 f a9 3c ae 92 db 75 7f e1 b7 51 8a A .

....O.... 0310 4f 2e a4 12 6 c 84 d9 4a 2d a8 c6 58 f0 62 ab 95 O ..Nh.cor exchange.7.518206000 pc13../.... 0350 8d 51 b1 ac 7 6 29 0c ea 6d 47 1d 14 8d 31 43 e8 ....v 0300 85 34 3f ff 7 f 9e cc 74 1c 90 b1 87 37 04 6b b1 ....&.v..1C.. z..g.....home cust-74-12412-138.. K......@.H...568136000 Romance Standard Time [Time shift for ..J-.=.x 0340 33 b3 aa 9c 3 a 41 37 33 bc 40 e5 ec a1 c2 19 04 3 ... 0370 75 u No.. .. Q.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =25084 Win=41895 Le n=0 Frame 51: 54 bytes on wire (432 bits).. 0360 fb 7a e5 26 8 d c7 13 96 b8 e8 bb 4e 68 de 9f fd .v). 2014 11:26:5 4... Time Source Destination Protocol Length Info 51 1.dllstx01. 0320 4e 25 5b 9f c 9 b7 48 fd 3d 94 a7 10 b0 52 33 85 N %[.k.. 0330 b4 4b 0c 85 c 8 85 2c a3 e2 91 ae 76 c6 04 94 78 ....l.X.:A73. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...b.R3....t.t5...mG.. 4?..._= 02f0 53 74 08 67 a b dc 74 35 ff c6 4f 1a 71 1e db 76 S t..q.cd aa f9 5f 3d ...

.. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).000 000000 seconds] Epoch Time: 141 5615214. . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ...... .0 ...0. .. ... .568136000 s econds [Time delta fro m previous captured frame: 0. .. .. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .518206000 sec onds] Frame Number: 5 1 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. ........... = LG bit: Globally unique address (fac tory default) .......port == 80 || http 2] Ethernet II. .... .. . ..000152000 seconds] [Time delta fro m previous displaye d frame: 0...this packet: 0...00015200 0 seconds] [Time since ref erence or first fra me: 1. . = LG bit: Globally unique address (fac tory default) ..... .. ..0. . .

home (192.138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.....ho me (192..0 . = Don't fragment: Se t .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.138) [Source GeoIP: Unknown] [Destination Ge .1. .com (74...dllstx01..168.. Dst: cust-74-124 -12-138. .... Src: pc13 . .12.corexchange... = Reserved bit: Not set .. .1.. com (74.. .. = Differentiated Ser vices Codepoint: De fault (0x00) .1 24.124..12.. ... .. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.11 ).co rexchange...0.1.168.....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f2c (20268) Flags: 0x02 (Do n't Fragment) 0..dl lstx01..11) Destination: cu st-74-124-12-138. .... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .

.. ... .0 = Fin: Not set Window size val ue: 41895 [Calculated win dow size: 41895] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: . .. 0 .. = Acknowledgmen t: Set ... Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 25084 (r elative ack number) Header Length: 20 bytes . .oIP: Unknown] Transmission Contro l Protocol. ..... . = Congestion Wi ndow Reduced (CWR): Not set ... ... = Urgent: Not s et .. = Reset: Not se t .... . .... = Reserved: Not set ..0 .0... = ECN-Echo: Not set ... . . = Syn: Not set . .. Src Por t: 49574 (49574). . ...... ...... Ack: 25084 ...1 .. Seq: 1. 0.... = Nonce: Not se t .. ..... . 0. = Push: Not set ..0... ....0.. .. . D st Port: http (80).. ..... .. ...... 0000 0001 0000 = Flags: 0x010 (ACK) 000..

)P.000 000000 seconds] Epoch Time: 141 5615214.. .home pc13.. .....`n.550816000 livebox....@.. 0010 00 28 4f 2c 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .600746000 s econds [Time delta fro m previous captured frame: 0.. Time Source Destination Protocol Length Info 52 1....home DNS 125 Standard que ry response 0xc783 PTR par03s14-in-f3 1..net Frame 52: 125 bytes on wire (1000 bits ).. (O.. 0030 a3 a7 18 d4 0 0 00 .600746000 Romance Standard Time [Time shift for this packet: 0....000152000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .dx.. No. 2014 11:26:5 4. .0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 50] [The RTT to ACK the segment wa s: 0.032610000 seconds] [Time delta fro m previous displaye . 125 bytes captur ed (1000 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.1e100.N.P..+.E.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 c4 29 50 10 ..

.550816000 sec onds] Frame Number: 5 2 Frame Length: 1 25 bytes (1000 bits ) Capture Length: 125 bytes (1000 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II...1. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .home (192...0.. Dst: pc13.. ...... . .. . .11) Version: 4 ...03261000 0 seconds] [Time since ref erence or first fra me: 1.....1).0. . ... . . ... ..... . .. .168..... . .0 .... = LG bit: Globally unique address (fac tory default) . Src: live box.. . . . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)......... ... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .....1 . = LG bit: Globally unique address (fac tory default) ......d frame: 0... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..0 ....home (192..168.

. = Reserved bit: Not set . = More fragments: No t set Fragment offset :0 Time to live: 6 4 Protocol: UDP ( 17) Header checksum : 0xb721 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: livebox ..home (192. .168..home (192. Src Port: doma in (53). Dst Port: 49779 (49779) Source Port: do main (53) Destination Por t: 49779 (49779) Length: 91 Checksum: 0x707 e [validation disab led] [Good Check sum: False] ...0.1.... . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.168. = Don't fragment: Se t . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. = Differentiated Ser vices Codepoint: De fault (0x00) ..1..Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 11 Identification: 0x0000 (0) Flags: 0x02 (Do n't Fragment) 0. .. .1) Destination: pc 13.......1.

000 0..arpa: ty pe PTR.... ... ........ ...... class IN Name: 6 3... .032824 000 seconds] Transaction ID: 0xc783 Flags: 0x8180 S tandard query respo nse.. . 0..1 . = Recursio n available: Server can do recursive q ueries ......... .0... . = Opcode: Standard query (0) ..... ...41..41.. .in-addr.... .. . ..... . = Response : Message is a resp onse . = Answer a uthenticated: Answe r/authority portion was not authentica ted by the server .0... .194... .....1 73. 1 ..... = Truncate d: Message is not t runcated . 0000 = Reply co de: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries 63.[Bad Checks um: False] [Stream index: 0] Domain Name System (response) [Request In: 49 ] [Time: 0. No error 1. . .194. .in-add r... ..173. .arpa .. = Z: reser ved (0) .. ... . . ..0 ...... . .. . .0.... .. .. ..... = Non-auth enticated data: Una cceptable . = Recursio n desired: Do query recursively ... . ..... = Authorit ative: Server is no t an authority for domain .....

.5.dx...1e10 0. class IN.1e100. o. 0010 00 6f 00 00 4 0 00 40 11 b7 21 c0 a8 01 01 c0 a8 ..!. 0020 01 0b 00 35 c 2 73 00 5b 70 7e c7 83 81 80 00 01 . No.par03s14-in-f 0070 33 31 05 31 6 5 31 30 30 03 6e 65 74 00 3 1.. Time Source Destination Protocol Length Info ... 173..194.194 0040 03 31 37 33 0 7 69 6e 2d 61 64 64 72 04 61 72 70 .6.in-addr...in-add r. `n.....[Name L ength: 26] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Answers 63. p ar03s14-in-f31.1e100..net 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..arpa Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Time to live: 13835 Data le ngth: 27 Domain Name: par03s14-in-f 31.@. ...41.173..194..... 0030 00 01 00 00 0 0 00 02 36 33 02 34 31 03 31 39 34 .41.1 73..net Name: 6 3...net....arp 0050 61 00 00 0c 0 0 01 c0 0c 00 0c 00 01 00 00 36 0b a .arpa: ty pe PTR.41.... 0060 00 1b 0f 70 6 1 72 30 33 73 31 34 2d 69 6e 2d 66 ....63.in-addr.@.. ..E.[p~.s...

000 000000 seconds] Epoch Time: 141 5615214.029244000 seconds] [Time delta fro m previous displaye d frame: 0. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).580060000 cust-74-124-12138. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 .corexc hange.629990000 s econds [Time delta fro m previous captured frame: 0. 2014 11:26:5 4.53 1. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.com pc13.580060000 sec onds] Frame Number: 5 3 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .port == 80 || http 2] Ethernet II.dllstx01.629990000 Romance Standard Time [Time shift for this packet: 0.home TCP 1314 http→49 574 [ACK] Seq=25084 Ack=1 Win=46 Len=1 260 Frame 53: 1314 byte s on wire (10512 bi ts).02924400 0 seconds] [Time since ref erence or first fra me: 1.

.. .... ... = ...... Dst: pc13... = Reserved bit: Not set ... .. = LG bit: Globally unique address (fac tory default) ...... = LG bit: Globally unique address (fac tory default) .. ...12. ....0. ..:78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. .. ... .0.dlls tx01.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00........138)... .. Src: cust -74-124-12-138.. . ........ .co m (74.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.0 .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..... = Differentiated Ser vices Codepoint: De fault (0x00) ...1... .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf18b (61835) Flags: 0x02 (Do n't Fragment) 0.168. ..home (192 .0 . ..1. .. .. . . .. ....corexchange.... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. .. ...124. .

. Ack: 1 .0. Dst P ort: 49574 (49574)...0.com ( 74... 0.. Seq: 25084. .home (192.168.. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a9f [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..124. .. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 25084 (relativ e sequence number) [Next sequence number: 26344 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .1.. .. .corexchange... = Congestion Wi ndow Reduced (CWR): Not set .138) Destination: pc 13. = Nonce: Not se t .0 .. . .... 0000 0001 0000 = Flags: 0x010 (ACK) 000.. Src Por t: http (80).... = Reserved: Not set . . .... . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..dllstx0 1.. .Don't fragment: Se t ..12.. ...

0060 18 3d 8c 17 0 8 14 58 a5 42 b0 c2 90 49 91 29 0b . = ECN-Echo: Not set .....X.. .U\ C.. 0050 c0 e0 1f 43 7 c 90 4e bb 36 8e 21 59 43 62 55 0e . .6. = Push: Not set ....... ...0.). .. `n.....E..)..1. .. 0030 00 2e 41 e2 0 0 00 80 55 5c 20 43 b3 68 64 46 86 .+....P..>\.... . = Syn: Not set . . = Acknowledgmen t: Set .dx..P. . 0020 01 0b 00 50 c 1 a6 2b c8 c4 29 9e 87 4e aa 50 10 ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x41e 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . .C|.... ..... 0.. 0040 e3 18 ca 3e 5 c 82 15 03 65 8d cd 47 3b 97 3f 13 ..hdF.0.1 . ... .. 0070 39 96 cc ef 9 1 e1 23 b3 96 c8 83 16 7c a7 56 41 9 . = Urgent: Not s et .. .....@....N.... . .G......J|.!YCbU.. 0010 05 14 f1 8b 4 0 00 31 06 3a 9f 4a 7c 0c 8a c0 a8 .:. . 0 .. .....A..B.. .. ..I.. = Reset: Not se t ..?..e..N.. =.

. C..5.p.'..d.vF.%. 00c0 7c 06 f5 c2 f 2 09 c4 dc 74 b2 9f 7a 3b 09 f7 ed | .S.. ..J"..2..*.VA 0080 c9 43 9b 42 a 2 57 37 18 e3 ff fb 92 04 eb 8f f3 .0180 d2 d0 bb 15 7 3 a2 71 f2 c7 43 47 a5 ee 21 1e c6 .....f.h 0140 f0 f9 99 ca 4 c b7 00 b6 14 f6 73 50 16 4d e4 34 .0o.hW...!...%. 00a0 13 58 0c 24 c b 81 7a 23 6b 40 f4 95 70 0a e6 12 .q.z#k@..z. ....X..L..c{.:.......z.#X.. 0120 d1 c0 ba 6a 7 2 a5 6b 29 5d c7 73 a2 63 7b a1 c7 ...W7. 0090 02 43 d6 01 e f 32 e0 64 e8 2a c0 61 e6 5c 0b f9 .$F2..B.... .:7......sP.~...k)].t.|...#.d.... 0170 52 5e 19 a5 1 8 32 b1 bf c9 72 c1 25 f3 58 b6 2d R ^.jr.Zu. . C..h. .i..#..q 0110 1b d6 c5 ba a 3 6e a7 5a 75 0d 01 68 57 01 ee 09 .4 0150 78 fa fa a7 f 7 f7 2b fb c9 2e 1d 27 ff f3 4a ae x ...9<C..... .G. 00d0 df b2 39 3c 4 3 f8 76 46 93 7e c3 38 6e f2 45 38 ..n.i.....2. ...\. 0100 38 3a 3a 4a b e 47 d6 d1 a2 7a fa 24 46 32 a2 71 8 ::J....J.r...$.../ 00f0 3d c4 71 df 4 a 22 99 7a 5f 89 ed 66 19 2c 3a 9d = . 0130 b6 d8 d1 25 1 c 53 ac 8c b7 3a 37 1f 95 68 8a 68 .q. X..CG.a...c.L..8n...+..s.. 0160 52 2f 9d b5 b e e5 cf 7f b9 af cb d4 69 a0 64 93 R /..E8 00e0 fd aa 4c 10 8 b 23 18 70 2e 69 e6 23 58 be da 2f .z_..Z$.. .....M... .s...p. 00b0 a5 0a 63 05 1 d a3 5a 24 9d 07 f0 35 ce 30 6f 0b .

. S....32.. 0260 3e c7 e6 8a e 2 39 3d f5 e5 ba 38 cf 2c 2c 95 d7 > ... ..a..........Y......o.J.0190 ec e9 54 37 d c a3 eb 6f 93 cc 4a 1b 32 4d 28 b6 ..' 0210 dd e9 21 e9 3 4 be 59 79 1e 45 da 5f 1f c5 44 dd ...<3...k.8... 0250 3b 77 7f fd 4 e 8a 30 a1 0f a0 d0 0b e3 81 c1 14 ...... 01b0 99 6e d1 4b f a b6 f8 fe 5e 3f 9d 6e 70 ec 41 b9 ......t... 01f0 28 aa e7 fc 9 2 eb ee bd 9b e5 74 18 32 87 ba 50 ( .: 01d0 84 c7 1c c2 3 c 33 9c 1e cb cb cd 97 db 0e c2 b2 .. ...... .^?...*..K7.....N. 01a0 82 40 17 ed 8 5 46 3d b3 f9 bc cc 0d b8 8b 66 8d ..F=.A.D.k.RK^.. 0280 aa 06 0c a7 9 8 83 8e 3d c4 f6 1f 4c d3 25 8e 9e . .w......E.. 01e0 7b 69 47 77 1 c db 2c 52 4b 5e 84 c9 d9 9a f3 a0 { iGw..... w..K.P 0200 f3 c7 0d 39 8 4 4b 2a a1 14 f5 66 b4 4a b4 e9 27 . ..... 01c0 8d fc 1b 4b 3 7 07 fe 77 ef f1 fd 63 2c ca 96 3a ...$.q.J.Yy.........9.._.. .. 02a0 64 d8 f0 74 5 .np.K*... . ...9=... E.......T7.. .D. @.X.=..!..=..4...%.L.2M(.f..3.... 0220 55 25 cb d7 3 3 d6 9a 0d a7 d4 6b ff fb 92 04 e8 U %..%.2.f.. 0230 8f f2 e5 44 d 6 03 08 2a e0 61 08 9a c0 3d 88 5c .\ 0240 0b 45 0f 58 0 7 b0 cb 81 6e 9c 6b 01 86 19 71 bd . 0290 9a 12 ad 24 d 4 ef a2 a6 cd b0 25 e0 98 11 06 17 .n.. 0270 b1 53 b3 33 3 2 10 20 8e e7 fc 20 1c 2e 59 f9 eb .0...c. n. .

..'sK....zo. 0380 8e 34 e5 9e a c 22 18 1e a9 91 59 57 0c 48 87 c8 .C..Z..$.n.UH...gC 0360 25 76 1c 84 4 1 f2 6e 2e b5 54 2f 10 29 d5 81 c6 % v..s*..XD 0340 b1 13 1c e5 4 3 bb 22 cd 0e 7a 6f c4 21 36 ee 4f ."..YW.zF.. 4..tQd\....r...G......l' 0320 48 5c 36 21 3 4 43 c3 0b 71 c5 49 43 d1 c5 4e 5b H !4C..T/..I).A.{.!6.@".LC.F.. .w 0300 8d 8d da ef 4 c 43 c2 ac b0 7f dc fd 24 86 1f 03 .1 64 5c a6 40 22 cf 8d ac b2 74 18 d .+.. 02f0 72 75 19 9e e f 5a 1d 2d b7 ef df 6e e8 ff 11 77 r u..).y...7.H...:..#x 02d0 39 62 8e f6 0 2 1c e6 b4 c0 d8 f1 6d 85 d9 a3 19 9 b.O 0350 a1 99 ee fb 4 7 ad b7 ff fd db e7 f8 7b bc 67 43 ..&3.O..)kK.q.^. ..`!...._ 03b0 7d 20 54 1c a e e8 15 c2 83 ce e4 ...n.. 02c0 77 91 c1 75 9 5 ae 52 a2 1f 9c c7 72 91 85 23 78 w ..v........#s#....... 0390 d0 d1 12 13 2 9 6b 4b 8a 46 fe c9 0a 71 ca 55 7b ... 0370 3d ba 5e b7 e f aa 8e 27 73 4b 0e 3b 8a d1 de 17 = .m...". ..N[ 0330 5f a7 4f ad c 3 23 73 23 04 8b 0f d9 3a 12 58 44 _ . 0310 5a 2d 80 8a 3 7 ff cf 55 48 a1 62 0b b7 11 6c 27 Z -....... 02e0 d2 b1 d4 0d 3 8 83 0b 7a 46 9a 1d ae 79 c4 20 d9 ..)..... ....IC....t...-.u.b.. . .U{ 03a0 84 ab 1b 9b 2 9 dd 49 29 e5 2b b1 f2 ab 76 12 5f .....8.. 02b0 37 ff fe a7 8 1 60 21 b2 73 2a d2 05 26 33 b7 11 7 . ..q.R......

. 03d0 04 ed 8f f3 1 3 44 56 03 0c 42 e0 5f 25 aa c0 3d ..J..~.M..HW 0430 cf b2 35 57 6 b 9c 8a 5a c8 ee 65 95 32 36 38 d4 ..P... .B....4...DV.W..)..$...g. ..x...... .<. 0440 a3 87 0b 99 2 6 f2 66 a2 81 67 93 53 d8 9d 68 a9 . ..._%.........\ 04b0 72 52 02 c5 3 4 02 21 85 8e 29 d0 a8 61 18 89 51 r R.. 03c0 bb 61 e7 57 1 9 dd b7 7e cf f7 e5 cb ff ff fb 92 ..w... 0420 42 bd a3 42 1 6 e2 41 d8 c8 c5 1f b5 a5 1b 48 57 B .... 0400 59 5c 6b 5c 4 f 26 98 0e 8a 07 5d 80 78 a5 44 22 Y \k\O&.d.x1..... 03f0 70 d9 fa 77 b f d8 e6 f1 fd 88 48 56 11 c2 a4 e2 p ...&.<.b).5Wk....B..h.... 0470 a5 8f 32 56 c 6 97 89 5a 43 42 0c 62 29 d6 42 6e ..]..A.. 0450 aa d2 9f 6b 3 f a5 78 31 8d d1 77 9d 8d c1 38 bb ... ..x..f.ZCB. 0460 7b 2b c2 20 1 e 1a 68 b1 82 ea e9 54 f1 4e 73 14 { +.. .f.268.w.D" 0410 43 41 d2 e7 8 5 10 64 8b 66 15 5f 27 20 fa 71 ca C A...N. L.C..s).G< .HV.2V...G9..Q 04c0 26 2c 7d d6 c 6 79 c6 a6 d2 c4 47 91 cd 8b 42 da & ..^..= 03e0 88 4c 0c 88 d f 5e 0c 3c cb 89 78 1a 2c 00 f6 19 .....q. . a.e4 e5 b5 c2 f3 } T....b 04a0 5c 2a 6c a2 4 7 3c 20 e5 24 c7 3c db 4a 13 df 5c \ *l....8..!...._' ..Bn 0480 3a 2b e7 0f 4 d 96 ec 8f a4 43 f5 73 29 17 b9 7e : +.Z..~ 0490 b4 9e c5 b6 b b a6 50 92 4e 97 9d 47 39 17 04 62 .k?.Ns.....T.h.a.e.S.

.r.O3[u.. 2014 11:26:5 4. 0510 3a 6c 2a 04 6 5 28 49 8b 8a db 8b 2b e6 84 72 b2 : l*.. Time Source Destination Protocol Length Info 54 1.+..F...001987000 seconds] [Time delta fro m previous displaye d frame: 0.3..000 000000 seconds] Epoch Time: 141 5615214...H...sbA.y..G.. ..{.._.. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.Y.582047000 cust-74-124-12138..631977000 s econds [Time delta fro m previous captured frame: 0.7.... 0520 43 6b C k No...home TCP 1314 http→49 574 [ACK] Seq=26344 Ack=1 Win=46 Len=1 260 Frame 54: 1314 byte s on wire (10512 bi ts).corexc hange.i.v.e(I.00198700 ..B...H... 04d0 68 e8 ed 59 c d 87 6a 0f af 48 be 76 b1 18 9f d2 h .631977000 Romance Standard Time [Time shift for this packet: 0.com pc13....j. 04f0 33 3a ed 2e e f 7b 9f 33 c3 37 b5 73 62 41 e2 8b 3 :.T... 0500 b9 87 d0 f0 8 a 48 ce 4f 33 5b 75 a8 cb 69 d8 99 .}.. 04e0 b7 c3 54 bf a 8 b5 c3 46 f6 9b d9 82 a7 5f e7 fb ..dllstx01.

.... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. ..0 .... .. ......dlls tx01.. .... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .....124. = LG bit: Globally unique address (fac tory default) .. . ..co m (74.0....138). . .. Src: cust -74-124-12-138. ....port == 80 || http 2] Ethernet II.. ...... ..0 seconds] [Time since ref erence or first fra me: 1.....12. .0. ..0 . = LG bit: Globally unique address (fac tory default) .. .... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..corexchange. .. .... .582047000 sec onds] Frame Number: 5 4 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ...... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).... .. ... .

Ack: 1 .home (192 .com ( 74.0. Src Por t: http (80)...124. .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.168..12.Dst: pc13. Len: 1260 Source Port: ht tp (80) Destination Por .1.... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.corexchange... = Don't fragment: Se t .. ... = Reserved bit: Not set . .. Dst P ort: 49574 (49574). = Differentiated Ser vices Codepoint: De fault (0x00) ... .138) Destination: pc 13.home (192.168...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf18c (61836) Flags: 0x02 (Do n't Fragment) 0.1. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a9e [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.1. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. Seq: 26344..dllstx0 1.

.0 . . = ECN-Echo: Not set ... . . 0 .. = Nonce: Not se t ...... = Congestion Wi ndow Reduced (CWR): Not set ... ..0. = Acknowledgmen t: Set . . . .. . .....0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x39e 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2520] .. . ..... ... .. .... = Urgent: Not s et ......t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 26344 (relativ e sequence number) [Next sequence number: 27604 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ... = Push: Not set . ... .... .... = Reserved: Not set . = Syn: Not set . = Reset: Not se t . .0.. ....... ...1 ...... 0000 0001 0000 = Flags: 0x010 (ACK) 000. . .... 0..... ..0.... 0...

. ..@. 0010 05 14 f1 8c 4 0 00 31 06 3a 9e 4a 7c 0c 8a c0 a8 .......F.P...........". IE. .+...N. .R....p.0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. .uIQ 0080 6a af 70 ff f b 92 04 ea 8f f3 00 22 58 83 0c 4a j ...k. 0110 76 a4 28 97 7 ...P..2...) 00d0 31 40 71 8d e b ac 22 cc 8a 1e 10 cd 0a 16 4c f4 1 @q.J|.dx. 0050 a2 49 45 bf 9 6 c6 e9 a9 43 4f 32 4d 07 8a b1 db ..... ..:..f 0040 82 8e f4 e3 0 c ea 3f 67 37 0e af 55 1e b2 72 b1 .q..r.'. `n..BfA..1#\...d. 0020 01 0b 00 50 c 1 a6 2b c8 c9 15 9e 87 4e aa 50 10 ............i'q@........?g7.e 00c0 71 14 be 32 c 4 08 bb 97 c3 d6 64 19 8d a4 d9 29 q ....p. 0060 33 58 ea ec a 5 54 a5 e8 5e 19 b6 a7 0e 5d 6c fb 3 X.. . 0100 ee 74 25 00 5 2 0f 14 44 46 9c 42 66 41 03 be d3 .N.U."X. Dd..18.\q..!ehAX..RyU . 00a0 7d 1e ec 40 c 4 99 70 d8 06 e1 31 38 1b d4 77 5d } . 0070 8a 9f c9 52 7 9 55 20 f8 ee 2d bb bf f2 75 49 51 . t%.....DF..w] 00b0 3f 8f d9 e5 d c 4e 98 f7 21 65 68 41 58 b0 bc 65 ? .E...-.X^..9...1..R.d.J 0090 52 5b c7 3b 1 0 31 23 5c 0b 71 0d 64 07 a0 6b 81 R [....CO2M...T....... 00f0 0b 44 64 dc 6 9 27 71 40 ed 46 84 c7 ee 55 ea af ..@. 00e0 a6 d3 44 f5 1 8 e8 27 0b 20 0c 5c 71 11 c0 ea 8a .. .U.^...D..L. 0030 00 2e 39 e3 0 0 00 9a 82 16 52 ce ac 58 5e 3b 66 ..]l..

. .%.mq.z. G.d 38 a9 28 ab 3b 5b 15 58 28 d2 1e v .n/N..... . 0180 aa 81 49 27 d 7 25 1e 92 ee 07 86 e4 d3 51 a7 f4 ..... V.p.. ..x...&.:..^[>.. 01f0 5d 68 bb cf 1 1 25 30 5f 0b e5 c7 ef e4 d9 8c 86 ] h..[..<<.X*.... d... 0120 bc 47 a5 d0 9 4 1b 92 26 89 7c fd ce 2e 4b 47 1b .|.S...Z..E.x 0140 fa ed 7b fd a 8 b9 de af ca 7a 8d d4 ab b1 4f 8b . 0150 78 cf 77 5c 7 5 c8 6e 2f 4e e8 90 f6 6a ea 92 cd x ..d.. 0130 7e 4d d1 a7 4 9 c5 43 5f e8 fd 9f 11 9b 96 05 78 ~ M. 0220 a9 92 70 ff 3 4 ff fb 92 04 ee 0f .....{..L.. }..m... 01c0 47 9f 26 2c 3 c 3c b1 53 ce 3d b5 89 ba e7 7a 74 G ....w\u......O..X(..|..4.I... (.C_..Q.. .W.... 01e0 d3 67 4c dd e 8 ce 93 25 69 7c 28 ee 86 99 7c ff . 0160 0b 28 b9 7f f c df 92 70 cc 04 64 a5 0c 20 64 19 ..=..x[N 0210 4a dd f2 12 c c ed 3b 6d ad 5a ea 6f f9 d9 e7 f2 J .7... 0190 e6 56 8e ce 5 5 7c 93 e9 81 82 58 2a 1e 73 72 66 ...e6. 0200 da 97 6d 71 8 8 5e 27 5d b3 d5 3a 95 aa 78 5b 4e .^'].T$Q.(..q._...K. ....}8......o.....%0_.srf 01a0 7c 15 89 34 8 1 5e 5b 3e b2 5f da af 37 be 7c b6 | ..T. gL...zt 01d0 d5 7d 06 12 4 c 11 0a 12 45 17 54 a5 cf 78 e0 0b ...U|.I'.(..%i|(..j.|.&.......... 0170 0b ba bd 57 a 3 4b 2e d1 a2 12 54 24 51 2e 71 1d . 01b0 f2 d9 f0 a3 9 e 17 65 36 7f 9f be 17 ea ea 1b e7 .KG...

8)......"..T&..<.....~. 02e0 01 a9 c7 c7 e e 54 26 a2 79 1a 89 f4 b1 48 47 de . .....':.$ 0240 cb 89 a6 22 e b 40 f4 99 70 47 d3 4f 14 7e 9e 94 .4...%X...m..n.@..AK...# 0270 3e b5 a5 fa f 5 52 96 47 eb 28 44 0f 96 17 c2 e9 > .+r...4..RP.{ 02a0 77 eb 9a 36 0 9 b8 c8 34 2e 74 63 0b c2 82 3c 1d w .. H. E..tc.Q....G=w.4....3+.a9.. ..G.......c. 02f0 41 bd 07 47 8 a 0c 07 08 0f 15 03 85 d0 90 ea d8 A .. .. 0250 f1 45 b8 eb 6 3 ff d8 82 98 96 e4 be 6c 70 75 2d .. 0230 e9 32 52 5b 6 6 7b 10 3d 23 5c 0c 78 e9 5c 0c 24 .?..Q.UA.0..... ...F .HG...KI.6.x.......(D.y..g 0310 bb 4b 00 f7 0 c d0 29 89 38 29 18 91 4b 49 b6 b3 ....J.. 2R[f{...M 0330 a6 54 b9 b4 e 4 4a 25 06 e5 b8 81 a9 e6 bb 13 21 ..J.....V.5 02c0 b1 c1 51 c8 c 4 3f d8 30 a9 74 04 af 46 20 11 9d . 0320 f8 48 a8 8d 4 1 4b d1 88 04 67 67 36 51 c4 a4 4d ......f2 f4 25 58 81 .t.. 02d0 d5 cc 9d 89 4 7 3d 77 17 0e c5 a2 52 50 dc a6 c9 ..R.O......=#\.p.....). 0290 59 54 ea 56 e 3 c6 95 33 2b 2c 34 bf 9d f9 bb 7b Y T. .pG. 0300 44 13 87 e8 6 1 39 d4 1f 51 dd a8 d1 4a 15 bb 67 D ....... 02b0 7a c1 10 6d a 8 bd 27 3a a3 04 93 4a d2 df a0 35 z ..lpu0260 86 bb bd 1e 8 8 c3 e5 e3 96 fa c9 a0 6e c9 db 23 . K. 0280 49 06 f2 e6 9 b 19 89 55 41 ad ae 18 2b 72 ab ce I ....\.. .gg6Q. ...G..

... q.> 0440 20 7a 75 12 4 7 63 ae e7 99 fe 1d 22 23 ae bf 68 zu..%..W"(...^. .9.vE#Wb 0370 18 57 2a 42 b f f1 28 09 90 cc cc b9 57 22 28 8c .i([....a..x...T 03f0 1a 73 7b 7e 8 9 69 28 5b d2 23 11 19 8d d5 80 e5 . ..2.*: 0420 e8 99 d0 69 5 7 2d 9e 13 a2 b4 3c 0c 77 61 36 5e .......WW...d.y.iW-....... %)Ad. s{~..J%..}Z. 03b0 de fd 5e 9d b 3 2c e5 64 dc 32 d7 b8 ce ce f9 57 .(. 0350 89 71 d5 94 b 9 b6 90 c8 17 df bf c2 5f 9b ae 4b ...._..p... 0410 ab df 78 be 5 7 57 bb c2 85 15 82 a7 ce be 2a 3a .Gc.f^..k.8k4.."#.X 03e0 0c 25 29 41 6 4 a0 6b 00 f4 8d 70 df fa 4f 0f 54 ..3..<...D....^. W*B....T.....: 03d0 56 03 0c 32 e 2 61 c6 8a c0 61 86 5c 0b 2c 91 58 V .. .W 03c0 ef e6 fc ff e 7 6f 38 ff fb 92 04 e9 0f f3 0c 3a .. 0380 4f 09 eb 52 d 4 7d 5a cb 25 ba da 33 b0 ec 8f bb O .U.... ..0 03a0 53 79 ad a7 3 9 89 d4 34 ed bf 86 21 ea a1 da 97 S y.... 0390 c8 47 8d c1 5 5 dc f9 15 6c 1a fe 00 db 5e e9 30 ..$.K 0360 78 60 ce 11 6 2 5d 10 38 6b 34 a9 76 45 23 57 62 x `..O....! 0340 b6 6b a8 10 8 a 10 96 15 80 cf 24 b2 23 8b 8d 9a .R.......\...... 0400 af ec 66 5e c 5 79 84 12 29 e1 fb a9 78 8a b5 9a ..wa6^ 0430 8b d0 da b6 d 2 4c a1 f5 27 d5 9f c7 ac 44 a6 3e ...........!.... .....a.#.L....b]. G.#.o8...).x....4... .h ..'.. k....2.l.

.|E....a..NF..(.dllstx01....@..D&Gpw.....r... ..f.com TCP 54 49574→h ttp [ACK] Seq=1 Ack .. No.C .b 0520 1d 17 . 04e0 4b 1a 8f df 1 f 25 c8 0f 44 26 47 70 77 12 6d c6 K ....s...cor exchange.0450 1d 64 73 f5 e 9 f4 43 20 09 8f 38 c1 14 82 1d f2 ...... 04b0 52 f5 28 ed 8 9 aa 74 18 70 b1 13 19 73 01 44 d3 R ..t 0510 58 ed 61 8e 7 2 85 7d 41 c1 3a 90 d1 40 91 03 62 X ...... 0480 c6 89 95 8b 2 8 80 80 7c 45 ca 2c 03 1d 48 3c 4e ....J+. .k.*?=T|b.....}A.. Time Source Destination Protocol Length Info 55 1.8.d. ..m. .....Gf...A. 04f0 a4 9a 64 e8 8 a ed 16 a9 af f7 ca 46 c3 9f 57 5f ..%.{.RuGnE.. .. 0460 6b 34 56 8e d 8 2a 3f 3d 54 7c 62 15 1b 1c b4 cd k 4V...(. ds..Y. 04a0 4e fc ac 83 5 2 75 47 6e 45 b3 92 47 66 d1 4b d7 N ....W_ 0500 76 3c e5 91 e f dd 96 1a 58 26 1a 02 12 7b ec 74 v <..X&.t...:..home cust-74-12412-138..V."TE"....|shV 04d0 1e d9 12 85 8 9 e1 d1 ac 56 da 66 f5 05 07 6b 13 .. 04c0 9a 2c 81 d0 8 f 41 c5 e4 59 01 e8 ec 7c 73 68 56 ..D.F....K. 0470 59 ba 97 0c 1 d ee 4a 2b 85 09 b9 4e 46 da b8 d2 Y ....p..H<N 0490 5b a0 0a ec 2 e 22 54 45 22 bb aa 9c a2 d3 98 e2 [ ...582161000 pc13.

.632091000 s econds [Time delta fro m previous captured frame: 0. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)..582161000 sec onds] Frame Number: 5 5 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . . .000 000000 seconds] Epoch Time: 141 5615214.... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.00011400 0 seconds] [Time since ref erence or first fra me: 1.000114000 seconds] [Time delta fro m previous displaye d frame: 0. 2014 11:26:5 4.=27604 Win=41580 Le n=0 Frame 55: 54 bytes on wire (432 bits).0.632091000 Romance Standard Time [Time shift for this packet: 0.port == 80 || http 2] Ethernet II.

..... = LG bit: Globally unique address (fac tory default) ...138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. .com (74... ...1.... ..home (192.. . ..0 . .. ... = LG bit: Globally unique address (fac tory default) . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4....... ..... = Reserved bit: Not set ...0. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f2e (20270) Flags: 0x02 (Do n't Fragment) 0...0 .... . = Differentiated Ser vices Codepoint: De fault (0x00) . . Dst: cust-74-124 -12-138..1 24..12.. ....... ..... .. .. .. .11 ).....1......co rexchange... ... .dllstx01. . = More fragments: No t set Fragment offset :0 Time to live: 1 . .. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..... = Don't fragment: Se t ... . Src: pc13 ..168..0..

. .. ..1.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol...0. com (74.... . . ..168. 0000 0001 0000 = Flags: 0x010 (ACK) 000... ..... = Acknowledgmen t: Set ....0 ..1 .....0. = Congestion Wi ndow Reduced (CWR): Not set ..12....11) Destination: cu st-74-124-12-138... Seq: 1.. 0.. = Urgent: Not s et ... . 0.. .124.. . D st Port: http (80).ho me (192.. Ack: 27604 ... = Push: Not set . . = Nonce: Not se t . . = ECN-Echo: Not set . .. Src Por t: 49574 (49574)... .. .28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13....corexchange... Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 27604 (r elative ack number) Header Length: 20 bytes .... = Reset: Not se t .. . . = Reserved: Not set . ..dl lstx01.. 0 .. ...

J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 ce 01 50 10 .0. 113. 0030 a2 6c 18 d4 0 0 00 . 88 bytes captured (704 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B ... = Syn: Not set . Time Source Destination Protocol Length Info 56 1. . .000114000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .P.dx..... ... 0010 00 28 4f 2e 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .@...611981000 pc13. (O.in-addr ..194. ..arpa Frame 56: 88 bytes on wire (704 bits).....home DNS 88 Standard que ry 0xc0fd PTR 184. .E....`n... No..0 = Fin: Not set Window size val ue: 41580 [Calculated win dow size: 41580] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 54] [The RTT to ACK the segment wa s: 0.N.... . . ...P.173.... l.home livebox...+......

..0 .. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)..-440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. .02982000 0 seconds] [Time since ref erence or first fra me: 1. ........ = LG bit: Globally unique address (fac tory default) .. . 2014 11:26:5 4. . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..000 000000 seconds] Epoch Time: 141 5615214. .661911000 s econds [Time delta fro m previous captured frame: 0.029820000 seconds] [Time delta fro m previous displaye d frame: 0..0. . ......661911000 Romance Standard Time [Time shift for this packet: 0.... .. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 ..611981000 sec onds] Frame Number: 5 6 Frame Length: 8 8 bytes (704 bits) Capture Length: 88 bytes (704 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II. .. .... ....

1) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..1) [Source GeoIP: ....168 .1....0.... = Differentiated Ser vices Codepoint: De fault (0x00) ....:60:6e:7f:64:78) . . . .168.1...hom e (192. .0.. = Reserved bit: Not set .168.. .168....home (192.1. = LG bit: Globally unique address (fac tory default) . Dst: livebox..11) Destination: li vebox. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: UDP ( 17) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13......home (192... ..... ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 7 4 Identification: 0x4f2f (20271) Flags: 0x00 0..1..0. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.... . . ..ho me (192. ..11 ). ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. Src: pc13 . . .... = Don't fragment: No t set .... .0 ....

000 0.. ... .. Dst Port : domain (53) Source Port: 49 779 (49779) Destination Por t: domain (53) Length: 54 Checksum: 0x83a 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (query) [Response In: 5 7] Transaction ID: 0xc0fd Flags: 0x0100 S tandard query 0.. .arpa: type PTR. .... ...arpa [Name L ength: 28] [Label Count: 6] Type: P .in-addr.1 .. .0..... = Truncate d: Message is not t runcated .. Src Port: 4977 9 (49779)..... ...194...194 .113... . = Response : Message is a quer y .. = Recursio n desired: Do query recursively . .... class IN Name: 1 84..... .in-a ddr. . 0.. ..... . . . = Opcode: Standard query (0) . .....113. ...Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.....173. = Z: reser ved (0) ... = Non-auth enticated data: Una cceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries 184.... ..0 .173. .. .

..5.173.713992000 s econds [Time delta fro m previous captured frame: 0.... .713992000 Romance Standard Time [Time shift for this packet: 0..a 0050 72 70 61 00 0 0 0c 00 01 r pa.net Frame 57: 127 bytes on wire (1016 bits ).`n.. .000 000000 seconds] Epoch Time: 141 5615214.184...... No.1 0040 39 34 03 31 3 7 33 07 69 6e 2d 61 64 64 72 04 61 9 4.6. 2014 11:26:5 4...... 0020 01 01 c2 73 0 0 35 00 36 83 a4 c0 fd 01 00 00 01 .. 0030 00 00 00 00 0 0 00 03 31 38 34 03 31 31 33 03 31 . Time Source Destination Protocol Length Info 57 1..664062000 livebox.....E..TR (domain name Poi nTeR) (12) Class: IN (0x0001) 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .home pc13. JO/..113.s.dx.052081000 seconds] . 127 bytes captur ed (1016 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. .1e100....home DNS 127 Standard que ry response 0xc0fd PTR ham02s12-in-f2 4. 0010 00 4a 4f 2f 0 0 00 80 11 00 00 c0 a8 01 0b c0 a8 .in-addr.......

.1). ..0 . ...[Time delta fro m previous displaye d frame: 0.0 .....home . .home (192... ..168. ... . .664062000 sec onds] Frame Number: 5 7 Frame Length: 1 27 bytes (1016 bits ) Capture Length: 127 bytes (1016 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II.... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..... Src: live box. . . .. ... ..... ..0. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. .. Dst: pc13. . = LG bit: Globally unique address (fac tory default) ...... . . = LG bit: Globally unique address (fac tory default) ....... ....... .....1 .05208100 0 seconds] [Time since ref erence or first fra me: 1.. .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... .0......

168..1. .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Src Port: doma in (53).0....home (192. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 13 Identification: 0x0000 (0) Flags: 0x02 (Do n't Fragment) 0..1) Destination: pc 13. . = Differentiated Ser vices Codepoint: De fault (0x00) .168. ..(192... = More fragments: No t set Fragment offset :0 Time to live: 6 4 Protocol: UDP ( 17) Header checksum : 0xb71f [validatio n disabled] [Good: Fals e] [Bad: False ] Source: livebox ..1.168. Dst Port: 49779 (49779) Source Port: do main (53) Destination Por t: 49779 (49779) Length: 93 Checksum: 0x419 f [validation disab led] ... = Reserved bit: Not set .1.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.1... = Don't fragment: Se t ...home (192. ...

.. . ...... 1 . = Z: reser ved (0) ...0... .. class IN Name: 1 . .... .. .arpa: type PTR.. .. ......0. . .. . ......194 .. . .0.. . = Opcode: Standard query (0) .1 .......0 ........ . = Non-auth enticated data: Una cceptable .......... ..... . = Authorit ative: Server is no t an authority for domain .. . .. ... = Answer a uthenticated: Answe r/authority portion was not authentica ted by the server ... ....173.... = Recursio n available: Server can do recursive q ueries .. . = Recursio n desired: Do query recursively .in-addr. .052081 000 seconds] Transaction ID: 0xc0fd Flags: 0x8180 S tandard query respo nse... .000 0.... 0.. ... . . = Response : Message is a resp onse . = Truncate d: Message is not t runcated ... 0000 = Reply co de: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries 184. ... ...113.... ... .[Good Check sum: False] [Bad Checks um: False] [Stream index: 0] Domain Name System (response) [Request In: 56 ] [Time: 0. .. No error 1....

. 0010 00 71 00 00 4 0 00 40 11 b7 1f c0 a8 01 01 c0 a8 .a 0050 72 70 61 00 0 0 0c 00 01 c0 0c 00 0c 00 01 00 00 r pa..in-addr.@.1e100.... ..173.5.E..84. 0030 00 01 00 00 0 0 00 03 31 38 34 03 31 31 33 03 31 .in-a ddr.dx..... 0060 68 17 00 1b 0 f 68 61 6d 30 32 73 31 32 2d 69 6e h ..arpa [Name L ength: 28] [Label Count: 6] Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Answers 184...194.s.173.net Name: 1 84..113. 0020 01 0b 00 35 c 2 73 00 5d 41 9f c0 fd 81 80 00 01 ...ham02s12-in 0070 2d 66 32 34 0 5 31 65 31 30 30 03 6e 65 74 00 f24..173.113.@.173.. .1e100. Time Source Destination . No..net...arpa: type PTR.arpa Type: P TR (domain name Poi nTeR) (12) Class: IN (0x0001) Time to live: 26647 Data le ngth: 27 Domain Name: ham02s12-in-f 24..in-addr.]A. ham02s12-in-f24...113. `n..in-a ddr..1e 100.184..113....1 0040 39 34 03 31 3 7 33 07 69 6e 2d 61 64 64 72 04 61 9 4.....net 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . class IN. q....194 ...194....

000 000000 seconds] Epoch Time: 141 5615214.00299000 0 seconds] [Time since ref erence or first fra me: 1.716982000 Romance Standard Time [Time shift for this packet: 0.dllstx01.716982000 s econds [Time delta fro m previous captured frame: 0.home TCP 1294 http→49 574 [PSH.port == 80 || http 2] Ethernet II.Protocol Length Info 58 1. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).667052000 sec onds] Frame Number: 5 8 Frame Length: 1 294 bytes (10352 bi ts) Capture Length: 1294 bytes (10352 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .002990000 seconds] [Time delta fro m previous displaye d frame: 0. 1294 bytes cap tured (10352 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. 2014 11:26:5 4. . ACK] Seq= 27604 Ack=1 Win=46 Len=1240 Frame 58: 1294 byte s on wire (10352 bi ts).667052000 cust-74-124-12138.com pc13.corexc hange.

..corexchange. .. .. = Reserved bit: Not ..138). . .. Src: cust -74-124-12-138.. = LG bit: Globally unique address (fac tory default) .1..Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .......home (192 . ..0. ... . .. .. .124. .dlls tx01... .. .168.... . = Differentiated Ser vices Codepoint: De fault (0x00) ...co m (74.. ..0 ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. = LG bit: Globally unique address (fac tory default) .. ..12.... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.... ..0 .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 280 Identification: 0xf18d (61837) Flags: 0x02 (Do n't Fragment) 0. ...... ... .. . ........11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.....0. .......... . Dst: pc13.... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .

= Reserved: Not set .....138) Destination: pc 13.124.... . = Congestion Wi ndow Reduced (CWR): .12.. = Nonce: Not se t .0 . Ack: 1 .168..1.set .. Src Por t: http (80).. . Dst P ort: 49574 (49574). ACK) 000. Len: 1240 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1240] Sequence number : 27604 (relativ e sequence number) [Next sequence number: 28844 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . 0.. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3ab1 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138......corexchange. . 0000 0001 1000 = Flags: 0x018 (PSH.. .. ... ..1... ..com ( 74. . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. .dllstx0 1... = Don't fragment: Se t . Seq: 27604..0..home (192.

. ... ... .Not set .0.+... .. .....:....... = Syn: Not set ... 0. = Urgent: Not s et ..1 .... = ECN-Echo: Not set . .J..N.yY.....0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x694 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1240] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .0..iB.1...R.J|.... .l..0. . 0050 f8 fb 94 b4 d 4 0c 61 92 88 e5 dc f6 d4 ca 4a d0 . .P.. ..... 0010 05 00 f1 8d 4 0 00 31 06 3a b1 4a 7c 0c 8a c0 a8 .... = Push: Set . = Reset: Not se t . 0020 01 0b 00 50 c 1 a6 2b c8 ce 01 9e 87 4e aa 50 18 .. .. 0060 7e 44 c7 d5 4 7 c4 96 79 59 09 0b 8e 9a 52 d3 db ~ D...dx.|F{. . ... .0........@. 0070 cf 73 8a 7f 1 .....P..a.E. . . `n. . . 1 ..iy6.. = Acknowledgmen t: Set ....._UZ.. ..........G... ..... 0030 00 2e 69 42 0 0 00 f1 f4 69 79 36 07 8f 30 e6 e4 . 0040 78 a4 5f 55 5 a f1 a5 f3 7c 46 7b f9 20 96 6c ca x .. .. ...

..\ 00b0 3a ae 4a ba 4 2 64 20 bb 69 72 f1 37 68 7e fd 4a : .).....'-.... ..y..>...U.).L.^........Ar.J 00c0 9c 1e 13 64 4 5 52 74 a8 d9 20 cc 16 bc 47 e7 bd .o.:. 00e0 39 c6 0f 41 e 7 41 11 85 01 80 ed 28 f3 89 8c 8a 9 ..2[ 0110 03 64 e2 a6 8 9 3e d2 d0 96 10 15 65 c8 e1 46 0f .8...m..W...'...j...X\..b f7 cf ae 6d 13 58 5c f1 ff fb 92 ..Fx. 0130 6d 59 13 29 7 8 ba 8e a4 29 e2 67 b7 38 c0 57 90 m Y. 0100 5f d3 27 2d 9 7 41 72 d2 a6 27 c6 7b a0 dc 32 5b _ . ...e.{. d.. 00d0 87 21 6a e3 b b b6 29 1b 73 13 87 94 29 4a 34 b4 .. t+. .<p...j...v . 0080 04 ed 0f f3 2 c 47 d5 03 2c 32 e0 61 a8 fa b0 61 . 0160 e4 96 13 04 0 4 0c 6d 8a 32 f1 89 3a db 88 f5 bf ..y..s.9 0180 84 23 e8 90 c b 41 c1 54 d2 af 0b ..w*h...m.... 00f0 b8 59 2e 06 a 1 f6 3c 70 b1 1e cf 77 2a 68 96 d4 .. . Y. \..)x.A.Bd ... 0140 36 f6 b3 cc e c 46 78 e5 a9 56 87 de 8f 23 8d 46 6 .F..V..... !j...... 00a0 70 56 01 44 2 0 88 93 0b a9 6f df 5e 85 e5 ad 5c p V..G..2.2...... 0170 ab 74 2b 11 6 a 01 44 b7 08 dc 79 fd 76 20 c8 39 .a 0090 88 5c 0b f5 2 1 54 0c 30 ab 81 7f 1b 6a 81 86 19 .dERt..D. 0120 05 29 89 83 0 1 55 08 a7 54 3f 64 8d 11 57 68 0f .a.0.D ..#.. .ir.)J4..J.^..s.....Wh..(.T?d. s...G.!T..g.F 0150 cf cc ef 79 b 5 b0 5e 17 4c d5 1a ed ff 3b 73 fc .... )..7h~.A.

. 01b0 61 05 75 ae 2 6 ad 85 c7 25 db 44 3c 44 cb cd c5 a .."..Q.SX.T.D. *#. X...&. 0210 8c 4b b9 56 e f 53 96 b7 4b 54 96 49 93 e3 90 ff .. 0270 d5 4a c1 90 6 c 2e 87 8b 29 a6 df 62 6e 7b 71 b2 .. 0230 a0 61 85 5c 0 c 30 dd 52 0c bc cb 81 80 9b ea 41 .)...R..%B..0.4T.i..S..^.u. 0280 b4 2a 23 01 6 6 8c 98 e1 6d 46 4d 34 be cb af e3 . 01a0 9e 3e 06 1f 6 7 64 07 43 c5 00 55 bd cf 5b 15 a8 .. >..V...*..C.gd. 01e0 46 c0 c0 ac 6 9 b2 e9 95 72 52 d9 4b 9d 55 fb 7a F .bn{q.A`.. K...[p8.KT....A....[. 0220 fb 92 04 e8 8 f f3 0d 34 54 83 0f 32 e0 5e 08 fa .K...l.k 0190 a3 c0 4e 8d 6 d 64 10 08 e9 bc b9 6c 03 95 44 b1 .&"s.f. 01c0 6b ae 77 58 e 0 92 53 58 a6 b2 2b e8 89 3f fa 15 k .D. 0290 41 b1 60 5c 5 4 f0 a1 32 a7 83 0a 71 46 91 3a b9 A ...z 01f0 a6 5d 6d b8 e c 73 52 cd d5 e7 13 fd 5b 70 38 a8 .mFM4..md.S.......X...S...wX.7wl].rR.. 01d0 7a 4a 90 16 a 8 2e 30 0a 94 b5 58 c9 5a f0 b4 ea z J.\... ...... a.%... ]m..l..N.....Z.A 0240 96 21 70 d1 7 7 06 a4 37 77 6c 5d 0e d3 44 02 f4 ....f..r.91 cd ce 0e 6b .pa.2........ !p.. 0200 f9 da aa e1 f 7 53 a8 d0 08 26 22 73 12 66 1e b9 .0.U. ..D<D..U.I.. #....w.. J.?. 0250 16 58 c8 a5 7 2 a2 ec 2a 01 70 61 f1 12 22 89 9e ...sR. ...+.. .. 0260 14 83 53 e4 b 4 c8 ad c8 51 b6 25 42 bc 41 60 a3 ..

.... 03a0 5f 55 b5 f5 d f ea 68 76 60 7d 4b ac ac ee 5f 2d _ U...U..$.hv`}K........:. ......JA. 0310 d8 1e b8 34 8 9 0a da a9 93 21 82 d8 8d 35 a5 b5 . 02b0 5f 12 27 1d 0 4 41 82 e1 2b ba a1 1d cd 02 d8 85 _ .... 02c0 36 e6 3b a8 3 0 65 3c fc b0 e2 09 12 a3 ba c9 7d 6 .~q....!>. 0330 1d d4 a3 94 a 4 dc f8 db d7 29 bd 1e 2c c7 10 64 .. ......N.0e<.|..J....Q?I.d 0340 56 98 bc 06 6 3 d4 df 51 d0 2a 32 5c 67 74 8d df V . 0350 23 55 a6 a0 7 d 0d 13 4e fb 7f 51 3f 49 bf 2f 3d # U......E.F...Iy..... .......... W...f[ 02f0 5e 16 a7 cb a 6 86 ef ef d3 22 f4 ec d9 df 3e 66 ^ ...W. 0320 74 ce 07 f2 9 e d7 4a 41 82 c6 d3 2c 7c ae 0a 08 t .#..'.........A....._- ...}.h<. .>f 0300 e6 7e 5c 5c 2 c 0b 68 3c 95 56 55 3d 56 50 18 e4 ...4...5....*2\gt.s 0390 b2 57 16 c2 1 7 cd 74 78 04 5d 98 9b 11 23 a7 e3 ... ..@l..G~../= 0360 f5 d1 57 fe 3 b ba e7 1a b9 0e 16 2e 8f 4a 14 02 . ~\. ....2.. ..VU=VP..T.....-..5" 02e0 05 ae 11 f3 1 9 24 0a db a6 d8 47 7e f7 b9 66 5b . 0380 c0 08 cd 21 3 e 87 a5 a8 ee c1 0b 0b 2d a6 b1 73 .!...`\T.Q..]. 02a0 da bb 1d b9 5 5 a2 08 af 82 10 49 79 05 40 6c dc ..)......."....c..qF.} 02d0 0d 0c da 3d d 4 2e e5 7e 71 93 86 09 a9 ab 35 22 .tx..=.......+. 0370 42 c0 0c 54 c 7 45 04 90 02 11 67 49 05 46 ac 8b B .gI.....

.zoxdG..+.z...~...Wj..zx._V..7T...2.......`pD...... ^...2b'.... 0490 a6 35 03 70 3 7 4d db 5f 56 c6 6d 6d 5f 3b f5 ff . .F.Uh. ..... 04b0 7f d6 b4 53 b 8 b1 78 38 15 c0 15 00 48 07 4d 61 ..`....= 0450 ae a5 09 a2 3 2 0e 03 46 9d 13 39 80 a6 00 60 ec .<..........W 03d0 85 6a a0 61 2 8 4c 0c b5 03 4e 0c bc cb 81 8b a2 ... .qB{Rd 0420 74 ad 9a 7a b a ec 0d 5b dd a3 e7 80 7e d2 b3 67 t .. 03e0 6a 01 87 a1 7 0 2e f3 f1 65 90 32 62 27 be f7 21 j .Ma 04c0 5b a9 a8 c5 6 ..[.... 0440 09 18 60 80 c a c1 dc e1 51 23 cd e7 df 5b e3 3d ...R 0410 62 44 b6 d2 b 2 90 c5 f3 dd 1c 0a 71 42 7b 52 64 b D. ~.. 0400 9d af a3 d1 d a aa 2b a5 92 d3 c6 3c d2 10 c7 52 ..M&N(q.H.e.-a. 5.x8.....Fx...c..... 04a0 d2 7e 0d bd 8 d 2d 61 aa 4d 26 4e 28 71 7f 3b ed ..`.. . 0470 1b ba b6 95 b 4 12 02 d1 24 7d 29 87 93 ba 3e 7a ...81J 03c0 3c ff fb 92 0 4 e6 8f f2 cd 37 54 83 2f 2a e0 57 < .Q#.....! 03f0 14 5e aa 95 5 5 68 02 7a 78 c8 20 05 d5 4c e6 d9 . .. .9..03b0 6e 7b 3a 63 6 b f2 7a 6f 78 64 47 09 a4 38 31 4a n {:ck. 0460 f5 a5 b6 93 4 6 78 af 2e c6 e3 06 2d 9a 97 0d f1 ....S.. j..$}).. ..g 0430 b9 fb 9f da 6 3 83 a6 d5 fc 9a cb 60 70 44 f2 da ..[...N..p.>z 0480 f7 da db 85 a d 5a f8 9e 2d eb 57 6a 16 5f a9 a4 ..a(L....-.....-. .. .mm_.L...Z.._.../*.p7M..

1PD.. ..O...home TCP 1314 http→49 574 [ACK] Seq=28844 Ack=1 Win=46 Len=1 260 Frame 59: 1314 byte s on wire (10512 bi ts).dllstx01.=K..b 2e c6 fb b5 ae b0 5e 25 b8 9b 96 [ .832000000 s econds [Time delta fro m previous captured frame: 0..R. ....corexc hange.115018000 seconds] [Time delta fro m previous displaye d frame: 0. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.... 04f0 d6 65 a5 52 c 5 1e db 8d 31 50 44 91 53 cf 43 c1 . Time Source Destination Protocol Length Info 59 1.782070000 sec onds] Frame Number: 5 .000 000000 seconds] Epoch Time: 141 5615214..k.& No.R.. K@.H6>....11501800 0 seconds] [Time since ref erence or first fra me: 1.d.K..^%... 0500 cd 8a b5 c2 c f 3d 4b 08 c0 4f dd b6 f7 26 .... 04d0 b3 4b 40 00 a a 50 a3 e1 48 36 3e 82 fb 4b 1c 96 .. e.832000000 Romance Standard Time [Time shift for this packet: 0..com pc13.782070000 cust-74-124-12138.. 2014 11:26:5 4.C.S. 04e0 e3 b9 a3 e2 d a 79 95 96 82 05 9a 1c 64 15 52 0f .P.y.....

.... .. ..... ....home (192 . ...... . .co m (74. .. Src: cust -74-124-12-138.0........11) Version: 4 Header Length: 20 bytes Differentiated .12.. . .port == 80 || http 2] Ethernet II..9 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ... ...... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. ....124..138)...0 ... = LG bit: Globally unique address (fac tory default) .0. . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). = LG bit: Globally unique address (fac tory default) .. . .corexchange. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.0 ......... .168..... Dst: pc13. . .dlls tx01.. . .1.... . ..

.138) Destination: pc 13. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a9c [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.. = Reserved bit: Not set .. Dst P ort: 49574 (49574).12.0. . = Differentiated Ser vices Codepoint: De fault (0x00) ....com ( 74. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.corexchange..124.. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..1. ... Src Por t: http (80)...home (192.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf18e (61838) Flags: 0x02 (Do n't Fragment) 0... Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number ..1. .. = Don't fragment: Se t .Services Field: 0x0 0 (DSCP 0x00: Defau lt. .168.dllstx0 1.. Seq: 28844. Ack: 1 .

0010 05 14 f1 8e 4 0 00 31 06 3a 9c 4a .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xd12 a [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2500] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..E. ... . = Reset: Not se t .. .. 0000 0001 0000 = Flags: 0x010 (ACK) 000... ...dx.. `n.. = Push: Not set . . . = Congestion Wi ndow Reduced (CWR): Not set .: 28844 (relativ e sequence number) [Next sequence number: 30104 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .0......0 .....1 . .... . . 0.... = Nonce: Not se t .. ... .. ..... ..... = Acknowledgmen t: Set . ... = Syn: Not set .. ... ... ...... . 0 ... 0.. = Urgent: Not s et ...... . . = Reserved: Not set ..... .... = ECN-Echo: Not set .0.. ... ... ..0......

..[...j.. 0030 00 2e d1 2a 0 0 00 4a 90 28 f3 40 0c 1b 40 c7 83 ...^.@......8]QP 0080 89 83 35 86 8 d ac 3c 27 93 2c 49 ff fb 92 04 e8 .5.I....... .+........ 0050 23 39 43 c5 1 f 37 40 71 66 9d c2 fc 07 57 97 5a # 9C.. .@.......~R. 00d0 58 13 be cd 3 9 8d 09 e3 8b 33 1a 33 2b 81 d3 e5 X . 00e0 b6 a3 9c 16 b 3 ea ab 62 c3 ce 11 67 d2 03 52 47 . . .....L. 0090 8f f3 0a 2c d 3 83 4c 62 60 5e 85 6a 80 61 8c 4c ..m.W..... h..7@qf.....qh.7c 0c 8a c0 a8 . ..1... ...3. ..J.S0...g. .k...N.... 0070 89 0d 9f 5e 0 8 99 ca f5 71 68 b1 a1 38 5d 51 50 . .>...*....x..b.....Lb`^..5.(..P.[.@....H.a...9.. .. ....RG 00f0 0e f9 13 9c 7 8 98 f8 cd 10 0a 0f 0c 8b 9a b7 4e ..=.-0c 00b0 47 3d b5 35 d 2 4c 8d ea da cf 5b 0d 6b c6 26 22 G =.....<'...P.N 0100 7d 86 90 b1 8 c be 6b 74 e5 39 de 3e 0f 92 af aa } .. 0020 01 0b 00 50 c 1 a6 2b c8 d2 d9 9e 87 4e aa 50 10 . ..&" 00c0 c9 06 2e 59 5 4 af 7e 52 92 23 4e cd 9a d9 e6 c4 ... 0110 de fb ef 7f 8 f 53 30 bb bf 3b a9 01 26 35 78 45 .kt.....:.o..J|.. 0040 16 68 0a 0e 8 f 8c c9 f9 48 8d b5 5b 3b 6d 14 b0 .N.L 00a0 0c 04 c1 4e 0 c bd e9 81 6f 95 aa 01 96 2d 30 63 ...&5xE 0120 13 3b 08 8a 6 8 34 12 6c 31 ab 2d 7a 8d 3e 4c 96 ...#N..YT. .z..3+..Z 0060 96 c4 8f 8d d a 9e ba d4 e7 3d a9 7a 84 da b2 d6 ..9..

........h4...L.<4."#m.C8`... 0160 9b ac cf b9 f 5 eb e7 6f 08 b9 a5 cc 10 9d 63 c4 ..u.N 0210 0e 06 04 98 3 5 65 00 dc 86 03 43 38 60 e4 9d 7a . snW<... .G. ........ 0130 41 5d 22 eb b 3 75 a8 09 28 80 b1 94 4c 0f 01 85 A ]"....#...%.c.o. 0190 2f 71 96 13 8 2 02 b1 d4 46 d4 ac 89 22 23 6d 95 / q..2...jA)....5e.....$T.. ........[.... 01e0 37 49 05 92 0 1 3e 5b 13 77 69 ee 24 54 aa f5 8a 7 I. 0200 f6 73 6e 57 3 c 93 c1 8f 0e 19 23 b8 e6 10 00 4e .Z.z 0220 26 a6 b7 23 b 0 bb d2 b7 f2 10 cf c6 3f ff fb 90 & .N..<].f.. .#.....${..p....>L.g 01b0 79 cb 3c 34 b c f3 3d 8d 5a ef 5b c5 b3 f5 5d c9 y .. 01a0 c8 cb 4e de 1 c cf 15 91 37 6f 54 d7 cb 8e 9f 67 .$S.?.wi.......u..=...... .. 0170 2c 81 2c 28 7 3 d3 da af 93 d0 ca 4b fc 66 0a 03 .r 0150 b0 d3 d6 95 3 c 5d ce ab 02 89 19 5e 77 81 47 ff ....v...(s....>Y..M#5... ..(... 0140 8b 95 f1 ac 7 1 bb 77 89 76 d2 4d 23 35 e7 8e 72 . 01f0 ed 9e 9a 70 a 2 e0 a4 a4 cc bd 9d 9e cf ea 75 a1 ....^w...7oT. .T..q.ObP`(Zpe .-z..w..F.<.... ..... .1.>[..]. 01c0 4b ff 9f 06 1 d 31 9b eb e7 3e 59 92 84 12 b4 78 K ...x 01d0 d7 a0 d3 c2 3 2 c7 0d a0 ab f7 6a 41 29 8b cb 2c ......l1..K. 0180 49 8b 25 fb 8 9 24 7b d9 54 11 d3 3c d1 eb 09 c7 I ... 0230 04 e9 8f f3 0 5 24 53 03 4f 62 50 60 28 5a 70 65 ..

d 0310 86 66 d6 37 2 1 ff 7f d0 bb 59 50 e5 41 13 21 4a ..(JXJ...WZl..C.. .. @.$....8........ \..7!.3...0.YP.!J 0320 2f 26 34 c2 f 8 8d cb 55 46 58 4e 4e b0 d5 9d cf / &4.... ... ..>..... 0260 c4 00 24 a2 2 4 62 90 fc a9 82 bb 2c a2 1c da c6 ......U\. 0270 a8 cd 99 e9 5 7 5a 6c 1b 4f 35 16 65 7c 1c c7 4a .&.....T(....1{ 02d0 15 20 7b c2 5 6 bc 79 13 03 b1 1d 1c dd 3e 9b 92 ........$b. 0300 e2 04 74 31 a b 43 0a 32 e7 b7 41 5b 2e f6 18 64 . ..b.J..Q.q.....3CBU...O5... 0330 96 25 fa 62 1 6 0d c8 17 28 4a 58 4a 13 ed 3c 24 .0 02f0 a9 40 c4 38 9 3 b0 e3 e2 42 91 c2 23 6c e7 cb ea ..UFXNN..y.P' 02c0 96 e2 04 00 2 0 66 50 f4 51 c3 29 bb 2c 8d 31 7b .l 0290 31 5c 57 9d 0 0 49 d7 ac 55 a6 b4 c3 cf d6 99 ff 1 \W..*.....2. .... {. 0350 06 81 f6 4a c ..<$ 0340 4c d2 bb cd 5 9 31 4a 7d 35 de 89 32 02 54 28 b3 L ... 02a0 ae b5 69 dd d 3 d5 f9 30 fc e7 cb 33 43 42 55 80 .0..V. .B...t1... fP.A..#l.. 02b0 68 78 f4 a1 5 e 22 66 ce e9 26 1a 55 5c 0c 50 27 h x.2. %. .i..A[. 02e0 a6 ba b8 bf 5 a 57 3c ee 91 4c c6 71 ee 2a 87 30 .e|...ZW<...^"f.)..L.*o>r.L.U..Y1J}5.... 0250 30 cf e9 17 d 9 9f f0 17 90 cf e4 bf 4a b6 96 b8 0 ..I...0240 e8 5c 0b e4 c f 4c 0d 30 cb 81 84 98 a9 c1 97 bd . f.J 0280 aa d0 fb 33 9 8 9b 2c 82 cd 2a 6f 3e 72 fe c4 6c ..

0430 91 c8 51 38 1 1 2c e0 e8 20 c4 1d 19 47 23 0b a6 .D.^. .I.......Q8....... k..y.6. .M...L.... .... 03b0 42 ac e8 d6 b 9 fd a9 5d db 17 d6 e3 cf 49 01 03 B .R...a.... 0420 1f 71 62 a1 5 1 f9 d6 c9 0e 7f 17 70 4a 36 a8 85 ....v. 0370 12 6b ad b5 9 4 f4 55 4f 55 15 36 d4 1c 44 8a f1 . 0410 d3 0c 09 5e d 5 26 17 63 5d a9 71 78 65 c8 da 86 .p 03e0 65 ec 4c 0b c c ef 4e 0c bc ab 81 79 18 e9 c1 97 e ..UOU...).G#.*#.k... C..`... p...5.c..@b.d 99 49 95 15 e9 cc c4 37 9c 94 37 ..... .Q..7 0360 7d ea 55 5e a 1 ff de c7 40 af 48 aa 5e 2c fb d4 } ..... 0380 5a 97 cc 92 4 a e5 e8 60 90 c4 52 04 a7 96 40 ba Z .. .N...].~. 0450 d7 e0 a9 ac 7 e 70 93 61 cc 53 bd 68 7e 55 98 d9 . .qxe.h~U.I.. 0400 1f 43 c1 17 e c 2a 23 01 7f 22 6d d2 18 46 47 92 ....@..u?3....... qb.=..@.&.S.7..h.....\... 03f0 a5 70 1a 36 1 8 a9 c5 62 ee 8c 76 9f a1 68 ad a1 .. 03c0 c0 a3 c6 a4 5 c 34 95 bd 8a 40 62 c6 29 95 ff fb ."m.. 0440 38 5b c6 cf 7 5 3f 33 f3 5c f5 23 b6 f6 ff bd 7f 8 [...J.pJ6. 03a0 36 72 da be 0 3 6b 96 a8 ab 83 03 de 4d d2 3b cc 6 r.i.H.U^.FG....D. 03d0 92 04 e7 8f f 2 ed 44 d3 03 2f 1a e0 5c e6 1a 70 . ....J.......~p./..... 0390 72 f5 94 7e 1 7 35 10 96 dd 63 d2 69 b3 3d fb 89 r ....^.c].\.b..6.#.... 0460 38 19 23 0e 0 a 92 44 28 18 b5 78 ...

!..Q...nMn.q%....dd 53 c8 84 6a 8 .$P..i.j 0470 72 c6 59 73 f 6 ca 24 50 f3 24 97 34 79 15 3b 38 r ... 0490 35 77 65 d5 b 0 21 fd 6b 75 16 69 d1 ad 7e 45 5a 5 we...1...~EZ 04a0 eb 9a fc 9d 2 8 10 06 43 a4 de 17 bc 98 cb 59 17 .x. .. .. .......dllstx01.8 0480 b7 2d 79 14 c 6 13 1e 14 9c 36 3f 58 dc 71 25 18 .Vv.cor exchange..$.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =30104 Win=45675 Le n=0 Frame 60: 54 bytes on wire (432 bits). .D(. ...K 0510 3a 1c 41 19 d c 51 87 13 b8 c5 90 71 c5 48 ca 07 : .)r_p..>.C...A.(..... 0520 81 5f .0 04d0 a1 8b 04 ef 3 a b1 bc b0 0e 17 b0 8a 17 38 27 dd . _ No...q....4y...v.. 54 bytes captured ...Y....8'..u...782255000 pc13.. 04e0 e1 97 56 76 e 8 d8 dc 18 95 c7 8f ac ca c8 c1 0a .:. . 04f0 a8 b9 75 12 e a bb c0 b6 e1 e2 6f 34 5a 6f 50 3a . 04b0 17 c7 3e f3 0 2 f5 bb e6 29 72 5f 70 0d 0b 31 f0 .).Ys..#.....6?X. 04c0 0a 9b 0e b2 7 6 1a f3 bc 1f 6e 4d 6e d7 29 89 30 . -y.S........... Time Source Destination Protocol Length Info 60 1..home cust-74-12412-138..ku.. ..H..o4ZoP: 0500 8e 0f 08 0a 0 a 0d 7b 45 4e a4 8c be d3 90 bb 4b ...{EN...

.....00018500 0 seconds] [Time since ref erence or first fra me: 1.. . = LG bit: Globally unique address (fac tory default) ... .... . .000185000 seconds] [Time delta fro m previous displaye d frame: 0..(432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.. .. ..832185000 s econds [Time delta fro m previous captured frame: 0.port == 80 || http 2] Ethernet II. 2014 11:26:5 4. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)..782255000 sec onds] Frame Number: 6 0 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . . ....0..0 . ... ...... .000 000000 seconds] Epoch Time: 141 5615214...832185000 Romance Standard Time [Time shift for this packet: 0... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..

.. Src: pc13 .1. ..1....dllstx01.. Dst: cust-74-124 -12-138. . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .... .11 ). ..... ..... .home (192.... . = LG bit: Globally unique address (fac tory default) . ............co rexchange.0......1 24. . = Differentiated Ser vices Codepoint: De fault (0x00) .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.com (74. ..... . = Reserved bit: Not set .168. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .. .0. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] .0 .. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f31 (20273) Flags: 0x02 (Do n't Fragment) 0..= IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ...12.... = Don't fragment: Se t .

. .......0.ho me (192. .. 0000 0001 0000 = Flags: 0x010 (ACK) 000. 0.. Ack: 30104 .. ...... . Src Por t: 49574 (49574). . . = Push: Not set ...... D st Port: http (80).. = Nonce: Not se t . . ...124.. ...1... .... 0 . = ECN-Echo: Not set .0... Seq: 1. .... = Syn: Not set ... . .. .. = Reset: Not se t .0 = Fin: Not set Window size val ue: 45675 ... .. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 30104 (r elative ack number) Header Length: 20 bytes .. .12. ..1 ....138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..168.. = Reserved: Not set ....dl lstx01.[Good: Fals e] [Bad: False ] Source: pc13.. 0. = Urgent: Not s et .. = Congestion Wi ndow Reduced (CWR): Not set ... .. .... . com (74. .......0 ..11) Destination: cu st-74-124-12-138..corexchange. .0. . = Acknowledgmen t: Set ..

. 0030 b2 6b 18 d4 0 0 00 . .. .dx... k..N.....852070000 cust-74-124-12138....[Calculated win dow size: 45675] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 59] [The RTT to ACK the segment wa s: 0.dllstx01.corexc hange...J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 d7 c5 50 10 .E.000185000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .....home TCP 1314 http→49 574 [ACK] Seq=30104 Ack=1 Win=46 Len=1 260 Frame 61: 1314 byte s on wire (10512 bi ts).P.. No. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.`n.. Time Source Destination Protocol Length Info 61 1.com pc13.P..+. 2014 11:26:5 .. (O1@.. 0010 00 28 4f 31 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .

. . ......4.. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).0..852070000 sec onds] Frame Number: 6 1 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .port == 80 || http 2] Ethernet II..... .......000 000000 seconds] Epoch Time: 141 5615214.. . . ..... . .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ...0 ..902000000 Romance Standard Time [Time shift for this packet: 0. . ..069815000 seconds] [Time delta fro m previous displaye d frame: 0. .06981500 0 seconds] [Time since ref erence or first fra me: 1.. .0.902000000 s econds [Time delta fro m previous captured frame: 0... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... .... = LG bit: Globally unique address (fac tory default) .

124.124......1. = Don't fragment: Se t . Dst: pc13.0... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. = Differentiated Ser vices Codepoint: De fault (0x00) . ...12....corexchange..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt...... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a9b [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.138).12... Src: cust -74-124-12-138..dllstx0 1..home (192 ....138) Destination: pc ....dlls tx01. . .168... = LG bit: Globally unique address (fac tory default) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf18f (61839) Flags: 0x02 (Do n't Fragment) 0. .co m (74.com ( 74. . = Reserved bit: Not set ..0 . .corexchange.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4....... .. ...1... . . ... .

..... Dst P ort: 49574 (49574).1 . = Reserved: Not set ... . .. ... = Push: Not set . = Acknowledgmen t: Set . ..... ... 0 . . . . ...13...... Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 30104 (relativ e sequence number) [Next sequence number: 31364 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. = ECN-Echo: Not set ........ .. 0.. ... 0. = Syn: Not set .. = Reset: Not se t .home (192.. . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = Urgent: Not s et ..168...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u .. ... .. . 0000 0001 0000 = Flags: 0x010 (ACK) 000.. ... . = Congestion Wi ndow Reduced (CWR): Not set .... ..... Ack: 1 .. . Seq: 30104. Src Por t: http (80)...0..0.. .. ..0 ... ..1.. . = Nonce: Not se t ... ..0..

Jk.u...8 0090 7a 50 5f 47 b a 70 65 e8 5c 0b a0 87 50 0c e1 89 z P_G. 0010 05 14 f1 8f 4 0 00 31 06 3a 9b 4a 7c 0c 8a c0 a8 ..j4*..`. 00c0 a5 4f 25 6a f 6 0d 6a 6e 6e ba 22 8e 0b 4b 74 62 .1...l 0040 4a 1d d1 81 b 3 51 00 6a 34 2a c2 80 86 1f 8c 9a J .H....D2.... ..... ... .Ktb 00d0 80 fc 77 aa 5 e 99 a5 29 2e e9 f1 ...:...E. `n.... 0080 7f f2 09 cb f f fb 92 04 ea 8f f3 0e 25 53 03 38 ..jnn..P.%S....".lR 0070 de a7 1c c4 6 7 e8 f1 77 3c bb 4a 6b 10 0e 75 a4 .P.\.. O%j....nknown)] Checksum: 0x458 9 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. 0030 00 2e 45 89 0 0 00 48 fc 60 99 80 d0 9b 08 94 6c .. 0020 01 0b 00 50 c 1 a6 2b c8 d7 c5 9e 87 4e aa 50 10 ...2.....xj........@. .j....N.E...H..A. 0050 60 5e 6a 3f 9 6 98 b3 5b 15 32 06 e9 44 32 bd 67 ` ^j?.|+$)D^#.P..J|..j..dx...(..w<.g 0060 36 16 2e 8b 9 c eb e4 48 18 08 13 59 c6 00 6c 52 6 .Y.. 00a0 41 73 13 6a 0 1 97 bd 28 be 97 41 fe 00 78 6a 0b A s...g.[...Q... . 00b0 88 b0 9e cd 6 a f3 7c 2b 24 29 44 5e 23 2e 13 d8 ..+.pe.. ...

. .p*9L. .6.q`n.L3u 01d0 bb 3f 04 69 6 d 14 e8 80 0a 4e d1 65 82 b2 5f 16 ..^z. ...x.B..Y. 01a0 ca a7 70 2a 3 9 4c c1 08 f3 5f af 79 d5 51 d7 9d .\M.' 0100 cd c3 ef e3 1 f 3e f3 7f d5 fa 66 52 78 2a a6 3a ..v...r. Fyu#HrgM....e..V.. 01e0 19 92 94 78 2 4 6c bf cd 4b 8f 1b a8 87 72 32 cd . d}..15... 0180 9f 32 ad 52 a c 4f 22 5d ed b9 41 e0 39 56 b0 57 .. 01c0 57 d9 5e 7a 1 1 f7 e4 77 49 b4 b3 6a 98 4c 33 75 W ...| 0140 db 4e fe 7b d 7 87 73 27 fd 34 7d 6f c4 5d 67 2b . ?.>.]g+ 0150 a3 cf 77 2b 4 3 b8 42 1f bd 72 00 92 27 ed f2 d2 .O"]. 00e0 49 b7 3d 33 e d af 4c c1 fe 4d 01 45 98 68 4e d5 I .*..d.W 0190 7b 94 bb 59 3 b 69 96 a3 07 97 64 a4 56 8a 36 ca { ...w.: 0110 9d 2f fd a8 a a 9d a6 dc 3b 17 72 c1 99 5a 03 ac ... 2...7d e9 c2 f8 8b .v([.].w...}. ...).s'. 01b0 b6 46 79 75 2 3 48 72 67 4d 8f 76 ba bc 86 44 ae .._..r... N... ..hN..6..S8I.5.R.9V..U 0170 84 64 7d af 2 a 88 21 cc 76 28 5b de 31 35 86 10 ..y..M...w. 0160 55 ff e7 5b d a e8 ca 78 e6 00 36 b8 8d 4a f4 55 U .j. h.A..=3.... .....Q.J.Z.(.E..wI.~._.{.N. 0130 83 91 e1 e6 7 e 0b 71 60 6e b8 77 af 0b a3 fa 7c .^...Q..fRx*.w+C.'. /... 0120 4e 54 c3 77 3 b 35 92 40 90 d3 51 8c c8 5d 9b 2c N T.. 00f0 02 68 1a 53 3 8 49 a5 df 06 5c 4d cd 28 d2 04 27 .4}o.L.@..im.!..[..D.i.

...S. ......1 0250 5d a4 6f aa b 0 9a 01 76 0f 02 28 bb 9c ab 60 a0 ] .`.. )(e.....r2..h..[< 02d0 94 b4 dc a6 7 a 9b 4a 1c db 27 22 a4 72 03 1f 37 .... 0200 fa 53 27 dd 4 c fc bf d3 74 bf 5c fa 72 7f 91 12 .t. ... 01f0 f5 c4 35 9b 8 d 34 6b 3f 8f dc 47 24 63 9c cb 9c ..)@ 0280 57 d8 59 18 3 9 e1 89 e9 65 f7 7f ed 1f 97 1b 55 W .S.r. 02b0 f1 29 28 65 1 7 87 46 6c 0a 75 ac a5 dc d3 9c a6 ....U 0290 0f d0 07 51 9 0 42 c7 b7 a2 7d 94 9b 7a d9 c3 4a .. ... ...'. ... S'.. .Q.bP`..Y.4k?.e....\. 0240 24 6b 89 9a a c eb 80 f4 89 b9 0e eb f1 bb b3 31 $ k.Fl. 02f0 dc 39 c3 f5 9 b 1a 97 ea 47 63 33 15 0a b0 69 82 ..E5..o.=........9.T.... 0220 65 2d 45 a4 d d d2 ff fb 92 04 ec 0f f2 dc 1f d5 e -E.z....H.t..J....r.. 0260 c0 84 23 00 4 2 6b e2 72 93 d9 82 7d 05 2c b0 5a ..z..Z 0270 46 65 2c a2 e 6 6f e6 eb 19 98 fa 45 35 12 29 40 F e...\..L..r... 0210 ca 86 5c d2 1 e f9 53 b3 54 eb a6 cf f1 b4 47 bf .......7 02e0 82 fe 10 98 5 1 75 22 a7 1a c9 aa 74 aa a9 68 cc .5.o... 0230 03 2c 62 50 6 0 c4 da b0 3d 8f 4a 0c 5d 0d 5c 0c ...G$c....`......Bk. 02c0 75 4b 23 58 f 8 60 fb ab 20 2c 6b 2f 11 ef 5b 3c u K#X.. ...\.}.].B.k/.Qu".. 9.J.'"...#...J 02a0 69 7d 5d 2f 4 6 c7 82 48 1f f9 f7 27 e9 53 d1 e6 i }]/F.Gc3...u.}.(..G.i. . ..x$l.........v..K.

K.y. 0340 9c 74 dd 74 6 2 17 d6 f4 62 f6 dc 5d bd 6a aa a4 ... . 0350 a9 52 c1 c6 1 e 37 0d 34 78 0a 1a 0a 11 3c 54 94 ...7...h&*.. -..3...@S8 0410 2c 41 b8 72 5 ..kA..ie...e. b'. 03f0 96 19 bd d9 d 5 91 ba ca 7f a3 f5 c4 42 c9 10 ca . 0330 1f 95 1f 68 6 9 84 a3 78 13 06 65 a2 5b e6 97 a3 .8t.@.b..=...-.B. .8Lh.^cZ....b.R.X...4x.[.`F~.d...y.K..." .<. %..!.#.x..V...Pk..].. 03e0 5a 0c 30 6b 8 1 83 95 6b 41 84 a1 30 17 09 33 a6 Z .j.9 0370 57 af 0d f9 2 2 20 aa 77 56 d1 94 9e 64 80 09 06 W . 03d0 51 58 01 e8 1 a f2 5e 63 5a f0 3c c9 38 4c 68 f3 Q X.. 03a0 05 62 27 be 2 1 87 d1 7b 7a cb 38 74 b8 b1 1c c5 ...}..?....6Y....hi. 0320 55 b4 c0 56 0 f a1 a2 50 6b b8 b8 49 0c 4b 13 c1 U ......%.0..@.... 0380 4e e5 65 0b 8 5 1c 16 40 15 e1 24 7c d8 2a 99 1b N ....]"..{z..0300 a1 25 01 8b 3 d f2 d9 61 c7 4b 09 5d 22 ee 25 18 .... t..$|..a.... . . 0400 5f 64 80 e2 9 8 92 84 b2 1d 27 02 79 11 40 53 38 _ d.wV........ R...i.I. 0310 3d d2 40 d2 d 1 aa 52 ad 80 d5 a0 11 fc 83 19 13 = ...'.. ...*..tb...^.. 0360 1a 96 89 1e 5 8 d6 02 79 d0 69 e1 a5 2d c1 b2 39 ...e. 03b0 b5 2d ed 60 4 6 7e 9f 7d 9b 5e f0 23 ee 8e 7f ef .....0k. 03c0 ce b8 68 26 2 a e1 62 f2 ff fb 92 04 e8 0f f2 e1 ..... 0390 8d 19 06 3f 8 c e6 97 86 98 69 65 94 ad 36 59 02 .<T..

i.V.. A......L<.....Q5..R&&..[Ba?.. 0460 c1 88 42 40 2 9 1e 42 ed cd 81 52 26 26 1d ca e9 .... 04b0 3f 8b b4 91 d 8 84 50 9a e0 82 81 8d 28 63 2b 59 ? .. 0470 c9 64 55 63 4 8 f0 8c 5b 90 a4 3c f4 3c 6a 4f 10 ... ).W 0510 26 0c a9 98 2 6 72 c0 03 94 05 d4 b4 d1 00 02 b0 & ...*.<jO..a.k... 0430 11 dc 4b 5c 7 9 7a 19 f3 f1 c3 7b b5 17 65 a7 6d .... 04a0 96 44 48 08 b 3 41 0b 08 30 f1 b1 6b dd 14 56 9e .N..c.SQn.r. 0520 a5 81 . 04f0 6f 1e 63 3b 6 b 43 5b fb 73 f3 ba e6 b3 27 90 24 o .&Er..B@)..B.O.t..Wn..U. dUcH....V. 0480 85 89 4c 3c 1 a 92 5b 42 61 3f 2e e3 d9 79 67 55 ..s....`.f=RJ... A.m.&r. . #.ygU 0490 d8 29 af fb a f 1f 55 1e 6b ec de 53 51 6e e4 b3 .. DH.....i........5......P..A.K\yz.<0VXU.rV..... 0450 ea ed 4f f4 3 5 d4 01 99 eb 26 45 72 1c 0c 69 80 .. . {. 04d0 f0 97 07 72 b 9 cd fb b9 44 d1 e2 8c ac b0 fa 0e .. .0...[........k. 0420 04 23 8f 6c 7 b 48 d3 d7 f6 61 87 d7 1b fc ba f2 .. .{.kC[.e.D.$ 0500 52 d4 82 ce 6 0 ab 80 db 77 b5 4e ac ab af d1 57 R ..w.N... ..(c+Y 04c0 8b b9 3c 30 5 6 58 55 07 2a b9 fb 10 bb c7 56 1c .<. .m 0440 76 61 3e 55 6 f 0c 20 7b dc 00 57 6e a6 51 35 17 v a>Uo...l{H.'...n<.. 04e0 1a 41 06 ac 6 9 96 a5 d5 12 eb 86 6d be fa 74 14 .6 ed 66 3d 52 4a a5 4e e5 6e 3c 09 .

corexc hange. . No.072622000 seconds] [Time delta fro m previous displaye d frame: 0.com pc13.000 000000 seconds] Epoch Time: 141 5615214. Time Source Destination Protocol Length Info 62 1.. 2014 11:26:5 4.974622000 Romance Standard Time [Time shift for this packet: 0.home TCP 1314 http→49 574 [ACK] Seq=31364 Ack=1 Win=46 Len=1 260 Frame 62: 1314 byte s on wire (10512 bi ts).974622000 s econds [Time delta fro m previous captured frame: 0. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.924692000 cust-74-124-12138.dllstx01.07262200 0 seconds] [Time since ref erence or first fra me: 1.924692000 sec onds] Frame Number: 6 2 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule .

. ..138). ..corexchange...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 . .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..port == 80 || http 2] Ethernet II. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ..co m (74..... . ..... . Src: cust -74-124-12-138.. .. . . ..... .... ..... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).dlls tx01.168. .. .... = LG bit: Globally unique address (fac tory default) .. = Differentiated Ser vices Codepoint: De fault (0x00) .. .. . .. ..... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. Dst: pc13..home (192 .... = LG bit: Globally unique address (fac tory default) ..0 .1...12....... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .....0 ...0.0....String: http || tcp .124.. . .. .

.home (192..12. = Don't fragment: Se t . ..Identification: 0xf190 (61840) Flags: 0x02 (Do n't Fragment) 0. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 31364 (relativ e sequence number) [Next sequence number: 32624 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ..1... Ack: 1 .corexchange.1...dllstx0 1... Seq: 31364. .0. Dst P ort: 49574 (49574). = Reserved bit: Not set . ... .124. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a9a [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138... = Reserved: Not set ..138) Destination: pc 13.. Src Por t: http (80)..com ( 74.168... .. . 0000 0001 0000 = Flags: 0x010 (ACK) 000.

. = ECN-Echo: Not set ...N.... ...... . .. . . = Congestion Wi ndow Reduced (CWR): Not set .. .... = Reset: Not se t ..]1. .... ....... .P...0. ..0.J|.. . = Nonce: Not se t .....E... = Syn: Not set ... .. ....P...... 0 .1. .. .^.....:..1 ... .]5. = Acknowledgmen t: Set .. .0 .. 0. .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x6de 5 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2520] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. 0..+..... `n.. .. 0010 05 14 f1 90 4 0 00 31 06 3a 9a 4a 7c 0c 8a c0 a8 ..Yp 0040 f1 9b 5e 2e 9 1 a8 43 53 24 05 10 5d 31 17 d3 3e ...@... ... .CS$..... = Urgent: Not s et .0..dx....... ... 0020 01 0b 00 50 c 1 a6 2b c8 dc b1 9e 87 4e aa 50 10 ... . = Push: Not set . ....m. 0030 00 2e 6d e5 0 0 00 85 ec c4 5d 35 8f e0 c4 59 70 .> 0050 2b a9 5f 37 0 b 68 ab b4 76 b8 b1 b1 1b 28 b8 74 + ...

T..}.. 00c0 6d 90 79 28 2 3 d0 1b 4d 2a c8 c2 f1 a9 70 c9 63 m .V .=.s 00e0 1b 31 74 5f d 5 34 c4 ca da c4 89 0e b1 54 cc 59 .@.e.. 0120 09 bd 16 9e 0 6 dd ee f5 57 b8 29 85 22 ad 8a 1a ...]vi...t 0060 8d a7 8c f5 8 8 f9 5d 76 69 1f 6f 3a d4 16 2c 6b ..'....W..] Z 0110 4c e4 8f f7 c a 0c 0a b2 21 15 7f 08 13 18 50 9a L .R.As.N.. 0090 65 ec 4a 0b c 0 9f 4e 0d 3d 89 41 73 14 6a 01 97 e .."...4..c 00d0 7c 75 6c 59 4 f 56 f4 22 ec 43 d9 eb 45 a3 d5 73 | ulYOV.E. 0080 92 04 e7 8f f 3 01 27 d4 03 4f 62 50 59 04 ea 90 . (". .../o..(..."..g...!. 1t_.].L 0150 f5 1b 65 b6 2 f 6f ee fb c2 b6 66 76 6b 91 dc cc ..p.....j.r|. ..y(#.k 0070 77 8b bd 69 f b cd 31 c2 e1 67 90 53 02 cf ff fb w ...VUS%....G5A.fvk.Y 00f0 56 66 98 5c d e 2d 37 e9 4a ea f7 a7 cd 7e 6f b8 V f. 00a0 b1 28 22 89 4 4 de d1 5d b1 7d c5 d0 c4 c3 40 9b ... ....h..M*......D...v.-7..o:.s' 0140 5b 89 28 1c 1 6 f5 c7 4e 14 f7 e0 80 72 7c c4 4c [ .. 00b0 83 b4 f4 54 0 e 1d ba 85 91 56 55 53 25 e0 dc 9d ...S._7......P. 0130 52 56 05 c2 b 4 fd 47 35 41 95 41 5c 2a 85 73 27 R V..i...1. .(... 0100 ce 60 c8 b9 b 2 52 e2 46 af 56 20 ab 96 5d 20 5a .C.......7 ....J.T. `..\..).~o.. ..m0M6. 0160 4f 2a 79 41 6 4 a0 87 b2 4a 84 6d 30 4d 36 aa 37 O *yAd.....F..J..J.N.......A\*.ObPY...

. ~....fW 01f0 c1 63 d9 e8 a c 3f a4 b7 92 84 de 3e eb 3c 38 b0 .....v 01c0 4d 76 24 24 2 f 43 07 7b a8 fd bf e8 81 4a a6 c6 M v$$/C....E.L. pe.. 0240 c1 9c 31 30 c d 25 6c 42 5d 5b 5f 29 d0 b0 a3 a7 ....ww.....10...B...f......>. 01a0 98 ea 91 d2 4 1 fe d2 23 c7 b7 93 99 18 ae 53 58 .#G...I.J....u. 0250 4c f5 81 41 0 0 e1 cc 0c 90 20 54 74 a0 70 e0 c1 L .............T...<8.. d. 0200 9e c0 28 ad b d db 78 ae ec de c7 bd 45 c6 f5 69 ..I+#...... 0260 0e 96 94 20 7 e 05 94 45 7a b9 cd 54 cc 32 0e 55 .u.....A..T... .. 0190 e1 64 d2 85 a 2 fb c2 e3 92 9a a1 da 03 b7 54 d2 ..(..p._.. 01e0 8b b5 49 2b 2 3 17 66 d0 f1 74 fd a9 3a ba 66 57 .. .....OzPa....1.N.....b..t.A.m 0220 ff fb 92 04 e c 8f f3 22 28 53 83 4f 7a 50 61 c5 .{."(S..1. Tt. .. %.SX 01b0 e7 1b ee 82 b 1 77 77 e4 0f 3b 49 bc d6 75 fa 76 .U 0270 f6 06 d7 a7 c a 75 b8 62 1f da 97 b5 1e 05 e9 46 .. ... .i 0210 62 6e d8 c6 3 1 f2 ea df 58 ce 7f dd b3 f3 e0 6d b n.... . .#...?.:..0170 d1 25 01 7e a a 31 00 cb 0c cb 15 8d 95 cb 5f f6 .Ez. c.e#.~. 01d0 68 08 50 96 d 8 ca 08 03 02 65 23 02 01 23 47 e9 h ........ ..X.x..=LZ.F 0280 aa b3 fb d6 c ..2...... ..P.%lB][_).. 0230 8a 70 65 ef 4 c 0b 90 b1 4e 0c bd 89 81 8a 17 e9 ... 0180 1e 96 10 bb 3 d 4c 5a b2 a7 a0 98 8e e4 42 fc b1 .

...U........"..H..W.. ..... ... .().T... 0380 a8 99 c5 3c 8 7 38 b5 5d 8a ca f9 d4 a8 b4 22 bb .2.A..m@^....8. 0330 2a 1e b3 66 0 6 6e f1 aa 21 84 6e 2a 5c af 90 e7 * . "5. 0300 76 7f fa df 9 d 38 0e 32 f8 70 5b fa 55 d1 d2 d4 v .h 0360 c3 4b 28 b0 7 6 32 98 59 ee 6d 49 f1 4b 3c 82 60 ..!.Y.....e....n*\....x6 0290 7d 06 06 f5 6 5 e7 d5 d4 6a db 18 b5 66 00 b5 85 } .K<..4...<..j. 0310 04 30 83 3a 3 7 96 28 29 09 02 41 8e 8e 9c a9 64 ..S..x....S.c 34 cb 9d a5 78 fa 6d 59 86 78 36 .UA...c....... ^... .<...p[. 0340 53 40 75 59 5 8 62 49 5d b1 63 c6 b5 95 54 8b 79 S @uYXbI].. 02f0 ca c5 0b 06 e f 22 ab 98 e8 a5 f6 ab b5 5e f2 af .mI.G..... 02d0 8c b3 c4 4b 2 b 10 c8 47 c1 d8 a0 53 de 80 1c 10 .. 0390 76 94 14 c3 2 5 42 7f 96 70 62 42 .c."..y8.@ 02c0 40 a5 ec 47 9 a 99 c4 70 4d 6c a7 6e 29 b3 b8 cc @ .m......v2.f. 02e0 0d 20 8a 64 2 c 2c 6d 40 5e b4 99 63 c9 a1 a4 c4 .` 0370 14 e6 ff 87 d 7 00 13 53 14 9a 14 c2 02 1e 48 c2 . 0......:7.x...].d.f..mY..n).n..(. .pMl.K+... .y 0350 99 5e ea 06 7 3 aa cf 78 17 85 8f bc 79 38 a8 68 .d 0320 24 54 e6 a9 6 d 97 3c b1 78 e5 0a 12 a8 2e b1 a7 $ T.. 02a0 c2 22 35 18 2 8 90 f9 57 8a 80 e8 cf ff 86 f5 b9 ...^.8.. 02b0 05 81 e6 1f 4 0 1a 21 43 20 4a c4 e7 55 41 e0 40 . ..!C J.. K(...@..s....G.x..

4..$ .*..&..uA. 0440 6a 78 ad b1 c d 75 b2 4f a2 8f f5 16 00 05 91 1d j x..s%..-xm..pbBU....P.p......w...n.. .. .../T..K 0420 43 4f 52 48 1 9 50 ac de 6c f7 74 db d6 56 18 0f C ORH..`.u........ ... 03e0 13 e9 c1 9c 3 d 28 f1 40 e6 8b 3c ab 38 00 ca 4a .l...... 0400 c6 e0 5c 18 a 2 c8 01 6a a5 26 2e 8c 2a 38 93 a5 ..... 03c0 e7 b1 ff fb 9 2 04 e9 0f f2 e7 2f 54 03 4f 7a 60 .....4. 0470 08 ac ca 91 c 4 8e 34 cd d1 07 73 25 d2 59 06 84 ...55 2c 26 1d 62 v ... ... 'i...9.pi.p...".. 0430 61 c4 cd 23 b 5 b5 e6 d6 8f 9d f9 60 b5 b7 eb ff a ..N... .<..%B. 0450 13 27 69 01 8 c 1e 65 5d 89 02 11 97 24 20 d3 5b ..O...t. . OR..=(.\..w.........m.c.$..e]..Wqn.. 03b0 7b 6f 9a 6d 9 a b9 f6 ce b7 96 07 c1 77 0c 9e d4 { o.Y.V.*8....g....J 03f0 f1 dc 70 f0 a 8 8a 88 88 da b6 08 63 1b 24 bd d1 .:. 0410 0d f1 fa 70 0 9 99 9a a9 89 22 ac 3a 05 85 01 4b .J.....VT 0490 dd 18 2d 36 e 3 ed 67 d4 2d 78 6d cd 15 7f 39 f8 . ...[ 0460 47 62 18 d6 3 4 8f 75 41 b4 77 80 ad 6c 99 e6 2c G b.-6..&.8......8..j..<..Oz` 03d0 62 44 fa 70 6 9 ef 4a 0b f8 c5 4e 0d 3d 29 81 7f b D.. 04a0 27 97 59 7b 7 9 b5 d7 d7 b7 45 5b 32 c2 9f 2f ff ' ..#.l.@.b 03a0 d7 4f 52 ef 1 a a1 57 71 6e cc e1 2e a1 38 b6 c0 .=).. 0480 45 dc 07 05 6 e 90 b8 3c d0 93 9f 2a 88 c4 56 54 E ..

v\.e. w. ... 04b0 51 d0 65 93 f 5 91 78 48 98 06 a0 c3 9a a2 ae 52 Q ....-.c... ...... Time Source Destination Protocol Length Info 63 1.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =32624 Win=45360 Le n=0 Frame 63: 54 bytes on wire (432 bits).F.u....F.h...924873000 pc13.)...Gi... Z./... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.Y{y... 2014 11:26:5 4.home cust-74-12412-138.%w 04f0 19 ed 19 1f 4 6 be 68 f2 0c b8 a7 cc 2d e2 5b 45 ...cor exchange.974803000 Romance Standard Time [Time shift for this packet: 0. 04d0 a3 3c 18 59 9 5 2c 2d ce 47 69 03 76 5c a4 c0 c7 ....R 04c0 c1 5a 96 86 7 5 11 b0 63 aa 32 ae 20 ce d5 a5 10 ..*d.974803000 s . IBH.2.000 000000 seconds] Epoch Time: 141 5615214.. <.E[2.. 0510 ba 49 42 48 c 6 f7 09 a0 2a 64 81 03 09 2b 79 88 ...+y.feGk...xH..... 04e0 59 42 e9 46 1 7 fa 91 ba 66 65 47 6b 89 16 25 77 Y B.[E 0500 ff 77 bd 31 e b f5 bf a8 2e 13 8e b2 29 a3 b7 fe . L No. 0520 08 4c .Y..-..dllstx01...1.

.. ....... . . ...0...924873000 sec onds] Frame Number: 6 3 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . . = IG bit: Individua l address (unicast) .. ..... ...port == 80 || http 2] Ethernet II. .... ..0 ...0 ... ......0. = LG bit: Globally unique address (fac tory default) .. . = LG bit: Globally unique address (fac tory default) .... .. ..00018100 0 seconds] [Time since ref erence or first fra me: 1... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . . ..... . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .000181000 seconds] [Time delta fro m previous displaye d frame: 0...... ....econds [Time delta fro m previous captured frame: 0. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). ... . .. ........ .

...dl lstx01.. = Don't fragment: Se t ..124.. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13....corexchange.ho me (192.0. = Differentiated Ser vices Codepoint: De fault (0x00) . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.168.. Dst: cust-74-124 -12-138.com (74.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol...11 ). Src Por t: 49574 (49574). Src: pc13 ...co rexchange. com (74.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f32 (20274) Flags: 0x02 (Do n't Fragment) 0. .. D . .1.138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt...12..dllstx01.12.1.home (192..11) Destination: cu st-74-124-12-138. = Reserved bit: Not set .Type: IP (0x080 0) Internet Protocol V ersion 4.1 24.168.1.

.. = ECN-Echo: Not set . . 0000 0001 0000 = Flags: 0x010 (ACK) 000.. ..1 . . = Acknowledgmen t: Set . .. . Seq: 1...... = Syn: Not set ... ......0 ...... 0. . = Nonce: Not se t ......... .. ... ... Ack: 32624 . . 0.... .. . = Push: Not set .....st Port: http (80)....0.. . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 32624 (r elative ack number) Header Length: 20 bytes ..0. ..0. . . ......... .. = Congestion Wi ndow Reduced (CWR): Not set .... = Reset: Not se t .. = Reserved: Not set ... .... 0 .. . = Urgent: Not s et . .0 = Fin: Not set Window size val ue: 45360 [Calculated win dow size: 45360] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an .. . .

000181000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .00419600 0 seconds] [Time since ref .978999000 Romance Standard Time [Time shift for this packet: 0. ....`n... 453 bytes captur ed (3624 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..N...dx.+. Time Source Destination Protocol Length Info 64 1. 2014 11:26:5 4..004196000 seconds] [Time delta fro m previous displaye d frame: 0. ACK] Seq= 32624 Ack=1 Win=46 Len=399 Frame 64: 453 bytes on wire (3624 bits )...dllstx01.corexc hange. 0010 00 28 4f 32 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .P. 0.... No..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 e1 9d 50 10 . ...P. 0030 b1 30 18 d4 0 0 00 .ACK to the segment in frame: 62] [The RTT to ACK the segment wa s: 0.000 000000 seconds] Epoch Time: 141 5615214....929069000 cust-74-124-12138.com pc13.home TCP 453 http→49 574 [PSH.978999000 s econds [Time delta fro m previous captured frame: 0..E. (O2@...

..168. . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. = LG bit: Globally unique address (fac tory default) . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . Dst: pc13. ......... .0.....1.. . ..... . .co m (74..0 .. .124.. .138). Src: cust -74-124-12-138... ..... .. . ..0.... . .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4... . .. ...... .0 ........12.corexchange..11) .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .929069000 sec onds] Frame Number: 6 4 Frame Length: 4 53 bytes (3624 bits ) Capture Length: 453 bytes (3624 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .port == 80 || http 2] Ethernet II..... ..... . = LG bit: Globally unique address (fac tory default) ..dlls tx01..home (192 .erence or first fra me: 1. .

.. = Differentiated Ser vices Codepoint: De fault (0x00) . Seq: 32624.1. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3df6 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..124. = Reserved bit: Not set .. Len: 399 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: .Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. .home (192.168... .com ( 74. . = Don't fragment: Se t .. Ack: 1 ..corexchange.dllstx0 1.. Dst P ort: 49574 (49574)..138) Destination: pc 13.. Src Por t: http (80). ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.0.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 39 Identification: 0xf191 (61841) Flags: 0x02 (Do n't Fragment) 0..12. ....1... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.

.0...0] [TCP Segment Le n: 399] Sequence number : 32624 (relativ e sequence number) [Next sequence number: 33023 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . . = Push: Set .. . ... = Urgent: Not s et . ... ......1 .. . .. ....... = Congestion Wi ndow Reduced (CWR): Not set . ...0.... 1 . = Nonce: Not se t . ACK) 000.. ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x3d9 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 399] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 . ..... ... ... ... ....... . ...0 . = Acknowledgmen t: Set ... = Reset: Not se t . .. 0. = Syn: Not set ...... .. 0000 0001 1000 = Flags: 0x018 (PSH.. 0..0. = ECN-Echo: Not set .. = Reserved: Not set . ..... ....... . .. .

.N.E...j...`./zP_. 0080 27 53 83 2f 7 a 50 5f 85 8a 70 65 ef 4c 0c a4 c7 ' S...P..+u.+..}.LVo...E.D.1.2 0060 b6 2e 9f ee 7 6 18 38 72 89 46 49 35 12 d9 79 67 .q..8r.*....Y %....&.= 0050 15 06 5b 0b c c 8b a0 de 54 3d ac 27 d7 9d ce 32 ...2...yRE.@...*.0.}..x.'.X... . $CB..pe.{..W$J.. ....a|. . .R..... .T=....=.... .uLJ.=. 00d0 11 c4 cc 59 2 0 25 90 96 4b 8c 02 c4 96 7b ac c4 ....L. 0010 01 b7 f1 91 4 0 00 31 06 3d f6 4a 7c 0c 8a c0 a8 ..=+. 0100 2c 01 78 2c 2 a e6 45 d3 6a 0b ff a1 34 08 58 18 . .P..... 0020 01 0b 00 50 c 1 a6 2b c8 e1 9d 9e 87 4e aa 50 18 ..& 00c0 00 24 43 42 d e 96 e4 ad 0e 61 7c af 52 cc cd 04 ..... ... .). 00e0 bc 8c 79 52 4 5 d3 1e e3 2b 75 16 75 4c 4a c3 a3 ..v....J 00a0 4a 05 1e 26 1 a e9 0f 5f 47 d0 93 89 a0 73 e9 98 J .yg 0070 39 7c bf cf 4 c 56 6f 8d ff fb 92 04 e8 8f f2 c5 9 |..dx...s..[..4. 00b0 e2 ad 60 b9 a 8 05 8f a2 f8 e8 c3 b0 93 58 e3 26 ..e1 08 00 45 00 .._... 0110 5d a6 05 78 c 1 83 02 41 81 18 50 c8 05 11 13 31 ] .X.....K. 0090 4c 0d 3d 2b 8 9 81 17 a9 c1 97 bd 30 e7 18 94 4a L ......._G..).. `n. 0040 d5 67 aa 02 2 4 23 b1 b5 29 2c 57 24 4a 8c e7 3d .....FI5. g...J|... 0030 00 2e 3d 94 0 0 00 09 0b 89 29 f7 2a 08 df 32 9b .. .$#.. 00f0 cc c1 71 91 f 6 7d e1 7d fa 44 ad 7f d7 c4 5f 0e .

rJ".Rd.8Ld~.+C....6...x.UZ..3"..... .TG.q 0160 c8 4b df 14 7 2 f6 fe a4 26 0c 1c 36 f5 cc 09 71 .6.m1 01a0 91 7c 3c 4e 9 e 4b 94 17 52 64 8b 1d 8a 8a cf cb ..B NnQ` 0130 29 19 34 e2 a 2 30 15 4b 6f e3 38 4c 64 7e e0 d1 ) .v. 9.......corexc hange....com pc13.....T@.6 01c0 e5 11 76 8f a e . Time Source Destination Protocol Length Info 65 2........ a..4. |<N.. ... 01b0 3c fc 62 a1 a 9 cb d5 f8 e6 d4 b2 a9 33 22 04 36 < .&.*X....X 0150 fb 61 cf 87 5 4 47 0e 55 5a b8 fd d6 c5 3f b4 71 .?#l 0180 72 40 09 d7 3 6 07 23 59 99 be 03 01 b8 0f d2 fa r @. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B ..r.Ko...q 0170 a1 e3 a1 d5 f b c4 91 85 b3 1c 8a 3a b1 3f 23 6c .125081000 cust-74-124-12138..1 0120 af 02 72 4a 2 2 11 11 0b ee dd 42 20 4e 6e 51 60 .. .home TCP 1314 http→49 574 [ACK] Seq=33023 Ack=1 Win=46 Len=1 260 Frame 65: 1314 byte s on wire (10512 bi ts).....?..dllstx01... 0140 c4 0b 0c 48 2 3 3a 59 34 0e 2b 43 c2 a4 03 91 58 . No..0.P.A.#Y.H#:Y4... .... K.K......:..b... 0190 8e 39 15 d2 b f 9c 2e 2a 58 9f 54 40 b1 b0 6d 31 ..

.. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 . ...125081000 sec onds] Frame Number: 6 5 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . ..175011000 s econds [Time delta fro m previous captured frame: 0... ...0..175011000 Romance Standard Time [Time shift for this packet: 0. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). .19601200 0 seconds] [Time since ref erence or first fra me: 2. .... .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .000 000000 seconds] Epoch Time: 141 5615215. 2014 11:26:5 5...196012000 seconds] [Time delta fro m previous displaye d frame: 0. = LG bit: Globally unique address (fac tory default) ... ....-440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.....port == 80 || http 2] Ethernet II... .. ...0 ...

. ... ..dlls tx01.. ... ..home (192 .... . = LG bit: Globally unique address (fac tory default) . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...168. ...co m (74.0. ....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf192 (61842) Flags: 0x02 (Do n't Fragment) 0.1... Src: cust -74-124-12-138.1.b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .....124... . ..0 . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a98 [validatio n disabled] [Good: Fals e] [Bad: False ] ..0....138). Dst: pc13. ... .. . .......... = Don't fragment: Se t ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt... ..corexchange. = Differentiated Ser vices Codepoint: De fault (0x00) ..12. = Reserved bit: Not set .

Source: cust-74 -124-12-138. Src Por t: http (80). . = Urgent: Not s et ... .. = Syn: Not set .124... ....... = Nonce: Not se t .......0.0 = Fin: Not set Window size val . .. ... .0... .. ..... . = Reset: Not se t .. 0. .. . . 0...138) Destination: pc 13..... = Push: Not set .12...home (192. 0000 0001 0000 = Flags: 0x010 (ACK) 000. = Congestion Wi ndow Reduced (CWR): Not set .corexchange.0. .168.dllstx0 1. ... .... . = Reserved: Not set .. = ECN-Echo: Not set .... .. Dst P ort: 49574 (49574)..... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. Seq: 33023.. .. 0 .1 . . .... .....com ( 74..1.. Ack: 1 .. . .... . = Acknowledgmen t: Set ..0 . Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 33023 (relativ e sequence number) [Next sequence number: 34283 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ...

.P..P.... x..:....J|.0P 00b0 c0 a3 81 b7 a 4 5d 6c 39 f5 a3 ad 06 01 8f 1a fa . 0050 ad 17 16 00 3 8 ba 6e 3d 21 b5 4b 2a 95 74 43 11 .... `n.N....8.tC...P.. 0070 eb c3 ef 52 c 5 5f 50 66 8e 4d da 73 63 dc 4f ed ..K*. ..@. 0080 b9 20 e3 54 a d 37 de a1 6e 0a 80 ff fb 92 04 e8 . . 0020 01 0b 00 50 c 1 a6 2b c8 e3 2c 9e 87 4e aa 50 10 .u.pi.L 00a0 0b 78 bd 50 0 d 3d 69 81 75 17 69 c1 a7 a5 30 50 .dA 0040 39 a1 05 4b 0 7 d3 50 c1 18 13 25 96 28 e4 28 b7 9 .E. 0060 0e 23 e9 95 1 8 f6 31 98 2c 09 4d 63 0f f6 d5 15 .1...]l9.. . ..ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x661 5 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1659] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .Mc.... 0030 00 2e 66 15 0 0 00 52 81 83 c6 1a 19 b1 0a 64 41 .. ..i...(.. #..K.. .(.Oz`a.f.. .n=!..O. .M..R. 0090 8f f3 07 2b 5 3 83 4f 7a 60 61 e5 8a 70 69 ef 4c .dx.1._Pf...........P.7......+S..sc.... 0010 05 14 f1 92 4 0 00 31 06 3a 98 4a 7c 0c 8a c0 a8 .n.R...+.%.T.. 00c0 84 c4 62 82 3 ...=i..

. ...TQ 01d0 77 4a 12 70 5 3 aa de ba ea 5d 8f ... 0160 72 72 5c 39 4 b 13 32 e5 d4 6b df e6 2e 7c 3a 1d r rK. 01a0 f8 09 b3 43 d 6 18 3c b6 9f 95 44 61 07 9f a3 14 .Y..J..~ 0100 cf 87 9f 0c d 0 77 6f 7a ea b5 84 b3 35 be fe b3 . 0140 b1 3c 1f 38 9 4 13 d5 31 77 43 58 75 0c ee 4e 1b .... ). ..=..If.>T>O.. 4r." 00f0 2f af a0 b2 7 9 1a f4 79 3c 16 eb 59 54 7d c5 7e / .[BAr2.......2.z`..\m...y]... 0120 20 05 01 ef 2 2 85 19 5c 8d 26 a8 09 8e 00 a0 9e . .. 0130 12 29 f9 1b 4 9 66 13 0c 7a 60 98 fb a5 a2 79 e2 ..N.... .<.. j.&ki.1wCXu..H...woz..y. 0190 a6 6a e4 c5 a 0 ce 26 d1 3b 4a d5 65 d3 95 66 a0 ....y.+H...e..K+. ...".../.. .\.. 0170 49 85 80 86 5 0 b3 65 ca 07 a8 b6 c5 a7 a0 32 c1 I .P.5C.........z....5..C... <..e.. 0180 08 c7 2b 48 8 a 18 d3 26 6b 69 a2 28 63 3e 9d a1 .k.QyRjk 01c0 9b 0a ff b7 f 5 be 2f ef 7a b3 33 35 97 e4 54 51 ..35.&.w...&.. 00d0 d0 11 95 4b 2 b c0 73 3c d7 a0 9e 79 5d e9 16 7b ..|:..b.(c>..8. 0150 57 8d 86 5b 4 2 41 72 32 cd a5 3d e0 a8 77 f6 ad W .s<.5 43 1f b2 eb b1 11 3e 54 3e 4f 96 ...... 0110 4b fb 7d 62 7 f 3c f0 fb 06 05 d7 ab a2 94 78 1d K ..}b.<.a.. 01b0 c4 34 72 08 9 1 b9 5c 6d 9d f4 b0 51 79 52 6a 6b ..YT}....x...2.{ 00e0 0b c1 c8 18 a 2 bc f4 ad 61 9c 59 0a 48 bb 8f 22 ...Da.. ....y<..f.

.jL.pS.OzPb.... 02c0 26 22 4a 58 5 1 22 2f 59 11 40 20 90 b7 45 40 61 & "JXQ"/Y. N:......`e 0240 ef 4c 0b d4 9 f 4e 0c e1 e9 41 70 96 29 c1 9c 31 ....._r... L.. 0230 04 e9 8f f3 0 6 27 53 83 4f 7a 50 62 c5 ea 60 65 .....s.N... t<..s%..3....N.. 01e0 0c 05 33 8b 9 5 58 91 33 f2 05 4e 99 af ed dc e7 ..w..1 0250 30 f1 fe fb a c e3 22 94 b2 f5 27 5c 53 92 87 04 0 ..m..d..E@a 02d0 1f 41 b1 b3 2 d 4c 31 91 9b 9c 40 22 b9 5d 65 33 .... z..2~.11 9c c4 71 d5 w J......X. .@ ...q... 0270 b9 25 8c 72 8 8 c0 fb 62 47 b0 97 1b 2b c6 ca b0 ..+}.WLf.. A.... .%.A..G/. . 0260 4f 01 90 8d 4 8 02 ee 15 41 09 00 bc 4a 00 c1 81 O ..g.Q.r...$ 02b0 0e 0a da b6 5 1 df a7 67 b9 6d e0 88 01 92 e0 0e ...'S..3..Ap.t..H.. ..>gw$ 0200 eb 7a 0c 84 2 b 7d f9 89 9a 74 00 d8 26 a0 e3 41 ...U. .bG.@"..%.).".3 02a0 b6 fa cb aa c 0 64 c4 f9 f7 bd 25 d8 00 f1 e2 24 .&.. .I>M.'\S..].... ....[u 0220 9b 74 3c a7 5 7 4c 66 92 d5 db 25 8c 55 ff fb 92 .+...J....A 0210 e5 f2 49 3e 4 d e9 6a 4c 95 73 25 c7 87 f7 5b 75 .. 0280 f1 91 c1 e1 e c b2 5f 72 2e 77 80 da fc c1 08 d4 . 0290 ac 90 db 17 e b 17 de 2e 73 a8 13 32 7e d4 e7 33 ...-L1.... 01f0 14 4e 3a cd 2 9 ca 0b 47 2f 80 de e8 3e 67 77 24 .. .]e3 02e0 1e 42 10 2e 8 c c7 ec 6d 09 a1 b9 1d 7c 3c b9 89 ..)........ %...

....".x. 03c0 19 ef 9a ed f e 87 b3 93 9d f5 c6 af 33 f7 af ff . 0350 89 21 24 55 f 9 20 3e 83 1f 10 71 3a dc 0a bf a6 ....fv@ 0330 62 10 30 e6 6 1 92 42 f8 f5 8c a3 5b 43 6c ad 4a b .n..~j...YS...:. .a...F. 0370 14 6f d5 e9 a a 6a 29 c8 62 ad 13 38 06 1b 16 c4 .m... .(.e.L.....=.P... ..|<..b...6... >.. 0380 24 d0 46 ad b f 11 06 50 a6 1b 2a 7f 1a 29 01 70 $ .j). ...x.0.6..3....Nno@ 03b0 5c b3 4b 3a d 9 f4 79 66 20 3e 4a eb ae 3a cb 0b \ ......=.... .@E.$.3..j.yf >J. . `.... 03f0 a7 bd 28 4f c 7 9c 78 9d 3d be 94 24 92 84 33 d3 .Q... 03e0 70 69 ef 4a 0 c 40 b3 4c 0d 3d 89 81 65 91 29 c1 p i..z.......J 0340 aa dc 1a 4f 8 1 bd 3b 2d b0 f4 9f d6 48 fd 8b c2 ........ .|....(O.J.@.)..}4 03a0 86 0d 13 28 a f 6e 03 a0 7c b1 b5 e6 4e 6e 6f 40 .$. 03d0 fb 92 04 e9 0 f f3 08 31 53 03 58 5a 60 5b 64 da .B.. 0320 90 0d 12 c3 0 c 08 f4 eb 53 47 0c b4 a2 66 76 40 ..p 0390 77 27 e5 36 e 5 4f 02 6a c3 14 d3 36 e0 b5 7d 34 w '.O.[Cl. M..q:.)..x.....O.m$UQ..-.... 0310 c1 60 fa 0b b d e7 ec 59 53 be cd 6d 24 55 51 8e ...SG.8.....B..1S.*.. !$U..K:.. o.6. 0360 5b 21 1a 2c 1 9 40 45 e9 13 19 20 4d a7 24 cb ea [ !.... 02f0 12 12 1f 51 d 8 22 93 d7 e0 88 78 f2 d3 f6 7a 93 .. 0300 6c 26 fd bd d 7 7e 6a c3 d3 36 cf cc 96 78 06 a0 l &.XZ`[d.. ...H.

...n 04c0 07 0e bc d1 f e 22 9a 08 4b 0c 13 ba 3b f4 d9 6f .. ..v......B 0500 a5 20 c7 a3 8 b fe fe 3c 91 3d e3 90 04 45 41 c0 ."..?R.2.........T6 0410 54 d3 13 30 7 8 1c 7f 61 87 26 2f c4 ef 28 33 2b T .....(3+ 0420 91 3e f4 50 4 d 24 c9 50 8b 6a 0b a5 cb a9 34 6b .. .6G.0x..<. .. x...q.j..w.4.x........AZ3..a.....6.. 0480 89 56 65 84 0 2 ad 10 5f 5e b7 c2 51 be 1e 97 18 .#..0400 8d 31 f7 d4 c 3 0a 4f 84 56 02 07 20 60 c8 54 36 . 0440 6d 3e 56 e2 3 4 f3 5d aa ee a2 78 db ad ad fe bd m >V.K..l.v..=...4k 0430 bb b8 57 50 e 1 15 92 0e 35 75 31 9c 36 47 c2 2e ...)... 04b0 9e df 48 de c c f9 9b 5d af 36 ba d2 4c 23 80 6e ....x. ...P6.\ 0460 85 a4 90 24 1 a 82 87 8c da 80 32 ec 2c 39 20 4e . 1. Ve.5u1.C... >.].ia..EbH...L#.WP..z_. %x.$. .V. `. 0490 79 a5 69 61 0 0 94 0f 12 07 84 82 f1 81 f9 c8 c2 y ..XO 04f0 96 25 78 a8 5 0 36 a8 ed 0e 78 97 71 ac 76 ed 42 ..H..P. ..]...9 N 0470 ac 14 af 7a 5 f 0a 24 fa bd 8d 8e 45 62 48 9b ba .....Q.1.EA.o 04d0 57 a0 db cc 6 c 9f 85 98 db 41 5a 33 12 18 a9 43 W .....$....hxI....O.5....._^. 0510 98 1e 40 3e f . 04a0 3e 23 f8 c3 2 9 ca 6a 2e 05 f2 0c 76 e2 92 77 e2 > #.&/. 0450 69 e7 c9 43 e 0 d0 b3 98 35 0e 83 e4 31 ae ff 5c i ..C 04e0 c4 78 e9 3f 5 2 f0 94 68 78 49 16 23 c3 81 58 4f ...PM$....j.

7 9c 3e 63 7b bf 45 7a 46 42 46 01 . 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.. X No.000187000 seconds] [Time delta fro m previous displaye d frame: 0.home cust-74-12412-138. 0520 0a 58 . 2014 11:26:5 5.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =34283 Win=45360 Le n=0 Frame 66: 54 bytes on wire (432 bits).dllstx01.>c{.@>.125268000 sec onds] Frame Number: 6 6 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype .000 000000 seconds] Epoch Time: 141 5615215. Time Source Destination Protocol Length Info 66 2.175198000 s econds [Time delta fro m previous captured frame: 0. .00018700 0 seconds] [Time since ref erence or first fra me: 2.cor exchange.125268000 pc13.EzFBF.175198000 Romance Standard Time [Time shift for this packet: 0.

. ..co rexchange... . ....0 .........0..... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.... = LG bit: Globally unique address (fac tory default) .. . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .com (74.. .dllstx01. . . . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... Src: pc13 .1. = Differentiated Ser vices Codepoint: De fault (0x00) . . .... ....11 ). = LG bit: Globally unique address (fac tory default) ... . ..12. .0...... .......port == 80 || http 2] Ethernet II....168.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab .. Dst: cust-74-124 -12-138.... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). . . . .... . .home (192. ...0 .... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.......1 24.:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .

.corexchange..ho me (192... . Ack: 34283 .1. = Reserved: Not set . = Reserved bit: Not set . ..0 ....... Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 34283 (r elative ack number) Header Length: 20 bytes . Seq: 1.1.... 0000 0001 0000 = Flags: 0x010 (ACK) 000.12.......168. D st Port: http (80). .. Src Por t: 49574 (49574).0..138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. . ..le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f33 (20275) Flags: 0x02 (Do n't Fragment) 0.dl lstx01.. ... .11) Destination: cu st-74-124-12-138. = Don't fragment: Se t .124.. com (74. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.

...0... ...... 0 ....0...... ...1 ..P...... 0........N..... . .E.. 0030 b1 30 18 d4 0 0 00 . .P. ..+....... ... 0010 00 28 4f 33 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ... .... 0. (O3@. ...... No. 0..`n. . .. . ..... = Congestion Wi ndow Reduced (CWR): Not set ..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 e8 18 50 10 ...... . = Nonce: Not se t ...dx.. .... .. = Push: Not set .0 = Fin: Not set Window size val ue: 45360 [Calculated win dow size: 45360] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 65] [The RTT to ACK the segment wa s: 0. = Acknowledgmen t: Set ..... . . = Syn: Not set . Time Source . = Urgent: Not s et .0.000187000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . . . = ECN-Echo: Not set . . = Reset: Not se t .

1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.port == 80 || http 2] Ethernet II.132077000 sec onds] Frame Number: 6 7 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .182007000 s econds [Time delta fro m previous captured frame: 0.com pc13. 2014 11:26:5 5.00680900 0 seconds] [Time since ref erence or first fra me: 2. Src: S agemcom_d0:17:e1 (9 .132077000 cust-74-124-12138.Destination Protocol Length Info 67 2.182007000 Romance Standard Time [Time shift for this packet: 0.006809000 seconds] [Time delta fro m previous displaye d frame: 0.home TCP 1314 http→49 574 [ACK] Seq=34283 Ack=1 Win=46 Len=1 260 Frame 67: 1314 byte s on wire (10512 bi ts).dllstx01.corexc hange.000 000000 seconds] Epoch Time: 141 5615215.

.138)...0. = . = LG bit: Globally unique address (fac tory default) .. . .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf193 (61843) Flags: 0x02 (Do n't Fragment) 0... . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... ...1. Dst: pc13..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..corexchange..124. ...0:01:3b:d0:17:e1)...... ..... . Src: cust -74-124-12-138. ....dlls tx01.home (192 .. .. .. = LG bit: Globally unique address (fac tory default) .. ... . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. .... .0.... = Differentiated Ser vices Codepoint: De fault (0x00) ....... . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .co m (74. ... ...12. ... ...0 ....0 ..168. ..... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . ......... .. ..

Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 34283 (relativ e sequence number) [Next sequence number: 35543 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ..168. . .dllstx0 1. .... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a97 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. . = Congestion Wi .. Ack: 1 ..1.. .0 . Seq: 34283. . = Don't fragment: Se t ..corexchange. = Reserved: Not set . 0...... Dst P ort: 49574 (49574).... = Nonce: Not se t .12.124.com ( 74.... .home (192. 0000 0001 0000 = Flags: 0x010 (ACK) 000.... ....Reserved bit: Not set . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. .138) Destination: pc 13. Src Por t: http (80).1.0......

. . .. .. 0050 74 9c 79 3c 1 2 8e 44 51 e1 e7 09 c5 d8 a2 2a 33 t . .0. ....1. ....N.. .....P... 0020 01 0b 00 50 c 1 a6 2b c8 e8 18 9e 87 4e aa 50 10 ..... . 0010 05 14 f1 93 4 0 00 31 06 3a 97 4a 7c 0c 8a c0 a8 ... ... . 0030 00 2e b4 4f 0 0 00 9d 08 98 23 4d e3 8c 18 83 77 .+. .dx.. = Reset: Not se t .... = Urgent: Not s et .P. = ECN-Echo: Not set .E. .*3 0060 cb 89 4b 4f 4 7 af 56 30 5c aa 8b a1 65 e7 5e a4 ..@... 0 .DQ. ... . = Acknowledgmen t: Set ...y<....#M... ...ndow Reduced (CWR): Not set ...t>1%FS...V0\.....0.J|......KOG. 0..0. .... ...w 0040 0d c4 b0 94 7 4 3e 31 25 46 53 00 31 28 9c 0c 2c . .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xb44 f [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ......O. ..e. ..... = Push: Not set .1 .:... .^.1(.. .. `n... = Syn: Not set .... ......

L.. .}.... 00b0 5e 2b 7f ff f f 55 81 d0 c5 c9 90 b4 50 e9 1c 8e ^ +..s. 00e0 12 2e 3a 84 6 2 38 58 16 e4 a7 26 6c 22 b1 f3 28 . 0180 a6 d5 af 07 9 ..\.. ..8. .kF.....}<.oJ.OC.........t}s\. .... 0090 58 62 60 65 2 5 6a 50 6b 0f 4c 0b 3c c7 52 0c bd X b`e%jPk....(JD....... 0110 9f dd 40 ef f f c8 01 14 ec c6 73 2a 53 54 bd cb .>N..T.g...C....b)iW<h 0130 0d c9 f3 a7 1 5 4f 43 e1 b3 03 a5 eb 54 5e 4d a4 ..g~'..r.y.. u3(. 00d0 35 02 79 1b 1 9 8a 09 6f 4a 13 a5 c9 92 b8 8c e8 5 ... x.. 0100 ae e6 5c aa e 3 2c df b1 b5 3a 98 74 7d 73 5c 9d ..... 0140 ed f4 b6 ca 0 d 28 b2 7a 2a 60 d0 bc 6c 63 f3 83 .. 0160 a1 63 2e 93 c e 1f f7 a1 db 72 02 ef 6b 46 c3 ca ...P....(..z...iUQ...U.. ...3..:.&l"..( 00f0 97 75 33 28 d 9 12 73 85 1f 67 16 f4 d4 5d 09 ac . 0150 50 83 c3 5c c b 54 3b 11 bd f2 8b 43 cc 8b 67 d4 P ..r_.T^M.1S..s*ST....... 00a0 0b 89 84 93 e a 01 97 bd 28 4a 44 ad cf 72 5f a5 .. ..6...lc.\..../.<.. 0170 30 b8 04 c2 f 0 69 55 51 ac 2f 98 dc 7d b2 c5 82 0 .. .z*`....\.. c..G...b8X.]... .R..0070 b4 cd e8 92 c c b8 ba 71 a6 7a dd 67 7e 27 85 09 .. 0080 1e 78 14 16 b 0 ff fb 92 04 ec 0f f3 0c 31 53 03 .:.. 00c0 47 d6 d9 7d 3 c d9 36 da f8 bc 3e 4e b7 33 b1 8c G . 0120 81 83 a3 38 d 1 5c 9c 47 f3 b5 62 29 69 57 3c 68 .g.q......@...

...@U<..q 0210 ac 12 16 37 d b f2 fd 27 86 7d 3d 0c af bd 69 77 ..(h..... 0280 f2 37 21 9f e 2 35 9a cd 50 be 51 aa 11 ed ff cb ...r.+..*...P... 0190 4f 36 70 1c 1 2 8c ba 24 9b f6 62 9e 9e 81 aa 76 O 6p.5.4./.j.]. ....b`a...r. 3.14H......!.b.. .....>.W..... 0290 a9 dd ff 4f 6 a 3b 8f d4 00 c5 00 . ..v 01a0 1f e6 e3 96 3 1 6a 52 73 80 9a 10 78 6b 98 86 c7 ./c.....l.(.G. 0200 cf 6a 85 f2 8 d 50 8f 7f fd be ee ef b6 21 8b 71 ..}=.y.j.....Q.2...iw 0220 a1 c9 8c f3 e 8 db b5 ff fb 92 04 ea 0f f3 15 29 ....'....6 a0 9f b4 1e 19 40 55 3c db 3e 86 .VQ. ... l.A* 01d0 05 f9 33 ad 0 f 97 f2 8b 47 1a 6c 08 d2 0c 06 97 ...Hi` 0240 0c 3d 27 01 7 5 0f 2b c1 86 19 28 f1 57 d1 ea 98 .. .a...L...V..... . 0250 36 d4 0e 09 5 6 51 c0 80 6a ca db 8a 9b 43 5b 6e 6 ....A...... 01c0 19 7c 6b dc 9 5 34 94 56 c3 f5 ac 5d e3 de 41 2a .) 0230 d7 01 ec 62 6 0 61 a6 2a d0 61 e9 4c 0b 48 69 60 .......w. 01b0 45 41 33 47 e c 79 07 99 16 df 20 50 ce dc 32 a7 E A3G. 01e0 0c d7 b4 89 4 d 15 6a da 2f 63 d6 eb 31 34 48 c4 .. ......u.7.P. ='.C[n 0260 91 33 a2 75 1 3 9c 92 91 20 b0 2f 8a 89 60 61 71 ....`aq 0270 ce de 14 c0 c a 41 96 e2 c8 87 f0 e8 72 a9 90 9f .....xk...M. ....u. j. 01f0 1b 6c 0d 28 6 8 e8 72 b5 97 7f cc 77 88 7f d1 ac ... .3.. P. 7!..$. |k..1jRs.

K....*..... 02c0 0a d2 56 54 4 9 30 d2 a3 ba 02 f1 d0 b0 92 5a a2 ..D9\.2e..^e.>. 0360 15 5b a8 95 a 8 ec d6 e0 55 00 59 6c 57 88 90 10 .... 0340 cf fc 12 68 4 4 2a 03 15 3e 2e 1e 52 5a 21 17 20 .kO. .. .+s.....d5rr 02a0 2b d8 92 59 3 1 7a ec be 2b 73 1e be c3 ff f8 0b + . .B..........j".d.Oj.qr.E 0320 20 97 a9 d0 1 0 99 63 0a ac e9 71 72 d8 92 de aa . h5*...g<...... 0310 bb 2f f3 b2 f e e5 f7 d3 92 20 68 35 2a bd 91 45 ..m%..}..q.. 02f0 17 ff 2f fe 4 b 8c 5e 65 97 85 42 7c 56 e2 82 9b ......".p.zA.. .... 0300 c7 a5 24 d6 3 d c7 ae f3 82 9a 97 81 bc f9 7e a7 .b1 64 35 72 72 ..~.. ...3.Y1z..B|V. ..."...`...hD*....g... 02d0 18 da bc d8 e 7 8d 42 89 a7 ef 62 09 64 2c 04 48 .=...... 0370 18 6e f8 60 0 0 7f b6 02 f4 c5 6d 25 04 67 af 51 .p2.H 02e0 c7 08 e7 3b a 3 26 54 cf 7d 7f 6b 4f ce f0 1b b5 ..&T....7.VTI0.U.Z.E.. [......J.$..)..c..Q 0380 60 4a f0 5d e e 29 a6 e7 44 39 5c 7f aa 94 70 12 ` J..r. /. .V.RZ!../. ...... 02b0 47 42 22 1a 7 1 96 09 2a b9 56 ea 09 cc 32 65 aa G B".. 0390 69 b8 70 32 f 8 f2 67 3c 01 05 22 9f a0 a2 37 d4 i ..... 0350 25 cb 6a 22 b 2 a0 22 ca 7a 41 a3 dc a8 4a b5 cb % ...... 0330 60 e5 d4 a8 c a 94 72 2c ea 33 ee 45 f3 7f cf f8 ` .].. 03a0 a8 fa da 89 6 1 5c bb 56 d3 7b e2 f9 2c d6 4e 5f .b. n.YlW.

. .).. . 0490 79 25 fb c9 d 9 3c 76 aa 77 d4 34 3c c3 bb 9e f6 y %.Rz.. 0440 65 90 91 5c d 9 19 13 3d 85 6a 2b 4f ff ff fa 09 e ...a\..H .\........w.B.2bJ. ........./]:.. 03d0 08 1f d8 03 0 c 32 52 63 e3 fa f0 61 86 4a 4b f8 .2Rc.p..a. 0450 46 00 3c 1b 4 9 86 16 ba e1 0a 16 32 62 4a c0 0f F ..J 0480 6b 13 c4 00 d 4 8b 33 25 cd 4f 22 19 1d 34 44 d4 k .z8..%...O".. 5. .^&z\...F4d.t.b..{.... ..<v.......<iI]..M....=..\...okc 0420 ab a1 3a b2 9 3 2f 5d 3a bf e6 ca dc b4 de f6 b7 .*4!..a....... .x/...I...... 0460 07 10 ae 81 4 8 49 2d c9 78 2f 8c 6b 52 a8 34 82 .:..kR...j+O.JK..0L.HI-.. 0470 3b 2a 95 e1 4 f 6a 96 5c 9c 77 5f a6 70 ee d3 4a .. 0410 e6 ba 4d 0f 7 a 38 83 42 cd 72 c3 40 ec 6f 6b 63 .bqG'. 04b0 5a b1 46 34 6 4 a9 0e 2a 34 21 82 e6 8c 90 90 48 Z . 04a0 2b 5d f7 b4 e 6 d8 8f 95 aa 12 1a 06 25 00 a6 c2 + ].N_ 03b0 af 35 a8 71 5 3 e4 18 14 1a f6 01 92 2a 21 6a 5c .*!j\ 03c0 bb 52 fa af f a 99 fb 93 fe ff fb 92 04 eb 0f f3 ... 9...4...0.4<.Oj. 0430 b7 06 74 f7 c d fa 62 91 8a 10 03 02 62 cf 61 d1 .<....V.A<M...3%..qS... 03f0 cd 15 41 3c 4 d 00 30 4c fa 5e 26 7a 5c 8c 9c 3f .....@..w_. *....r.b..4D. R. 03e0 9b 5c 0c 3c 6 9 49 5d 0c eb 81 86 30 e0 b1 80 01 ... \.? 0400 0e 39 9e 13 5 2 7a dc 90 62 71 47 27 d2 29 b7 f0 ....

..3.060005000 seconds] .com pc13. 2014 11:26:5 5.000 000000 seconds] Epoch Time: 141 5615215.192082000 cust-74-124-12138..242012000 Romance Standard Time [Time shift for this packet: 0.x.*.!..J.f 0520 84 71 .. q No.. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.uE....g$..corexc hange.X 0510 2b ad 4c 5a a 2 a1 da 11 02 33 f2 8d 14 81 80 66 + . \w].home TCP 1314 http→49 574 [ACK] Seq=35543 Ack=1 Win=46 Len=1 260 Frame 68: 1314 byte s on wire (10512 bi ts).6w.0...WO 0500 37 79 ad 36 7 7 f7 4a d3 c8 aa cb 1e 0a 21 8c 58 7 y. ..... 04f0 a5 5c 77 5d f b a8 e0 c7 dc 38 bf e3 30 e2 57 4f ...QVX 04d0 41 a4 b1 2a f 8 78 85 4d 2a 4d f0 f6 86 13 32 58 A .LZ....dllstx01.8.W.2X 04e0 f5 20 f5 74 7 6 05 19 8f 7a 62 78 4d ae 75 45 c7 ..M*M.242012000 s econds [Time delta fro m previous captured frame: 0.tv.... ....04c0 91 01 57 ec c 1 8f 19 85 f1 67 24 f8 1b 51 56 58 ..zbxM.. Time Source Destination Protocol Length Info 68 2.

. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). .... .... Src: cust .port == 80 || http 2] Ethernet II....... = LG bit: Globally unique address (fac tory default) ...192082000 sec onds] Frame Number: 6 8 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . .. . = LG bit: Globally unique address (fac tory default) ... .0 .. .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ...... .. ..[Time delta fro m previous displaye d frame: 0.... ... .. . .0 . ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. . ........ .....06000500 0 seconds] [Time since ref erence or first fra me: 2..0. ....... .0.... . .. ... .

..12.168.. Seq: 35543. = Differentiated Ser vices Codepoint: De fault (0x00) .. Dst: pc13.. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. .home (192 .... Ack: 1 . ..138) Destination: pc 13.1...1.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf194 (61844) Flags: 0x02 (Do n't Fragment) 0..com ( 74.dlls tx01. .0.1..co m (74.-74-124-12-138. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..dllstx0 1.corexchange... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a96 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. Src Por t: http (80).124. .home (192.corexchange. Dst P ort: 49574 (49574).12.124..168. = Reserved bit: Not set .. Len: 1260 . = Don't fragment: Se t .138).

.....1 ..... ...Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 35543 (relativ e sequence number) [Next sequence number: 36803 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. ... ... ..... = Reset: Not se t . 0000 0001 0000 = Flags: 0x010 (ACK) 000... ..0.. . . ... . .. . .. 0. .. = Nonce: Not se t . = Push: Not set . . .0... = Reserved: Not set . 0... 0 . ... .. ...... . .. = Acknowledgmen t: Set .. = ECN-Echo: Not set .... ...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xd0e 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] . .0 . = Congestion Wi ndow Reduced (CWR): Not set ......... = Urgent: Not s et .. ...0.......... .. = Syn: Not set .

. 0030 00 2e d0 e3 0 0 00 9d 60 61 01 0c 96 50 83 02 54 ...U).N.. ..N...... 0020 01 0b 00 50 c 1 a6 2b c8 ed 04 9e 87 4e aa 50 10 .`....b.1..J.`a..".. 0090 90 65 ec 4a 0 c 68 bd 4e 0d 61 69 81 90 15 e9 c1 .. ..x....= 0060 96 a3 53 b3 b 3 3f 6b 8c a8 b6 b5 11 ef a7 ca be .. 0070 cd 4f b7 9f 9 6 ab 32 04 de f0 60 59 f2 eb 2e ff ... "B.f.. t...l.. 0100 a3 89 63 bd 2 a b3 ae 0d 0a 28 11 ...1.2.../JPa.P...M.. ...+...... 00d0 f1 1b 3d 8d 8 2 84 e0 61 8e f1 b4 f8 1c 21 bf 29 ..2 0050 d5 32 48 a6 6 f 25 4a c3 f4 be 26 98 de 4a d8 3d .. O.. ...@.~..J..ai..<.$&. . 0010 05 14 f1 94 4 0 00 31 06 3a 96 4a 7c 0c 8a c0 a8 .}.. `n....h... .!.P.\%.a. .. e..:..dx..o%J.0........P.`Y...!..&*...S. 00a0 a7 bd 30 89 b 5 03 9c bb b9 55 29 81 8f 9c 21 8c ....&...... 00b0 68 c1 07 0e 0 4 88 55 00 60 08 6c 18 3c 8a 31 db h . 00c0 0d 22 42 0d 1 8 66 b5 01 11 7e ba 0f 26 2a 9a e7 .E 00f0 e7 93 04 0f 1 d 7d f3 b9 24 26 f9 7e eb cf e8 a9 ....Qe~......U.[Bytes in f light: 2520] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .N. 2H..T 0040 5a 40 9f 5c 2 5 8f 51 65 7e b3 90 4e bb 78 a7 32 Z @.) 00e0 b3 74 1c 1f 0 9 ce 62 c3 b0 d5 9a a3 f3 4d 08 45 ....=...?k. .~..J|..E. 0080 fb 92 04 ec 0 f f2 d4 22 d5 03 2f 4a 50 61 c5 0a .

0120 50 5f 1d 91 d b 90 e3 99 50 b9 43 9b 1e 6d 5a b9 P _....>..C.. 0170 40 81 60 41 6 6 28 22 3e 85 46 2e c0 22 21 6a 2f @ ...3.<..."!j/ 0180 18 a0 fa 05 7 b 13 92 60 04 33 89 94 f6 65 42 a2 . . 01d0 02 df 58 c6 7 3 41 8e 10 32 fc 30 70 80 ca d9 2f ..{.^]...' 01a0 20 bf ca 7a 9 6 4a d0 df 70 ac f0 17 49 f9 b2 c3 .K...!.`Af(">.5qc..eB.0p...fJb.2e 37 91 0c a9 . ..F..i...c.=$._.]o.Y..... 01f0 da af 55 c1 8 c 69 2c a7 9b 4b f9 20 78 dd 6d 92 .7. . 01b0 12 b7 77 79 3 d f4 88 91 fe be 73 5c ed bf 1b ff .2..s\....z.L...(h.wy=...mZ... p7.F...Z. 0190 5d a0 28 68 0 3 4c ba 9b cb b5 4b 8c 03 20 9a 27 ] . .W.I...X.m.. ...K../..(.SS.`. 0150 6b 0d b3 53 5 3 19 ae 64 92 0e 3e b5 8d 63 cd 8d k .. ..d. 0200 b1 70 37 e1 3 d 83 11 fd 5e 5d 91 37 e0 de da a6 .c.U.....|..g 0140 6f a4 74 b4 5 d 6f 0d 4d 7a ec 35 71 63 9b c6 c5 o . 01c0 fb e7 3f eb d 3 5a f8 81 c5 46 d6 de bf ae 06 05 .. 0110 c3 12 7c c8 0 5 2e f9 6d 0c 30 12 3c 05 c7 ea 05 .....t.p... 0130 20 ee 66 4a 6 2 2c 57 1d 21 83 0c e8 9a 1c 19 67 ...../ 01e0 51 ae 03 7b 1 9 ae 3d 24 15 95 1e ac 10 a5 85 c9 Q .{. x..J...0. 0160 ef 1f 5f c9 c 5 97 59 9f 6e 4b ea 89 83 2f 18 98 ...m.nK...7..=.Mz.. .. ....*...sA....?. .... 0210 9a e6 74 e1 b 9 6b f3 86 d6 eb c7 b4 3f 6f eb 2d .P.... .

B@ 0270 c4 21 0a 26 3 8 2c 41 b2 81 2d a1 8e 74 3d 43 9f . . .-......C..!Q.).1.h.` .v 0290 3c 45 ba 66 6 9 22 d3 31 7f c4 38 19 c6 7f a6 25 < E.=..0220 dd ff fb 92 0 4 e9 0f f2 d9 22 d4 03 4f 7a 50 5c ..{..k........ ........ 0320 40 8d 20 bd 3 2 a7 95 e3 07 46 69 c4 65 04 c9 60 @ ...b.......-...2......i..t=C._..y.N...fi".....+S.8.. 0260 11 58 b0 8e b 8 49 61 4d 30 9a 10 29 90 d5 42 40 ....e."..X.C.^>d.t..%4..._..9.&8.... .*x..X.gt . .... !......_T.% 02a0 85 9f ff cf f 2 98 79 06 93 b6 81 67 74 20 00 13 . 0300 d9 51 71 34 9 d 29 4c 5b 9b b0 d9 74 03 1f 03 58 .....k. 0280 41 0f f3 19 d 3 e8 b5 6b 8f 97 1a 21 51 f4 db 76 A .t.Fi. X... Qq4..6 02d0 b4 e1 52 bb 2 c 68 81 de 39 a2 29 f1 80 49 1a c3 . ..OzP\ 0230 a5 9a 80 69 e b 4c 0c 88 c5 4e 0d 3d e9 81 8b 18 .. 0240 a9 c1 a7 bd 3 0 95 94 03 2d 02 97 cd 08 2b 53 db .R... 02f0 46 1d 7b e6 9 2 2e 34 7c bd 9b ee ef 8b 9a d7 a4 F ...L....A. .X 0310 77 26 ad c0 9 8 d2 14 14 a2 5f 80 2d 5d e8 f8 ea w &.W......?o..1.I.....Ph. .).)L[.0.. 0250 ef d6 5f 54 a e 2a 78 8c 80 02 81 86 c3 07 5f 01 . ./ 02c0 c0 9c 99 18 9 8 57 e0 82 43 01 25 34 f5 84 9c 36 ....IaM0.4|. 02e0 d1 1e bd a5 4 3 e1 e2 58 93 da dc d6 5e 3e 64 b3 ...... 02b0 3c 0a a4 c0 3 1 16 50 68 19 62 a6 0a 1c 58 16 2f < .-]....

....x..m0Ikx..?> 0360 f2 e0 e8 15 c 1 55 95 1a e3 78 bf 90 47 43 41 8c ...i..)... 03a0 6d ff f7 85 6 4 8a 68 3e 03 82 fa b7 5f 4a c9 59 m .Z..0 0390 93 b0 d6 97 2 9 a6 22 5a ab 4a 2e 63 46 19 03 1a .d.Y 03b0 b7 1b 3b d5 1 a ad 1e 2e 61 6b e2 57 b0 b5 f3 ad .L. ~....GCA.f.@ 0380 ff 26 45 b9 c 8 59 95 c2 62 cc a6 2d 59 e4 2e 30 ...-Y..[]F. &E..... 0350 bd a3 9c 58 5 0 77 88 2a d8 ce 54 dd 69 ac 3f 3e .....T.8g 0410 80 7e 10 98 e 9 d8 6d 30 49 6b 78 a7 aa d1 ab b8 . .lN..V...M......J..cF. 03c0 5f 18 8e ff f b 92 04 e8 8f f2 ff 28 53 83 4f 7a _ .. ......W....a. 03f0 50 03 43 73 a 0 90 18 86 de 02 4d 0f 1c 3a 22 66 P ..L. 0440 a7 fe f9 c7 b .5.`..x..Cs. 03e0 85 93 69 81 9 c 3d 28 b1 6c 4e 03 31 50 bd 35 a0 .....ak...N.i.Oz 03d0 50 5b 45 7a 8 0 61 ef 4c 0b b0 c5 4e 0d 3d 69 81 P [Ez....h>.... 0370 46 b4 45 6d 4 2 8d 9a c4 b8 47 a1 60 e8 e8 19 40 F ... p.....1P.."Z.Y..*......Xh.:"f 0400 00 1a 66 1a e 3 f1 a4 52 c1 a6 23 e3 cc cc 38 67 ..EmB.#.(S..z.=(.0330 ce 5d c7 f5 5 b 5d 46 e8 1d e3 99 a1 17 8b 8f 91 .=i.. ...... ].. . 0340 75 54 6e bb a 5 e1 a3 5a d0 31 35 9a bd cb cd b6 u Tn....|j.XPw... 0420 0c a0 74 1e 4 c ff 78 fe 2e 58 68 ff 18 a4 56 da . .15..b.G._J.. 0430 e9 70 e1 a8 e e 1a ad b3 7a c3 8f 7c 6a df 13 3b .. .t..R.. ...U.

. ..6mc#.Q....owZS. Time Source Destination Protocol Length Info 69 2... ...home cust-74-12412-138..t.*. 04d0 64 56 b8 36 6 d 63 23 e4 23 ec 36 6d 6c 1e 60 58 d V..-. ... 04c0 6d 18 86 f1 c 8 7a 1d e2 e4 d4 28 d5 07 2a 40 8f m ..`... .h 0460 11 0c 4a 94 f 8 0a aa e1 4a 43 47 f2 89 cd f2 d1 .....J.Wv.. 0480 bd 75 8c c3 8 d b7 8b 3a 33 ed bc 32 3d 8c e1 d7 ......H. .j4u7. 0490 48 d6 18 cc 1 6 8b fd 9c dc 6b f3 8a fc d5 1e 1a H .....=.... 0510 04 8d 98 21 e 1 89 d9 88 34 61 8b 2a bd 48 81 4f ...Q.. .. 04a0 bc 34 b4 b4 2 1 8b 84 8e c1 6f 77 5a 53 82 91 9c ...k.& 04f0 9a df 29 61 3 7 7f a3 fa 57 76 92 17 ff 6f 35 ff .*@...z...dllstx01........]7S. 0500 f8 9a be 6a 3 4 75 37 df a6 42 13 3d 01 1c 80 1b ..2=... 0470 aa ad 74 a4 d b 08 e7 2f 21 c6 a5 2d 8f 98 09 d8 ..4 c9 52 21 bd df ff 51 08 92 b2 21 . . 04b0 04 a2 81 8c 8 b 23 18 49 10 04 08 dc 22 25 e2 f4 ................. u.. .!.o5.6ml.#..)a7.JCG....O 0520 5b 61 [ a No.! 0450 73 62 15 60 e 7 e4 17 c7 86 b3 e3 04 14 51 01 68 s b.:3.B.4a.#.R!..B......192260000 pc13..cor .(... 4../!...I.!...."%.`X 04e0 8d bf 8a f9 1 2 fa 42 1c ac c4 ac 5d 37 53 af 26 .

000 000000 seconds] Epoch Time: 141 5615215.242190000 s econds [Time delta fro m previous captured frame: 0. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa .242190000 Romance Standard Time [Time shift for this packet: 0.000178000 seconds] [Time delta fro m previous displaye d frame: 0. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).192260000 sec onds] Frame Number: 6 9 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . 2014 11:26:5 5.exchange.port == 80 || http 2] Ethernet II.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =36803 Win=44730 Le n=0 Frame 69: 54 bytes on wire (432 bits).00017800 0 seconds] [Time since ref erence or first fra me: 2.

...1.gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..0....co rexchange.. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f34 (20276) Flags: 0x02 (Do n't Fragment) 0. Dst: cust-74-124 -12-138.. ....... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4... Src: pc13 ...1 24... = Reserved bit: Not set . ....dllstx01. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ... . . .... ... = LG bit: Globally unique address (fac tory default) ..... = Don't fragment: Se t . . ..0 ...... ....168........ ...1. . = LG bit: Globally unique address (fac tory default) .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. .... ... ...11 ).. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. ..home (192. . ..0.....12. = Differentiated Ser vices Codepoint: De fault (0x00) ..0....0 . ...com (74.. .. . .. . = More fragments: No t set .. .. .

.dl lstx01. ... .. .......11) Destination: cu st-74-124-12-138. 0 .1.... 0000 0001 0000 = Flags: 0x010 (ACK) 000.. Seq: 1.. com (74. D st Port: http (80).. .. .... = ECN-Echo: Not set ... . ... = Urgent: Not s et . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 36803 (r elative ack number) Header Length: 20 bytes ......124.. . . ... Src Por t: 49574 (49574)..corexchange...138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.0.. .1 . .. = Acknowledgmen t: Set ...ho me (192. . = Push: Not set .Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.... = Nonce: Not se t . = Congestion Wi ndow Reduced (CWR): Not set ... . Ack: 36803 .. ..0... = Reserved: Not set .12.0 . 0. ..168.

....000178000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . = Syn: Not set .P... = Reset: Not se t .. .. .J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 f1 f0 50 10 .0 = Fin: Not set Window size val ue: 44730 [Calculated win dow size: 44730] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 68] [The RTT to ACK the segment wa s: 0...`n.dx.. .. No. ...dllstx01. . 0030 ae ba 18 d4 0 0 00 . ......corexc hange..E..274086000 cust-74-124-12138. ACK] Seq= 36803 Ack=1 Win=46 Len=1239 Frame 70: 1293 byte s on wire (10344 bi ts). Time Source Destination Protocol Length Info 70 2. .+.N... 0..... .. 1293 bytes cap tured (10344 bits) .com pc13.... 0010 00 28 4f 34 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .P.. .0.... ......... ..home TCP 1293 http→49 574 [PSH. (O4@..

.... .081826000 seconds] [Time delta fro m previous displaye d frame: 0. .port == 80 || http 2] Ethernet II.. .... . ....08182600 0 seconds] [Time since ref erence or first fra me: 2..... 2014 11:26:5 5. = LG bit: Globally unique address (fac tory default) ..0. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).... .. ... ..on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...000 000000 seconds] Epoch Time: 141 5615215. . .274086000 sec onds] Frame Number: 7 0 Frame Length: 1 293 bytes (10344 bi ts) Capture Length: 1293 bytes (10344 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. .324016000 s econds [Time delta fro m previous captured frame: 0..0 .324016000 Romance Standard Time [Time shift for this packet: 0.... .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .

= IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .. = Don't fragment: Se t . . ... .. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3aaa [validatio n disabled] .0 . .138)...0.... = LG bit: Globally unique address (fac tory default) .124. ... Dst: pc13..168...home (192 ...12. .. ..... ... . .co m (74.. . ..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..1. = Reserved bit: Not set ..... = Differentiated Ser vices Codepoint: De fault (0x00) .. Src: cust -74-124-12-138.....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 279 Identification: 0xf195 (61845) Flags: 0x02 (Do n't Fragment) 0...... .dlls tx01.0... ..corexchange.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.1....

home (192..12. .. ..... . .dllstx0 1.. 0. . ..1 ... .. ..168.124... 0000 0001 1000 = Flags: 0x018 (PSH... Ack: 1 . . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. . = Acknowledgmen t: Set .. = Reset: Not se t ... .... . . = Reserved: Not set ..... = Congestion Wi ndow Reduced (CWR): Not set .. = ECN-Echo: Not set ...138) Destination: pc 13... Len: 1239 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1239] Sequence number : 36803 (relativ e sequence number) [Next sequence number: 38042 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .... .. = Urgent: Not s et .... Dst P ort: 49574 (49574)...... ..0 ....com ( 74. ..[Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. = Nonce: Not se t .... Src Por t: http (80).0.0. .. . . ACK) 000. .. . Seq: 36803......... = Push: Set . 0.corexchange. 1 .1..

.At.. 0040 a9 c8 ad 13 d b 31 8b f3 24 6e 6c 9e 47 63 25 b2 . 00a0 a3 bd 65 d1 1 6 42 6c 23 98 02 42 4b 14 dd 5a 51 ...0.....e...dx.. 0030 00 2e 2a d3 0 0 00 44 4b a5 a2 aa b3 63 f6 27 a0 .... = Syn: Not set . .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x2ad 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1239] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .?.. .Gc%.... . 0020 01 0b 00 50 c 1 a6 2b c8 f1 f0 9e 87 4e aa 50 18 ..... 0050 9f 3f 77 29 d d 53 8a 86 92 b1 04 e6 a6 68 e4 eb . ..P. `n.26o.).......Oz`[... L.P..N.pe.Y...M.>.h.*. ?w).BK.... .=... 0090 9d 4c 0d 3d e 9 41 74 96 29 81 a7 bd 30 ca ed a2 .. .....ZQ 00b0 38 12 04 18 e .:. .1..@. 0060 11 0e 92 4d 0 d f9 fc 81 59 9c 35 9d 32 36 6f b6 ..E.+.5.'...DK.... ... ..c.C'..S.S. 0010 04 ff f1 95 4 0 00 31 06 3a aa 4a 7c 0c 8a c0 a8 . . ...... 0070 fb 9d 3e e3 b d 43 27 7f 3f ff fb 92 04 ea 8f f2 .Bl#...L.$nl. 0080 fe 2c 53 83 4 f 7a 60 5b e5 8a 70 65 ef 4c 0c 00 .J|.1.0.

(...A. .c 4c c0 4a b3 f1 75 03 e9 92 70 b9 8 .......^..a...0....D....F. 0130 85 12 29 91 4 6 fd 8e 19 b8 2c 5a d5 a4 b3 14 2d .).yNOW..u. ........A..9..... B.>...1^B......3..d.... 6.J.wq.. 0160 fe 23 69 41 5 d 5c 92 08 0d 37 c7 69 34 c9 04 5e .r 00e0 ea 63 5e 75 f e 8b 77 71 ea b8 4b 1f 69 a8 af 3e . 0120 51 00 f0 44 1 d f0 d8 11 06 83 33 1b 81 e6 ba 1f Q ..]...._..: ..f.WT.......D......B. c^u.o...... #iA]\.Z.n@F....i.p. 00d0 68 3e c6 c9 0 e e2 ba 93 79 4e 4f 57 a8 e7 dc 72 h >.J... .f......L.7.... 01b0 6f 60 e7 14 d e 3c 36 5d d3 fb 6b 3a dc 6d 20 42 o `.f 01a0 69 bd 57 54 8 6 df 5d e6 02 ba 04 5a b8 6b e2 ed i ... /.m B 01c0 c5 06 fa c5 1 b a2 4d f0 43 23 46 ....i4.k.... ... I.....^ 0170 0a 36 1f 31 5 e 42 c3 3a 20 95 09 aa aa 11 30 04 .K.l.H. 00c0 0b 42 c5 18 d 3 09 a4 6c 05 4a f3 0c 28 82 c3 af .Z......0140 ae cf 07 5e 9 6 66 bd f2 c5 1f ac 42 a4 6f f3 1d ....#.. 0110 18 1e 48 cc c 0 09 44 81 8e 91 61 a2 e2 b0 23 a1 ..r.....> 00f0 51 a9 0d cc 7 2 bb 86 b9 ba 1e 6e 40 46 89 23 49 Q .. 0180 b2 49 fc 10 1 0 d9 d8 92 03 a1 fc eb e6 39 e8 1d .. 0190 06 e0 ec 41 a d ab 5f b9 17 80 83 bf 9a d6 b3 66 ..k:. 0150 ce 2f cd ef 8 c 41 8f b9 3e be 66 bb 7e bf fa ce .<6].~.#I 0100 45 4f 9e 8e f 4 08 07 19 d5 c6 1c b1 9b c8 64 00 E O..

..qq........>`.R. 0...30 c1 c5 34 c4 ...y.. ..Z0......XZ. ..V.S.. 0260 e1 2d ad 52 b f e3 c0 b3 0a aa 0e 24 5e 99 f0 83 ....o 02d0 0a 09 0d 37 c 7 c3 03 a3 d5 43 04 b7 b4 62 1d 22 .:...IIq.f..D. .. 0280 43 90 c7 81 f 2 dd 7c a8 a6 43 77 ec cd 15 c2 3e C ...C#F0.d..R. X+.M..*... ..... 0250 e6 ba 66 0c a 6 4a 20 a4 cb e2 58 15 32 0c 36 12 ..... .. 0220 0f f3 0b 36 5 3 03 58 5a e0 62 c4 fa 50 69 f8 4a . 0240 ce e5 de bf f 1 a7 71 71 82 2c 2a dd 49 49 71 14 ... .!. 02a0 e1 91 52 d5 1 d bc 7b 31 5e 80 20 d2 04 22 5f 81 .....b..gz.. ....|..|.J 0230 0c 30 c5 4c 0 d 3d e9 81 7c 96 69 81 97 bd 30 19 ..( 01e0 23 29 c5 f4 9 2 56 1b 81 b0 5e 10 67 7a ba 2a 1e # ).4.0.{1^. 01d0 0d c9 f1 29 2 2 41 d0 d0 2e 58 ee 18 d2 21 c4 28 ."_. 01f0 2f 55 a6 81 0 2 5a 30 a1 44 1e c4 1f 30 2b 86 d7 / U.u[.Pi.......i.b.. .)"A............ 0270 5f 68 ec f6 9 4 79 2e 69 c5 80 de d9 6c 77 00 19 _ h.6S.$^. -. ..J .lw. 0210 be 58 2b 07 7 9 ae 71 a9 e0 53 1f ff fb 92 04 ed .L..0+..2. 02b0 9f d6 31 94 c 2 0e 3e 60 01 8b 06 06 99 8a b5 da ..8Z.^. 02c0 60 82 98 cd a 3 5e c0 19 c4 b9 80 62 cf 14 d6 6f ` .X..<.g. .X.. 0200 cc ab 6b b5 3 c de d3 a3 64 9b 75 5b 89 a8 3a de .6.> 0290 fa ae 04 38 5 a 81 f1 05 ad ba bb f8 af ae 67 89 .*...1.. .^.y......Cw.=.k...q.i...

......3.." 02e0 42 c9 28 3a 6 a 00 9f a0 56 59 54 44 1c d1 b5 a0 B ..B.d..1Swoj..n.k0....Q.}....M..C... . 0340 59 5c 9a ce 7 b 9c 6e fd 60 36 35 67 19 57 c4 8e Y \. 0370 99 85 42 42 8 5 05 32 31 a0 04 79 4d 33 29 3e 3b .....3.=.... ... 02f0 cd a7 49 85 4 d e6 39 61 e1 d7 31 53 77 6f 6a d1 .VYTD... 0310 42 78 c0 c8 9 1 88 00 64 04 1c 12 b4 15 a1 f2 e6 B x.{.(:j..0..%...0 0390 fd 28 a0 b6 1 f d0 a0 98 3d 82 1c 6b 30 cf 0c b5 ....FA. 0360 8a fc df bd 7 d f5 06 04 12 46 07 26 6c 88 82 bd .... .... (.X..]1.0. 03a0 e8 b7 bb 91 9 2 33 84 5d 31 a3 ef 58 98 73 ff be . J..pg 03d0 0f 4a 0b f8 d 9 4a 0d 3d 6b 81 72 93 a9 81 a7 bd ..........x.yU.F..... . 03e0 29 f3 4d 63 c 1 a0 cd cf 39 ab d4 5a 80 aa 33 d2 ) ...R.yM3)>. 0350 f5 dd f7 ac 5 2 1e bf ae b3 af 20 4e 3a 88 90 ea ...9a.Mc..J.b..Oz`\.`65g. ..r.s.... . 0380 13 a5 f1 f8 e e 46 41 3b 94 30 a1 33 c1 2e a3 30 ..Z..9.....l 0330 8d 25 74 a1 7 8 bc a5 69 7a a5 1b e7 81 d5 06 04 ...=k. 0300 3d 1e ef 7d 5 c 7c 57 9c fa 42 81 c4 5c c3 51 07 = ......... 0320 dc 68 8a 37 1 8 f4 25 e7 83 d3 d8 9b 9d 30 cd 6c ........ 03c0 04 e9 8f f3 1 8 2e d3 03 4f 7a 60 5c 85 0a 70 67 .... .. ..BB. N:..3...I.}\|W. h.\.. 03b0 ef f1 bf eb 7 9 55 9b f8 ce bd ef 8a 7f ff fb 92 ..7..21. %t.7.. ..iz....W.&l..

0R4....". 04e0 19 86 19 0f 7 d 6f 97 4b b5 04 77 35 0f 85 12 0c .\.....2..~.sy 0500 6b 7f fd 5f 1 ..:.Hjd..B...R..K..... ..... .. 0400 f4 c9 b3 fe 3 9 c8 af 0a b4 fd 1c c2 7d 91 59 58 .. ....g.. 04f0 0d ed 27 2c d d ec f0 bf f6 7b 1b 76 de 73 79 20 .... 04b0 65 85 19 7c 8 0 56 00 82 05 03 98 38 8c 03 32 61 e ......Yj 0430 89 33 62 c7 3 6 34 39 ca 89 ae ca 30 52 34 8d cc .. f .v.... ..........2a 04c0 c3 6c 7a 65 8 a 21 81 18 61 2e fb 00 a1 48 d0 61 ..*0... .V...(. 0440 6a d3 65 59 1 f e7 5c c1 ae fd 37 d9 d6 42 04 62 j ...a..#QZa.5.b 0450 c4 66 20 00 0 0 82 0e 2a 30 d3 45 58 c7 94 81 08 . 0460 d1 60 11 15 a 7 a4 04 48 6a 64 b6 8b 8a a1 fa 20 .9.EX.....!.W.a 04d0 84 a8 db 84 d f 39 ec 7f 22 0e 23 51 5a 61 cf 08 ...}o.... `..'.. ....03f0 90 c5 98 52 0 1 8c d9 20 a0 a8 20 c0 0f 31 c3 f9 .1.JQ......9.{. 4.YX 0410 a5 10 4a 51 0 1 7c b2 d6 9c 84 d6 04 a4 65 8b 52 ..7.. 04a0 83 62 c0 96 e 4 a4 12 32 f8 07 94 3b b7 eb 1d 0c ..649... 0470 bd b8 2e 9d b 9 b5 8b 4b c6 c5 86 83 fe 3f 3f 07 .B..|. .... ..y..a.}. 0480 d1 34 c4 6c c 9 3a fb ca be 67 9e 48 90 15 f5 da ...8...H.w5.l... lze..R 0420 41 d3 28 19 0 f e4 f2 10 c8 13 8a 89 42 f1 59 6a A ... ..??.H..K... b. 0490 65 e4 7e c5 a a ff 96 f8 57 9f 35 c5 61 f6 79 fa e ..eY. 3b.|..e.....

04800200 0 seconds] [Time since ref erence or first fra me: 2. Time Source Destination Protocol Length Info 71 2..322088000 sec onds] Frame Number: 7 1 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] ..000 000000 seconds] Epoch Time: 141 5615215.372018000 Romance Standard Time [Time shift for this packet: 0..* No.048002000 seconds] [Time delta fro m previous displaye d frame: 0. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.corexc hange.dllstx01..322088000 cust-74-124-12138.home TCP 1314 http→49 574 [ACK] Seq=38042 Ack=1 Win=46 Len=1 260 Frame 71: 1314 byte s on wire (10512 bi ts)._... 2014 11:26:5 5..com pc13.4 cc 92 0c 93 a6 bb f5 2a k ..372018000 s econds [Time delta fro m previous captured frame: 0.

... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .0 .0.corexchange.. ......0 .. . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). ... ........124.. ... = Differentiated Ser vices Codepoint: De fault (0x00) . . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. .. Dst: pc13. .. Src: cust -74-124-12-138... ... = LG bit: Globally unique address (fac tory default) .... . .138).......dlls tx01.. ... = LG bit: Globally unique address (fac tory default) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 . . ..co m (74.. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. . .....0. .. .. ..[Coloring Rule String: http || tcp ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..port == 80 || http 2] Ethernet II..1. ..home (192 ... ....11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ..12.. ....168..

home (192.1.138) Destination: pc 13.. Src Por t: http (80).dllstx0 1.. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a94 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138... = Reserved bit: Not set . Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 38042 (relativ e sequence number) [Next sequence number: 39302 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. Dst P ort: 49574 (49574).. . = Don't fragment: Se t ..... ... 0000 0001 0000 = Flags: 0x010 (ACK) 000...1..12.corexchange. = Reserved: Not .300 Identification: 0xf196 (61846) Flags: 0x02 (Do n't Fragment) 0. .com ( 74.168. Ack: 1 . .0...124.... Seq: 38042. .. .

E.. . .J|.. 0 ..0. .... .0.....0 ... .. 0030 00 2e 3e 95 0 0 00 18 0e 69 68 84 9d 34 31 88 b2 .. = Nonce: Not se t ....... . ... .N...dx.... 0040 19 75 63 c0 1 d 94 d0 30 61 c6 8a 8d 51 49 86 c0 .P.1. ....>.. uc. = Reset: Not se t ......... = ECN-Echo: Not set ... 0020 01 0b 00 50 c 1 a6 2b c8 f6 c7 9e 87 4e aa 50 10 .. `n. .:..@........P........ = Congestion Wi ndow Reduced (CWR): Not set .. .. 0.+.0a.. = Urgent: Not s et .... = Syn: Not set . .. ... 0... . .41...1 ...... .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x3e9 5 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2499] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. = Push: Not set .ih.. .. ... = Acknowledgmen t: Set . ... . 0050 17 05 24 3d 9 2 fb a3 ca 18 6c 10 .. ..... .. . ....QI.0. 0010 05 14 f1 96 4 0 00 31 06 3a 94 4a 7c 0c 8a c0 a8 .set .

.... 0090 31 53 03 4f 7 a 60 62 06 2a 60 69 ed 4c 0c 24 a1 1 S.3 00c0 55 00 83 42 c 5 84 62 1a a2 cb 61 ad d5 5f ac 35 U ..$=.A.N....w.Z3...... 00a0 4c 0d bd e9 4 1 78 96 69 81 a7 bd 30 77 37 c9 e4 L .*`i.5 00d0 98 c2 e3 2e 9 c d3 a5 81 12 e2 b7 dd 15 79 45 3d . ...i.....0w7.... 0160 88 40 af 73 e a 56 fe 40 2c 03 d0 f2 92 e3 a7 e7 ._........\H..Q.r... ..L. 00b0 8e 10 20 a1 e d 64 b0 fe 94 57 4a d6 04 c7 a2 33 .a.[... ..T..Y= 0130 86 87 bd 1d c a f5 7c 64 8a be 77 1a 17 62 c2 de .n. 0060 41 54 2d 02 a c b1 88 d3 6c f0 20 83 97 cb cf 5a A T-........B.r@00f0 50 7d ab 15 7 2 9c d9 30 77 67 96 4c dd fc 55 4b P }.yE= 00e0 39 eb 00 cd 5 b 9c 13 0e 4e c7 69 ae 92 72 40 2d 9 .d....*..l........yk 0150 e2 e6 a5 03 5 a 33 bb 6e f7 ea 52 d2 c7 ec f4 d9 ..8.. 0110 dd 3f dc de 0 8 c6 bc fe ae 86 0a 41 f2 20 99 76 .....l.. ..4}a~u....v 0120 3d 11 11 d7 5 c 89 d9 2a 1c df 1c ac ea f5 59 3d = ..0wg.. . .WJ..UK 0100 7e 35 3c f0 7 f a3 5c 48 9b bf c5 21 63 6e ff fa ~ 5<.......|d... .Oz`b.. 0140 07 f2 51 e7 e 4 1a a3 d3 cd d7 85 91 38 d2 79 6b .......... .. ?..L..6..!cn.\..L..Ax.$.R.ba 08 44 69 9c . }s...... .b.Di.i.Z 0070 22 12 02 54 a 2 2c ad 07 34 7d 61 7e 75 f5 ef 44 " ....D 0080 dc 7d 73 9b 4 c b5 36 bf ff fb 92 04 ea 8f f3 07 . ..b...

.r.9.K 0270 a3 1f c5 f7 1 6 34 c1 77 cf 67 22 04 ee dc 93 e0 . 01d0 73 7d e1 fa 8 0 c5 46 df 16 0b 6d f5 6f a2 ac cd s }...0.u.?... ......ba.un. 0190 6a 3c ab 33 b 7 b2 3f 0d a8 e7 69 77 64 91 f7 d0 j <.. .....XZ`^E..=iAn....w.OD...4.O~d?..@..S.V.W..`k.l. 0210 b1 dd d2 d5 f 4 6f 47 46 4b 11 d5 99 d4 8e c4 ae .C7r. .iwd. o. 0170 3f f7 14 75 6 e e9 fc 40 d4 08 14 62 61 c1 6a 19 ? .g6...a. ...s.H.8.X. ...oGFK. .......[..9... ...q.....m.3... 01c0 78 7f 4a b2 8 2 75 81 0c 90 bd d8 d4 17 20 4b ed x .......%I 01b0 29 cc ed 4f 7 e 64 3f 86 57 9f 94 32 17 38 7f d7 ) ... 0220 8c d9 52 f7 3 f 5f aa 1d f5 fd ff fb 92 04 e8 0f .....@.F.. .4.@..eUl..{^l. 0230 f3 0a 2c d3 0 3 58 5a 60 5e 45 aa 60 6b 0f 4c 0b .. 01e0 f9 85 47 22 f 5 58 98 00 dc d0 e0 08 5b 08 81 f8 .....G".Q...... .. ]j. 0250 bd 5d 6a f4 5 e 8b a3 12 9a 0c aa 71 eb 53 8e 95 .....L.p. K.. 0180 07 c1 3b a7 4 f 44 2c 72 f9 cb c8 ae 4c a5 a0 b0 .L...?_."b 0200 be d1 f7 57 6 f aa f7 48 94 39 ac ea 43 37 72 8b .2.....j...o.. 0240 cc 9f 56 0c 3 d 69 41 6e 96 aa 81 87 a5 30 d2 ae ..3...^... 0260 59 c2 8b 51 b 9 1d 7b 5e 6c 89 65 55 6c 80 bc 4b Y ..g"....J.. 01f0 a1 6f 10 1c 1 8 c7 94 b2 34 e0 70 9e 61 e6 22 62 .. 01a0 2b d4 6c 8c d 9 67 36 3b 02 33 19 8d 39 8f 25 49 + ..R.V..Wo.

.-ZP..4w.... l....v.._....D 02a0 f8 41 7b 00 e f 3f 50 6f 4b 34 2b ff df 8e d7 fd .`. .a......m\.9.e.>.^!...[@n..... A{..F 02e0 51 c9 7c cd e f 89 c3 a2 2a 01 30 2c e0 79 20 fc Q . 0310 0c 37 ac 9c 4 8 a2 e3 04 93 97 a1 93 cb b0 a5 ab . 02c0 a2 4c 66 48 d 4 de 09 13 bc 5e 21 1d 19 3c 78 05 .0.. 02d0 42 2b 25 b6 d 2 32 78 07 73 09 52 bd 4c f4 0c 46 B +%..u. . 0320 4c 58 8e a2 8 4 99 aa 64 4d 06 e1 a5 d2 b8 1f 35 L X.[..F.<x.......6. 0290 b9 6c a6 2d 5 a 50 8b 59 e6 5b ff 11 ff 61 8e 44 ........R..?. 0350 40 22 c3 3b e 7 ff be 11 60 9d fc 9d 5f 9c f7 ab @ "...*. 0390 4c 34 ef 6a b .Y.H.?PoK4+...Mb..?.. . .dM....y . 02f0 4c b2 86 04 8 3 1c 2a 8a 87 25 89 d4 75 80 05 bc L ...<"J 85.X.TC..}f.7......l....... 0300 81 89 ea 65 0 8 0a 9a d0 c5 4d 62 ce 44 8b 76 1d ...%.......D.........5 0330 8c c9 d7 d9 f 2 8e 6c c4 6d 5c e5 3e e3 73 7a 24 ...sz$ 0340 dd 8e 30 8f d e 58 7f fe 7d 66 db b2 3b 46 a1 0c .*..O*~ 0370 ff e5 3c 22 4 a 20 38 35 cc 39 06 25 f0 ba cc 12 ... 0380 35 16 e5 99 5 4 43 1f f1 4d 71 0a 11 a1 75 dd ab 5 .. 7... 02b0 5f f0 3f a9 e 0 3b 37 90 ff 3f a9 f6 7f e0 9b e4 _ ... .u.7..%.2x..... LfH..0..|.. 0360 56 9d fe a3 3 4 77 f5 db 36 ee c5 37 dc 4f 2a 7e V .L.s..0280 09 de 2e a0 8 6 ab 5b 40 6e 88 ac 81 1c 90 83 9b ..Mq..

nE.....#.... 0450 d5 27 c2 e5 f f cf bf a2 6a 07 ef ed ee 7e cb 00 ..1..h.!.h.. EE6...H.m.EZ...">|..m. 03a0 5e 22 da 09 7 6 b9 d8 6d dd 21 be c1 cf 97 22 99 ^ ". '... . 0420 ed 70 4f ef b 0 27 9d c2 f5 0f 96 05 b5 ca b3 3b ..c.. 04a0 46 c7 42 a1 5 4 8f 8d 34 28 77 5a ..... .. 03c0 36 d6 1a df c f cc cb e9 89 31 1c 68 ff fb 92 04 6 ...v... T..b..L....&.pc.... 0490 f3 f3 e3 cb d 4 d6 fc f5 a5 b2 6d 8c 5a 10 50 8b ..e..mh.~.*..:v99.eA..'... 0410 04 54 f3 59 2 b b9 10 23 f1 6e 73 9d 26 f1 ba a3 . pO...p0 0470 99 45 45 36 c 8 88 38 5c 94 48 b1 6d 1f ec 3a ee ......b ff 97 f7 ed 58 b6 f7 b3 d3 fb bf L 4.0. 0430 be 3e db d6 b b 7b 6c f1 af a5 4c 85 1f fc 9b 71 ..l..:... .....m.Z.s..j... 03d0 ea 0f f3 13 6 2 d9 03 08 13 70 63 86 cb 20 3d 23 .J.X........... 0480 45 c6 6e 45 f d c6 05 68 99 53 4f 5b ff 45 ca 1a E ....q 0440 ba 9e 93 73 1 b 22 3e 7c cd 00 4a cf eb df cd c1 .j..H..{.... ..... 03b0 20 22 d0 f9 f e d5 7b 7f 3a 76 39 39 f0 ef db d2 "... >..SO[.L.&...P.e'HD 0400 e4 bc b3 2c f f 2a f3 11 e4 c5 48 12 26 12 11 f8 .ns.8\...... =# 03e0 5c 4a e0 6d 6 8 0c 30 c7 01 7e 95 6c c1 84 99 31 \ J.{l.E. ...".~...1 03f0 2c e1 1e 4c e 8 65 ec 63 2c b0 2e e0 65 27 48 44 .... 0460 30 90 65 41 9 2 93 52 90 e3 45 5a f6 b6 81 70 30 0 ....Y+..R.

. .. I.><. 0520 75 2b u + No......000 000000 seconds] Epoch Time: 141 .eN..T 04e0 1a 2b 23 e5 b a 54 75 d2 47 9b 73 fe 3e 3c c9 5c ...4(wZ.T..m..{o.d.. 04c0 6a a5 65 4e c 5 06 0f 23 b3 0b 32 f4 09 9d 17 72 j .home cust-74-12412-138.^.... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =39302 Win=44105 Le n=0 Frame 72: 54 bytes on wire (432 bits). Time Source Destination Protocol Length Info 72 2...s. .322264000 pc13.\ 04f0 d0 8b 5e fc 6 d ba d2 94 df f4 9e e5 1e 15 68 20 .0a 0a 42 63 48 F ...dllstx01...Y....Tu.G.. 0510 e3 60 67 d8 c 7 9e 7b 6f da 9a 20 41 7a d6 aa cb ...PPV. `g.G. Az.BcH 04b0 6d 50 51 8a 5 0 50 56 92 f5 fe 14 17 01 d4 2c a6 m PQ. +#. 2014 11:26:5 5..!BG.#.(.372194000 Romance Standard Time [Time shift for this packet: 0.h 0500 1a 49 83 21 4 2 47 90 e1 0b 08 0a a0 64 e7 28 a2 .....cor exchange...2...B....r 04d0 a7 ae 19 47 0 f d4 fc 12 b7 9f 59 df 1f b7 95 54 .....

. ....0.0 ... .. ..00017600 0 seconds] [Time since ref erence or first fra me: 2... .. .0.372194000 s econds [Time delta fro m previous captured frame: 0...... .... = LG bit: Globally unique address (fac tory default) . ... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... .. ...000176000 seconds] [Time delta fro m previous displaye d frame: 0. ..322264000 sec onds] Frame Number: 7 2 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .port == 80 || http 2] Ethernet II. ......... .... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. = LG bit: Globally unique address (fac tory default) ...5615215. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. = IG bit: Individua . . .. . . . .. . . .0 ................ ....

. = Reserved bit: Not set ..1 24.home (192.dl lstx01.12.corexchange.12..dllstx01. com (74.1. = Differentiated Ser vices Codepoint: De fault (0x00) ...0.ho me (192. = Don't fragment: Se t .1..com (74.168..l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. Src Por .11 )..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f35 (20277) Flags: 0x02 (Do n't Fragment) 0.. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..168..124. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. Dst: cust-74-124 -12-138. ..11) Destination: cu st-74-124-12-138.co rexchange.1.. .. Src: pc13 ...

.. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 39302 (r elative ack number) Header Length: 20 bytes . .. D st Port: http (80)..0 = Fin: Not set Window size val ue: 44105 [Calculated win dow size: 44105] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] . Ack: 39302 .0 .. ....... .. ..0.. = Reset: Not se t .. .. ..1 ..... = Urgent: Not s et . = ECN-Echo: Not set . = Nonce: Not se t ....... ..... 0. 0 ...0.... . = Congestion Wi ndow Reduced (CWR): Not set ... Seq: 1... . = Reserved: Not set . .t: 49574 (49574). . . .... .. . 0000 0001 0000 = Flags: 0x010 (ACK) 000. .... ... 0.... . .. = Acknowledgmen t: Set . ..0..... .. .... = Syn: Not set . ... = Push: Not set .. .....

.dx.+......459094000 cust-74-124-12138.N. 2014 11:26:5 5.[This is an ACK to the segment in frame: 71] [The RTT to ACK the segment wa s: 0. I.. .. Time Source Destination Protocol Length Info 73 2..dllstx01..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c8 fb b3 50 10 .000176000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . No.. 0030 ac 49 18 d4 0 0 00 .. 0010 00 28 4f 35 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c . ..corexc hange.P..... 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...000 000000 seconds] Epoch Time: 141 5615215..`n. (O5@.13683000 0 seconds] .509024000 s econds [Time delta fro m previous captured frame: 0.136830000 seconds] [Time delta fro m previous displaye d frame: 0.P.509024000 Romance Standard Time [Time shift for this packet: 0..com pc13.E.home TCP 1314 http→49 574 [ACK] Seq=39302 Ack=1 Win=46 Len=1 260 Frame 73: 1314 byte s on wire (10512 bi ts)...

....0.......... ...12.......corexchange. . = LG bit: Globally unique address (fac tory default) .. . ..0 .. .124...co m (74.0...home (192 ... . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .port == 80 || http 2] Ethernet II.. ... .. . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ...138)...dlls tx01. . . Dst: pc13...[Time since ref erence or first fra me: 2.0 . . ... .... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. Src: cust -74-124-12-138. . ... = LG bit: Globally unique address (fac tory default) ... .. ... ....... ...459094000 sec onds] Frame Number: 7 3 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .

Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) ..168..... Src Por t: http (80).corexchange. .12. .. = Reserved bit: Not set .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf197 (61847) Flags: 0x02 (Do n't Fragment) 0. = Differentiated Ser vices Codepoint: De fault (0x00) .168.1. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.0. .124....dllstx0 1. = Don't fragment: Se t .. Ack: 1 . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.1..com ( 74..138) Destination: pc 13. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a93 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138...1.. Dst P ort: 49574 (49574).... ..home (192. Seq: 39302.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.

. ..... 0 . ...[Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 39302 (relativ e sequence number) [Next sequence number: 40562 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .... . .. ..... = Syn: Not set .. .0 . . = Acknowledgmen t: Set ... .... .. .. = Urgent: Not s et .0. .. .... . . 0.... .. = Reserved: Not set . ..... 0000 0001 0000 = Flags: 0x010 (ACK) 000.. 0..... .. ... = Congestion Wi ndow Reduced (CWR): Not set .. .... = Nonce: Not se t ..... .. ..0..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xbeb 0 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 ....0.1 ... .. = Reset: Not se t .... = ECN-Echo: Not set . = Push: Not set ... . .....

......... 00e0 cd c0 c1 00 5 1 6c 26 13 39 11 84 d8 4d 46 ad 2a .9.....7...0....vQ.d.n. 0010 05 14 f1 97 4 0 00 31 06 3a 93 4a 7c 0c 8a c0 a8 . 0030 00 2e be b0 0 0 00 54 4b 59 74 c7 29 6f a7 00 b9 .. .Mb 00c0 ad 4a c9 90 7 c ec ec 64 d3 9c b7 6e d4 da ca 92 .G 00b0 9e d0 54 31 8 4 e8 05 82 5e 25 f5 14 a1 bf 4d 62 .4 78 90 01 3b d0 17 e1 08 00 45 00 ..". 0110 f1 12 a5 04 2 f f2 f0 ae a1 91 78 . . ...C.l...T1..l....N..P.. 0060 c7 91 5d ca 8 c ee 5b 39 c6 2a bd 6c a9 42 3a 65 .....jI+-IUdR. . 0100 2e c5 52 59 8 2 ab b5 43 dc cd d5 1f 16 c6 a6 90 . . .1....RY.0a&LK.|... `n....t*r... J..0.. =[.=.)o.P.........!!t.. .. .. 0080 6a 66 ff fb 9 2 04 ea 8f f3 1e 4c d9 03 0c 1a f0 j f..]. 0020 01 0b 00 50 c 1 a6 2b c8 fb b3 9e 87 4e aa 50 10 .:..J|.... 00d0 c7 3d 5b f3 7 3 b9 b9 11 21 21 74 3b 06 d0 98 01 .s..z 00a0 18 ac 80 f4 9 9 30 c7 90 65 48 d2 43 66 e9 c8 47 ......Cf..F.E. ....*..{O..|..L.^%.Ql&..B:e 0070 67 b9 3d ec e c 52 ce 6a 49 2b 2d 49 55 64 52 a3 g .R.hz 0050 c4 da 7b 4f 0 3 46 1e 81 fb 30 98 e4 74 2a 72 84 ..TKYt. 0090 61 85 db 30 6 1 26 4c 4b 98 ab 64 07 a4 c9 81 7a a ...eH..[9..4..... .MF....d. .5<.+.* 00f0 17 0b 76 51 9 b 7c ff ef 35 3c f2 8c 22 b6 c6 8c ..dx... 0040 a3 fb bb 96 b 0 10 37 86 fb 34 db 6c b0 f3 68 7a ...@.

.....%K..m..:.B~ 0120 13 ef e5 f7 8 7 cf 45 9a 6a 2b 16 a7 52 2d 79 eb ..E.t..... ......... 01e0 01 06 15 dd c 0 8c ba 47 e7 7d e3 c8 e9 08 f0 6b ...j+.z._... 0150 2c ea 43 87 7 3 b0 93 b3 d3 bd 91 db 85 a6 97 6e .....s 0190 76 37 35 06 8 7 91 e1 3c 45 2c 35 a3 40 f7 2d d0 v 75.WF 0210 29 9e 67 a2 b 5 66 62 d5 8d 52 34 62 61 a1 54 3c ) .X... 01d0 73 a0 5e b4 1 0 e5 7a a4 95 25 4b ac 37 be ed c2 s .R4ba...s.A.5.. 0130 79 6c a6 8b 5 f bb e1 58 95 3a 1e fa ee c0 87 1d y l........n 0160 83 68 01 e2 9 5 80 0e 19 f7 b0 61 a0 69 b4 7d 69 . . 0140 d8 dc c1 07 d b c9 4c b0 46 17 2d 4c 91 9a 4e 1b ..T.... .E.......-L..... 01c0 fb 7d 97 f4 c 3 f9 6d f3 a9 bf 77 d7 ff ff f6 17 . h...T< 0220 5c 0a e2 c9 f f fb 90 04 e9 0f f2 ff 48 58 83 0f \ .<E..:.G...N..DH....5e 52 ac 42 7e ....L.#.w.. 01a0 a8 d3 be 24 4 9 23 b1 a2 da 8c 0c 89 d4 a5 64 67 .@.dg 01b0 d6 da c4 0e 9 0 b9 97 ee c4 bb c7 88 d7 9e a3 f2 . ....i.k 01f0 4f 5a a4 6d a b da 96 41 e8 1f 2c c1 10 3a dd 90 O Z..p........ ......F.R-y....}i 0170 24 41 b8 3b 5 5 85 c9 70 a5 54 ee 44 48 a2 c1 58 $ A.C.U.a.....7.... }.$I#... 0200 a6 69 8e 45 2 c 5d 2d bb 19 e6 ba 99 0c ae 57 46 . ..^...m. ..fb..-...g........}.X 0180 32 93 23 84 b d df 15 74 93 7d a6 fd c9 a6 c5 73 2 .. i.]-.}.x^R../..

........j...hQ..L.=..... .a..p 0300 2a 1f da 3c 6 d ed 9d 3b ed fe df f9 7e bf 65 c4 * .."J.Q-.. 0320 24 41 01 c2 b c b3 17 27 8b d9 a2 c2 ca af a9 cf $ A.a=..l 02b0 b5 85 b4 c0 b 9 1f 76 93 eb 6e 91 64 3e 7f 6b 4a ..a1.....v.#Ct. {.A...'...\.`..-^ 02d0 b7 e7 03 8e 8 3 da 22 46 50 cf 7c 36 3a d9 cd 79 ...Q 0270 d8 89 48 65 e e 87 ad d0 a4 f6 07 92 5d da a3 40 .....P.J!cFW: 0250 aa 15 4b 3b 7 4 98 6a c1 f8 3f 95 e4 c7 4c 1b ec .|. |....n.y 02e0 5b 30 e7 2e a c e8 fa f9 23 86 29 aa 5e 6a 4f 45 [ 0.`.... 0310 ba 83 80 23 4 3 74 b0 a5 b7 11 27 96 7e 04 10 fa ..d.@..... ..<k 0240 81 7b 14 ac 4 0 f4 a1 31 8b 0a 4a 21 63 46 57 3a ........y....~.AC.e.. :3Y......HX...1..\G..?. .... ....oha...~..=.|6:.. 0230 2a e0 5c 47 8 b 10 61 83 5c 0c 3d 19 60 0c 3c 6b * ..d>. .. ... 0260 aa e8 85 8a c 1 dc 9c 51 2d 96 df 85 af e6 8e 51 ......t.]. 0330 4e d9 e7 99 2 2 4a e4 41 b4 6f 68 61 c2 e1 a8 11 N . .^jOE 02f0 01 3a 33 59 3 b 2d 3d 2f 4d 97 bd df 68 51 80 70 .."FP...\..K....).He.. ..#.# 0290 2a 2b 8b 1a 3 d a1 86 b5 0d 64 a0 80 41 43 92 e4 * +....kJ 02c0 0e 7c d2 1f 9 f 11 c8 a8 ed 79 8f 1b 9f 0e 2d 5e .. .-=/M. 02a0 99 06 1e c6 a 5 b7 0d 60 8c 7c e7 61 3d e8 fd 6c ....<m....@ 0280 b1 c2 61 31 9 3 a1 f5 af 0e 5c d5 bc f7 50 f3 23 .....'...

=(L.k.R. 0450 50 8b 8f c3 4 .tQ.J 03f0 aa ef aa 8b 4 b a9 33 7f 64 54 93 d9 15 96 15 28 ..3.#... 0420 9a ff 96 6a 9 1 ea dd ac 5e 36 38 35 97 b1 c7 e3 .... *...... 03b0 10 1a 61 0f 5 4 80 2e 65 8e 74 51 06 db 0e 9e 82 . 0370 d1 23 00 e3 1 3 80 4d 12 53 35 56 4a 55 e8 e7 19 ..dT.m....S 0390 00 46 a6 6c a 0 6d c4 4c dc 18 33 1d a8 93 d2 27 ...' 03a0 e2 cb 11 45 1 0 43 72 d3 50 50 1e 0f 81 c0 6a 02 .t 0440 43 f4 d8 a7 7 d 7e 86 66 5f f4 96 2a 05 8a 92 8a C ..T.2=. ...........j.... ..e.. ..Gn.....A@.= 03e0 09 89 8a 1c 6 b c0 f4 21 70 a4 af fa 9b 03 c6 4a .......j.ZF+.0340 86 a9 21 14 7 f 32 3d 0c 17 1c 52 2c b4 2d 4a 52 .. *. . 0380 a1 e2 08 7e 5 a b4 78 ea c7 b9 ad de 62 35 a7 53 ....^. ... ."D....E..S5VJU...f_.HI. F. #.3.b5..*"..K..Cr..!.l.YM. . . 03c0 a6 cf 16 31 4 4 ff fb 92 04 e9 0f f3 11 3b d8 01 .M......a.leu&.1D.0P^X`d..L... 03d0 ef 2a e0 5a 4 6 2b 10 3d 28 4c 0b e0 b7 5e 0c 3d .. .......PP.. 0360 79 2e 20 19 4 8 49 e7 1b 12 e3 cf 2e ec a9 18 97 y ....}~.... 0410 e8 e4 41 40 d 6 59 4d d6 4c e8 e2 1a 0b 0e 12 8d ..L.!p. #{.. 0430 98 23 7b c8 0 d 30 50 5e 58 60 64 c4 2a 22 14 74 ........~Z.-JR 0350 48 89 c8 c4 e b ea 6c 65 75 26 d8 b1 91 e3 23 9a H .^685..x.( 0400 8a 2a 07 1b 5 2 a5 8c ac 22 44 a4 ea 8b 47 6e ae ....R. .*.

l#.home TCP 1288 http→49 574 [PSH.... ..: 0520 82 4a ..T./....9 90 4f 43 82 dc 16 9a 66 12 2f 71 P ... Time Source Destination Protocol Length Info 74 2.0V. .u-....+ KF.7.M. 0500 d1 fa 06 04 6 b ca aa aa 95 52 95 96 44 a0 01 dd . 04d0 cc 8a 52 98 1 4 7e 76 5a 24 50 54 40 09 47 9b 33 .X.D.... 0510 66 6c f2 2f f 6 69 05 2b 20 4b 46 10 18 9c ed 3a f l.Kr.com pc13..dllstx01.o. 04f0 fe c6 1f 7f 3 b c7 c4 a2 6f f7 b4 6f 93 95 1d e3 .f...yi..~vZ$PT@.!.... 04a0 2b a9 4c 3a d d 28 d7 53 33 6b 42 a4 2e 0d e8 09 + . .L:.i...R. ..... ACK] Seq= 40562 Ack=1 Win=46 .J.m. O..-\s.P.3 04e0 5e 9c 96 f6 4 a 1d 1c 57 cc 47 d4 c7 54 b8 ff f5 ^ ...W. ..corexc hange.+8....r..G.#=I.471094000 cust-74-124-12138.]L 0490 65 ff 6d f7 c d f9 30 56 2e f3 e6 8e 21 8d 18 b2 e ..R. 0480 36 a8 77 be 4 d f1 15 c5 e4 a5 4b 72 bb dd 5d 4c 6 ../q 0460 ca b4 e4 37 9 4 75 2d 0b b9 b5 2d 5c 73 aa b1 db .w.q........(.... J No.. 04b0 b3 4f b7 a9 e 9 35 0f e9 ab 71 b1 58 05 71 bc 5c .G..\ 04c0 4f 16 50 f5 b 6 bd 23 3d 49 e6 da 97 2b 38 c5 99 O ..I......S3kB.5.. 0470 1a f2 79 69 7 f b0 c0 98 89 83 d4 72 d1 6c 23 1a ...OC..o.q.k.........

1288 bytes cap tured (10304 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.471094000 sec onds] Frame Number: 7 4 Frame Length: 1 288 bytes (10304 bi ts) Capture Length: 1288 bytes (10304 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. .01200000 0 seconds] [Time since ref erence or first fra me: 2.521024000 s econds [Time delta fro m previous captured frame: 0. .012000000 seconds] [Time delta fro m previous displaye d frame: 0. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..0.521024000 Romance Standard Time [Time shift for this packet: 0. 2014 11:26:5 5.Len=1234 Frame 74: 1288 byte s on wire (10304 bi ts).port == 80 || http 2] Ethernet II.000 000000 seconds] Epoch Time: 141 5615215.

....1.. = Reserved bit: Not set ..... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .......home (192 .. = More fragments: No t set Fragment offset :0 Time to live: 4 . . ...138).. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4...co m (74. Dst: pc13.. .........0. = LG bit: Globally unique address (fac tory default) . ... ..0. .1.. .... .. .... = Don't fragment: Se t ......corexchange.. = LG bit: Globally unique address (fac tory default) .. ..... . .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 274 Identification: 0xf198 (61848) Flags: 0x02 (Do n't Fragment) 0.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Src: cust -74-124-12-138.. . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.0 . ..0 .........168.dlls tx01. ..124. . .... ...12. ... .. = Differentiated Ser vices Codepoint: De fault (0x00) .... . ....

..9 Protocol: TCP ( 6) Header checksum : 0x3aac [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. . ..... . . = Nonce: Not se t .corexchange..... .1.dllstx0 1. ... .. Dst P ort: 49574 (49574).. Seq: 40562... ACK) 000.. = Reserved: Not set . .com ( 74.... .0. = Acknowledgmen t: Set .....1 .124. .home (192.0 .. Len: 1234 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1234] Sequence number : 40562 (relativ e sequence number) [Next sequence number: 41796 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ... = Urgent: Not s et .0... .. ... Src Por t: http (80).. .. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = Congestion Wi ndow Reduced (CWR): Not set . Ack: 1 .12. 0000 0001 1000 = Flags: 0x018 (PSH. .168.. = ECN-Echo: Not set ... 0... ..138) Destination: pc 13..

..n. yJ.....y.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xe32 0 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2494] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..}g... = Reset: Not se t ... = Push: Set .. 0070 6d 63 5e 00 0 b 8f 03 cf a0 7d 67 ff fb 92 04 e9 m c^. .N.....g.. 0060 90 79 4a 8e 0 8 96 50 3c 44 36 1f 01 87 92 3c b8 .+..@.)...'W...#. ...0. . . ..+......<.. ....:......Q 0050 09 76 f3 9c c 1 f8 1e d9 27 57 cd 79 f6 6e b6 1c . 0030 00 2e e3 20 0 0 00 9e a2 20 e1 0a ae e5 67 0a 18 .. . ....P... 0. .P.o.. .. 0010 04 fa f1 98 4 0 00 31 06 3a ac 4a 7c 0c 8a c0 a8 .#W. .. .. 0080 0f f2 ba 23 5 7 81 ef 42 50 5a 46 4a f0 61 28 5c .... v....a(\ 0090 0c 24 e9 5c 0 c 3d 0b 81 82 a4 6b 81 86 21 78 15 . = Syn: Not set ..J|.dx.E... :}z. .1....BPZFJ.. ...... `n.. 0020 01 0b 00 50 c 1 a6 2b c9 00 9f 9e 87 4e aa 50 18 .. .....P<D6...... 0040 81 3a 7d 7a 9 9 23 13 6f df 2b 1c 2c 29 9b 91 51 . 1 ...

."i..=.+&.B.Z..c....o.ey.72sLn.U....*... 0170 89 e1 1f 72 5 f d0 ec 4d a0 42 c4 65 79 ec a3 91 . . 01a0 f4 10 1f da 8 9 64 d0 e2 63 90 c6 f2 dd 9e 3d 17 ...1.^.. ?.g...d.y.J..... 0180 16 23 81 c1 4 6 e1 45 77 21 bb 37 32 73 4c 6e 2c ..M.. .. H... 0160 51 74 1d bb f f eb 64 1d a0 05 8b 42 16 4e 58 d1 Q t.. . ..0 00e0 af ff 35 42 b 6 4b f0 36 e2 f5 22 69 13 18 7b 6d ...W"..E 00b0 e9 d8 dc a9 9 5 45 22 8d cc c1 7a 40 4c a5 d7 16 . ... #.F.=... &.|)..B.6R.3.sF 0150 e7 c9 91 24 3 c 58 81 5a 86 25 a9 01 e8 a1 8e 92 ..z@L. o3.&... . ......W 0100 3f 12 96 33 f b 6d a5 f4 6f 03 a6 5e 85 36 52 b7 ? .^.K...k.IQ. 0130 04 94 f4 2a 8 2 e6 5e 32 bf 8a 3e 5c 68 44 bd 24 ...>\hD..$ 0140 7f a3 f0 b5 7 d a6 b3 dc c4 cc 5c 6d 77 ff 73 46 .\. 0190 7f 3f 92 f3 5 7 22 1a 7c 29 8a 97 ff ce 79 d7 93 .^2....\mw....6...+Icf.B...NX.M.}....U..{...E".%...5B...{m 00f0 5d fd cf 10 3 e 7b 7e 9b 7b d1 20 6f 33 f1 eb 57 ] .. 00c0 a2 ca bf 26 a c f3 af 5e f7 d4 8d cc cd 92 1e 24 .d..$ 00d0 59 57 7f 42 e 2 8b 31 9b 2b 26 96 13 84 c6 d4 30 Y W. 0110 44 90 f7 55 b e dd 55 a4 90 2b 49 63 66 1e 0b a9 D ..Ew!.. . 00a0 90 48 cb ef 4 a 11 67 e5 d9 0d 96 a4 2c 97 cd 45 .m..r_.......!x....$<X.>{~....1...$..... 0120 a4 26 06 95 9 c 4d 10 fe 8e f3 49 51 a4 31 8d 99 . .

E.j... {Hpp.K. 0220 04 ee 0f f3 3 a 28 d6 83 0f 5a 50 5e 89 3a e0 61 .. 01f0 37 04 81 21 7 0 70 14 e3 04 71 35 1b 16 6b 94 49 7 .V..........#..j?... 0240 29 52 e4 6d 2 c d6 ba 93 e9 a4 22 28 aa d0 c2 4a ) R.. .01b0 69 89 17 f7 1 5 39 8f 9e ce fb 53 fa 7f bf 0f fd i ....."z..B=.I 0200 f9 1d f9 e2 8 b 66 b5 69 26 5a b4 e9 91 45 04 44 ...5.. . 02a0 f5 4a 40 2a a 7 85 10 f7 6f de 3c ae 1f a2 2a b0 ..."(.:(. .....0 0280 42 35 dc 98 3 e ad 22 7a 83 de 26 fd 23 e6 52 62 B 5.... .T.....a 0230 88 5e 0b e8 d 9 5c 0c 45 0b 81 68 93 eb c0 f4 a5 . 02c0 5e 06 65 16 a ...&...h..*2TV 0260 4f 77 71 5e 3 5 7a b0 69 01 07 a2 54 f5 4b e4 bd O wq^5z... 01d0 cf 15 a1 e4 5 0 8b ef f6 73 ee fe 79 3d 4d 37 74 ....:.. ^.s.*...m.....f. ..k.Rb 0290 38 4a d1 fb e 9 d2 3e 97 af a5 8a 6d ea 1f c7 ea 8 J....q5..(.<9..R.9. J@*....2ZH....R.i&Z...i....\....f.@.....S.E.>...>....H. 02b0 10 f4 ce 48 8 2 42 3d 82 a6 76 12 52 9a 6a 86 9a .....V]..y=M7t 01e0 d9 e3 56 5d 1 9 66 f5 2c da b5 8c dc ba f7 35 bc .o.v..ZP^.. 0270 eb 7b 48 70 7 0 0e 81 d9 40 f0 52 96 da a4 97 30 .. .P.D 0210 63 07 a9 c5 9 4 d2 ee 13 96 3c 39 02 35 ff fb 92 c .!pp.<.5.J 0250 a7 4d 79 84 3 2 5a 48 b4 0a 86 a0 f0 2a 32 54 56 . 01c0 aa 88 02 04 0 5 08 81 ca 28 af 56 b2 6a 3f ee 0b ..m. My.....

... 02f0 df e9 7d 70 3 5 4d ba f4 ff f6 a1 a6 8f a3 0c 74 ..... 0320 56 d7 83 20 f e a4 c2 f9 48 d2 ca 4b 6c 3b 59 38 V ...........x. h.y.|]. ..Kl.x........H.V....[...0..8 5a e7 70 6c 52 f9 eb 5b ce 3f 51 ^ .-.A...d. .t`ag 03a0 44 8c d4 0d 8 9 0f 12 15 41 f0 84 fd e8 dc bd 8c D . .]_m..c.. 03b0 e2 a8 d4 5e 3 5 99 ef b4 8a 32 68 48 0a 00 9c ff . 0370 0b 64 60 09 9 e 2d d5 a4 b7 85 f7 96 b2 79 c9 9c .2)B\.........h....=. .. 7V..2hH.z.t 0300 f9 93 32 29 4 2 5c 8d 7c 5d 8c 46 af 3c bb 28 80 .Y8 0330 c5 ff 36 82 e 2 a2 21 93 ee 0f 81 96 7a 9a a5 12 .Z...7..(.e. ......... 03d0 e0 61 88 5c 0 c 10 dd 5a 0c 61 0b ..W. 03c0 fb 92 04 ed 0 f f3 20 37 56 83 18 1a e0 64 08 9a . 0340 6c 4e 32 38 7 4 76 a6 5f 3f c5 56 f2 e6 ca d4 0d l N28tv. 0310 16 8b 7c d0 5 3 49 b5 5c f0 c3 08 7e 06 e0 3f 1b ..<.. d`. .$m'_J|.. 0390 74 a8 63 d5 e 1 78 f1 37 fe 2d 81 74 60 61 67 20 t . ..~.?Q 02d0 47 1e 68 de 3 d c7 57 9d bc 7f fe af c5 e1 d9 f7 G ....}p5M..SI.. .-...qn1.!9.. 02e0 81 e2 ba 71 6 e 31 c4 21 39 a9 d3 dd 7f 75 48 c7 .6..?.3'....F..._?.. 0360 ec f9 ad 9b b 4 5d 5f 6d 13 ad af ff ff eb fb 87 ..\....^5.. ....plR. 0380 ca 68 01 be 2 4 6d 27 5f 4a 7c 1e 78 ff ae d5 02 ...... ..!.uH... 0350 c5 c1 ac f9 9 8 b7 c8 08 30 ad 91 33 27 a1 e6 cc ..|......

.C. 0460 72 c3 2d 6e a 6 4e 7d 6f 6c 10 b9 cd 77 e6 e1 d4 r ...Y... 0470 f7 9d ab 3d 5 3 5f 5a 43 ff ff ba d4 e8 2a 3f 1e .?.*....U......+..y. 04b0 2e 5a 30 3a 7 7 5d 65 32 ba 90 dc 96 1f 43 07 be .[.wu.f 03f0 26 82 10 35 d 9 a2 08 e1 2c e5 d7 65 72 9c 55 d0 & ..ZZ..^........6..AS{ 04e0 49 a5 be 78 e 4 30 f3 ef 2c 87 49 ca 6e db a9 bb I .]...y...-n...M& 0410 46 86 a1 fd 9 d a0 fc 79 00 ec 5d 0a 83 17 f6 7a F .F 04a0 35 8a 5a 0a 0 5 da dc 97 77 75 11 57 21 a1 01 a7 5 ..Z.5...Z..l. ..g.5}.. 04c0 d4 a4 36 db 7 c a6 34 61 87 5f a5 b5 0c ee b3 33 .|.\.4a........BU. 0490 68 eb cd cb 5 e df da 35 7d bb e2 73 83 0d cb 46 h .w....W!..{. 0480 58 ea ad 0f 7 b 89 0a 0a bc 55 1f ee de db e9 17 X .... .. Z0:w]e2... ]..z 0420 03 d4 0e 07 8 0 d1 e9 06 87 dc ad 2a f6 e6 4c 2b .*?.6./.s.........._.. 0400 40 0b 20 92 a e 5b 14 b7 67 e0 71 9e e2 3b 4d 26 @ .I? 0440 d7 98 aa 30 b 0 12 b4 10 d2 2f d6 af 56 9a 25 0e .0...81 85 95 2b 41 ..3 04d0 44 d2 f5 07 9 5 bb 3f 0e f5 5e f3 6c f0 41 53 7b D .... a... ...N}ol..rA....L+ 0430 dc 5d c2 a5 9 b 1f 3c f1 1f 59 09 0d 0c b5 49 3f .U...a.....^...%...er.... 0450 52 00 92 85 4 2 55 1c 36 8a 2e 5a 5a ca e8 2b df R ...q.<.>.=S_ZC.V..... .. -16..+A 03e0 86 2d 31 36 c b 0e 11 3e 2c 72 41 fc 06 79 12 66 .. .

n. .471278000 pc13. 04f0 5f 6f b2 6f e d ef d4 85 9e f7 9d 12 0b 07 56 b3 _ o. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.521208000 s econds [Time delta fro m previous captured frame: 0.000184000 seconds] [Time delta fro m previous displaye d frame: 0... 0500 8a 93 64 f1 d f 57 f1 75 . 2014 11:26:5 5...471278000 sec onds] Frame Number: 7 5 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] ..00018400 0 seconds] [Time since ref erence or first fra me: 2. Time Source Destination Protocol Length Info 75 2.d...000 000000 seconds] Epoch Time: 141 5615215....I..cor exchange.home cust-74-12412-138.521208000 Romance Standard Time [Time shift for this packet: 0.0...x.o...u No..dllstx01..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =41796 Win=44100 Le n=0 Frame 75: 54 bytes on wire (432 bits).W.V.

. . . ..11 ). .co rexchange... = Differentiated Ser vices Codepoint: De fault (0x00) ...........168.0 ...0..... ......0.... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ..138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..... ..00 = Explicit Congestio .dllstx01. . . . ....com (74.. .... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00..[Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . Dst: cust-74-124 -12-138.. = LG bit: Globally unique address (fac tory default) .. .. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .0 ..... .. . . ... ......1.. ...1 24..port == 80 || http 2] Ethernet II. Src: pc13 . = LG bit: Globally unique address (fac tory default) . . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)...home (192.. ..12..

.corexchange. .138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.124.. 0000 0001 0000 = Flags: 0x010 (ACK) 000. ...1.. = Reserved bit: Not set . Seq: 1... Src Por t: 49574 (49574).ho me (192..n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f36 (20278) Flags: 0x02 (Do n't Fragment) 0.. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. com (74.. .168. D st Port: http (80).0. Ack: 41796 ....dl lstx01. = Reserved: Not ..... .11) Destination: cu st-74-124-12-138.12.. = Don't fragment: Se t . . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 41796 (r elative ack number) Header Length: 20 bytes ....1.

.... .. (O6@. .. . = Reset: Not se t .. = ECN-Echo: Not set . ..... = Urgent: Not s et .... . 0... . ... ...000184000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . ..`n.E.. = Acknowledgmen t: Set ... .......... 0010 00 28 4f 36 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .0 . = Push: Not set ...1 .... . = Congestion Wi ndow Reduced (CWR): Not set ....... . .set ...P. = Syn: Not set .. D.. . .... . ....dx.... 0030 ac 44 18 d4 0 0 00 . ......... 0....0.. ...N..+.. .. ... .0. 0 ..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 05 71 50 10 .....0 = Fin: Not set Window size val ue: 44100 [Calculated win dow size: 44100] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 74] [The RTT to ACK the segment wa s: 0. ...qP. .0. = Nonce: Not se t .

649030000 Romance Standard Time [Time shift for this packet: 0.port == 80 || http 2] . 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.649030000 s econds [Time delta fro m previous captured frame: 0.127822000 seconds] [Time delta fro m previous displaye d frame: 0.home TCP 1314 http→49 574 [ACK] Seq=41796 Ack=1 Win=46 Len=1 260 Frame 76: 1314 byte s on wire (10512 bi ts).dllstx01.corexc hange.12782200 0 seconds] [Time since ref erence or first fra me: 2. 2014 11:26:5 5.000 000000 seconds] Epoch Time: 141 5615215.com pc13.599100000 sec onds] Frame Number: 7 6 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . Time Source Destination Protocol Length Info 76 2.No.599100000 cust-74-124-12138.

..168.corexchange.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.12.. . .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). . . . .124..dlls tx01.....0 . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4... = Differentiated Ser vices Codepoint: De fault (0x00) .... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.... ......00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf199 (61849) Flags: 0x02 (Do .... . ..Ethernet II.. .0.. ....... Dst: pc13. . . ....co m (74.......home (192 ..... . . .. ..0......0 ... . . = LG bit: Globally unique address (fac tory default) .1.138). Src: cust -74-124-12-138... = LG bit: Globally unique address (fac tory default) ..... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . . ... .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ...

.1. 0000 0001 0000 = Flags: 0x010 (ACK) 000. . Dst P ort: 49574 (49574).. .... = Nonce: Not se t .1. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 41796 (relativ e sequence number) [Next sequence number: 43056 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .138) Destination: pc 13.168..124. .n't Fragment) 0. .....home (192.......dllstx0 1. Src Por t: http (80).. Seq: 41796..0. = Don't fragment: Se t . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.com ( 74. = Reserved bit: Not set .12...... = Reserved: Not set . . .. . .. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a91 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.0 . Ack: 1 ....corexchange.

= Urgent: Not s et .1. ...N..E...X...c. ...0.i!. ..{.. ... H.. . ... . 0030 00 2e ca ff 0 0 00 90 33 f0 a2 86 58 b1 d6 23 06 .. .. . = Push: Not set .#. 0. 0020 01 0b 00 50 c 1 a6 2b c9 05 71 9e 87 4e aa 50 10 . 0060 77 f5 87 8a 0 5 ec 3e 6a a1 a4 bd .. = Reset: Not se t .dx... .@... ..q........ 0. . = Syn: Not set .uz. .....0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xcaf f [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . S... 0040 19 53 b0 30 0 9 75 7a ba 69 21 e0 a2 fb b7 2f 7a .. .:..+....P. ...#... .. 0010 05 14 f1 99 4 0 00 31 06 3a 91 4a 7c 0c 8a c0 a8 .. ..J|.......... .3. 0 ..... .. = Congestion Wi ndow Reduced (CWR): Not set .1 ....0. `n..P.0... = ECN-Echo: Not set ./z 0050 8e 48 b1 c3 3 e 4c d1 23 e5 b9 8b 7b fc 63 92 2e .. .... .... .....>L..0. = Acknowledgmen t: Set ......

.... -p]....^.. 0080 de f9 fe 96 b 2 64 f8 d7 8d 78 5a 21 7e c0 f4 ff .z.. 00a0 d0 61 28 5c 0 b 9c db 5a 0c 61 0b 81 74 9b 6b 41 ..4 00f0 32 00 71 71 1 9 c7 d0 51 e0 c3 61 eb 9c 47 7e 19 2 .....P 0110 f1 a5 ae e1 7 0 c2 f7 2b af 5b e8 48 f1 16 08 74 . .72 7d 1e 3c 5c w ...+.? 00e0 b7 ed ed c6 b 0 80 0b d7 15 09 45 de ba 3e 8b 34 ..Z 0150 c0 d9 a7 18 3 0 e4 28 b1 9f 46 dc d1 9f 3f 74 fd .Fq.xZ!~....A.. ........~...$q._Z~..'... .t.R. 0100 63 aa e6 24 c e 27 fb fa 1b 4c d3 63 a8 54 9c 50 c ..*.. 0160 fe e3 ba db a 4 df 8b ce c1 b1 67 93 75 40 36 da .(.. 0140 75 f7 7e f1 e 7 fd bc 88 23 0e 2e 87 84 e5 93 5a u .r}..c...][..u@6... ..}g...$. 0090 fb 92 04 e7 0 f f2 db 37 56 83 0f 2a e0 5f 27 fa ....t 0120 89 86 32 33 5 0 aa ed 2b bc 71 c6 5e a1 81 d5 a4 .....+.F.a.q. .. ..kA 00b0 86 2d 70 5d e a 5f 5a 7e fd 8a bc c2 84 24 71 99 ..G~.#.. ... .... a(\..H.d.23P.Vky} 00d0 26 5b 91 cf e 1 5e b3 ba 7d 67 8c 7a f8 52 2c 3f & [.. 0170 2e 18 05 ce 2 9 85 47 f7 53 b7 5d b5 c3 12 62 5a .E.... ..._'...Q. 00c0 b2 98 41 ea d f 14 4d c9 e8 9c 19 b6 56 6b 79 7d ....c...q..Z..?t...[.R7.>j.p. 0130 fd e3 85 c4 d c d7 cc 63 96 ae a1 5c 96 5d 5b 0e ..L....qq.a.. ..>.T.^.....<\ 0070 5c b4 81 a3 4 6 71 cf b4 d7 13 71 0f 7f 52 37 eb \ .0...M.\..g..7V...

.V..P..> 01f0 b3 73 03 11 3 3 24 29 22 82 01 a9 8e e3 32 2e c9 ... ..\.2..fB.Be... 0270 ab 3c 22 39 3 6 17 d9 ea d5 b7 e8 ea bc 82 75 8b . 0200 e7 8a e6 fa d 1 37 52 66 06 da 45 c6 5b 3e c8 3e ...NW.cw..bZ 0180 24 a5 54 42 6 c ce 2c 0e a0 72 d8 95 6f 27 71 ff $ .B...O 0220 30 e7 d2 fa f b ab 9a 69 93 57 fd 37 56 73 8e 67 0 .g 0230 4d ff fb 92 0 4 eb 8f f3 00 37 56 03 18 42 e0 5f M ..._ 0240 a7 1a d0 61 e 8 5c 0c 50 d9 58 0c 61 0b 81 73 9a .$...JY 01e0 06 17 10 33 1 9 dd 4e 57 fe 79 23 e0 96 18 9c 3e ..3$)".[>..'...... D]+f.a.....3). l.o'q...*.i... 01c0 8c 32 e7 fc e 7 e5 fd da 20 44 5d 2b 66 c3 2a 85 ..o!...B.f. 0280 cf fa 24 f1 8 5 08 f3 aa 46 f4 b7 ce d0 4f 48 86 .].....3. .( 01b0 39 0a c2 3b 4 2 f9 ee ed e7 a8 1b 6e 79 51 cf ff 9 .. .....TBl..7Rf.nyQ.[..W.....B..a..> 0210 3b 14 33 29 1 2 07 1c 8f 56 1f 42 65 de 61 d5 4f . ..|....S.. U. 0250 eb 41 86 25 7 0 3a 17 1c da 3d 1d 83 c5 7a 1f 48 .N.a...X.G.. <"96...)...OH..H 0260 78 85 0c 42 1 d 63 77 15 92 28 b1 4d 8e f2 5b 12 x .......m 01a0 7a cc ac b3 3 4 50 1b fd e4 66 d9 ff db c6 e6 28 z .E.....s......7V... 0190 14 6c f3 03 2 7 a0 af b3 66 42 f7 b1 7c e0 96 6d .y#.. .(.7Vs.u..i...F. 2.. 01d0 d7 55 aa 6f 2 1 bd 4e ed 14 69 03 ad 10 82 4a 59 .%p:.z.M.=... . s.r. A..4P....

.......9OL\y. 02f0 ad 09 02 09 e f d3 f0 cf 71 4c 6d 72 89 53 bd 71 . 0390 ea 38 c1 8c 4 d 1f cf 94 2e 8b a3 ad 69 bd 8e 3e ..D..!.m....S 0310 4c 5b a8 21 5 b 5e 16 ba 5d 6a 53 c0 97 f0 50 60 L [..d....p.. ..P.. ..B..U 02b0 ba 6d 79 ef 2 1 e9 6c 02 13 44 8f 31 21 78 82 c2 . 8.. ...]jS..tJ.. E*.. 0340 3d 5e 49 4c b f 70 9d 3b 50 a0 d9 b5 ca ca 9c 5c = ^IL...$3p... i.. 0.$..... 02e0 ac 02 e3 9a b d 44 31 76 83 87 f6 c0 d8 97 e4 d1 . 02a0 ff da 16 23 3 1 58 c3 40 a0 a9 eb 58 62 6d 84 55 .....%.......Km..4.. my..![^.'..... .....w. 02d0 25 4b 89 99 1 9 b9 c9 eb 18 24 ab cd 5a 7b 3b 9a % K... 0330 9a 69 d8 6e b 1 fb 39 4f 4c 5c 79 e6 67 03 f8 ed ......+..9..g.> 03a0 94 83 f1 2f 4 .@.\ 0350 79 23 8e a2 d 7 20 79 33 ba d0 e2 57 de dd 06 2f y #.... y3.l..@.. 0380 1f d3 18 cc 8 5 40 f4 24 33 70 82 4b d6 18 bc 9d ...Mt.M../ 0360 30 cf fa a3 2 5 c0 b8 42 d6 13 b2 84 6f e3 71 a3 0 .0290 46 1f 99 34 1 0 8b 4d 74 ef e1 74 4a fb d9 ff 7f F .....n....1!x.K.W......K. 02c0 c5 c0 d5 d2 0 e 0c ef 4b b5 99 27 a4 14 f2 cc d8 .. 0370 b9 45 2a d6 e c ef 37 7f bf 79 1f 77 f3 bf fd 83 .q...P` 0320 62 69 ef 9a e 7 96 95 08 39 15 b1 f3 a1 6d bb 07 b i.2.qLmr. .Xbm.Z{...D1v.i...S..7..y...o...#1X.q 0300 d1 30 1d 32 a 0 64 83 12 2b 15 4b 6d 12 ae b1 53 ...

-1.`. 0410 b2 0c d7 c7 a 7 4b 28 5d 2d 1d 9d df 18 5e dc 3f ... 0440 84 9c 39 ec 9 d 3d d3 33 3f 7c ab c7 9e 08 9f 79 .....'.....!N0P.'c. B.ouD 03b0 a6 c8 74 55 e 6 dd ad 0f 42 52 42 a2 00 a9 c3 22 ..2al. .yu.r.j|K...9.V..XRI.RM...h. 0480 4d b6 d7 0c 6 a 7c 4b a7 f7 a7 c6 b2 e6 8c 35 42 M .. ..HV... .a.?y..^ 03d0 cb 22 b7 ff f b 92 04 eb 0f f3 0a 48 56 03 12 3a ..? 0420 67 e7 50 98 5 7 49 b5 b8 58 52 49 13 8c 85 b8 4a g ..tU." 03c0 c2 89 38 34 5 f 87 de c1 10 8d 2f 2e f4 3d 8e 5e ... .L...5B 0490 b7 47 10 f1 3 7 47 6f b7 32 61 6c d9 12 14 bd ca ..q.2 c2 e3 71 a2 40 e4 34 bc 6f 75 44 ...>....4..... G. W.......K(]-...J 0430 94 42 ac 73 0 2 da 3a 14 3e 2c 70 aa 92 27 bd a9 .x.. 0460 9e ed 05 d6 9 a 05 bb 7b db 12 e7 78 15 96 19 a4 . ....../B...=...o:...2.. ..: 03e0 e0 57 c5 fa d 0 61 89 4c 0c 94 bf 56 0c e1 09 81 . 0470 9d b8 07 b2 7 2 e4 e5 a8 3b 6f 3a 9c 60 b9 da ef .y 0450 e3 02 68 1d f 0 f9 e3 f4 6d 7f 79 75 93 b1 a7 f2 ... .....p...^. 04b0 ad b8 c0 81 f 5 e2 ec 9f 47 9f 27 .. 03f0 91 97 eb 01 8 6 2d 31 0b 52 4d 09 27 63 b9 44 c1 .m..{.@. ".:.P...0.....D.84_... ..../.. ..s..7Go.... 04a0 76 69 d6 e9 a 7 bc 32 e6 c7 f4 bc 3f 79 e2 02 a2 v i....BRB.. 0400 da 09 30 06 5 2 e7 21 4e 30 50 f4 1a 68 f9 56 8c .WI....V..h.3?|.=. ..R..

668843000 s econds [Time delta fro m previous captured ..618913000 cust-74-124-12138.'.d.668843000 Romance Standard Time [Time shift for this packet: 0..|... 2014 11:26:5 5.7...). 879 bytes captur ed (7032 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10./D..YC.v. 04d0 44 83 9d ab 2 9 1c 21 1d 42 f9 2f 44 e7 44 bb 9b D .5. Time Source Destination Protocol Length Info 77 2. .G..w_.Fk{.gDs..!. 0500 28 7b c8 59 4 3 99 1f a8 75 a2 0a 2c 54 3f 4d f8 ( {....Hy. b.....SM. ./}o..dllstx01.D.. 04f0 00 28 71 55 8 7 7c 8f 35 84 46 6b 7b ff 53 4d ff . 0520 4f e2 O . ACK] Seq= 43056 Ack=1 Win=46 Len=825 Frame 77: 879 bytes on wire (7032 bits )..home TCP 879 http→49 574 [PSH.8b 77 5f 9a ae . 04c0 91 62 01 b8 3 0 3b 1f 76 96 43 f8 d6 64 b1 46 85 .u.0.com pc13.. 04e0 b1 8c aa b2 d 0 c5 e3 07 67 44 73 90 b5 37 02 0a ...T?M. (qU..... No..C.B.....corexc hange.F. 0510 5e b6 d6 ff 2 f 7d 6f fb 9e 95 94 85 48 79 09 85 ^ .000 000000 seconds] Epoch Time: 141 5615215..

... .. ..0.. . . . .... .0.. .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .........frame: 0.. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).port == 80 || http 2] Ethernet II..0 . .... = LG bit: Globally unique address (fac tory default) .0 . .01981300 0 seconds] [Time since ref erence or first fra me: 2. .618913000 sec onds] Frame Number: 7 7 Frame Length: 8 79 bytes (7032 bits ) Capture Length: 879 bytes (7032 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ......... .. ........ ..... = LG bit: Globally unique address (fac tory default) . ... . ...019813000 seconds] [Time delta fro m previous displaye d frame: 0. . = IG bit: Individua l address (unicast) Type: IP (0x080 0) . ........ . . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ........

.1. = Differentiated Ser vices Codepoint: De fault (0x00) . ..12...12. Src Por t: http (80).00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 65 Identification: 0xf19a (61850) Flags: 0x02 (Do n't Fragment) 0.dllstx0 1. ... Dst P ort: 49574 (49574)... = Don't fragment: Se t .124...11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Src: cust -74-124-12-138.138).home (192 .. Dst: pc13.1. . .corexchange. .. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..home (192... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.co m (74.168.168.1.. = Reserved bit: Not set .138) Destination: pc 13..com ( 74.dlls tx01.. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c43 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.124.0.corexchange.Internet Protocol V ersion 4.

..... .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x46e 7 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 . .....1 .. = Push: Set ... = Reserved: Not set . .. . = Reset: Not se t ...... . . 0000 0001 1000 = Flags: 0x018 (PSH.... . 0.. .. = Congestion Wi ndow Reduced (CWR): Not set .. = Nonce: Not se t . .. Len: 825 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 825] Sequence number : 43056 (relativ e sequence number) [Next sequence number: 43881 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ... . . ..... .. Ack: 1 .0 . = Syn: Not set ... ...... 0. .... .. = Urgent: Not s et . . . .0........ = Acknowledgmen t: Set .....Seq: 43056. ACK) 000. .... = ECN-Echo: Not set .0.. 1 .. .....0. .. ..... ..

.0.E...|N. E.3R. 0020 01 0b 00 50 c 1 a6 2b c9 0a 5d 9e 87 4e aa 50 18 .<k..f....P.F..r. 0080 cd 90 93 3b 4 9 6f 52 ad fd ff fb 92 04 e9 0f f2 ..[SEQ/ACK analys is] [Bytes in f light: 2085] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..! 0050 37 bc 14 c1 e a cc e5 e2 aa 28 ff 17 33 a2 9b 12 7 . `n........... 0090 dc 20 d6 83 0 f 42 50 61 e6 ba d0 3d 88 5c 0b d4 . .. 0030 00 2e 46 e7 0 0 00 27 c4 d3 5e 36 bb 65 f2 be 50 .P 0040 a5 60 2e 2d 8 a 72 c3 01 60 64 5a e8 60 1a c6 21 ... a...P.\.^6. 00a0 ff 5e 0c 3c 6 b 81 6a 1e 2c 01 84 8d 70 1e b4 24 .... .\..g..IoR......+.]..j......Y. . 00c0 a7 96 82 1f 7 c 4e 14 aa c2 4a f6 0a 92 ac 92 4f ..4. ^.E.... ....1..%..$ 00b0 ac 45 2c 33 5 2 13 1d 0c 90 e9 59 bc 34 ff ca 20 ..4... 00e0 3b f1 f2 b0 4 6 87 5c ce 6c 70 bf 58 7d 29 65 d7 .e..(.@.F.. ..J......`dZ....N. .3...'.(..lp..<CJ|.dx. . 0060 e3 16 28 c0 4 6 de a8 66 aa 93 b2 5b 32 5d 5d 2b .8.B. `.=...O 00d0 a7 9c 66 d4 1 2 97 d3 f7 38 d6 be 1f 15 08 42 c4 .-..)a....BPa..F. ...f.. .. 00f0 37 ae 45 ed 9 7 29 61 94 30 aa 84 89 99 11 67 19 7 . ..p..X})e.[2]]+ 0070 99 91 17 34 a e ec ba 25 cd bc 9e 97 ee d7 4d df ..`.....M.. 0010 03 61 f1 9a 4 0 00 31 06 3c 43 4a 7c 0c 8a c0 a8 ....

. .u.{YE.. ..7......q.$]c.D..."[..CO._.ky..r9{...D. .......... 01a0 36 0a 75 d5 9 6 72 2e 45 5f 39 d8 1b fb 5c a9 7f 6 ./.. 0130 8f 08 0a 69 6 3 ef 1a 6b 79 ab ff fe 33 57 71 a2 .e=..&....t...... 0120 af 09 d6 c1 7 d 03 b8 dc d6 a1 65 3d 18 af 9b b6 .S 01e0 b6 9d fb c6 2 2 03 8c 22 5b ba b2 0a 26 44 fc 6f .y....a.".. .V. 0140 20 e9 41 c6 6 6 81 a1 4c 56 1e 16 2d 22 90 12 58 .. :....../..... ..]nY.. 0110 00 22 92 d1 d 2 37 e6 d2 a8 02 53 b5 92 e2 2f 12 .&5...F3J.. ...'...o 01f0 b7 e7 f2 a8 8 d 3e 22 1d 26 35 15 19 1f 8c be d7 ...r.WD..Q.sh.....E_9.Lu..>"........ 0210 11 a0 99 65 b .. 0160 ec 3a b2 2f 8 d ce a2 97 f5 cf 98 52 56 da a4 52 . ". .3Wq.. 01b0 4b 33 90 c2 a b 64 bf 79 7f 5f 95 cd da e4 26 17 K 3...&D. 0200 c7 f0 c6 7b 5 9 45 bf a9 cd a6 61 8e 18 0e bc b9 .S. ..f. .H 0180 42 4e 9c 57 4 4 85 31 18 60 81 a9 d9 71 e2 20 b2 B N.._ 01d0 85 d5 9c 2c 4 4 bd 81 aa b1 24 dc 52 84 b0 7f 53 .d....R 0170 0a 86 2c 74 0 8 73 68 0a ae ca 14 ee 56 d8 0c 48 ...RV.X 0150 81 b6 3d 8e a 9 eb 2e e1 0a 9a e6 c8 24 5d 63 0e .$.0100 61 06 43 4f 0 f b2 4c 75 8c ca 9e 5d 6e 59 1a 00 a ..1.A.... .LV..`...... 0190 6d a9 51 1b 7 2 39 7b 96 ee 46 33 4a 04 bf 9a d1 m .}.R. 01c0 bb df be ab 4 4 df 0e 5e de b9 ee ef b2 27 bd 5f ..=...^..\.ic...-".

..1.=.A...x.6).....x. 0280 ae b7 89 07 f 2 3d 9a bc f5 7b b1 22 d4 c5 0f 1d .....q.j...C.o9>m.."........O.V@oY. 0220 cb 42 51 73 7 a 6b 2e b1 76 24 bb ff fb 92 04 ec ....... $]J...{.m..=."j.>.....Ao..os.Y4... 0320 5b af 90 e0 1 d 09 0d 8f 92 01 77 .....i..*... 7.P 0260 1e 55 ba 1f 6 a 80 fc 05 d5 94 c0 41 6f c4 78 8a .. ..J..v$.. 02d0 d6 e4 0f 4a f 5 bc 99 6f 39 3e 6d d1 66 d9 14 12 .4.....{...=U.... ..TAmYQd55 02b0 e9 37 9e 22 6 a bb e4 03 d2 c1 d4 00 11 17 69 00 .. 0230 8f f3 1f 60 d 7 03 08 13 72 5c 86 ea f0 61 63 5c .}. 0270 da 3e d2 8a e c 95 01 78 1c 15 3d 55 03 90 be ba .4mR.@...`.. . ..3 96 7b c0 59 23 a8 59 34 1a e5 8f . ..f.. ...Y#. 0300 12 24 5d 4a b 5 86 90 ab 18 9c 52 f1 6f 73 ed ea . >......_.R..]......e. 0250 58 54 a1 fa d a 92 2d 9b 40 e4 43 d3 a0 a6 08 50 X T. Pe\. BQszk. 02c0 52 61 60 0d 1 2 5d c5 91 22 98 91 c6 8e e4 75 ef R a`..ac\ 0240 0b 50 65 5c 0 c 3d e7 01 92 9b ab 41 84 8d 71 c5 ..r\.... 02e0 4a 5d 85 0b d 5 3e 9b de cc 13 9f 2a e9 fb 5f 84 J ]...... 0310 b8 95 7d 8b 0 d 31 a4 08 88 34 6d 52 8f a5 c2 e1 .. .. U.z..... 02f0 8a d5 6b 01 9 7 56 40 6f 59 82 6d ad d2 4f ae e6 .-."....n 02a0 2f 06 9a e9 e 0 eb 8f 89 54 41 6d 59 51 64 35 35 / .r. 0290 cd f4 36 29 1 6 7a eb 1c 93 2e 91 72 dc 34 00 6e .u...k.

dD.dllstx01.669008000 s econds [Time delta fro m previous captured frame: 0.669008000 Romance Standard Time [Time shift for this packet: 0... L.....f.9. 0360 a5 4c 05 43 e e 2b 6b fd b9 62 a3 b4 db f4 2a .-.-.ac 98 52 7b 79 [ .b..cor exchange.......C..w.619078000 sec onds] Frame Number: 7 8 . 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.* No.7...R{y 0330 6a 2c 37 e9 2 d 8f 23 91 ad ef 2d 01 44 09 97 67 j ....619078000 pc13.+k..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =43881 Win=43578 Le n=0 Frame 78: 54 bytes on wire (432 bits)..000 000000 seconds] Epoch Time: 141 5615215. 0350 3d 47 f5 f8 c d 66 92 39 bb 50 6f 2f 8b ac 63 2e = G..home cust-74-12412-138.Po/.~Xx...#..00016500 0 seconds] [Time since ref erence or first fra me: 2.g 0340 b9 64 44 d4 a 5 ae 92 7e 58 78 d1 f2 c5 da f3 fc . 2014 11:26:5 5.. Time Source Destination Protocol Length Info 78 2..D.000165000 seconds] [Time delta fro m previous displaye d frame: 0.c.

.1. ...168.. . ....12.. .. .. . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . ......co rexchange.1 24... .0. . ..... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ... ....... = LG bit: Globally unique address (fac tory default) . ..... .0 ..138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4... Src: pc13 .... ...11 )....0.com (74... .. = LG bit: Globally unique address (fac tory default) . ..port == 80 || http 2] Ethernet II..... .home (192. .. .Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). .. ..dllstx01.0 . Dst: cust-74-124 -12-138...

Ack: 43881 .. = Reserved bit: Not set ..1. = Don't fragment: Se t ..1. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.12..168.124. com (74.0..11) Destination: cu st-74-124-12-138... = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.lt.. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment ... D st Port: http (80)..138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f37 (20279) Flags: 0x02 (Do n't Fragment) 0.. . Seq: 1..dl lstx01. .....ho me (192. .corexchange. Src Por t: 49574 (49574). = Differentiated Ser vices Codepoint: De fault (0x00) . .

.. 0010 00 28 4f 37 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .... . .... . .number: 43881 (r elative ack number) Header Length: 20 bytes .0 ... .... ... 0000 0001 0000 = Flags: 0x010 (ACK) 000.... = Reset: Not se t . .dx.......... = Syn: Not set .. . .J| .0.. . . . = Nonce: Not se t .... .0 = Fin: Not set Window size val ue: 43578 [Calculated win dow size: 43578] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 77] [The RTT to ACK the segment wa s: 0... (O7@..`n. . .. 0 ......... = Reserved: Not set ... ..1 . . 0.. .. = Acknowledgmen t: Set .000165000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ..... ... .0.. = Urgent: Not s et ......E........ ... ...... = ECN-Echo: Not set .. = Congestion Wi ndow Reduced (CWR): Not set ... 0. ... = Push: Not set .0..... .

689102000 cust-74-124-12138..com pc13. 0030 aa 3a 18 d4 0 0 00 ..+.. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.689102000 sec onds] Frame Number: 7 9 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] .corexc hange. ..N.07002400 0 seconds] [Time since ref erence or first fra me: 2..739032000 Romance Standard Time [Time shift for this packet: 0..home TCP 1314 http→49 574 [ACK] Seq=43881 Ack=1 Win=46 Len=1 260 Frame 79: 1314 byte s on wire (10512 bi ts).P.dllstx01.000 000000 seconds] Epoch Time: 141 5615215. Time Source Destination Protocol Length Info 79 2. 2014 11:26:5 5..739032000 s econds [Time delta fro m previous captured frame: 0. No..070024000 seconds] [Time delta fro m previous displaye d frame: 0.P..0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 0d 96 50 10 . :.

.. . .1.[Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ...........0 . = LG bit: Globally unique address (fac tory default) .. .... Dst: pc13.. .. .. ... .00 = Explicit Congestio .. .. ..co m (74....124..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.138)...... ...home (192 . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... . . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.port == 80 || http 2] Ethernet II. .. ... = LG bit: Globally unique address (fac tory default) .... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. ...corexchange. ..12...0......0.dlls tx01.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ...0 ...168. . . .. = Differentiated Ser vices Codepoint: De fault (0x00) . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... .. .. Src: cust -74-124-12-138.... .

.. = Don't fragment: Se t .. Seq: 43881... Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 43881 (relativ e sequence number) [Next sequence number: 45141 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .....home (192.dllstx0 1..138) Destination: pc 13.12.. Src Por t: http (80)..corexchange. Dst P ort: 49574 (49574). = Reserved bit: Not set .0. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a8f [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. .1.124.1. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf19b (61851) Flags: 0x02 (Do n't Fragment) 0.. .168.com ( 74. Ack: 1 . .

.... ...... `n. .....0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x085 e [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..1 .@. ..... .. . . . = Reset: Not se t . ......... = Syn: Not set ....+.N.....0...........^.0 . ...... 0.J|. = Acknowledgmen t: Set .. = Reserved: Not set .. . = ECN-Echo: Not set .. .....:.. 0 ..E..u.. . .I..... . = Urgent: Not s et . . = Push: Not set . .P. .P. 0020 01 0b 00 50 c 1 a6 2b c9 0d 96 9e 87 4e aa 50 10 .. 0040 cc 8e 80 a5 e ... . .. .....0.... . .. . ..1. 0010 05 14 f1 9b 4 0 00 31 06 3a 8f 4a 7c 0c 8a c0 a8 . = Nonce: Not se t ....... ........ = Congestion Wi ndow Reduced (CWR): Not set ..0. 0000 0001 0000 = Flags: 0x010 (ACK) 000.. 0.... 0030 00 2e 08 5e 0 0 00 75 11 9c e8 49 19 10 94 84 82 ... .dx.

^9 0080 99 dd 9b a4 a f c8 80 13 68 ab d5 55 eb ac c2 92 ..QK..K 0050 77 61 d2 b4 3 8 ea 15 22 a9 47 82 76 39 b6 1a 12 w a... 0060 9f 5a 9e 46 2 0 93 37 e9 a8 37 05 9d e5 4a c3 f1 .+.}.a..$. .. 0150 0b 5b a4 1f 5 7 06 f9 27 8c 5d 90 ..7...X. .7..hP.'..........P.*t..!0..{w..S..2.J...8yx..#..k 0110 eb 3a 68 0c 2 b d9 42 ff eb b5 32 02 af 24 09 00 ....U.G..Bc..+.c ad ed 68 50 f4 12 72 9c 3d b9 4b ..b.ig..O.8..j.J. [....=...M.F .`.... 00e0 4a f3 38 79 7 8 bc b4 fd ca 2a 74 d2 7b 77 a0 a9 J .B. 0120 28 56 74 24 8 f 18 6b 0c c1 12 d1 f8 6b 35 25 40 ( Vt$..k5%@ 0130 5a 4b 6d e1 5 5 16 2b b0 16 27 23 7e a8 2d 53 ac Z Km. 0100 4d a5 89 78 4 5 f5 62 e7 d0 cb 9f 2b 7e 8b d9 6b M .....h. 00f0 cb d5 2e 95 1 d 0d 5d cc 4d eb 7d fc c2 61 07 84 ...'#~...E].r.8 00a0 4a 50 5f c4 e a c0 3d 88 4a 0b 98 8d 56 0c e0 c9 J P_... 00b0 41 64 16 6a c 1 86 21 30 cb 42 63 a0 83 98 a0 17 A d. .. Z..pTi... . .U...(\rH....xE... . .".V. 00c0 88 e4 c5 10 9 4 0c 86 69 67 93 51 4b 8c de 4f cd .]...v\T.. :h....k..R..-S. 0140 a9 5b ec 1c 8 0 28 5c 72 48 82 10 23 f2 f6 50 f2 . . 00d0 ed c1 53 85 7 6 5c 54 ea 27 2e cd 01 b6 14 52 1c .+~...... 0070 b3 cf 60 f1 0 3 d2 e8 70 54 69 86 58 c7 84 5e 39 ....=.v9...... 0090 b1 8f 45 5d f f fb 92 04 eb 8f f3 15 20 d5 83 38 .

.'.h-..35.i..^) 01b0 a4 9f c3 d5 3 3 35 99 7e ed 5b 2c fc df fc e6 2d .... 0260 92 20 a0 e9 a 8 6c 2d 09 a0 0a 13 a0 9f 64 7e 37 .(. 01a0 39 40 e5 9a 2 6 ee 1e cf 3c da 86 a0 67 dd 5e 29 9 @....}........W...%. 0230 ee ff ac 8d 3 5 e6 ff fb 92 04 ee 0f f3 02 1d 54 .{......J.a.....".J... J.A.. [.5es..$F. 01d0 b1 f4 b8 8e 2 b a3 fb 4a d5 76 48 2d 1a 24 46 18 .... .. .Z... ..`.u!E...a.... 8JP`$.." 0200 5b d6 20 83 a e 38 f6 07 0e d3 db 10 52 c1 92 be [ . 0160 3a d6 b2 46 a 9 66 33 58 77 3e 7a e7 df cb af 62 : .. ...[..01c0 73 04 e8 7b 2 e e6 1c 48 d6 f7 fa 83 d4 76 a1 cb s ...g.....J. .{.&. 0250 e1 09 41 92 1 3 aa 01 9c 3d 28 1d 97 00 68 2d 83 . I!....H.W.R.b 0170 f9 14 f0 8b a 2 60 0a 61 e0 3c e8 89 53 24 72 25 ...HT. . r.<.8..50 ba c6 c7 e7 . 01e0 02 72 a8 4a 9 0 a8 ec e0 54 b7 99 0d a4 15 c7 2b ...+ 01f0 ad 49 21 83 1 a cc 69 9e 2e fa 48 54 c6 57 ab 22 .R. ....<..]..V 0190 2b f3 2e 8e 9 f eb 10 7d b6 66 f2 3d 06 1a 1a 85 + .5...E.F&..f.....=(....&...=.f3Xw>z... 0210 42 43 87 d5 8 9 9c 82 22 ae b7 5a a9 7b e5 05 00 B C......T.+.C....vH-.P..~..F.S$r% 0180 12 4a 00 14 4 6 26 cb 25 95 d1 e1 35 65 73 de 56 .... 0220 33 cc 43 90 7 5 21 45 18 a9 c4 88 fc 45 ec 26 e7 3 .T 0240 83 38 4a 50 6 0 24 ea a0 61 eb 4a 0b 28 9d 52 0c ..v.

'... 0320 fb 7a 59 48 c a 00 22 c3 74 1d 80 81 06 3c 8e 29 .i....../. n.!.O... 0370 18 df ae fd 2 f 0b 31 35 60 d1 35 6d a2 07 41 a4 . zYH.j...<.+.$Jk1x...W.. 8.x.. 0350 69 62 95 aa d d fd e3 c7 75 23 23 2f cb f6 17 ce i b. 0300 af 29 6f 4d 3 c f4 df fd 7c c8 da ef 63 69 5b 8b ...fJ.. 0360 f6 9c 54 76 d 6 08 b0 a2 ed 91 b3 d7 18 ff f8 2e .... .h.<..px..d~7 0270 c2 6e 1a 51 2 4 20 67 13 69 fa 3c 57 9e 37 38 88 . .G. ..Dy7+'.....y 02b0 cb 73 ba bb 9 2 c6 ee d5 77 90 69 ac c4 cc 9b 35 .b.B..a..Tv.A..........A.. 0...={.L.... .5m..ci[.T 0340 57 45 c4 d0 a 2 81 3e 7e ac 97 12 66 4a f1 47 8b W E....u##/.w......J.|.....n.l-. 02d0 92 95 24 4a 6 b 31 78 e2 92 91 16 05 3c 2e 64 38 ... 0310 ae 38 a8 f5 9 c 9a 42 94 b8 7b f5 2b 8e 4f fd 9f .. 02a0 e7 a5 cb 3d 7 b c3 61 8a b3 e2 eb ac f2 05 94 79 .g.Q$ g........ A...>~. ... F#l.. )oM<..d8 02e0 ec 46 23 6c c c 78 94 b5 c3 6e b6 f1 e4 c8 1f 18 .. s...U.5`O. 0290 8d 30 b0 67 1 9 8d 68 fb 83 35 60 4f b8 9b 96 0e .....{. 02f0 9a 4c af 27 c d c8 c7 03 44 79 37 2b 27 1f 6b 09 .....i.78. P.H....) 0330 90 34 f8 f0 0 3 c4 57 e5 41 1a 70 78 d6 17 c8 54 .. 0280 aa 50 e7 2e a a 55 c7 8f 62 e8 4c 9f 41 fe 6a f6 .".A..k... 4.t..5 02c0 18 41 86 c1 4 8 9f 61 ad 4a d6 10 21 97 06 01 a5 .a.15`.<W... L..

.jpa.d^.i.?. 0400 5d ca 0d e7 6 9 c5 5d c2 a0 00 86 cd 60 89 50 02 ] ...).aC.jp.L.... 03e0 ea 27 54 03 3 9 42 50 5e c4 6a 70 61 ef 4a 0d 08 ...)..0380 53 ad ca 64 5 e ce eb 7f d6 85 73 44 42 88 47 35 S ..*u.. 0440 3d 77 24 fe 1 2 cc bb 7b 58 53 51 ba 0c 09 fe 33 = w$.. 'T..I.ii..Y. ..mkP.# 0470 8b 32 b4 3c 1 6 93 26 e5 2e 6a fa 76 5e d3 60 6a . 0S|@.`. 03f0 c5 4c 0d 69 6 9 81 9d 16 29 81 97 bd 30 53 c2 84 .....0S.W+[ 0490 c7 ab 65 3f f .u..sDB.^..y...]....h.... . 2.1.d 03b0 d3 0c 6d 6b 5 0 13 ca e8 e1 ab 61 c8 b8 f2 d2 84 ......hH?f: 0420 d8 48 94 31 5 2 c0 79 b7 31 b4 51 70 9a 3f 8f d2 ..V. . .2..=EJ..J..3 0450 ff bc 3d 45 4 a 80 5e ec a5 9b 75 d8 fb ff ff d6 .a......n}..{XSQ. L.u 03d0 cb 25 4d 0f e e 4c ed 65 ce ff fb 92 04 ed 8f f2 ......&...6YVF.....<..9BP^.$.j..Qp....r...... 03a0 0e 25 de 4d 5 e 55 59 82 c9 13 29 a8 cb 24 d5 64 ...e. 0460 fe 30 53 7c 4 0 b6 0b f9 84 ab a3 82 59 a0 b0 23 . %M.r.. 0430 f6 fa ba 8a 3 2 d2 d8 de 72 dd 56 b7 94 49 b4 db .G5 0390 8e 04 c0 68 b 0 04 14 c6 a9 61 43 02 72 15 8a 8e ...M^UY..J. 03c0 79 53 95 98 6 e 7d 3b b0 a4 8e 6a 70 cf b0 fc 75 y S.....1R.v^.`j 0480 08 8d 9e 36 5 9 56 46 d1 1f 6a ad 00 88 57 2b 5b ....P.j.. .. %. H...... 0410 50 9a 8e 4a f 6 0b 2a 75 04 af 99 68 48 3f 66 3a P .

.....com pc13..C 0510 ad 68 b2 91 b 2 2b 41 c7 9c 3f 59 ff 2e 0f fa 73 ..'....home TCP 900 http→49 574 [PSH. 04d0 48 18 92 a9 4 d 21 9e ed 44 f1 12 a8 73 82 9b ab H ..5.767106000 cust-74-124-12138.+A...s. ..s 0520 ea 73 .W...-.. .... 04e0 0c 18 a5 03 4 2 96 a7 9b 96 3c 21 f4 05 c9 ef 87 . .7 05 58 e9 20 66 ed 2d cc ec 54 61 .. ACK] Seq= 45141 Ack=1 Win=46 Len=846 Frame 80: 900 bytes on wire (7200 bits )..E.X..}..817036000 Romance .dllstx01.?Y....<!. .....c.B.W%..V.corexc hange...b.s..........^e 04c0 fc 55 21 ce 4 2 b0 8e 0a 87 f2 14 7e 1d 24 40 92 ..$@.M!.. h.. 0500 b3 8c 73 29 9 7 f5 57 ff 0f ed 7d 04 e8 56 18 43 ..Ta 04a0 fd fc b4 db 4 3 4b c6 be 35 b9 ce f5 bc f2 73 95 . 2014 11:26:5 5. 04b0 3a 94 17 c9 9 3 92 da da a7 1b 62 9c 70 d6 5e 65 : .~.CK. 900 bytes captur ed (7200 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. Time Source Destination Protocol Length Info 80 2.. .B..e?.p. U!....s). s No..D. 04f0 10 b5 09 d0 2 7 1a 57 25 14 cd 45 9e d2 63 da ca . f.

...Standard Time [Time shift for this packet: 0.. ....07800400 0 seconds] [Time since ref erence or first fra me: 2.078004000 seconds] [Time delta fro m previous displaye d frame: 0. ..0 . ... ... ... . . .. .. = LG bit: Globally unique address (fac tory default) ...port == 80 || http 2] Ethernet II.0... .767106000 sec onds] Frame Number: 8 0 Frame Length: 9 00 bytes (7200 bits ) Capture Length: 900 bytes (7200 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. . ..000 000000 seconds] Epoch Time: 141 5615215....0..... . .. ... ... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. ..817036000 s econds [Time delta fro m previous captured frame: 0. ......

.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c2c [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.1... .= LG bit: Globally unique address (fac tory default) ...12..corexchange. . . ....dlls tx01.... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...138).co m (74. = Differentiated Ser vices Codepoint: De fault (0x00) ...12. = Don't fragment: Se t . .0 . .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 86 Identification: 0xf19c (61852) Flags: 0x02 (Do n't Fragment) 0....dllstx0 1. Dst: pc13.124.corexchange..com ( 74.... ..168. Src: cust -74-124-12-138.. ..0. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.home (192.home (192 .168.124.. .... . = Reserved bit: Not set ...1...1.138) Destination: pc 13.

. .... .... = Congestion Wi ndow Reduced (CWR): Not set . . = Acknowledgmen t: Set . .. 0. Src Por t: http (80). .. . ACK) 000.. = Push: Set ...... . ... .. Len: 846 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 846] Sequence number : 45141 (relativ e sequence number) [Next sequence number: 45987 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. .....1 .. = Urgent: Not s et ...... Ack: 1 ..0. = Syn: Not set ..0.. ... Seq: 45141.. = Reset: Not se t ... . 1 .0 . . . .. ....0... 0. = ECN-Echo: Not set .. . .. ........ .... . = Nonce: Not se t .........11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] ..... = Reserved: Not set . . 0000 0001 1000 = Flags: 0x018 (PSH.. . Dst P ort: 49574 (49574).

..<..@...+. 0050 d3 5b 3c 12 8 c e9 56 4e f5 fc ef 48 63 5d 03 d1 ...Vi... .. .q. 0020 01 0b 00 50 c 1 a6 2b c9 12 82 9e 87 4e aa 50 18 ....Checksum: 0x208 f [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2106] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ....c.0070 80 00 d2 63 f 6 df c7 a2 81 75 ba 12 a0 ba 2b 37 .. .a)A...j..+7 0080 12 0f 26 e5 1 8 56 69 88 42 03 29 d9 39 c7 a5 ff .6.. v.E.).. `n.. . 00b0 97 ad 30 6d 2 8 71 c6 94 1f 9c 76 cb 0b 21 79 08 ..J|.. .. ..&. 0060 7c 30 2d 23 f a 8c db a3 f7 7d 7d 98 6a 01 cd 2d | 0-#...}}.d.u.{T....9.. 00a0 70 65 ef 4a 0 b fc 9d 52 0c 61 29 41 97 96 6a 01 p e.0m(q.. 00c0 d6 06 14 f9 8 9 a1 7b 54 16 39 b2 c2 88 7a 94 b2 ..J.R.F.....v. 0010 03 76 f1 9c 4 0 00 31 06 3c 2c 4a 7c 0c 8a c0 a8 .z.v....1.N.R. .!y. 0030 00 2e 20 8f 0 0 00 76 a1 8b 52 94 21 c9 36 55 34 ......Hc].P.. [<.VN... 0090 fb 92 04 e6 8 f f2 c2 28 53 83 39 62 50 59 a4 fa ..!...(S. .6U4 0040 51 4d 17 71 9 4 f1 a4 d2 46 17 bc 36 81 2e 64 e1 Q M..9bPY.dx.P...B. 00d0 ab 51 ea a6 9 9 3b c4 49 95 23 03 52 63 d1 c0 08 ..9. ..........j.

U.Rc. 0180 0b 72 4d 76 f 5 63 10 b5 0b 1e 15 c2 20 c1 bb 0c .).Z... rMv. d. .. 00e0 7f 7e 42 15 5 c 59 3f 39 a9 38 84 48 38 08 b7 0e .#.. ... 0170 06 ec ad f8 d c 7b b6 b0 ac 50 55 26 8b 98 dc 15 .`. 0150 88 a9 f2 82 6 7 50 05 10 89 28 e4 4e a9 f6 0b 1a . 00f0 a5 4f 6d a8 7 f 1e b9 01 e9 74 35 a7 59 b4 12 1e ..t5. 01b0 65 41 b4 b2 5 a 1f 2d f7 3b 11 55 f5 7f 38 ee ee e A..H..I.H8..\Y?9........!\Qc... Om..E..T..P..<...... 0140 fb 64 15 1e 5 2 64 ea 21 5c 51 63 cd 9a 5a e5 d3 .0x.{. 0160 22 f0 a8 b5 6 0 11 c6 89 15 82 bb e0 57 3d 41 d4 " . 0130 de 32 d9 9b 5 c c1 cc a4 50 b8 a0 b4 93 20 dc b9 ...c..~. +.....5.. 0190 86 2b 8c 0d 2 c b8 b0 a6 e0 2e 2c d8 e4 4d a2 33 ..\. ~B.. 01d0 04 e3 45 90 5 a 58 d0 d8 35 11 26 ea 9c 2e 74 89 .ZX.PU&... ........8.... 2.8..t..2.:*..Urn..&...Z.9W. ..Q......K 0110 58 2e 3a 2a a c 48 09 07 4c 18 f5 84 46 f0 4b 95 X ..ad... 0120 12 08 d4 8b 1 5 dd c2 ba 39 57 ed 55 72 6e a7 ec ....... 01c0 d3 49 24 a1 e 1 91 87 94 54 8b 84 ad 32 e0 d9 dc ....(.gP....M...W=A.N.3 01a0 ee a0 30 78 f 7 e2 d0 60 77 61 d1 d9 3c b5 c3 9c .L.......Rd.... 0100 d3 aa 72 9c 1 e 20 a0 c2 29 99 d5 7e c4 97 9c 4b ......`wa. .F. ....... .. . . .-..Y..K... 01e0 6a 62 a4 84 c b e4 61 64 8a 09 16 84 f8 1b 81 85 j b. I$.r........

L.<.a.d.4. 0280 b0 16 9e c0 2 e 8c 27 4a b5 06 c2 4c 0a 53 f8 bf ...H..`.6.......Yty./Y.. 0210 2f 5f a4 23 0 3 52 ff a7 a5 88 1e 48 1c cf 02 33 / _... 0250 aa 41 87 a1 3 0 c2 7d 83 4b 31 04 d4 a6 45 90 8d ..coS...5. . 02e0 67 5f cc 52 b 6 34 9f e9 64 f2 32 5a 58 5d 34 f0 g _.. 02a0 71 53 9b 92 5 7 b6 8e f6 59 91 d1 ef 73 52 34 63 q S....1.W.(. .3 0220 50 eb 34 d5 b 5 35 fd 59 74 79 1a f9 f2 4b 31 bf P ..F..A. uk. 0270 e6 56 f0 21 a 6 30 c0 f2 1d 4e aa 3a 82 3c dc 8e .. ~..S....K1.5..N.aV.}. 02f0 d0 69 54 04 e 1 bb 14 b7 23 6d 85 4b ca bf a3 06 ..K(.Y...BPY 0240 c3 7a b0 61 e 9 38 0c bc 9b 54 0c 61 09 41 9f 96 .a. $.. iT.....K1.`Ct.OW.....R.#m......W. .. 0230 ee ff fb 92 0 4 e9 8f f2 d8 1e d6 03 0f 42 50 59 ."M.0.01f0 f1 24 1f 17 5 0 6d b3 c3 bc 87 36 bc 0f 25 4d 28 .5...... A..sR4c 02b0 a3 f9 95 4f 5 7 df 35 ad 5f ac d4 9f 46 a6 39 4f .T.Pm.!....+. 0260 ff 7e bf d9 c 6 35 01 1e 2f 59 e2 f1 60 43 74 a4 ....%M( 0200 b2 08 57 bc 2 2 4d d7 9e 65 d0 63 6f 53 a4 ef cb .'J.. .8....`sPY.4... 0290 13 75 6b 1b 4 b 28 bc 02 ce 5f 98 2b 03 a9 c1 f0 ._.#... z.* 02d0 8b 1a 7d ad 0 3 28 a2 60 e1 60 73 50 59 8a 82 cb .2ZX]4..._. .. .9O 02c0 fd f5 ff 61 5 6 d0 10 89 bc b1 8c 81 a6 31 8b 2a ...0...:..R..E. 0300 d4 8c 7a 34 f ..K..e..}. V.....

..home cust-74-12412-138.q. . 2014 11:26:5 5.J....1. 0370 45 be ef 8d 6 6 0e 22 e7 ff f1 8d 4c 79 40 69 c7 E .J...QJ.000 000000 seconds] .B 0350 e6 b9 89 23 9 a a4 74 93 4a bf ab e7 78 41 45 72 ...4k2C.#.817211000 Romance Standard Time [Time shift for this packet: 0.u No. 0380 7b 3b fd 75 { ..cor exchange.Ij. 0310 e6 13 7c 67 1 f 49 29 9f a7 ba ff fc 4a f2 31 0e .3.r.. 0320 60 53 53 ba 9 e 51 4a cd 8b 0e 72 0d 88 82 a9 ab ` SS..xAEr 0360 41 fd c1 95 7 1 be d6 af d4 ef a3 43 89 e1 33 af A ..Y_.t.....767281000 pc13..C.Ly@i.. .b 0340 80 9a e6 e6 d c 11 49 6a c6 8c 29 81 da 73 95 42 .. Time Source Destination Protocol Length Info 81 2. 0330 69 2a 29 fc 1 7 a8 e4 08 6e f6 04 e8 84 b0 ab 62 i *)...).z4..... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.n. ... ...|g...com TCP 54 49574→h ttp [ACK] Seq=1 Ack =45987 Win=43052 Le n=0 Frame 81: 54 bytes on wire (432 bits)...f.dllstx01."....3 f7 59 5f d2 ab e6 34 6b 32 43 97 .........s...I).

Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). .. .... . . ..... .000175000 seconds] [Time delta fro m previous displaye d frame: 0. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... ...817211000 s econds [Time delta fro m previous captured frame: 0... . . ... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... .... . = LG bit: Globally unique address (fac tory default) ...port == 80 || http 2] Ethernet II....... ... .. ... = LG bit: Globally unique address (fac tory default) . ..0.. ..0. .. . ....00017500 0 seconds] [Time since ref erence or first fra me: 2...0 ....767281000 sec onds] Frame Number: 8 1 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .Epoch Time: 141 5615215. . ........ ....0 .......

1. Src: pc13 .0. = Reserved bit: Not set .11) Destination: cu st-74-124-12-138.= IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..dllstx01.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro . = Don't fragment: Se t . Dst: cust-74-124 -12-138.co rexchange. .ho me (192.11 ). .168.home (192. . .dl lstx01....1 24.124. com (74....12.. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.168..com (74...1....12. = Differentiated Ser vices Codepoint: De fault (0x00) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f38 (20280) Flags: 0x02 (Do n't Fragment) 0.corexchange.1..... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.

..0.. = Nonce: Not se t ... = Push: Not set . .0 ...... 0000 0001 0000 = Flags: 0x010 (ACK) 000.. = Acknowledgmen t: Set . D st Port: http (80)...l Protocol.. ... .. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 45987 (r elative ack number) Header Length: 20 bytes ... . . = Reset: Not se t . = Congestion Wi ndow Reduced (CWR): Not set . . ..... ........ .. . 0.0 = Fin: Not set Window size val ue: 43052 [Calculated win dow size: 43052] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys ...... .. 0 . ... = Urgent: Not s et .... Ack: 45987 .. ... 0..... ... .. ... = Reserved: Not set . ... Src Por t: 49574 (49574). .... .1 .. . = Syn: Not set .... Seq: 1.0.. ... = ECN-Echo: Not set .. .. . ..0.

com pc13.119785000 seconds] [Time delta fro m previous displaye d frame: 0.....936996000 Romance Standard Time [Time shift for this packet: 0.000 000000 seconds] Epoch Time: 141 5615215.+..11978500 .N.E.is] [This is an ACK to the segment in frame: 80] [The RTT to ACK the segment wa s: 0..corexc hange.. . No..000175000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .P.home TCP 1314 http→49 574 [ACK] Seq=45987 Ack=1 Win=46 Len=1 260 Frame 82: 1314 byte s on wire (10512 bi ts).P.. Time Source Destination Protocol Length Info 82 2..`n.. (O8@. 2014 11:26:5 5.887066000 cust-74-124-12138... 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.dx..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 15 d0 50 10 . ... 0030 a8 2c 18 d4 0 0 00 .dllstx01..936996000 s econds [Time delta fro m previous captured frame: 0. ..... 0010 00 28 4f 38 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ....

.... .0 ..0 seconds] [Time since ref erence or first fra me: 2..... .... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. . . Src: cust -74-124-12-138. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ...0........ ... ....... .124. .. ...corexchange.. . .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... = LG bit: Globally unique address (fac tory default) .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .....co m (74.12. .. ..... . ..dlls tx01.. ..0 .. .138).. ..... = LG bit: Globally unique address (fac tory default) .. ...0..port == 80 || http 2] Ethernet II..887066000 sec onds] Frame Number: 8 2 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . ...

.. = Don't fragment: Se t . Seq: 45987.1.... Dst P ort: 49574 (49574). .138) Destination: pc 13. Src Por t: http (80).dllstx0 1.. = Reserved bit: Not set . Ack: 1 .1.corexchange.168.1. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a8d [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. ......0. ..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..home (192 ..12.com ( 74. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00..168.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf19d (61853) Flags: 0x02 (Do n't Fragment) 0... Len: 1260 Source Port: ht tp (80) Destination Por .. .home (192.Dst: pc13.124. = Differentiated Ser vices Codepoint: De fault (0x00) .

... = Reset: Not se t .... .. = Nonce: Not se t . = Push: Not set ........0 .... .0. .. . = Urgent: Not s et .1 .. = ECN-Echo: Not set .t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 45987 (relativ e sequence number) [Next sequence number: 47247 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ..... = Acknowledgmen t: Set . = Reserved: Not set .. 0... ... .. = Syn: Not set ....... . . . .... .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x35e e [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] ..... .... 0.... = Congestion Wi ndow Reduced (CWR): Not set .. .. 0 ..... 0000 0001 0000 = Flags: 0x010 (ACK) 000... .... . ......0. .. . .. .0. . .. .. ..

R. 0070 4f b0 28 12 1 2 80 24 f1 24 9b 74 19 0d a0 b0 8d O ..cs. `n..Q~...)A. y..j8W 00c0 35 94 46 12 6 0 80 02 11 04 09 0c 0a 22 3d 1d d0 5 ......<.:.L..._...6. ..`. 0100 63 81 35 33 a f fe ae f3 10 94 00 ec 51 7e a4 3a c ...|..53.[k..V& 00f0 f6 79 a4 9f 3 8 ab c5 7c 6f 06 2c 4a 3d 89 7f e5 ...t.& 0040 20 92 f3 36 8 1 4b cc 78 a1 60 a2 31 13 b0 30 5a . .|o......W. ....#.P 00e0 95 21 00 0b 2 6 a5 1d d1 20 93 5b 6b 85 f3 56 26 .`...... 0080 2a cf 87 05 5 7 ff fb 92 04 e7 0f f3 01 2c 53 03 * .. 0020 01 0b 00 50 c 1 a6 2b c9 15 d0 9e 87 4e aa 50 10 .J=.E...$....1.. ... !. 00a0 e9 81 7c 96 2 9 41 97 bd 30 13 3c bb 7a 45 29 5c .~J.$...6!=..8...+. 0030 00 2e 35 ee 0 0 00 60 82 14 ea c8 63 73 08 0c 26 ...S....+...F..5.Q.(...P..dx. ...0.{S.`.: 0110 a3 0d 83 94 0 .&..P.....D...|.@...... .N. 0060 5c 54 22 37 0 d 36 78 29 ae 7c a5 a2 c7 7b 53 f5 \ T"7.0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . 0090 59 4a 60 5f 6 5 da 60 65 eb 4c 0b f8 ab 4a 0c e9 Y J`_e.K. . 0010 05 14 f1 9d 4 0 00 31 06 3a 8d 4a 7c 0c 8a c0 a8 .6x).zE)\ 00b0 cf fd ff 23 b 7 36 21 3d d0 b7 44 09 81 6a 38 57 ..J.x.b."=..a.. 00d0 67 28 e3 c2 e 8 51 8e d1 52 18 5f de 61 e1 1a 50 g (....1......`e..J|.0Z 0050 c2 88 e0 e6 c 2 f5 a5 7e 4a ca df 2b c6 97 62 e5 .

....i..T 0150 d4 6e 60 44 2 4 d0 51 61 b2 28 39 7c d6 b3 42 11 .t.L....v0_.. }.j 0210 0a 72 6d e6 1 4 ee 7f 51 9d 52 47 7a f7 c5 df d5 ..'. rm.a 0170 1a 19 63 ee 1 5 94 63 26 98 d0 c0 02 0d a0 55 42 .. W...m. 0220 df f6 ff 12 b 9 ef fa ff fb 92 04 .'..L 0130 c4 1c a2 fd 7 5 e2 76 30 5f 09 6c d0 15 49 a1 49 ....i. ..o%. ....(9|. 01d0 9b e6 95 52 c 0 b8 e1 72 63 0f d1 81 10 d1 c4 e7 ..K.q.Z 0120 d9 59 60 39 4 c 38 3b d1 6f 25 ae 13 c2 a6 14 4c . . Y`9L8...l....2... 01b0 1f 11 e0 4f 2 c fb 86 a5 71 db 94 76 3f 89 32 cf .O........'..u.. ... 01a0 a6 0e e3 0e 9 1 46 64 4f 96 f5 63 8a e5 27 a2 fb . 9/...8..[z.. 0160 c7 5d 1d 65 d 2 cd 1d 69 b2 06 ea ef cd d6 b5 61 .....RGz.c..u 01f0 c0 26 66 29 3 c 2a 0c 3d 1a 69 71 bb 0d c9 f5 61 .I 0140 5e 1e dc 10 1 1 4c 8e c9 b8 c2 44 d0 5f 27 8f 54 ^ ....=.c...32...E.. . n`D$..C. 01c0 9d 7d d7 fc 5 b 7a f8 df c5 f1 3d b2 45 8e b5 d5 ..B... &f)<*. .v?. .Q............I.FdO._'.r 0190 81 ac cc 13 b 3 e1 4b 13 27 c0 1e 89 e0 32 03 d2 .....Qa.....5 16 6d 08 33 32 9a 02 f4 69 85 5a .2..q.. 01e0 91 57 a6 38 d 2 ba 43 85 05 80 69 43 60 38 8b 75 .a 0200 0a 39 2f 8c f d c9 a1 74 0f a5 9a e6 06 ee fd 6a ...e.....TRRp.iC`8...rc.UB 0180 70 96 54 52 5 2 70 95 c2 e0 04 27 05 71 ea 01 72 p .=......c&.R.iq. ].D.

6....`9d......r. .....i.Cxy.H 02f0 6c ea 78 ea 5 7 76 26 ae b1 0e 77 f0 35 43 b5 c7 l ... 0270 6e 13 60 0c d 7 92 d5 b2 69 c6 60 39 64 fc d4 a9 n .i.. 5.. .. 0300 e2 f7 89 f1 5 6 5b 6f fd ff 8f 37 f8 c6 b1 7c eb ..T. P.M 02e0 9d 32 04 14 b e 9b ca 98 f3 43 78 79 8f 4b 8c 48 ..VD......0...... 02d0 48 29 21 45 9 e c2 06 86 a1 60 90 24 e6 19 7f 4d H )!E.YB...`..A.x..= 0260 2c b9 2c 94 c 2 89 26 00 c1 e8 a6 ab d9 72 c4 93 ..e6 8f f2 f7 31 .s.(U2.|.rQ......" 0330 75 68 1e b0 d 5 ac d4 49 54 92 76 d7 7d 13 fe fe u ...Wv&. !. 02c0 c4 50 b3 f3 7 0 55 37 01 3c 42 40 9f 1e b1 86 3b .w..Lf..... 02b0 37 69 27 97 1 7 56 a0 9d 80 a1 87 aa c6 03 a0 a4 7 i'. 0280 a3 21 e4 5a 9 1 b1 dc 9a 06 90 16 dc 5b 4d 56 c5 ....<B@.......7.K..D.[MV.....`..x..K. .. .&.Pe.J....pU7..$. 0310 7f fd cd 2c f 7 ff 4b 80 40 90 dc a4 36 d2 89 04 ....J 0240 0c e5 a9 81 8 4 16 69 01 a7 bd 30 d7 54 c4 78 da ..... ...V[o.1 0230 d2 83 59 42 e 0 56 44 fa 50 65 ef 4a 0c 44 c5 4a . 2........... 0250 86 9e b1 ed c 5 d9 d2 98 81 75 07 15 41 b4 04 3d .... ...|.......@....@ 02a0 c5 35 bc e1 2 8 55 32 a8 eb d4 60 4c 96 bb d6 cb .V..5C. 0320 85 89 bb e6 1 9 18 f0 72 51 af 7c dc be 89 b5 22 . . 0290 12 a9 d1 cc 4 c 66 cf b9 d3 e4 5c ad 73 c3 9b 40 .........\. ..Z... ..`L...u.

. .7........ 0430 a6 f1 9b da 9 5 ce 6d 4b 53 72 c7 bf cf d6 6f bf .mKSr. .07+....=0.. 0360 f9 b7 f0 bd 0 6 1f d6 37 fd df 4d f1 e9 f1 ac e7 . 03c0 fe 77 fd 7d f 7 99 c6 0a 8e ff fb 92 04 e9 0f f2 ..3! 03a0 c7 84 65 0b f 8 25 19 77 36 f5 6b 37 69 fb 64 8a ... w. 0390 9d c8 14 cc 8 6 71 c4 56 36 35 2a e4 1a 0b 33 21 .e. ..b..<.4..Ege.. . 0340 21 7c 34 87 8 f 6b 60 90 5e cc 34 c6 a3 82 a3 da ! |4.h...........>. 0400 b3 40 21 a8 7 a 08 45 05 cc 30 37 2b 9b e6 f5 23 . ..o] 0420 1e 10 a5 cc 1 2 36 c6 fd 8e 9e 04 48 9f 0a b7 f4 .... 0350 03 46 13 b0 0 6 a3 ac 45 67 65 9e 26 20 b0 6e d3 ...}. L.... ..w6....v.n....U`#.}.|..# 0410 24 cd a5 81 0 8 81 04 c4 97 9d 6a 84 91 0f 6f 5d $ ... ..... ....4............... N.i.c 0380 49 d9 62 92 0 4 1a 7c 2c d5 a4 92 ba ed a7 7a a5 I ..... ....d..5...... 0370 ff 9a 7f e5 9 0 76 7b 86 55 60 23 b2 35 80 c0 63 .& .Yz``...z...M..z..~..k7i.IT.... 03d0 ff 2c d2 83 5 9 7a 60 60 c5 9a 50 6b 12 4c 0b e0 .. 03b0 b8 d6 b6 17 3 4 ab e7 cc 99 9e d6 cf f7 85 3e fe ..5% 03f0 02 37 8d 2e 7 e 0f be 18 cf fd 5f 20 50 8b 50 01 .j.. 7..P..L....^.H.. 0440 14 4e 07 3e e b 04 00 3c 1c 86 09 97 89 cf b0 a6 . F.o..%..6..V65*......E..q.Pk.. @!.. 03e0 bb 4c 0c bd e 9 81 86 98 69 01 ac 3d 30 18 35 25 ..k`.._ P.....v{.>.

... 0490 82 b5 28 46 1 b 92 93 40 9c 50 9b 95 07 1e e6 b8 ... .~p[^'.'k.T.....-a..*...|.dllstx01..!M).k.com pc13.W. 04a0 54 10 29 a8 4 0 52 79 05 ce 28 81 75 9b 38 94 b4 T .. 04b0 31 7e 98 c7 8 4 bd 06 70 8f 05 8e b0 76 94 bb e1 1 ~.. 04c0 f7 38 44 05 8 b 68 c6 25 34 67 15 12 cf 5a 2c a2 ... 04d0 3e bc 67 07 e 7 cd 2f 24 5d d2 dc 63 02 98 8c d0 > ....[M....v..>*$'..%4g. E...y 0460 02 45 b6 5b 4 d de cc 40 19 1d a7 3e 2a 24 27 89 .8.Y..Z...916112000 cust-74-124-12138..@.home HTTP 1296 Continuat ion .. ..... .f.u..YJ....).(..corexc hange. 8D..< 04f0 ef da f5 fd 6 b f6 66 8a f0 de f5 f3 70 a0 74 4c ..p.0450 5d fe 53 39 d 6 f1 8e d3 f2 0f 08 59 01 e2 00 79 ] .. .! 0520 23 2a # * No.c.(F.S9....g..p..@Ry.v...b...P..A\ 0510 73 1d a7 1e 7 6 06 0d 2d 61 ea a8 b3 93 81 88 21 s ....r...h..tL 0500 1a 10 4c 30 b 1 2a 87 2c b3 59 4a 15 96 d5 41 5c .. Time Source Destination Protocol Length Info 83 2.0.. 04e0 83 99 92 0d a a 30 db c4 a4 cd ad 7c 94 b0 91 3c ./$].L0... 0470 0f 02 27 6b 8 f 54 d0 a8 7e 70 5b 5e 27 00 72 05 ....... .... 0480 24 f3 62 81 8 0 9f b6 e3 57 12 21 4d 29 0c ad db $ .@.

02904600 0 seconds] [Time since ref erence or first fra me: 2..... .966042000 Romance Standard Time [Time shift for this packet: 0. 2014 11:26:5 5.. 1296 bytes cap tured (10368 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. ...0. .000 000000 seconds] Epoch Time: 141 5615215.. . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)....029046000 seconds] [Time delta fro m previous displaye d frame: 0. .. ..Frame 83: 1296 byte s on wire (10368 bi ts).916112000 sec onds] Frame Number: 8 3 Frame Length: 1 296 bytes (10368 bi ts) Capture Length: 1296 bytes (10368 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .port == 80 || http 2] Ethernet II. .966042000 s econds [Time delta fro m previous captured frame: 0.

= Differentiated Ser vices Codepoint: De fault (0x00) ... Dst: pc13.. = Reserved bit: Not set ..co m (74.home (192 ... ..124. . ..... .1.. Src: cust -74-124-12-138... ..168...11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt... = More fragments: No t set Fragment offset :0 Time to live: 4 9 .138)..12...0 ........1. ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ...... .. ...dlls tx01..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 282 Identification: 0xf19e (61854) Flags: 0x02 (Do n't Fragment) 0...... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . . ... = Don't fragment: Se t . . . .corexchange.0.0.0 . .. ..... . ...= LG bit: Globally unique address (fac tory default) ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. . .... = LG bit: Globally unique address (fac tory default) ......

.0 . 0000 0001 1000 = Flags: 0x018 (PSH.168.Protocol: TCP ( 6) Header checksum : 0x3a9e [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138... . = Nonce: Not se t .. = Congestion Wi ndow Reduced (CWR): Not set . = Reserved: Not set ........ . . ...138) Destination: pc 13. Ack: 1 . Len: 1242 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1242] Sequence number : 47247 (relativ e sequence number) [Next sequence number: 48489 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . .. ACK) 000. Dst P ort: 49574 (49574).....dllstx0 1..com ( 74.. .. ... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. .. . . = Acknowledgmen t: Set .1 .1... = ECN-Echo: Not set . ......home (192. ..12... ... = Urgent: Not s et .. ..0. .. . Seq: 47247.corexchange.. 0.0..... Src Por t: http (80)...124.. 1 .

0010 05 02 f1 9e 4 0 00 31 06 3a 9e 4a 7c 0c 8a c0 a8 .....dx.|US 0040 f8 64 e1 70 9 ... . .. `n.:.E. ...o44L22_q>u\ 37374706217 72777322###BOT_TEXT###0 447###BOT_TEXT###1762 Data (1054 byte s) Data: da8df 1bb6d5a07f6cc49bd6f 97ce7bc1bff53d8fdc8 ef7ab.. = Push: Set ..E.0.@.P.+....1.J|. . ... [Length: 10 54] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ... = Reset: Not se t . .P.............A*A..:.. ..N. .. .... = Syn: Not set . 0030 00 2e 45 0b 0 0 00 3a 91 41 2a 41 81 d3 7c 55 53 .. . 0.. ......0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x450 b [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2502] Hypertext Transfer Protocol [truncated]: 21A*A0123|US7 0d41p30L61E 04###BOT_TEXT###23###BOT_TEXT###027473\ 24623U~5177 53n73'65642 2=\vt73^k138G 5666525533\ 372U###BOT_TEXT###17>37f06\ 360.. 0020 01 0b 00 50 c 1 a6 2b c9 1a bc 9e 87 4e aa 50 18 ..

.. .n. 6.*..jl.>..L.<.*.... d..4~ 0130 86 6c c4 53 5 d 6e 27 fb 27 a2 38 f7 16 7b 41 b6 ...X..!..L..8 4c b1 45 84 13 02 fc bb a6 93 55 .. 0140 05 09 ac 4a c a 90 2a f1 80 73 6c 7b 62 f6 bd 51 . 8G.:......L.J.. o.mZ..'.=. .u...00c0 6f d5 d5 95 5 7 58 b7 80 f2 77 36 68 33 5e 4c 54 o .U 0050 7e e9 7f eb 6 e fb 27 f5 f4 92 3d 0b 74 fb 5e 6b ~ .S]n'. 0100 7b c1 bf f5 3 d 8f dc 8e f7 ab d9 79 af fc 3a fd { .8.I...Z.sl{b...{A...f... =....kA 00a0 86 19 30 bd f 7 4b c0 3e fa cd c7 fe 8b e0 21 85 .Y..>.. .t......D.A.. 0070 3b 6f e4 4c 9 2 5f 71 3e 75 fb fc f8 f2 cf fa ff .'.T.U..\.V..WX.T-...... 00f0 2d 0d da 8d f 1 bb 6d 5a 07 f6 cc 49 bd 6f 97 ce .c... ... 0080 fb 92 04 e7 0 f f2 f7 29 d4 03 0f 7a 60 5d 84 ea .p..}[n..Q 0150 03 0b a1 2d 7 2 14 54 5d 6d 73 b7 ..w6h3^LT 00d0 30 4e de 82 5 6 b1 95 c4 08 22 34 be 59 ef dc 2b 0 N.I".....K... 0110 bd 0e 58 00 6 3 01 5a 0a db 4c 0d 2a 85 5c b0 91 .0._q>u....J.... l... ...y.o.)."4.^k 0060 cb 38 47 ee f 6 aa ed db fa 55 0f 3e 9f 66 86 f0 .. 0090 b0 3d ef 4a 0 b 44 8b 56 0c 31 29 41 81 98 6b 41 ..h...1)A.....+ 00e0 bb d1 11 15 1 e ae 7d 5b 6e 86 8e 3c f9 6a 6c 97 ..z`]. 0120 99 b9 54 2d f 2 d6 14 08 af 41 d2 75 bd db 34 7e ..=.E. 00b0 dc 36 c7 d2 d 1 e2 68 c3 54 dd c6 ae 49 22 9b 2d ..V..

D... .qcR..n. 01a0 68 24 19 04 c b 80 67 c4 6e a5 6f 24 91 a9 44 e0 h $. R.t.."..T]ms.i..F 01f0 c4 bb 7e 7d f 9 53 5d 1e ef 6c 6c 7b 1b 27 6f fe .[^.n.8i...d 0260 d9 72 69 2f 0 9 17 65 70 76 3b 79 82 99 54 2a d4 .....Q..4. .{...... ....I........`ej..=.~}. ...* 0250 41 4c ad 43 0 c 3a b1 78 4d 88 71 63 52 a5 86 64 A L...N..cT....n.... 01b0 a0 f1 54 a5 2 7 d4 4e 12 60 65 6a eb d0 f8 a4 2a .. 9.Z.{TY.KSGE. 01d0 68 aa 73 65 9 5 10 cb a5 c8 18 a7 8d 09 27 12 39 h .:. 0170 43 32 a7 0a 0 8 ca 88 6e f5 4b 53 47 45 9b 51 c5 C 2. 0190 d8 fb 7b ed 7 5 1a f7 85 9d ca dc 7f de ab bb bf ..ll{... 0210 15 16 3e 2c 8 7 3c 54 51 c9 14 69 e6 0d 7a d4 39 . ...v.. .e. ...T. Z...LK.9 0220 e9 ff fb 92 0 4 ea 8f f3 02 1b d7 03 0f 49 c2 63 .. .:.9 01e0 f2 b7 46 bd 6 e d0 0c 06 78 3b c6 aa d1 69 b5 46 .<TQ. 0200 e2 df 3b ab a e 3a b9 af 55 e4 ec 63 54 eb 2b 9d ..u..=.+.U.....x..'....c 0230 e5 5a f0 3d e 8 4c 4b 18 5b 5e 0c 3d 87 01 74 15 .. 0160 9b 99 b7 70 a 2 e8 5a ed 36 d5 11 cc 18 38 69 aa .....S].se..6. .p.o$..]...34 eb d6 db af .'...i.KnW.-r..F..g.P.Y0..* 01c0 e4 39 0c 50 a 3 93 83 59 30 08 ac ad be 5d 0d 8c .'o.0.C. 0240 6b c1 86 19 3 0 b4 82 83 76 06 7b 54 59 b5 98 2a k . 0180 ea 52 99 7f 6 5 b7 22 ed 90 18 4b 6e 57 8c ed 11 ......z.xM.>. .

.. 02a0 da cd 5e 5f 0 0 d7 4a 7d 24 6c b7 d5 fb 92 05 67 ....E7e?t..... .....G.g 02b0 22 c1 81 8b b 6 f9 34 62 ae b5 7d f2 74 cd 54 62 " ...fm... N.%[ 0310 e2 aa 80 f8 2 e 01 ce 39 f5 08 fd 27 ed 8b 10 eb .N...H{...... 0330 c8 60 3b bb f 9 1b b9 97 ac a4 dc df 7f 79 ea 78 . 0370 65 2d 90 06 4 8 7b 0b 84 98 d2 d0 12 55 5c 4a 24 e -..'..3....n[.p.. W.t.Ef...e6...&.R 0300 a7 4e 95 ab 9 7 75 6a 1c c0 a8 16 6b b5 dd 25 5b ... 0270 39 53 f7 7f 7 5 f2 33 b9 e6 c7 8c 20 41 ee ea 5a 9 S....-.H...Z 0280 9d a2 f8 79 e 5 c7 8d 46 d0 45 37 65 3f 74 bd 4c ....arD.... 02f0 db e4 66 6d 0 e f5 65 36 87 32 ba 4c af 33 a5 52 ..3.. . .&.P. 0350 99 5c 9b c4 1 2 cf 2d 2c b5 8a a6 04 50 d5 15 5c .[.Tb 02c0 15 a6 88 b9 3 4 91 b0 d7 48 be 75 33 54 08 98 a0 ..F..9.2.\....y.....i...T*.tu.x 0340 90 b4 8e 7e 5 e 97 fa b8 ab c7 b2 80 65 96 09 00 . 02e0 a9 b0 c8 ec 8 8 26 ee b7 bf 32 f4 dd cb 62 a9 93 .}..4b.. . 02d0 8a a6 47 10 4 5 66 02 e6 3d d3 4e a6 74 97 26 9b .. .. `.sE.... \..epv. .e..^_..~...ri/..b...y...L. .uj....~^.\ 0360 b9 57 12 9c 7 a e3 6e 5b d8 f1 73 45 f5 aa 70 0c .2.u.. 0320 ad 9e 5b bc 5 c e4 69 f1 7e b9 58 62 48 db d6 ea ..4. .y.J}$l.L 0290 62 77 f5 b6 b 6 25 a5 74 75 be 61 72 44 f7 b2 8e b w.U\J$ ...XbH..t.u3T..=.z.....%. .k..... A.

.. . 03e0 6f 16 6b 80 f 6 21 30 a9 b8 09 cd 2a c3 74 cb 55 o ..6. @...*.../.n..... ..Z 03d0 60 61 09 1a e 0 3d 25 5e 4c 75 49 5a 0c 44 4b c1 ` a. .om.\)...!0.Z.... 0390 04 b3 13 54 b 4 c2 50 b2 82 2b 75 98 9a 17 19 4b .E.B6S".y..k.D.!.K{l.?....... c.. ....#..+u. 0440 53 5e 80 0c 7 9 01 e0 39 6a 57 3a 97 21 cb 6e b2 S ^... ...A...BR 0400 88 99 68 0a c b eb 5a 04 1b d7 28 5a 2a fa 58 57 ..=%^LuIZ.y..C.DK.`T.&T$.3.&.e......v[.06.U 03f0 7b 92 b7 d1 0 b c2 e4 42 36 53 22 8c 33 c7 42 52 { ...1e.K 03a0 65 bf a3 31 6 5 3b 19 18 01 a7 a0 50 0f 68 70 58 e .9jW:.... ... 0430 ed f5 04 e0 0 c 04 f1 65 a1 6f 6d ab 04 5c 29 14 . 03c0 88 aa c8 ff f b 92 04 ec 8f f3 16 2f d7 03 0f 5a ..P.(Z*....^.0380 8a 40 84 fe 9 9 cd 23 f3 d6 2e eb 5e d6 ab 1d a6 .T.......6Z.[l 0420 a9 b6 c8 29 0 2 a6 36 fe fe f9 0f fb 37 de ee ff .... ...).. UI..hpX 03b0 42 61 d4 36 5 a d2 00 44 e8 7a 4e 18 14 43 0a ae B a..zN....XW 0410 2c 55 49 a5 4 5 9a b7 ef 4b 7b 6c c6 61 1f 5b 6c ..% 0460 6e fe af c7 c 6 a5 3f 86 f7 dd 41 b5 79 cc 7e 4b n .....G 0480 0f d2 98 9b d e ad 9e 9a 15 20 b4 9a fa 8c d4 f9 .....h..~K 0470 2e 63 04 e2 9 a 26 8e 99 30 36 d0 76 5b a0 9a 47 ....7.... 0490 a1 01 2a a2 c . . 0450 af 88 00 26 5 4 24 98 60 54 de 1b 03 06 16 c3 25 ....a..t..P......

.. 04a0 29 dc 75 43 e e 27 0f 52 3f 7a 77 d4 a6 50 dd d2 ) ..[. 04b0 80 03 24 b7 9 0 a7 5e d8 93 64 76 86 24 7b 3e 5f . 0500 e8 95 ca 16 2 c 66 6c 25 64 43 5b ef 14 5b 03 75 .C...'.. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =48489 Win=42426 Le n=0 Frame 84: 54 bytes on wire (432 bits).... 04d0 e0 87 b8 a8 e 6 b9 e5 9e 98 43 98 60 c5 57 a8 ed .. 04f0 32 f5 e7 81 4 4 8e b6 24 95 43 82 aa 93 5d 90 ac 2 . Time Source Destination Protocol Length Info 84 2.D.. .*.kDRS2h.dllstx01. 2014 11:26:5 5...966209000 s econds [Time delta fro .].000 000000 seconds] Epoch Time: 141 5615215.966209000 Romance Standard Time [Time shift for this packet: 0... 04e0 6e 86 a0 7e d 4 3e da 13 94 dc aa c7 1c 3a b6 15 n .$..`..>...uC....R?zw.dv.W. .home cust-74-12412-138...fl%dC[.$..~..${>_ 04c0 49 cb 9f 0d e 6 d4 11 6b 44 52 53 32 68 01 02 e1 I ...u No...916279000 pc13.. ..C........:...^.f b7 04 18 26 52 6b 71 2b 4e a8 f2 .. .&Rkq+N.P.cor exchange.

. = IG bit: Individua l address (unicast) Type: IP (0x080 0) . ....... ....m previous captured frame: 0. ... . ..0... = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .000167000 seconds] [Time delta fro m previous displaye d frame: 0....916279000 sec onds] Frame Number: 8 4 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . . ... = LG bit: Globally unique address (fac tory default) ... ...0 ...port == 80 || http 2] Ethernet II. ...... . . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .... ..... ....... . = LG bit: Globally unique address (fac tory default) . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. ...0.00016700 0 seconds] [Time since ref erence or first fra me: 2....... ... .. . ....0 .. .. .. .

Src Por t: 49574 (49574)...12.dl lstx01.ho me (192. com (74..11) Destination: cu st-74-124-12-138. = Reserved bit: Not set .168. Seq: 1... D st Port: http (80).dllstx01.corexchange.168.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.co rexchange.1.1. Src: pc13 ..Internet Protocol V ersion 4..11 ).. .138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol... = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.1 24. .com (74.. = Don't fragment: Se t .. .1.home (192.0.138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. Ack: 48489 .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f39 (20281) Flags: 0x02 (Do n't Fragment) 0.. = Differentiated Ser vices Codepoint: De fault (0x00) .12... Dst: cust-74-124 -12-138. ..124.

..... = Urgent: Not s et .. .. . . . .. = Congestion Wi ndow Reduced (CWR): Not set .... . ..0 ... ..... ..... 0 . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 48489 (r elative ack number) Header Length: 20 bytes ...... = Push: Not set ..0..... = Nonce: Not se t .. ...0.. ...... .... 0. 0. .. .... ....... = Reserved: Not set . 0000 0001 0000 = Flags: 0x010 (ACK) 000. ... ... .. = ECN-Echo: Not set ... . ... .. = Reset: Not se t . . . = Syn: Not set ..0 = Fin: Not set Window size val ue: 42426 [Calculated win dow size: 42426] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 83] . = Acknowledgmen t: Set .0.....1 ...

078048000 Romance Standard Time [Time shift for this packet: 0.[The RTT to ACK the segment wa s: 0.E..home TCP 1314 http→49 574 [ACK] Seq=48489 Ack=1 Win=46 Len=1 260 Frame 85: 1314 byte s on wire (10512 bi ts).. No. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.+..dx.000167000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .. Time Source Destination Protocol Length Info 85 3.. 0030 a5 ba 18 d4 0 0 00 .11183900 0 seconds] [Time since ref erence or first fra me: 3.000 000000 seconds] Epoch Time: 141 5615216.. ..028118000 cust-74-124-12138...078048000 s econds [Time delta fro m previous captured frame: 0. 2014 11:26:5 6.028118000 sec . 0010 00 28 4f 39 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c . ... (O9@..P...com pc13..N.111839000 seconds] [Time delta fro m previous displaye d frame: 0..corexc hange...J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 1f 96 50 10 ..P.`n.....dllstx01.. .

............ = LG bit: Globally unique address (fac tory default) .. .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..... .124.. . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ...0 .onds] Frame Number: 8 5 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. .0....co m (74..0. .. ...1. .12. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. . .. ...port == 80 || http 2] Ethernet II....corexchange. Dst: pc13.home (192 ...11) Version: 4 Header Length: ... . ... . ... ...0 ... Src: cust -74-124-12-138... .. = LG bit: Globally unique address (fac tory default) ... . ..dlls tx01.138). .. ....... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). . ..168.

. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. ....1. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a8b [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.12. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...124.dllstx0 1. Src Por t: http (80).home (192.138) Destination: pc 13.. = Reserved bit: Not set . Dst P ort: 49574 (49574)..com ( 74.. = Differentiated Ser vices Codepoint: De fault (0x00) .168.1.. Ack: 1 .corexchange... .. ..20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. = Don't fragment: Se t . Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf19f (61855) Flags: 0x02 (Do n't Fragment) 0. . Seq: 48489.0...

... .dx.n: 1260] Sequence number : 48489 (relativ e sequence number) [Next sequence number: 49749 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ...... . . . 0.. . . = Reserved: Not set .... ..... = Congestion Wi ndow Reduced (CWR): Not set . .... ... = Syn: Not set . .0 .. ..0.E. .. . .. 0000 0001 0000 = Flags: 0x010 (ACK) 000...0.... = ECN-Echo: Not set .. = Urgent: Not s et .1 . . .... = Reset: Not se t .... = Push: Not set .. = Nonce: Not se t ......... ... . . ...0.. = Acknowledgmen t: Set ..... .. ...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x3f2 3 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. ... 0... `n. . ......... 0 ......

5.P.U....)".. W*..e\.s....5..|....!t&......X.. 00b0 9c e6 84 ab e 5 55 cc a8 35 19 83 3e f4 cb 6d 85 .. 0020 01 0b 00 50 c 1 a6 2b c9 1f 96 9e 87 4e aa 50 10 ... 0030 00 2e 3f 23 0 0 00 5f 23 af 3f 88 bb ac a1 18 de ...].a..-."V.A.. =. 0120 b9 03 65 9c a ....p. .....jx."..J|... 00d0 44 f2 81 70 0 2 13 c0 b6 50 c0 6c f5 ef f2 d5 21 D .P.. 0050 35 b7 52 44 8 a 91 5a 1d ed cc 6d 6f b3 8a 0a 54 5 .q...m... 0090 8f f3 04 22 5 6 03 0f 6a 50 5d e5 fa d0 61 86 4c .... 0100 65 22 31 eb d 6 71 da d5 ba 73 98 e8 5d 09 f8 6d e "1... . .! 00e0 05 3d 16 65 5 c fd 5c f2 de bd 2d 06 aa a2 aa 5b .l. 00c0 a7 b9 e8 fb 6 3 53 01 37 d0 19 5b ab ad 1a 8c d7 . 0070 6c e1 96 f8 f f 5f f8 35 c5 22 07 ae 90 35 1d 64 l .... 0040 80 bf 2b 30 6 4 d2 6a 78 85 18 60 45 dd 55 19 e9 .+0d.U...jP].?..!(.?#. .L 00a0 0b b0 9d 58 0 c 61 a9 41 86 13 ea c1 86 21 28 a7 ..+.cS..>.._.[..5. ..:...0010 05 14 f1 9f 4 0 00 31 06 3a 8b 4a 7c 0c 8a c0 a8 .>.......T 0060 6b ef 3a de d d e3 16 f8 96 3e bf 7f 35 69 36 f7 k .d 0080 a0 57 2a f6 f d 83 74 ed fb e2 cf ff fb 92 04 e9 ..5i6. ..mo. . ...a....Z..7.N.[ 00f0 92 1c 14 5a 0 7 11 a1 14 ee 7c b5 eb a8 29 22 84 ...`E..m 0110 98 64 12 01 2 1 74 26 18 56 d5 ca 8d b7 da d5 cd .RD.. d...t..Z..........:....V..@._#....1... .P.\..

...*I......<.._... . 01a0 64 30 c1 28 2 d f1 82 20 a7 c1 bc 29 12 3c f4 71 d 0...8..T.. 0230 04 e9 8f f2 c b 27 55 83 0f 7a 50 ..S..... .(.1.D9 0190 74 ed 23 01 b 1 10 e7 19 ec 4b 33 36 c3 be eb 1a t ..5N.#.X..<.%..I.......]. .h.....vGk......Z.%V 0200 35 6d e7 c0 a 6 a9 9d 67 c9 0f 0f ed 85 a9 f5 4d 5 m.u+?.v. ^9...? 01f0 61 27 5c 83 2 e 35 4e f7 d7 53 cc fa e9 e1 25 56 a '\.+H..>e.E.tL.M 0210 5b 59 db 74 4 c b6 38 f8 f7 fd b8 4a f7 11 5a 90 [ Y. E...].w. 0150 56 a7 5f 9d 3 e 65 bc 5c 54 70 55 e3 54 90 50 ce V ..>$.Xp..).T.. ..... Z 0180 f7 86 ac c4 a a 12 2a aa d7 8b 03 9d 60 0a 44 39 ..`...(-... ..e.....z.K36....g..0 7a 9a ed ad 3c 2e b4 9b b7 3b 11 .*..s 01c0 fc bd cc dc 5 d c6 58 ca 82 94 a3 02 e0 4c 46 28 ..#.P..LF( 01d0 49 04 5b f5 2 5 d6 2e e7 9d a1 2a 49 e3 11 17 51 I .......\TpU. 0130 79 d2 90 3e 2 4 e7 23 01 e0 49 96 d0 c8 34 f6 05 y ....9.J.......L.. .._..U..4.\.Q 01e0 f8 45 be 45 c 6 58 70 b2 fa c5 ac b6 c9 90 d8 3f ..... -N.q 01b0 d7 2d 4e ec c f 1e bc 76 47 6b 15 5f 1c 77 d7 73 . 0160 d6 95 1c a4 2 b 48 a0 75 2b 3f d1 18 dd 97 5c da ...[.S. 0140 e9 5e 39 ab 1 5 13 39 94 1b 0f 0b 07 09 a4 68 08 .... 0220 7d c1 dd cb 0 b 8b 76 a4 5d fd 54 d6 c4 ff fb 92 } .. 0170 14 e6 28 f0 5 5 06 80 31 85 0c 53 ef 4c 0a 20 5a ..

..R. . 0250 70 be dc 46 d a 5e fb ff 6c ef 5d 67 75 2d a4 58 p .1.....W..J. .HQ( 0310 ca 13 b2 cf 3 5 65 6f f7 23 a5 d7 fa 93 fc cf e3 .C-...l....8lP..5....5.58 a4 4a b0 61 ......=. ... 0290 e7 a6 8c d2 0 f 96 99 ea bf ef fc cc 38 6c 50 f1 ..[ 0340 68 1f a3 99 d e af ac 9b aa e5 99 be 27 fa 7b b5 h .*A.A Uo@. J....kd.\. 0320 16 c4 13 41 d 0 6b 64 ce e2 81 88 5c 95 32 b1 08 .A.....zPX.3ZYJ:Yb....U 02b0 31 af 57 f4 3 5 fe 88 ab 85 12 92 e0 59 45 e5 1c 1 ..... 0300 2b fe 31 f3 1 9 f5 ff cd 35 7f e3 ee a4 48 51 28 + ..A. K.%..^.. 02f0 0b 4b 0d 1e c f f1 35 b7 02 0e e9 3d e3 5a 9e ef . 02d0 67 e2 ee 7c 7 5 4a 2c 5f 66 30 e4 1f 00 d2 5e 92 g .}R..v)...... 02c0 28 88 25 dd 8 1 43 2d bb 6f b4 14 ce ad 5f 41 10 ( ...#.....F.j.5.. 0270 b6 80 c1 9e 0 c a1 15 0f 69 02 4b a5 7b a8 cd e4 ..5eo....|uJ.... ...1.....X 0260 2f c8 b5 51 8 0 1a 06 38 f5 a9 52 13 06 b9 a3 09 / ...o..... .Q.]gu-.^..._A.OTH...2.a 0240 89 4a 0c 9c 7 d 52 0c e1 09 41 a6 1e 2a 41 87 a1 .......... 0280 34 cf 14 13 a e b2 6a 0f 8e a5 a7 a7 16 76 29 e3 4 .'U.{..8. 02a0 64 ea be 41 2 0 55 6f 40 ab 8c f4 0a 1f 17 a4 55 d ....Z.%<W..i.. 0330 a3 07 33 5a 5 9 4a 3a 59 62 95 4f 54 48 97 91 5b ...K....... 02e0 b2 f2 25 3c 5 7 b1 af f9 0d 31 83 d6 bd a4 d1 bb ... ._f0.YE. ...

.T..T.XY..C... . . 03d0 fb 92 04 e8 0 f f2 f1 22 54 83 0f 7a 50 5c c4 5a .t.h 03a0 8e 3c 78 e0 7 4 84 b2 ab 10 74 89 49 a0 ce d2 4a ....j.......T{..J..P....5. 0420 f1 99 54 0f 0 8 b9 3d bb ac 58 59 19 8f a9 b5 98 .P. 0390 84 ee 5a a3 a 2 fe 8d d4 e2 f9 8c cb ac 2e 1a 68 ....a}g...S."L+ 0400 87 25 32 1d 2 8 58 a8 5a bb 2c 14 f6 05 c7 6d 62 .... .Z.Rk...m......f...........N.+.Oq...$... 0350 64 da b2 2e 2 4 d5 f4 5d ea 94 9f 36 a7 ab eb ce d .... .... 03f0 87 bd 28 98 e 9 49 0b 1d fe df 7f ff ad 22 4c 2b . a..."T...K. %2......... .'..L...6....t.I...6 0370 5c 1b b5 52 6 b 8d 94 a9 14 50 ee af 91 4e 93 09 \ . .#...zP\. <x.|Bb.J 03b0 b4 3b c1 23 d d 79 ab 2b e5 90 49 3c 74 37 75 34 .C.].......(X.. 0380 78 c3 13 2d c 8 58 88 54 7b c6 35 55 e1 43 9b 3b x . ..t..J 0450 7a 1f a4 da d 4 53 d1 d8 54 8d 1a d5 bb 93 11 04 z ...]L+j.... .w..Z 03e0 90 61 ec 4a 0 c 4c b3 50 0d 61 e9 81 83 11 ea 01 ..Z..X.=. ......I..s..{.5U. h.. 0440 bc 68 11 61 7 d 67 7f ed 8a af 62 64 6d 4d d5 4a ...I<t7u4 03c0 24 d1 f3 fe e 2 c3 74 12 1a fa 43 ea ee 4b df ff $ .-....a..y. 0430 17 81 6d aa 9 d d2 ed 6a dc 7c 42 62 be 73 1b 1b .. 0360 b7 89 c3 4f 7 1 87 17 35 ae b0 8c b3 20 02 1b 36 .bdmM..(..mb 0410 36 6c ad 01 6 6 c8 5d 4c 2b 6a 95 e8 77 dc d8 ce 6 l..

. .&...."..d..K..dllstx01....W.Fp.'Yy........iL.1f.P 0470 94 ea 6f ea d 9 11 cc 8d 57 60 4b 50 7c 8a ab 03 .corexc hange.Vl.g....w.]..w.Y@..$.+........ 0480 67 33 31 ce d f 6c 2c d0 a1 2d 67 4a ba 0e 27 56 g 31.M3U..-gJ. 04b0 50 0d a1 82 c 2 15 32 8f d1 d4 22 00 c1 80 29 49 P .. 0510 9b 21 57 7f 4 b bf 77 ff fa ea 67 e2 06 46 70 e8 .. !W... .home TCP 884 http→49 574 [PSH....0a. 04e0 ab 14 30 61 1 e 2e 79 b5 93 c0 b3 54 c4 fe d3 c2 .l. 2.2.v.uMB 0500 9d c6 6c eb f f 98 b0 f4 c4 24 d1 89 26 aa 96 b0 ..=~...)I 04c0 2a 86 59 40 8 8 95 31 66 da e0 10 56 6c d4 aa de * . 04d0 58 e2 57 97 5 d b5 2b 94 76 02 72 a6 63 15 ed e0 X .o. .W`KP|.0460 31 f3 8c d1 9 1 18 d1 91 69 4c dc 8d b9 64 c0 50 1 ...064116000 cust-74-124-12138...'V 0490 89 32 b7 77 c 6 27 59 79 a5 8b d2 2e a5 89 9c c8 . 04a0 fa 34 58 ed 7 0 29 9f 2d 9c b3 ff f9 ac 6a 61 91 ...r. Time Source Destination Protocol Length Info 86 3..com pc13.p)..ja........K.. . 0520 34 79 4 y No...c.. 04f0 8f 85 4d 33 5 5 95 3d 7e a4 87 4b c0 91 75 4d 42 .-.T. ACK] Seq= 49749 Ack=1 Win=46 Len=830 Frame 86: 884 bytes ..l. 4X...y...

Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).000 000000 seconds] Epoch Time: 141 5615216..on wire (7072 bits ). 884 bytes captur ed (7072 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.. = LG bit: Globally unique address (fac .0.. 2014 11:26:5 6.035998000 seconds] [Time delta fro m previous displaye d frame: 0.. . .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . . .....064116000 sec onds] Frame Number: 8 6 Frame Length: 8 84 bytes (7072 bits ) Capture Length: 884 bytes (7072 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .... .03599800 0 seconds] [Time since ref erence or first fra me: 3.114046000 s econds [Time delta fro m previous captured frame: 0..port == 80 || http 2] Ethernet II.114046000 Romance Standard Time [Time shift for this packet: 0... .

168. Src: cust -74-124-12-138.. .. .0 .......home (192 ... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .corexchange.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ... ..dlls tx01.. .. .1...co m (74..0 .. . .. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) .12.0. .. = Reserved bit: Not set ....tory default) ..1...138)....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 70 Identification: 0xf1a0 (61856) Flags: 0x02 (Do n't Fragment) 0. ... = Differentiated Ser vices Codepoint: De fault (0x00) .0. .. . = LG bit: Globally unique address (fac tory default) . ....... . Dst: pc13. ...... . ........ . ..... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. = Don't fragment: Se t ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00....124.... ..

0... = Urgent: Not s et . = Congestion Wi ndow Reduced (CWR): Not set .... = Acknowledgmen t: Set . ..0..12. = Reserved: Not set .. = Push: Set ...dllstx0 1.168.. = Nonce: Not se t . . .... .... .corexchange... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. ...0 . . Dst P ort: 49574 (49574)... Len: 830 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 830] Sequence number : 49749 (relativ e sequence number) [Next sequence number: 50579 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . .home (192. .. .com ( 74. . Ack: 1 .. . . = ECN-Echo: Not set ... . Src Por t: http (80).... .138) Destination: pc 13....... ..124.1 .. Seq: 49749... ACK) 000..Header checksum : 0x3c38 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. 1 ..1...... . . 0000 0001 1000 = Flags: 0x018 (PSH..0....... ..

.l.@. . .. ... ..#".P.5_ 0080 d4 b3 62 e2 0 b ff fb 90 04 e8 0f f2 de 27 d4 03 .C.Vg......0. 0040 9c e5 bb 2b a 4 2a 46 d9 e6 1f 5a 14 12 46 69 96 . 0010 03 66 f1 a0 4 0 00 31 06 3c 38 4a 7c 0c 8a c0 a8 ....'.....$.....1.+......J.N.... ...b.*F......<8J|..N.2 0070 16 70 f8 f8 7 6 0a 43 fc c9 34 d6 56 67 b8 35 5f ....a 00a0 e9 41 7d 93 e 9 81 9c 3d 28 14 70 .4. ..c[..'.)..... 0050 62 ec 87 26 b 0 81 23 22 84 29 8c 8d f0 8d 44 2d b .0.#&oi.qa. 0020 01 0b 00 50 c 1 a6 2b c9 24 82 9e 87 4e aa 50 18 . .E.+. 0090 58 4a 50 61 4 4 fa 70 67 0f 4a 0b 7c 9f 4e 0d 61 X JPaD...Fi.D0060 f4 16 23 26 6 f 69 d0 1e 00 98 01 c2 71 61 04 32 ..... 0030 00 2e c6 9c 0 0 00 08 11 27 cb 6c d8 63 5b e3 09 . .. `n. f.. = Reset: Not se t . ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xc69 c [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2090] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..pg...P. = Syn: Not set .dx. p. ...|.&....v.Z.

......<..M....Z...]S..t.._%<h0....B..~ 00e0 b5 3d 80 65 8 7 42 5e 0d 7b 2e 9e de 10 f5 ef 73 ..j 0190 71 7e b5 39 5 3 f9 9c ad 56 a7 b9 71 32 20 a4 d8 q ~.5...C....e.dt 01b0 7a f6 3d 5d 9 a 90 db eb f4 fe 3b ac 66 98 d7 cb z .d.x.L1..n.. 00d0 29 5a b3 89 1 7 78 ae 3c 9b 68 28 35 0e 35 c8 7e ) Z.0bd.. A}.px*.V. ..q2 .....^... .5 0140 05 84 8b 0e 2 8 70 01 91 25 0d ff 9f 25 ae 24 50 ...(p..H.....M~.HY6.....$P 0150 e3 a5 aa 24 7 e 66 85 b8 d5 42 ff 4c e2 15 5e ae ..a. 0180 8f 16 b7 13 5 a bc 02 ad c0 43 f3 39 2b 43 ad 6a .6nP.9+C...`.Z).. .. 01a0 63 92 42 ab 1 4 f9 87 11 8d cd bd 4d 7e d5 64 74 c ...&i.A... 0120 e6 c6 90 b0 f 0 30 62 64 15 75 d8 64 a9 08 f4 57 .$~f./ 0170 29 89 56 5c 9 3 8e 48 cd 09 1c 76 d4 02 c4 9a 19 ) ...{.. 00c0 26 cb c4 11 4 1 0d 36 6e 50 cd 0c c4 a2 91 6e 92 & .. .@.Z.W 0130 da 16 2c ee b d 64 d7 60 b4 11 28 c7 c4 c2 c2 35 ._....78 2a b7 4d 9d ...0 0110 ef b7 ff d0 5 d 53 1a f4 5a 29 8f 74 a0 01 0b e2 ..(....d.. 0100 ff 87 df 5f 1 f 5a f6 9b ff 2c d4 bd 95 a0 c5 30 .B..".u.. .V\.......L. .B^. ?.....%.... 00b0 cb 3f ad e3 0 4 4c 31 d9 cb 22 13 0c d1 0a 0c 00 .=(.h(5..v.%. . 0160 6c f4 e2 b6 1 e 40 b9 61 92 48 59 36 b7 16 ea 2f l ....^.s 00f0 38 a4 ab 5f 2 5 3c 68 30 a4 cc 5e a5 9a 26 69 bd 8 .9S.. =....

y.f 0280 98 03 3b e4 8 2 62 b0 00 76 53 af 6f 55 8e e0 c2 .FD......O".. .... YJ`a%. .. 3...]&...vS..>aL 02b0 dd d1 e8 f6 f 5 ba 46 44 fe 64 86 40 d0 53 04 1e .( 0200 8e 98 0d 23 f 0 87 57 79 7c c3 09 6d 81 ec 4f 48 .y...'.A. ...U.=].. ....m..x`.A..S..y......+o..E.Q.b. .#.lN..... 0240 65 89 41 7c 9 3 e9 41 ac 3d 28 80 ec 6c 4e d2 78 e ... ..g...... 0Ac.. 01e0 84 a5 51 e5 a e d0 c6 8b f2 45 b6 68 eb 5b 76 ec .......OH 0210 d3 df 7d fa 1 f 0e 4d ba 79 7f e3 bc 79 8d 6a d8 .@......<(.#^8..M.=(.....0.RI. 01c0 8e 98 28 0a 1 6 74 93 55 39 a9 ff ff 67 f4 d5 05 ...0. 0220 d6 2b 3e 1a 7 8 60 ff fb 92 04 ea 0f f3 06 2c 53 .. +>. 0290 63 31 9e 13 f 6 e5 56 6f 37 3e 62 c3 92 1c 08 b1 c 1... 02a0 ff 58 9a 0e 2 b 6f 8d 4f 22 1b 16 30 d5 3e 61 4c .oU. ..L.n...d.Wy|.<.x 0250 ed d5 f1 81 8 2 0c 98 f3 3c 90 e7 cb 30 00 41 82 .d..[v.S 0230 03 59 4a 60 6 1 25 da 50 67 0f 4c 0b 64 9f 4c 0d .... 0260 c9 91 af 64 e 8 32 03 52 49 14 65 6f 64 60 6d 68 . 01d0 04 33 b5 cd c 1 23 5e 38 00 80 02 55 c6 0f aa 85 .h.... 01f0 bc 2d 7a 0a a 3 a4 9c 91 3c 28 ce c8 09 ea bb 28 .j.d..Vo7>b. -z. .f... 02c0 1c 30 41 63 8 5 27 82 92 e5 5d 26 93 ea f8 05 ba ..}..A|....U9..o. X.t.eod`mh 0270 3e 5d 32 0a 1 2 e4 79 b8 c3 6e f7 6f c6 9b 1d 66 > ]2....(.L..2....Pg. ..

.... 0310 65 3c e7 43 b f d6 d5 0c c1 f3 2d 58 55 2a 71 88 e <.......C....cor exchange.n|.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =50579 Win=41904 Le n=0 Frame 87: 54 bytes on wire (432 bits)..s{..S 02e0 82 58 35 a6 d 5 d3 db ef a8 92 08 43 95 d3 fa b0 . T.....&G. X5.. 0340 ac 98 4b 02 f 1 cc 43 f8 4f 8a a0 51 cc 92 a8 72 ......02d0 69 d1 f6 29 5 d c0 b6 f0 aa 16 69 0f 43 8e e4 53 i .... 0360 93 ba cd 8c 1 e b3 b4 a6 26 bd 6e b4 26 47 ff ce ..064284000 pc13. ._. .home cust-74-12412-138.n...Q....dllstx01...C.. Time Source Destination Protocol Length Info 87 3. 0370 df 93 f2 0a .......p_R." 0330 75 f8 82 82 0 3 4d 4e b6 46 8f 10 8c 3f 92 19 0b u . .K..... 0320 20 27 30 a0 3 8 04 85 93 70 5f 52 9b 68 73 03 22 '0.MN.r 0350 97 92 37 59 c 6 b1 b0 97 94 17 31 40 ba 6e 7c e9 .i....hs.Usl.. 02f0 9c 54 b5 8e 3 8 bf b9 1c ee be 0f 55 73 6c ed 7e .~ 0300 b6 f4 82 e3 5 f ff c6 73 7b 7f e7 cb ff 87 ec be .-XU*q..C..8.)]..C....F. No.. 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) .?..1@.O.8..7Y..&.. .. ..

.00016800 0 seconds] [Time since ref erence or first fra me: 3.114214000 Romance Standard Time [Time shift for this packet: 0....port == 80 || http 2] Ethernet II.... . .. = LG bit: Globally unique address (fac tory default) ...0.. ...064284000 sec onds] Frame Number: 8 7 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As .. ... 2014 11:26:5 6...000 000000 seconds] Epoch Time: 141 5615216.. .000168000 seconds] [Time delta fro m previous displaye d frame: 0. . ...0 .. .....Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.114214000 s econds [Time delta fro m previous captured frame: 0. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . . . ....

...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f3a (20282) Flags: 0x02 (Do n't Fragment) 0.1.168.. = Reserved bit: Not set ..0 ...home (192.. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.0... = Don't fragment: Se t .dllstx01..co rexchange. ..11) .. Dst: cust-74-124 -12-138. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. ..12...ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .....0.......ho me (192.... .168.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .... . = Differentiated Ser vices Codepoint: De fault (0x00) .1. ..11 ).. . .. = LG bit: Globally unique address (fac tory default) .1. .. ....138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.... . ...1 24. .com (74.. Src: pc13 ....

. 0.... ... ..corexchange.. = Nonce: Not se t .0.... . = ECN-Echo: Not set .. Ack: 50579 .. Seq: 1.0 = Fin: Not set Window size val ue: 41904 [Calculated win dow size: 41904] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d ... . = Syn: Not set ....124.. = Push: Not set ....1 ..0. .. D st Port: http (80)....12. ....... .. = Acknowledgmen t: Set . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 50579 (r elative ack number) Header Length: 20 bytes .. .. . .138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. ... . 0 ... = Congestion Wi ndow Reduced (CWR): Not set . Src Por t: 49574 (49574).. . . = Reset: Not se t . = Reserved: Not set . 0. ..... 0000 0001 0000 = Flags: 0x010 (ACK) 000.. . com (74... .. ...0.. = Urgent: Not s et .... ....... ...dl lstx01. ..0 ... .Destination: cu st-74-124-12-138. .. ...

171121000 cust-74-124-12138.dllstx01.. No. . .E...000168000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . (O:@. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10....com pc13..corexc hange..221051000 Romance Standard Time [Time shift for this packet: 0.home TCP 1314 http→49 574 [ACK] Seq=50579 Ack=1 Win=46 Len=1 260 Frame 88: 1314 byte s on wire (10512 bi ts). 2014 11:26:5 6.N.dx..P.. Time Source Destination Protocol Length Info 88 3...4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 86] [The RTT to ACK the segment wa s: 0.... .+.. 0010 00 28 4f 3a 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .P..'.000 000000 seconds] Epoch Time: 141 .. 0030 a3 b0 18 d4 0 0 00 ..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 27 c0 50 10 ...`n..

.. .... .. .. .0 ...106837000 seconds] [Time delta fro m previous displaye d frame: 0. ..... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... . . ......221051000 s econds [Time delta fro m previous captured frame: 0..... .171121000 sec onds] Frame Number: 8 8 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .... .. ... ..10683700 0 seconds] [Time since ref erence or first fra me: 3.....port == 80 || http 2] Ethernet II...5615216. ..... .0... . ...... . = LG bit: Globally unique address (fac tory default) ... ..0. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . . .. . = LG bit: Globally unique address (fac tory default) .0 . ..... ......

.138)..com ( 74.138) Destination: pc 13. ... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. = Reserved bit: Not set .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1a1 (61857) Flags: 0x02 (Do n't Fragment) 0. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a89 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..home (192 .. .dlls tx01.corexchange.12.. ...1.home (192. Src: cust -74-124-12-138..dllstx0 1.124..12..corexchange...124..168.168..1.co m (74. = Differentiated Ser vices Codepoint: De fault (0x00) .. Dst: pc13.1. = Don't fragment: Se t .= IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.0.

= Reset: Not se t ....... = ECN-Echo: Not set .. . ..0. Src Por t: http (80).. .. = Nonce: Not se t ....... = Push: Not set ..... Seq: 50579... . .. .... Ack: 1 .. .. 0. . .... . ...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x54f 4 [validation disab led] [Good Check sum: False] ... ... ... 0000 0001 0000 = Flags: 0x010 (ACK) 000. = Reserved: Not set ....... . = Urgent: Not s et . = Congestion Wi ndow Reduced (CWR): Not set .....0 . .Transmission Contro l Protocol.... = Acknowledgmen t: Set . .... ... ..0. . 0 ..0. . ..... = Syn: Not set . . Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 50579 (relativ e sequence number) [Next sequence number: 51839 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. ..... 0. Dst P ort: 49574 (49574). ..1 .

.........a1. .. 00b0 10 46 a2 dd 5 f f5 21 e8 08 51 2f 03 28 58 78 78 ..:. ..J|.bc`..$..&^.P.@....gE.. r...+..v.@k/J..(Xxx 00c0 f2 a1 e4 2a 2 5 2e 31 e7 50 b5 37 65 37 dd 00 34 .X.XzPa..b..... 0030 00 2e 54 f4 0 0 00 20 22 01 62 63 60 18 86 2a 4d ._.dx.[Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .?&. 0020 01 0b 00 50 c 1 a6 2b c9 27 c0 9e 87 4e aa 50 10 .. ". . .p..... 0070 e8 72 af 26 5 e c3 c5 0f 8a 14 d6 3f 26 d0 ad 5b .. 00a0 18 b1 4a 0d e 5 e9 81 76 18 69 41 ac 35 30 d5 be .... .N..n#(b4.. 0010 05 14 f1 a1 4 0 00 31 06 3a 89 4a 7c 0c 8a c0 a8 .eS..!.P.(.P.iA.k@.. . 00e0 b2 e4 1d 61 3 1 3b ed 76 b5 70 00 12 1f f3 58 d1 .ag9r. `n.*%..'. .(R..7e7.1. b.4 00d0 65 50 1d 62 8 7 5d 95 a7 a9 10 a0 48 e3 bb 02 cf e P.E.....T.*M 0040 8e 18 61 67 3 9 72 83 85 c9 24 ca 08 62 72 50 5a .J..].{...H.q...[ 0080 cc 62 fe fa d a 7b f9 89 67 45 ff fb 92 04 ea 8f ..Q/.. F.. .1.50..h0.brPZ 0050 89 93 6e 23 2 8 62 34 93 28 0d 68 30 04 71 e5 a2 ...... 0060 72 d9 3b 65 5 3 b9 0b a6 d8 6b 40 03 54 4f 30 88 r .v..TO0.. .. 0090 f3 03 28 52 8 3 58 7a 50 61 c4 ea 40 6b 2f 4a 0c .

... ..j^... 01f0 c7 f3 80 24 d 4 94 8b ce 1e 0e 19 3e 36 48 fa d1 .C.J'.. 0150 ab 5a a9 5c 6 f 77 19 3f bc 55 e8 57 f6 a6 f3 df ..6.U.x<....nq... i..Z....P.Yja 0190 66 4f 88 f3 e 8 84 d9 99 50 fd ac ca 29 12 ee b7 f O......5.........+.... ....n 01d0 48 64 6d 43 9 9 22 ce da 2c a1 cc e7 81 4a 27 15 H dmC..$&...u... Z.\. 01e0 6f b2 4a ef 7 8 50 90 b9 f6 e7 17 6e 71 a6 60 e2 o ...00f0 35 89 e4 29 c e 8c d2 4c 5e a7 93 aa 56 e3 36 ae 5 ........X..... 0170 0a ec 78 3c 9 e 43 8d c0 00 d2 5d 20 22 6c 5d 72 .+.$....xP..?. .`.@o....>6H..U.... 0120 00 69 f3 cc 2 b b0 68 8a b8 2e 82 35 12 b5 32 cc .Q.W.Z.3 01b0 72 9d a6 f6 a a 35 73 cb ef f7 ff fb 6a 5e cf e6 r ..L^.-FA. 0160 b3 f1 eb 2e 5 8 f3 ee 2d 46 41 fd 3e 94 b9 31 0a .. 01c0 6c 3b f2 03 1 5 51 b1 bb 1d 5a 1f f1 bf fa 91 6e l ...o 0110 42 38 87 40 6 f a0 0b 84 df 5c b7 24 26 1b 0a ad B 8. 01a0 b4 9c 11 b2 d 8 dc a0 9d 10 19 84 5a 14 2b a9 33 ..q...)..).. 0200 ea d7 73 d1 5 ..... 0130 17 4b 56 8a e 1 0e c2 a6 c3 1c 71 0e 52 e5 1d e3 ...h...5s.J.......R..6..... 0140 7a 61 54 26 b 1 e6 b5 e1 2a 54 f3 b7 c7 9f de 90 z aT&.] "l]r 0180 39 b0 ce 03 0 4 36 cc 04 a1 85 58 87 98 59 6a 61 9 .\ow...V. 0100 46 fd a5 e3 9 b 75 ff cc 9f ef f2 55 bd af 95 6f F .. ...1...".2.. KV.....>.X......*T.

s. .w. ... ..>t.p 0250 3a 0d 3a 4e 3 8 99 c8 b8 88 0a 45 a5 d4 59 c8 22 : .X 0270 d2 67 50 58 9 4 cb aa c6 7a c1 15 bc f5 92 3c 58 .XZ`Z.Pk..g.&...... 0300 a7 ce 4c 9d 0 f 1c 65 84 80 8d 16 12 0a 90 07 1f ....'q..... 02d0 38 a7 63 55 b 0 49 52 6c f2 7a a1 f8 82 a9 04 b1 8 ....... 02e0 9a 08 34 7d d 9 3d 56 b9 3b 27 71 ea 56 5b d4 5f .....#W59...*.Y... 02c0 82 52 48 bc 2 1 0e 2a b2 2d 75 0b 26 82 17 11 89 ....A.... 0240 4c 0b 7c 9f 4 c 0c e5 e9 41 89 98 e9 81 97 a5 70 L . .9 95 4b 49 8f de 8e 3d f7 e4 8a 77 .. E..:N8...L. gPX.x\ 02a0 85 45 03 cf 9 a 09 03 80 50 64 31 c9 02 c4 9f 4d .....V#..e.M 02b0 4d 7f 8b 99 a 2 11 c4 91 ec d1 55 54 45 53 83 9c M .....w 0210 f2 99 db 2c 7 7 db af 56 a1 81 73 90 3e 74 b0 a8 .. .Pd1...4.4}......S 0290 ec 9c f8 4b f e ec ff ff 34 df f8 bc a7 96 78 5c .. 0310 8b 3a 4d 32 1 1 6f 9c f4 22 90 c6 .. 0220 d1 55 56 44 c d 67 2c 30 2a 2a 64 eb ff fb 92 04 ..IRl.." 0260 57 6e 23 3a 9 d 44 10 56 23 9d 2c 89 5e d1 cb 58 W n#:..R....^._ 02f0 ee ed b8 fd 9 e af 5e cb b2 67 1a bc 59 07 d7 ff ...... 0230 e9 0f f2 e1 2 c 52 83 58 5a 60 5a 85 9a 50 6b 09 .=..K.E.....Y.<X 0280 d1 60 4f 91 0 b 7f 94 9d 23 57 35 39 0f fb ce 53 ....g..KI.z. .=V. UVD..Y.D.UTES.|.V...V[..L.z..!.0**d.cU.. `O..s.... RH....-u.....^. ..

...s.2.<. .M.'y..sE.q. .q.x.'P..P.R....("..'T..Z. 0420 e1 ca 58 ea 6 e 5c 6c 52 40 96 b9 b2 0d 87 49 89 ...`...B 0370 0f 07 00 81 1 5 9a 41 fa b6 a7 fe 73 e8 78 02 ee ....:.. 03d0 92 04 ed 8f f 2 f9 27 54 83 58 62 50 61 e6 9a c0 .+..U.......Q..?.... 0390 3a 5e 84 c3 d a 3c 8d e7 6c 7c ea 6a 08 c7 17 2a : ^..".rN. 0400 4a 06 e5 18 8 a 0e 83 28 22 2c dd da 2b 1c 28 a2 J ....s.+.c. LY.. ....l|. .@...\... 03f0 25 30 a5 db e d fd bf d0 dd 00 a4 14 9b 04 71 1b % 0.. 0320 c0 4c 59 b5 7 1 d9 3a 01 50 9a 3f 83 a2 51 e6 09 .. 0410 69 fc d2 32 a 9 49 69 39 95 f1 54 e0 2e 53 ca 16 i ..XbPa... e...E.j...(..`2 03c0 d5 15 15 73 2 c 5b 5a ce 0c 6d 31 5d e1 95 ff fb ..!..v?d...".11. ......o.f:..<9".@...* 03a0 18 73 a5 c8 1 7 3c 39 22 e9 0a ee 66 3a a2 60 69 .A. .S..Ht.....m1]..g 0340 84 13 31 31 0 0 a4 7e ff 49 d4 55 a5 4d eb 1c 81 . :M2.Q.. 0360 66 5e c4 1e e 9 f0 40 2c 27 79 00 19 93 22 c2 42 f ^.... 0330 03 9a 84 76 3 f 64 9e 60 c2 52 8c 27 50 9f eb 67 ..`i 03b0 b0 10 f0 b3 5 4 08 b0 48 74 0e 1b 73 45 2c 60 32 .u...~.T.Ii9.....[Z...81 51 a0 aa 87 ..T. ... 03e0 61 e6 5c 0c 9 8 c5 5a 0c bc c9 81 91 17 2b c1 86 a ... 0350 3a 5d af 9b 9 3 f2 63 e4 21 be df ee d7 f3 40 99 : ].. 0380 11 65 b4 2e e 4 b1 c8 45 98 c3 75 89 72 4e 00 a6 ..... s.I.

.n.. . 04a0 70 bd 0d 2e 1 0 15 69 31 52 54 24 fb 10 b4 68 7b p . 0490 cd f7 f8 ef 8 d e3 3f 6f f7 2d b4 c1 52 e0 03 8a ...C[........... Time Source Destination ... 0470 43 16 48 3b 4 3 5b a1 a0 25 8b 01 e3 d9 f6 b0 02 C .404" 0500 58 bc c0 90 f 0 20 19 17 26 44 d0 f6 34 91 7c c1 X . ...h..5.. 0430 ae 22 51 b4 1 a 68 f7 a5 54 26 04 4d 88 04 04 83 .Zx.|. 0460 0d 8d ae 35 d 9 ce 85 85 d0 b7 21 d5 53 c9 1d 95 ...!....R@..n\lR@. ( No..... qj..6E. "Q...... ....X.T&.<.w........-. 04d0 bc a9 15 ad 3 6 45 b5 77 96 d4 08 b6 2c 4d f4 c7 . .......MSu. ...i1RT$... .. 0480 7b 90 7d 6c 2 5 26 6d 6a 06 a9 ea 9e 1f f9 ef db { .b 04c0 12 c7 52 40 1 4 2c 1a 7d 01 e1 e0 e8 94 85 e2 ea .|.G&.}l%&mj.|^ 0520 de 28 ..H.R......M...4...3 0450 4b b7 da ff b 7 fa 1b a2 c1 0a 98 b5 6d 0d de 97 K ...V.m..... 0440 82 11 56 86 4 2 a2 30 08 18 9d 4e de f8 61 1c 33 ....?o..0..I.. ..S. 04e0 61 96 76 a1 2 1 aa de e6 5d a6 7c bf d3 e1 3a 6b a .a.:k 04f0 c4 7b 10 47 2 6 b5 0d 52 71 a4 19 e9 34 30 34 22 ...... 0510 96 89 4d 53 7 5 ca 3c 84 f6 bb 5a 78 0b aa 7c 5e . {..B.N. .....%..&D....Rq.h{ 04b0 d3 71 6a a8 e b 6e 10 fd f2 83 aa bb 97 20 a7 62 .}.!.v..M..]...

042002000 seconds] [Time delta fro m previous displaye d frame: 0.corexc hange.263053000 s econds [Time delta fro m previous captured frame: 0.port == 80 || http 2] Ethernet II. 1303 bytes cap tured (10424 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.home TCP 1303 http→49 574 [PSH. 2014 11:26:5 6.dllstx01. .000 000000 seconds] Epoch Time: 141 5615216. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).213123000 cust-74-124-12138.04200200 0 seconds] [Time since ref erence or first fra me: 3. ACK] Seq= 51839 Ack=1 Win=46 Len=1249 Frame 89: 1303 byte s on wire (10424 bi ts).Protocol Length Info 89 3.263053000 Romance Standard Time [Time shift for this packet: 0.com pc13.213123000 sec onds] Frame Number: 8 9 Frame Length: 1 303 bytes (10424 bi ts) Capture Length: 1303 bytes (10424 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .

. .. ....dlls tx01.. ..Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... ....... Src: cust -74-124-12-138.home (192 . ...138)....... = LG bit: Globally unique address (fac tory default) . .... = Differentiated Ser vices Codepoint: De fault (0x00) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 289 Identification: 0xf1a2 (61858) Flags: 0x02 (Do n't Fragment) 0... .....168. ... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .......co m (74..0..0 . . = Reserved bit: Not .corexchange..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. .... ... Dst: pc13..0 . ...... ..1... ...124. . .. . .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..0. ... .. . = LG bit: Globally unique address (fac tory default) . . ... .12..

. 0000 0001 1000 = Flags: 0x018 (PSH..com ( 74.set . = Don't fragment: Se t .1. . ACK) 000..0. Ack: 1 .124.. Len: 1249 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1249] Sequence number : 51839 (relativ e sequence number) [Next sequence number: 53088 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . . = Reserved: Not set . .. = Congestion Wi ndow Reduced (CWR): .. = Nonce: Not se t .. Src Por t: http (80).... ...dllstx0 1..168.home (192.. ... Seq: 51839....138) Destination: pc 13..0 ...... 0... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a93 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.12.1... Dst P ort: 49574 (49574). 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. ..corexchange. . . .

... . .. .. 0070 36 90 55 cf 1 .4T.".0.... = Reset: Not se t .. ...+..dx...P.......P...Gi= 0040 9f e0 b9 34 5 4 8a 55 5a 8d cd 3a 72 43 86 d8 9b .. 0. . .......UZ... 0020 01 0b 00 50 c 1 a6 2b c9 2c ac 9e 87 4e aa 50 18 ..... `n... .d+..:rC...g....1 . .0... = Syn: Not set ... ...........DtRd.._..0. .Not set . = ECN-Echo: Not set .... . 0010 05 09 f1 a2 4 0 00 31 06 3a 93 4a 7c 0c 8a c0 a8 .:.J|.E. = Urgent: Not s et . .. I........ . ...1. = Acknowledgmen t: Set .. 1 . .@...h.. ....N..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xbca 7 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2509] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..^... . .. 0050 a2 49 c6 80 6 8 a4 1d 02 67 1a 5f 05 09 5e 0c 66 ..f 0060 3c 70 e9 22 2 e 94 e2 0f b6 c6 c5 44 74 52 64 93 < p. 0030 00 2e bc a7 0 0 00 d2 c4 64 2b c1 b3 b7 47 69 3d . .. = Push: Set . ...

. . 0150 ca 1c ed 01 0 1 80 4c 3f 06 1c 92 01 87 92 12 0c . 0100 fc bb 5e bd 8 f 7a 5e 7e e5 df ff ea 2a 3a 59 db . 00b0 af af f5 47 1 2 f4 c4 76 5e d4 5b 1c ea f1 7c db .........^.E.. 0140 05 0d d8 6a 3 e 9e d6 86 10 bf 45 f9 88 b7 ff de .....E.. 0110 31 9a f2 e7 4 a 76 b0 12 6b a3 4a e4 46 97 8b f0 1 .9.a 0180 36 1e 30 18 1 b 4e 05 98 ea d5 74 ...L.K...Rn.. 0160 70 70 44 4d 0 c 52 11 27 72 d5 f7 73 fa 55 61 b1 p pDM..v^.. 00f0 3d eb 02 ec e 6 24 54 78 b4 c5 dd bc 5e 04 ac da = .......j......'r.... ...y.0..*:Y..U.."....a. 0090 42 50 5e 65 a b 00 61 88 4c 0b d8 bd 5e 0c 3c c9 B P^e.[.Ua.*.... ....p..u..VUb 00d0 bb 2e 8b 83 2 2 88 27 14 15 51 04 9a da 4e 19 6c ....l 00e0 ce 83 99 22 c 6 0d 1f 0d 05 51 31 7a ef 11 2e b6 .^..G.$Tx..j>. ...'.Z~$O. 00c0 2a c1 f8 a0 a 8 52 6e 91 0c dd b3 75 cb 56 55 62 * .....|......... 00a0 81 96 99 2b c 1 84 99 70 dc e4 11 b4 ed af de db ..F..".N..... . 0130 e3 d1 ec 87 2 6 91 b1 e3 80 41 82 4b b5 0f 39 a1 ....oS.A.. . 0120 0a 09 af 11 5 a 7e 24 4f dd 18 ce 6a 96 a8 e4 c8 ....+.. 0170 9a f0 12 2a a d bc 0e cb 9d 14 79 9e 6b 0c 8a 61 ..Jv.L 0080 71 24 07 45 f f fb 92 04 e7 8f f2 b7 1e 58 03 0c q $.L?.. .z^~....^... ....Q1z.k...R.&.2 84 04 81 30 00 f3 6f 53 da d3 4c 6 . .X.s....... .k.....Q..J...<.

0190 6a 42 e8 a2 6 4 75 5c 29 5f 4c f7 6e 9c ed 51 68 j B...w} 01b0 84 76 9d 56 9 d 3d 32 57 f3 f6 cd a9 6f 9f 7b 4f . 0200 05 01 a1 19 1 3 45 1c 8b 83 73 88 61 c3 44 19 55 .LH.E...n.........| .+..N.Qh 01a0 ca e3 49 4c 3 9 36 66 83 d1 a2 f4 6d f9 b6 77 7d .{Cw....V....... 0240 bc c9 81 8f 9 d 2b 01 87 99 70 70 f1 d5 c7 01 e5 ..iT..aK9..L s........Q.7.8.... 01d0 6f a6 80 4c 2 0 73 80 b8 74 0a 48 01 00 23 70 09 o .du\)_L.M:."...!.O...U 0210 16 1e f6 4f c 4 8a 8c eb 7b 43 77 ba bd a1 b5 a9 . ..o..a. . .IL96f.$.{T.0.t... /BPX..<U. 0270 87 cb c7 ac a f 1b a9 0d bd c1 37 0c bf 38 e3 c3 ..t.. 0290 26 bd 45 5f b 8 66 31 61 d2 3a 39 9a e0 c5 67 31 & .#p.m......H. WQ.JLD.. ...$..=2W.SU. 0280 c0 1d 55 2e 2 2 ec 38 bd ce 81 92 4d 3a 8e bb 92 .t.... 01f0 33 a9 ba d2 c 9 fa b1 24 a2 a7 69 54 98 53 55 b8 3 ......-. 0220 b7 ae 1a 09 a 9 11 ff fb 92 04 e9 8f f3 01 25 d6 .... 0250 19 fb 3c 55 8 9 b3 fd 51 12 80 4c 48 90 16 48 00 . .PJ.... v.......pp.H.D.....s. .. .V..8.17 07 d3 ab 95 6 ... . 0260 c0 57 51 b9 7 c 20 81 e9 ee c0 ae 0d 94 7b 54 17 ...U. 0230 03 2f 42 50 5 8 a4 ea f0 61 88 4a 4c 44 a5 56 0c .G{....{O 01c0 54 e7 74 b0 1 2 ad f3 05 2d b9 24 9b a9 47 7b f1 T ...... 01e0 7b 02 50 4a 1 6 c3 21 95 00 96 fd 61 4b 39 12 b9 { ..a..%...

3A. ...M-..8V.hL.:9..)..l..}.3&W 02d0 e1 9c 6b 0c a 7 59 e7 22 f3 75 53 eb cb cc aa 48 ...PV.@..... . U....|.{^..d7. 0300 86 84 83 e0 e 9 d0 89 35 2c 22 d9 60 6e dc 4c 85 .. 0390 2b 06 98 53 2 4 72 5d d2 b1 96 6a b5 88 c1 d8 54 + . 02b0 38 b1 e4 75 7 5 f4 7c aa 52 a6 01 bf 1b 4d 4f 25 8 .]..Y%...S$r].. 0370 20 05 19 ce 9 8 09 4d 2d aa 0d a0 68 4c 0b 34 54 .uu.|.../R 0320 fe c3 6c 9c 5 8 28 92 b0 16 1e 92 9d af 0e 9d 5a .&:......T 03a0 3d 2b 30 e9 3 8 61 86 d6 8d 46 8d 75 4b 51 b3 1b = +0...E4U{.0.F.R......= 0350 88 fb a5 8a a 9 0b 3c 68 1c 2a b0 d0 80 f8 f9 d2 ..p_..g1 02a0 42 00 55 40 d 0 74 7c aa d4 0f a4 40 19 38 56 ae B ... 02f0 51 da a6 bf d 9 34 6e bd 7c 9a e8 17 8f bb ba c5 Q . 0340 aa 3a c6 b5 7 b 5e f7 2c 85 33 41 ad 64 37 b6 3d .5....4n.... ...8a..uS...H 02e0 36 83 18 0c 0 8 f4 50 56 13 30 7f 38 96 7c c8 89 6 ..`n.8.k. ...MO% 02c0 1c 55 13 5c e 7 5d 06 86 d1 9d 01 6c 1e 33 26 57 .....t|.U@.|.Z 0330 5d 75 44 57 4 3 5f 4b 90 24 83 a3 b1 16 86 29 9d ] uDWC_K.".....l....f1a.....uKQ....4T 0380 92 24 ef 70 5 f 00 45 34 55 7b c2 48 e1 04 e7 b3 . .. .L. 0360 f6 82 2c 59 2 5 14 1c d7 b4 b2 fe e6 fb 7d 7f e8 . $....\... :.<h..E_..H...*...j.........Y.... 0310 b6 cd df ff d 4 a3 e5 dc 26 3a 09 13 19 bb 2f 52 .". .$....X(.

..... 0490 d4 b2 cd 58 5 2 12 b8 a5 77 28 74 d3 44 ec 89 ed ...V. ...u....l..L. 0470 37 8c bb 73 c d 82 01 80 e0 28 85 ba 3c e6 23 11 7 . 0460 a9 47 18 9e a 3 04 3e 4f ba 67 d1 c7 75 e1 e6 b7 ..!-Q..XB``E.r... .._.s.....<.#R!..... (k.-(.>O.e 04c0 13 58 2a 98 b ..>.1.<{R4 03c0 8b d2 a1 56 a 1 ca bd 7a ff fb 92 04 e9 0f f3 0b .. p..T..... 0440 2e 7c 32 f7 8 d b2 56 a2 cd 37 8c fd 6c 5f ab 2e ....j..XR.v 0430 79 dc 97 ba c a e6 f7 e6 ce b5 6e 3c be 3e a9 ac y ...}qt.. |2.G..7... 03f0 f4 28 6b 08 0 4 d1 88 31 14 10 c3 10 99 58 58 36 . 0410 db 57 db d4 c c 10 1c 20 d3 6a a7 ad b5 b6 35 67 .x.R....&.W.. G.. 0480 5b 12 2c ea 5 d f1 0c 78 c4 9b 72 02 21 2d 51 18 [ .. 03e0 54 0c bc c9 8 1 6c 93 eb 01 86 2d 28 d6 fb 34 7f T . ..(.[DX... 04a0 ed 70 e6 5f e 8 8d 95 26 a8 73 90 38 60 a8 f5 e9 . 04b0 4d 6c 51 4d 0 a 2b 0b 0f 20 4e 54 ad 15 47 96 65 M lQM.. )>.03b0 67 54 f7 7d 7 1 74 b5 17 57 92 a9 95 3c 7b 52 34 g T....w.. NT....D..n<.z.+......7. .XX6 0400 a3 6e 39 13 f 3 15 c5 fc 52 d2 2b 0b 5b 44 58 0f ...#.V. W. 0450 83 29 3e 07 f 0 23 52 21 d2 54 b6 c2 37 d8 20 b0 .....s..5g 0420 2a 33 3b a3 7 7 98 60 6c ca bb cb bb dc 7d da 76 * 3....4. 03d0 31 55 03 58 4 2 60 60 45 ca c0 65 e8 4c 0b a8 af 1 U..].8`..+.....g..}. n9.l_....`l.w(t..e...

D.kP..263229000 s econds [Time delta fro m previous captured frame: 0./.home cust-74-12412-138.#/... 04f0 3a 8a 90 6a 4 c 56 a9 6b 50 b7 46 55 4c 37 71 73 : .00017600 0 seconds] [Time since ref ...C...FUL7qs 0500 03 08 02 a1 0 6 1e 76 05 22 c0 85 69 2c 44 f3 d0 .>. 2014 11:26:5 6.. X*.i.v. 0510 8e c2 65 7e b f e2 d5 ...com TCP 54 49574→h ttp [ACK] Seq=1 Ack =53088 Win=41277 Le n=0 Frame 90: 54 bytes on wire (432 bits).^. 04e0 41 ac 9d 8c 2 6 f3 14 3e bc 43 db 84 81 cb 0f c5 A .jLV.9D..1 23 2f 18 1b 02 fd 5e cd 02 32 1e ...&.cor exchange... 04d0 aa 57 11 0c 2 f a7 9d 95 f3 39 44 c9 0b 0c f6 08 .000176000 seconds] [Time delta fro m previous displaye d frame: 0. ....e~...dllstx01. No.263229000 Romance Standard Time [Time shift for this packet: 0.. Time Source Destination Protocol Length Info 90 3.".000 000000 seconds] Epoch Time: 141 5615216... W...213299000 pc13.2..... 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. ..

. ...... .. . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .. ...0 . .138) Version: 4 . = LG bit: Globally unique address (fac tory default) ..... .port == 80 || http 2] Ethernet II..213299000 sec onds] Frame Number: 9 0 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..1.11 ). . . .. ... .0... ..com (74.dllstx01. .... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)...0.... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4........ .. . .. ...erence or first fra me: 3. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... ..... ...home (192.12.. .0 ...... Src: pc13 .co rexchange...168.1 24...... = LG bit: Globally unique address (fac tory default) . Dst: cust-74-124 -12-138.

... .1... Ack: 53088 .ho me (192. ...12. = Don't fragment: Se t . D st Port: http (80).... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.168..138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13...dl lstx01.124. = Differentiated Ser vices Codepoint: De fault (0x00) . Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le . .. = Reserved bit: Not set .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f3b (20283) Flags: 0x02 (Do n't Fragment) 0.. . com (74.Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.1.11) Destination: cu st-74-124-12-138.. Seq: 1. Src Por t: 49574 (49574)..0.corexchange..

...... ... . = Push: Not set . .... = Syn: Not set .. . ..... ... 0. ... . 0000 0001 0000 = Flags: 0x010 (ACK) 000. .. .... ...... = ECN-Echo: Not set .. = Reset: Not se t ...... = Nonce: Not se t .. ..0.. ..... . = Urgent: Not s et .000176000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .0 = Fin: Not set Window size val ue: 41277 [Calculated win dow size: 41277] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 89] [The RTT to ACK the segment wa s: 0.. . ... . . . = Reserved: Not set .... .. .... ... 0 ......1 ..0 ....n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 53088 (r elative ack number) Header Length: 20 bytes .0. = Acknowledgmen t: Set ... .0... 0.. . = Congestion Wi ndow Reduced (CWR): Not set .. .

..274057000 s econds [Time delta fro m previous captured frame: 0.01082800 0 seconds] [Time since ref erence or first fra me: 3.224127000 Netgear_2e:1a:0 9 Broadcast HomePlug AV 60 MAC Manag ement.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 31 8d 50 10 ..`n. 0010 00 28 4f 3b 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .000 000000 seconds] Epoch Time: 141 5615216..+... 2014 11:26:5 6. 0030 a1 3d 18 d4 0 0 00 ..E...N.010828000 seconds] [Time delta fro m previous displaye d frame: 0.1.P.P.274057000 Romance Standard Time [Time shift for this packet: 0..224127000 sec onds] Frame Number: 9 1 Frame Length: 6 0 bytes (480 bits) Capture Length: 60 bytes (480 bits ) [Frame is marke .... =......... 60 bytes captured (480 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. (O.dx. No. .@. Time Source Destination Protocol Length Info 91 3.. Get Bridge I nformations Confirm ation Frame 91: 60 bytes on wire (480 bits).

d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :homeplug-av] [Coloring Rule Name: Broadcast] [Coloring Rule String: eth[0] & 1] Ethernet II.. = IG bit: Group add ress (multicast/bro adcast) Source: Netgear _2e:1a:09 (20:0c:c8 :2e:1a:09) Address: Ne tgear_2e:1a:09 (20: 0c:c8:2e:1a:09) .0 . ...... .. ......1 (1) Type: Get B ridge Informations Confirmation (0x602 1) ..... 00 ..... = LG bit: Locally a dministered address (this is NOT the f actory default) . . = IG bit: Individua l address (unicast) Type: Homeplug AV (0x88e1) HomePlug AV protoco l MAC Management Header . . .. . .. ...... Src: N etgear_2e:1a:09 (20 :0c:c8:2e:1a:09).0..... .. = LG bit: Globally unique address (fac tory default) .... .. ............ = MSB: STA .... .... . .. . .... .Cen tral Coordinator (0 x00) Fragmentati on Info: 0x0000 ....1... .... D st: Broadcast (ff:f f:ff:ff:ff:ff) Destination: Br oadcast (ff:ff:ff:f f:ff:ff) Address: Br oadcast (ff:ff:ff:f f:ff:ff) . . . ..1 ........0 0... . ...1 = Version: 1. 01 = LSB: Confirm ( 0x01) . .

.J.. Time Source Destination Protocol Length Info 92 3. = Fragment index :0 Fragmen t Sequence number: 0 Get Bridge Info rmations Confirmati on Bridging: T rue Bridge Term inal Equipement Ide ntifier: 5 Number of s tations: 4 Bridged Des tination Address: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1) Bridged Des tination Address: A pple_86:da:3d (04:e 5:36:86:da:3d) Bridged Des tination Address: H onHaiPr_be:71:b9 (8 4:4b:f5:be:71:b9) Bridged Des tination Address: H onHaiPr_c9:0e:4a (0 0:1f:3a:c9:0e:4a) 0000 ff ff ff ff f f ff 20 0c c8 2e 1a 09 88 e1 01 21 ..... 0030 00 00 00 00 0 0 00 00 00 00 00 00 00 .....dllstx01...home TCP 1314 http→49 574 [ACK] Seq=53088 Ack=1 Win=46 Len=1 260 Frame 92: 1314 byte s on wire (10512 bi .:...! 0010 60 00 00 01 0 5 04 90 01 3b d0 17 e1 04 e5 36 86 ` .....6. 0020 da 3d 84 4b f 5 be 71 b9 00 1f 3a c9 0e 4a 00 00 ......com pc13... ...00 = Fragment count :0 0000 ... No.. ....q.. =..314128000 cust-74-124-12138.K.corexc hange.... .. ..

..000 000000 seconds] Epoch Time: 141 5615216.ts).. . 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.. 2014 11:26:5 6. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .port == 80 || http 2] Ethernet II....364058000 Romance Standard Time [Time shift for this packet: 0.0. .09000100 0 seconds] [Time since ref erence or first fra me: 3..090001000 seconds] [Time delta fro m previous displaye d frame: 0. ..364058000 s econds [Time delta fro m previous captured frame: 0. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). .. = LG bit: Globally unique address (fac tory default) .314128000 sec onds] Frame Number: 9 2 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .... ... .

... . .. ............. . = Differentiated Ser vices Codepoint: De fault (0x00) ..home (192 ...... ... .1.0 .... .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .. . .168.co m (74. . ... = LG bit: Globally unique address (fac tory default) .12..124..... .... = Reserved bit: Not set . ..dlls tx01.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ...138).1..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1a3 (61859) Flags: 0x02 (Do n't Fragment) 0... Src: cust -74-124-12-138.... ..... ..0... .. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum . ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00..0 .corexchange... = Don't fragment: Se t ...0. Dst: pc13... .

...... . = Urgent: Not s et . Dst P ort: 49574 (49574).. 0 . . = Nonce: Not se t .0 ...... . . 0000 0001 0000 = Flags: 0x010 (ACK) 000. . . . ... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.1. Src Por t: http (80). .. = ECN-Echo: Not set . ..124. .1 ....corexchange...0. ..138) Destination: pc 13.168.........com ( 74..dllstx0 1.. . . .....0... = Reset: Not se .. Ack: 1 . 0.. Seq: 53088. = Push: Not set ....... .. .. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 53088 (relativ e sequence number) [Next sequence number: 54348 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .home (192. = Reserved: Not set ....12.... 0... = Congestion Wi ndow Reduced (CWR): Not set . = Acknowledgmen t: Set ..: 0x3a87 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.

J|.E...B. 0040 4e 33 dc 85 1 9 30 54 ca 51 1c 8c 15 69 0e d0 40 N 3. 00a0 d9 50 0c e1 0 b 81 88 18 6a 41 87 a1 30 77 18 0a ......+\...1.t .@.CB...s.Y....\... ...*.n.0.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xacd a [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. . 0080 3a 6a 5b b6 9 0 e1 af 96 59 ff fb 92 04 eb 0f f2 : j[.a.. = Syn: Not set .. .6......@ 0050 b4 ee 75 c8 2 9 d3 95 cf dc ca 95 bb 2b 5c c5 1c .. .. ...g"1.. ... 0030 00 2e ac da 0 0 00 67 22 31 0e fd 42 d0 2a c5 84 .:..Q 0070 51 58 47 96 3 d e7 6e 9b ed 36 fe 7f 0b 8c 31 f7 Q XG. 0010 05 14 f1 a3 4 0 00 31 06 3a 87 4a 7c 0c 8a c0 a8 .... `n..+. 0020 01 0b 00 50 c 1 a6 2b c9 31 8d 9e 87 4e aa 50 10 .N.. ...1. ./B`^.T.1... .dx........ ........P. .0T....u.. 0090 e9 2c 54 83 2 f 42 60 5e c6 9a b0 61 e6 5c 0c 90 ....Q.. .=.. 0060 31 52 97 1a e 2 73 ad 16 43 42 2c 0f be 90 b5 51 1 R.i.P.)......

... 00d0 46 e7 8b c7 f 1 ab 58 ac aa 37 8f f1 f8 0b 08 52 F ....u.. %.. .}.B.. 00c0 a5 12 4d 18 9 a ff 65 53 33 41 10 b4 56 35 b8 f2 .... 0160 f1 25 ab ff b 1 ff c7 69 4d 7e fe 87 71 bf 04 fd ..... [.F^..9.V5...5Ul..AS..q.01. 0170 15 da 11 8c 4 9 30 a7 9f f4 41 53 b2 e5 9c 23 04 . 00b0 35 c5 a2 42 9 b 24 28 ea 7e 56 90 5f 69 e0 b0 aa 5 .g. ..0w..i...4$.8at..\......eS3A..R 00e0 64 c5 9f 34 a 2 87 c4 d1 29 d5 aa 6d 45 b6 3d 59 d .. .w.3...Kk 0130 bb f2 a9 f9 f 8 0d 33 ad 1d 9e 46 5e cd 20 88 98 . ... 0150 a9 5b b6 87 1 c 28 13 75 11 18 5a a3 16 b3 cc de .>.M. Y*...... HK...=Y 00f0 2b 8a 9e 96 f 2 30 31 b0 eb 04 e4 10 7d 8c 8b 9d + ... 0190 11 59 2a 85 2 7 8d 5c c7 f3 2c 3e 8c 1e 86 42 b3 ...7._i.<>A. 0140 fd eb ae d6 c d 0c e7 f1 84 ec c5 bd 15 f5 77 f5 . 0100 b1 ef ac 34 2 4 bd 5a 5f dc 35 55 6c b7 fb a9 5c ...b. . ..jA..(..#...4........~V.....j...g.H:..I0... 01a0 da e7 fa 86 b b 38 61 74 d9 ea 6a 0f c0 d3 ae 60 .)..X....P..Z_..........Z..'.*@\D....\ 0110 80 d0 09 ee 0 8 2c 2a 40 5c 44 04 9c 48 3a a3 27 .... ..B.... . 0180 4b 23 cb 69 d b 93 c3 17 55 72 8e c0 a8 62 15 99 K #.......' 0120 b2 48 4b c6 b b c4 67 9e b1 4f 49 4b 3e e9 4b 6b .iM~.` 01b0 b0 b1 67 90 1 c 09 3c 3e 41 c8 1a 2c e6 b7 39 12 .....mE.. .OIK>.Ur... ..$(.

0270 8d c8 96 b3 9 4 45 c2 75 f1 cb 58 2a 2d 69 c4 64 .-.X*-i...S!.~.@K. 02b0 85 f8 b5 af f 7 77 d2 83 02 35 0d 46 58 c8 34 76 .... ....3.5.. ..+...%..mi7z 0210 e7 1a f6 ee 1 0 a9 aa 5f 14 d5 a5 f9 91 81 50 19 . .?BD. \T.W.g..d 0280 db 56 ab 75 5 0 28 a2 41 db 20 92 84 26 b6 7a 8a . . 01d0 43 94 a0 20 2 2 aa 82 88 88 c1 19 c4 a5 e0 07 04 C .A.(..FX......I.... ..4..-.$........L(... 02a0 ba e2 6f 9a f 1 b4 a0 4a 77 6b 0c 8f 16 2d 8e b0 ....#........ V.i.. <U2.OBC. ...w..&._..L 0240 0b 90 8b 50 0 c e1 89 49 84 93 ea 81 87 ad 28 b5 .[.. 0220 f0 5c 54 88 8 8 02 f0 34 fa 25 18 ff fb 92 04 e8 ...P....8J`W.01c0 8a 16 4c 28 c 5 3c 77 6b eb fa 19 4f 42 43 81 0a . 0230 8f f2 f0 2b d 4 03 38 4a 60 57 05 2a b0 61 e8 4c ..nz].. 0260 00 39 ca f0 4 0 4b 11 2d bd 24 e1 ee ce a5 9d fe .... 01f0 bb 3c 55 32 0 5 a5 08 53 21 b0 60 42 a3 f5 20 b5 ..P..s.z....j.E.. "..o..4v 02c0 0e a0 c5 7e a 6 70 84 23 80 9e c6 3f 42 44 1d 32 ......2 02d0 5e 64 4c 16 e ..d..... v. ..*.B.Z. 01e0 29 cb 95 0b a 0 6a 09 b3 82 18 a5 6e 7a 5d 15 08 ) .. ..p.uP(.<wk... 0290 19 b3 10 ad c 5 c0 ed 05 79 48 e2 69 ef 57 a7 8f . ...Jwk... 0200 42 72 83 67 9 a 85 13 73 ef ea 33 06 6d 69 37 7a B r.yH.`B. 0250 1d 76 ff ed a f b3 5a aa 5b 0d a2 64 17 80 42 b9 .. 9. ....u..a. ..

.a 03e0 e8 5c 0b 5c 9 f 50 0c bd 89 49 68 .....nW.#..Z..D. U*.....Oa}=.}.. 03a0 c7 55 2a de 9 2 44 06 44 68 d7 a7 34 f1 e1 de bb ..Q./`.y..[.. . 0340 82 c4 74 1f c b b9 91 24 b7 b7 c3 23 96 9f 94 56 .S.S. 0360 10 ea 12 65 c 9 dc 93 bf ff bb ff ae 2f 60 ab 27 ... 03d0 04 ee 0f f3 2 d 28 d3 83 4f 7a 50 60 46 ca 90 61 .d..=.k{B..K..{. <..No 02e0 19 ef ad 3a 0 1 34 62 2b 47 4b 2d 81 85 9b 37 25 . 03b0 5a bb 27 6a 4 7 9f 77 2e e7 31 5b e6 a1 b7 0c 7c Z ... 0330 b2 76 b4 82 a 8 ed 03 33 4c cd d8 d2 06 99 a9 c5 . ..%....OzP`F.4..*.4 6b 7b 42 b3 6f 51 20 e8 3b 4e 6f ^ dL..... v.B...-..7% 02f0 2e fb 61 b5 3 a 99 4a e7 a6 c7 ef f6 fb 4e 2c ec ....2...i.e.H 0320 fc 3c 0b ec 5 b 11 25 82 8a ab 9e 8e 2d e8 8b e1 .....t....#..' 0370 2d 60 43 4b 4 a d6 06 0b 04 5c 5a 91 93 53 c5 87 `CKJ...-(.N...J....oQ ..1[..| 03c0 54 b9 7b db 7 1 0a b9 b2 82 f8 f4 53 bd ff fb 92 T ...q. 0300 4b 64 06 4f 6 1 7d 3d d9 69 dd 5b 7f ec 7d d4 f3 K d.x...a.. ..... 0390 c5 ac 4b ad b 1 19 64 cd 79 1c 6e 57 95 13 5b 9e .\Z.V 0350 36 6c 1e 51 0 8 b1 01 18 2a 9a c3 d2 c2 a1 99 0b 6 l. 0380 4b 9a d1 80 e a ea 3d 15 b0 c4 23 12 f7 16 00 94 K .w..(.Dh. ..:.. .. .$... 0310 a1 ed 32 17 7 8 08 28 0e 15 42 1d 5a da 99 bb 48 .....[. ..3L.....'jG...[.:.............4b+GK-..

..D&k.... ..T......o%...S... 04c0 9f 0c 29 69 3 0 84 7d 0b 20 94 bc 5c 83 25 1f 01 .. N.^.. 04d0 5b 28 6d 46 5 6 ab 90 d5 25 e8 c9 b2 3d 20 15 7b [ (mFV. .R... .!z.4.... . ..o!. 0460 98 10 90 83 4 9 86 9b 87 b4 65 c8 11 0e ac 6b 57 .@.Ih...uy+.%8.e..].c4u 04f0 29 32 a9 59 6 c 51 c3 d5 c2 5a dd 2b 0b 20 55 22 ) ..... 0450 cd a1 ed d2 f 9 3a f4 5e cc bb 77 7d 0e 00 53 f4 .#.. 0430 63 75 08 d4 e 1 0c 3b 35 60 6a 58 c9 91 a7 3e b1 c u..\.`B]*e..jA...%. 0480 25 eb 4b 5a 0 a 75 79 2b 81 2d 62 40 82 40 0c 27 % .....V...... 0400 41 ac 34 0e 0 e b5 10 c9 21 7a d7 76 db 81 8c 7f A .)i0......\....= .:.5`jX..-b@....' 0490 7b da c1 da b 0 fa b4 44 26 6b ea 93 c8 6b 33 51 { ..>. 0440 c5 12 b7 eb 0 7 42 25 45 75 17 8c eb 5e f9 dc 99 .11 6a 41 87 a5 .{ 04e0 48 2a 4a 81 a 1 92 97 4b ca 85 52 0c 92 63 34 75 H *J.}..I. 0420 0c 32 f5 bc f e 7b 1e 16 91 e3 c6 51 84 9e 23 99 ...I...%. 0410 bc 3c 27 0a 1 c 14 8b 13 b2 e6 a6 8a cc 6f 25 15 . .VHh(c(. ..!lB 04b0 8b 98 15 40 f 7 d5 56 af 54 10 60 42 5d 2a 65 d6 .K.^..KZ.Q..P.... \.@..w}.B%Eu.... 2. 03f0 28 8e fd 3e f 3 f6 7f 52 72 16 25 38 dd 18 3c a8 ( .w.Rr. <'..>.....v..k3Q 04a0 0e 4e a6 49 7 f 0d fd f9 e6 77 2e 74 c5 21 6c 42 .t..{....<.kW 0470 1b c0 56 48 6 8 28 63 28 97 5d aa d5 6f 21 e8 ed .

.Z..J. 0510 df eb 69 26 4 4 20 ad 4b 8e 1c 88 c0 41 44 0d 98 . .home TCP 885 http→49 574 [PSH...YlQ.corexc hange. U" 0500 60 ab c8 1f 6 3 9e 27 ac 1b dc 89 d6 4a 7f e8 f5 ` . Time Source Destination Protocol Length Info 93 3.000 000000 seconds] Epoch Time: 141 5615216.411062000 Romance Standard Time [Time shift for this packet: 0. No...com pc13. 885 bytes captur ed (7080 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10... 0520 c3 97 .c.+.361132000 cust-74-124-12138.K.411062000 s econds [Time delta fro m previous captured frame: 0.AD.'.04700400 0 seconds] [Time since ref erence or first fra me: 3. ACK] Seq= 54348 Ack=1 Win=46 Len=831 Frame 93: 885 bytes on wire (7080 bits )..dllstx01. .047004000 seconds] [Time delta fro m previous displaye d frame: 0....361132000 sec onds] Frame Number: 9 3 Frame Length: 8 85 bytes (7080 bits ) Capture Length: 885 bytes (7080 bi . 2014 11:26:5 6.i&D ...2.

.ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ... . . . ....12... . = .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..... . ... ...1... .124... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00...co m (74..0... ........ .....0.port == 80 || http 2] Ethernet II. = LG bit: Globally unique address (fac tory default) .dlls tx01.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. ..corexchange..0 ... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).... . .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.. .... Dst: pc13.0 .. .... . .. . ..home (192 ..168... . Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. = LG bit: Globally unique address (fac tory default) . Src: cust -74-124-12-138...138)...

.. Seq: 54348..168. Src Por t: http (80). = Don't fragment: Se t . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..corexchange...com ( 74.1... .. .. Ack: 1 .. = Reserved bit: Not set ..1.138) Destination: pc 13.0. . Len: 831 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 831] Sequence number : 54348 (relativ e sequence number) [Next sequence number: 55179 (r elative sequence nu mber)] ..home (192.dllstx0 1. Dst P ort: 49574 (49574).00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 71 Identification: 0xf1a4 (61860) Flags: 0x02 (Do n't Fragment) 0. . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c33 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..Differentiated Ser vices Codepoint: De fault (0x00) ..12...124.

0 ...... . = Acknowledgmen t: Set .0.. ..<3J|. 0.. . g.. . .N...0. ACK) 000. 1 ... = Urgent: Not s et ....... . . ...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x769 0 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2091] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . ..... = Reset: Not se t .. = Push: Set . .P.. ... ..6y.dx... = Nonce: Not se t ..+....... = Syn: Not set .. 0.. .....Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . = Reserved: Not set . . `n...... .. . . 0020 01 0b 00 50 c 1 a6 2b c9 36 79 9e 87 4e aa 50 18 . .1...0... . = ECN-Echo: Not set ... 0010 03 67 f1 a4 4 0 00 31 06 3c 33 4a 7c 0c 8a c0 a8 .P.. . . . ..E..... . = Congestion Wi ndow Reduced (CWR): Not set .........1 ..... .. . 0000 0001 1000 = Flags: 0x018 (PSH..@.......

X. 00e0 7f 4f a2 54 9 6 6d 6b 5a b6 d3 d9 b5 ab f3 ab 1a . 0140 9b 87 97 62 1 ........p. 00a0 65 91 ea 01 9 7 a5 28 57 3d 69 3a e7 db be cf d6 e . 0080 60 37 51 ff f b 92 04 ef 8f f3 3d 33 53 83 38 5a ` 7Q..........g.\.(W=i:. .p.... M2c. .... .......O.. 0120 e8 06 26 9a 8 9 b9 a3 1e df 3a 6c 1f 76 5b 19 64 . d..v[.%h2..N. 0050 8f c7 61 b6 0 d ee 9c 62 5c 08 4f 0f bd aa 4b 48 .KH 0060 c0 a4 e9 70 9 e de c3 b4 5f 0d 2e 1f 9c 64 9b bf . .... 00b0 bb c8 58 90 7 0 e9 24 50 85 d1 03 09 77 92 b0 93 ..]/...i. 00c0 02 a9 59 08 1 9 85 d1 b1 ca c9 58 88 b7 ca b7 ad .$a... O.x..W.b\..X......d.. ....8Z 0090 e0 64 c6 da 7 0 65 e8 5c 0b 88 b3 4e 0c e1 69 81 .T.=3S....i...Y 0040 11 e8 f4 a5 2 4 61 e6 46 ec 41 d1 78 8b f7 18 9c .v...DD....... 0070 29 2b 67 17 f a 65 25 ab 44 1e 96 e7 ac 18 8c 17 ) +g..pe.. ...A.......e%....d 0130 af ec e3 67 c 9 db 57 10 58 4e 6c 5d 29 34 72 0e ._.a..... 00f0 83 cc ae 25 6 8 32 2e 44 44 bc 5d 2f 00 1a 25 72 ..F.....&......Y..%r 0100 d2 12 ad ba 7 7 22 ab 69 af a5 09 ee ef fc 89 7d ..0030 00 2e 76 90 0 0 00 06 20 4d 32 63 de 91 92 9c 59 . . .... .w.. .D.mkZ.:l...w"..XNl])4r. .....43.`.R... 00d0 ae e2 ae 14 2 e c9 60 c9 34 33 ab 87 52 d2 8c f8 ...} 0110 5f 83 9f 10 8 6 d0 12 0d 0c aa c1 c3 13 1e 0a 98 _ .$P...

..d..O..M1. 0230 38 5a 60 5e 2 4 6a 80 61 ec 4a 0c 04 a3 4c 0c e1 8 Z`^$j.$i..Fo.... .a.K. 0160 92 44 80 fd 8 3 00 c5 da c6 8a ab 42 10 ae 41 ba .. A... 0250 f8 df 5a ed 2 a dc 1d 30 70 49 12 ...x.....L.Pq. ^.. 01c0 7a 96 71 e7 4 c 2e a5 4d 31 e6 be ca 7f bf 64 ad z ..z...w 01e0 1e 36 ac 67 2 4 82 6d 79 2e 18 9c d4 6d 93 4e d2 .# 01b0 8a 81 01 97 4 9 f5 1e 4f b6 df 2e d7 f7 f8 d2 ad .A........ ....?...0..ju."Y....{. 0220 c7 3e e7 f5 a f ff fb 92 04 ed 8f f3 34 2c 53 03 .O..F..... ....K 0190 45 f6 f8 2c 9 1 6a 75 b9 10 ec c1 0e 43 01 4f c8 E ...C...7%:...(.m...5 8e b0 43 c2 c9 22 59 a2 64 28 ec .. >........... 01a0 14 2c 2e a0 d 0 46 6f 10 03 92 3c 1d 1c a3 8b 23 ..q.g$....4.N....my. 01f0 72 d5 98 0a 1 5 da 37 66 62 1c 6a 71 97 9b 1d 02 r .5I...a.J.L..rtPzTT 0210 aa b0 24 69 9 9 7b 1a 64 ad 7a 85 46 b0 96 3f f9 ...<...jq.I. 6. 01d0 41 56 40 73 c 2 18 d0 a4 02 c8 02 96 78 c3 8c 77 A V@s..... 0200 a0 12 c6 d5 f a 98 d1 1c c9 c7 72 74 50 7a 54 54 ..S. ....d(... .B.j.b..C. 0170 88 a8 35 49 1 5 28 a8 1c f4 a8 a0 84 ad 61 ca 00 .7fb. ....=n..... D.i.d. 0180 11 5e ba 20 4 2 72 ab 66 82 0b 37 25 3a f4 88 4b ..f... 0150 76 f9 a7 47 4 d 7e 6e c3 f1 3d 6e 99 9f 6a 18 a4 v .GM~n. Br. 0240 89 41 83 98 6 9 c1 97 a1 30 89 4b 9f 08 50 71 1b .

9f 54 40 a0 d4 .|. 0320 19 9b 10 16 2 9 11 41 51 20 c6 20 9a 04 a5 90 50 ..q..... .$.Q.O..s.'..&h. 0280 9b ff 0d 86 5 7 58 7c ef e2 24 91 e9 bb ac de 98 . 0260 e9 e1 8c 00 e 9 92 20 99 84 61 84 e0 d8 8a 3a ba ...B.}..@...xQ3g. .U.. ......bM.....$.10. .}...T@.....t... !2...F0.. 0350 41 f6 55 b3 4 9 db 79 ed 7e 96 e9 96 e3 f2 aa 4b A ..:..'.......?r>...F 02d0 56 af 21 2c a 9 f3 b7 5a 83 6d 82 27 c7 5e 92 f1 V .... 0300 6c 93 ef fc c 9 27 cd 73 f5 ed f5 98 6a 6e a3 4b l .. 02e0 50 19 d1 f5 6 6 b7 26 68 07 95 f2 ed 81 c1 9a a9 P .%..=:{v. 02f0 bc c6 82 62 4 d 9c 42 87 f1 12 78 51 33 67 fa f6 .Z.m..Z..f.Z.....^...y.. 02a0 ca 6e 7a ce d 5 7d ff 5b 6c fe af fe 95 31 30 04 . ..m.....I.jn.0pI. ..... 0290 f7 f9 fd ec 7 f fd bf f5 9c da 0a 1b 10 5a 08 c3 .K 0310 c3 e9 ca 3b 7 1 9c f0 54 b5 60 4b 36 e6 9d 08 f7 ..)...WX|.....P 0330 34 fa 19 74 a a 15 7d d3 86 20 21 32 e5 d2 fd 18 4 . 0340 1c 0e cb 3d 3 a 7b 76 0a 0d 12 4f 9c b7 6d ff 18 ......5. .T... .a.... ....`K6.....*.[l...AQ .. ..~. ..~ 02c0 00 1d 2c 94 4 6 30 e1 b8 0c 11 25 01 c9 7c 9d 46 ... 02b0 05 26 33 a1 4 0 84 24 83 01 92 91 11 07 51 06 7e .. 0270 35 69 46 8a 9 e cb bd 3f 72 3e e3 cd 9a 35 8c a5 5 iF.. &3. nz.!....K 0360 42 e5 cb a5 4 2 00 73 1d 7d 04 9c 86 f2 e9 f5 df B .

54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.s.361313000 pc13.. 0370 8a bb 3f 77 a 5 .411243000 Romance Standard Time [Time shift for this packet: 0.cor exchange.B.. No.home cust-74-12412-138.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =55179 Win=41580 Le n=0 Frame 94: 54 bytes on wire (432 bits)..361313000 sec onds] Frame Number: 9 4 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule ...00018100 0 seconds] [Time since ref erence or first fra me: 3..}...dllstx01.?w. 2014 11:26:5 6. ..000181000 seconds] [Time delta fro m previous displaye d frame: 0. Time Source Destination Protocol Length Info 94 3.000 000000 seconds] Epoch Time: 141 5615216.411243000 s econds [Time delta fro m previous captured frame: 0.

. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) . .com (74.....11 ). = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ... .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.0 . ....port == 80 || http 2] Ethernet II..1. . Src: pc13 ....home (192.Name: HTTP] [Coloring Rule String: http || tcp ... ....12.. ... . = LG bit: Globally unique address (fac tory default) ... . ....... . ..... = LG bit: Globally unique address (fac tory default) . ...... ..0.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . . Dst: cust-74-124 -12-138..0. = Differentiated Ser vices Codepoint: De fault (0x00) ..0 .. .... ...... .dllstx01.1 24..... .. .... .... . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)..138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.168..co rexchange..

...Total Length: 4 0 Identification: 0x4f3c (20284) Flags: 0x02 (Do n't Fragment) 0. = Nonce: Not se t . ...138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. ... Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 55179 (r elative ack number) Header Length: 20 bytes .. ..0. = Reserved: Not set . 0000 0001 0000 = Flags: 0x010 (ACK) 000. D st Port: http (80).124. = Reserved bit: Not set .11) Destination: cu st-74-124-12-138. . = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13..1. com (74.....corexchange.12. Seq: 1...0 ..ho me (192.. ... Src Por t: 49574 (49574).1. ... Ack: 55179 .. . = Don't fragment: Se t .dl lstx01.. ...168..

.... .... ....... ....dx. = Congestion Wi ndow Reduced (CWR): Not set .... .. . . l... .0 = Fin: Not set Window size val ue: 41580 [Calculated win dow size: 41580] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 93] [The RTT to ACK the segment wa s: 0....... .. ... . ..........0.... 0.. (O<@.. 0 ..... = ECN-Echo: Not set . No.`n.N. 0030 a2 6c 18 d4 0 0 00 .0.. 0. . ..E. ... = Acknowledgmen t: Set ... . ..... = Reset: Not se t .1 ... . .. .. .+..9. = Urgent: Not s et .J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 39 b8 50 10 ..P.. = Push: Not set .. .P...... Time Source Destination Protocol . = Syn: Not set ... 0010 00 28 4f 3c 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .0.000181000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ...

home TCP 1314 http→49 574 [ACK] Seq=55179 Ack=1 Win=46 Len=1 260 Frame 95: 1314 byte s on wire (10512 bi ts).com pc13.460008000 cust-74-124-12138.09869500 0 seconds] [Time since ref erence or first fra me: 3.098695000 seconds] [Time delta fro m previous displaye d frame: 0. Dst: AsustekC_7f:64 .dllstx01.corexc hange.460008000 sec onds] Frame Number: 9 5 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .Length Info 95 3. 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.port == 80 || http 2] Ethernet II.509938000 s econds [Time delta fro m previous captured frame: 0. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).509938000 Romance Standard Time [Time shift for this packet: 0.000 000000 seconds] Epoch Time: 141 5615216. 2014 11:26:5 6.

. ... = Reserved bit: Not set . . .0 ....168.... .........:78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1a5 (61861) Flags: 0x02 (Do n't Fragment) 0. .. = Differentiated Ser vices Codepoint: De fault (0x00) ...124.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .. . ..138).corexchange..... .... ........ . Dst: pc13. . .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. ...11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt... ..0..... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. . .12. . = LG bit: Globally unique address (fac tory default) .. ....0 ..0. .dlls tx01.co m (74........ Src: cust -74-124-12-138... = LG bit: Globally unique address (fac tory default) . ....home (192 .. .....1..

.124... . Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 55179 (relativ e sequence number) [Next sequence number: 56439 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . . 0000 0001 0000 = Flags: 0x010 (ACK) 000.com ( 74..1..138) Destination: pc 13.. .168. ... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a85 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.12...... 0... . ...... = Don't fragment: Se t ..home (192.. = Congestion Wi ndow Reduced (CWR): Not set .corexchange. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. .. Dst P ort: 49574 (49574)... .. = Nonce: Not se t . Seq: 55179.0 ...dllstx0 1.1... Ack: 1 . Src Por t: http (80).0.. = Reserved: Not set ..

1 ... ......... . . ..X. ...0.^.. .b 0040 d3 98 b7 8c 6 c d2 58 ec 08 d3 37 8e ae 47 1d cb . ..O...N..3.E.. 0020 01 0b 00 50 c 1 a6 2b c9 39 b8 9e 87 4e aa 50 10 ..9.j.. `n.. .G.1......:.0.... 0070 d3 1e 23 a8 9 e 31 53 d2 9e 9e 12 ... 0... . .. . ... = Acknowledgmen t: Set ... ...@..... ..G E. 0 ..B.. 0050 6c 0c 4d af 4 7 20 45 de ee 33 c9 97 5e ba b7 bd l .... ...P.. 0030 00 2e f9 fe 0 0 00 7c 82 90 1a 42 08 94 4f f2 62 ... 0...J|.. 0010 05 14 f1 a5 4 0 00 31 06 3a 85 4a 7c 0c 8a c0 a8 . 0060 f1 30 1c 02 0 2 84 15 6a 14 8a 17 12 9e 92 c4 bd ..7.. .0............. = Push: Not set ... = Syn: Not set .P.. .M...|. . .. = ECN-Echo: Not set ......l..dx. = Urgent: Not s et ..+... = Reset: Not se t ... .. ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xf9f e [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .

..:..j.h..a.~Ga. .. 0150 dc e6 cb df f 4 b7 db 86 68 86 68 6f 1c cc 5b 14 ....76 0080 90 a9 21 77 8 f 93 05 d7 ff fb 92 04 e9 8f f2 f5 . 0160 e5 20 20 e7 a 2 4d 62 44 53 4d 65 85 cf f7 f7 df .\.. 00a0 4a 0d 61 e9 8 1 8d 93 e9 81 9c 31 28 e3 5e 17 7f J .. J. 00b0 67 a9 c7 fe 8 5 fc bf a7 fe a6 b2 4a c3 e1 10 4a g .$ 0100 70 2d 17 20 5 0 f5 0b 28 4b 26 b5 1c 52 cd 3a 16 p -.. .pe.!w... .(...1(....J 00c0 8d 4a c6 f5 3 7 65 b8 c0 89 c0 28 14 69 05 78 76 .. . 0130 93 0e 6a 15 7 9 5b 05 db a6 f9 e1 6f 10 22 3e 8f ..DZ..(. .+. O....@...^.>Y....#...~z..I....e.b5.7\.XJ`Y. . 0180 74 3f 23 00 3 4 a5 77 5d f6 49 4c be 8d 52 82 db t . 00f0 62 a6 3e 59 8 7 ce 68 98 7e 47 61 fd 46 2f 1a 24 b .MbDSMe....xv 00d0 9b 86 ba b4 1 a 49 85 2b e7 14 4a bd 0b 7e 7a a3 .. 0140 88 82 06 40 8 0 f4 37 5c cb 2d 20 db 91 ba 8e bb .i...y[..... ..5b 5b 9d 37 36 .">....J.H.o. 0120 33 94 b0 d3 2 8 94 5c d3 a8 5b 2b f7 25 0a e9 85 3 . b`P....J.K ..[+..6.. 0170 38 8f ce 36 f e a4 44 5a da 69 09 a1 4c b1 65 ce 8 .h.[[..i.....[.R.....X..%........ho.... . P.L. 0110 fe 4f b3 bf d 3 f8 7f fa ac b5 e0 e5 1d 00 58 85 ..1S....(K&...F/....J... 0090 2f 53 03 58 4 a 60 59 e4 fa 70 65 ef 4a 0c 9c c3 / S. 00e0 0e 62 60 50 c b 4b 20 2c 48 0c 62 35 cd 20 18 8b ......7e..

ej..<... f.. .T(. 0240 bc b5 60 0c 3 c c9 81 6c 90 2b c1 86 25 28 1d d4 ...L.(..7c+.R.8.4.~Q....QX...j. 0250 67 cb c0 6c 1 3 a7 45 84 5d 86 a3 5b 3a 90 b8 1e g .. 01e0 3a 60 54 b1 d c 48 bd 32 3b d4 a4 40 1f 76 35 17 : `T. ..Y. 0190 64 94 13 c5 e 6 2b 16 c6 14 7b 6a 91 06 0f 30 80 d ...R 0200 14 b4 23 0b 0 9 91 d5 ae c8 e4 2a ca 64 25 5e db ... 0260 aa 95 67 02 6 2 c7 0f 16 37 63 2b d2 03 89 6e e8 ... 0280 1f b4 65 6a b 4 92 4c 81 10 54 28 09 05 8d 28 0a ...~.`.{j.t.)....0..........].....N.. ..a..... . 01c0 7d 2a 43 d6 a 3 7e 51 02 7e 99 c6 be ad 4e e6 63 } *C.C*.n.v..*.l.B.. . 0230 f2 fc 27 54 8 3 38 42 50 5e c4 6a 90 61 e9 4a 0b ..."0.. 01a0 d3 9f b7 29 9 d 59 99 33 0d 9d be 73 6e 26 43 62 ... 01f0 37 d9 a2 13 0 e ba c9 fb d2 b1 98 2c 14 08 c5 52 7 ...IL... .....31..RHt.. 0270 93 9b bf 90 5 1 58 a2 c2 ef 48 1a 76 18 33 31 e3 ...#..b...H.l..2..*... .. .*..3.@...J..v5.%(.?#.c 01d0 7a d5 4e 88 c 0 2e 81 2a d4 74 17 c2 12 91 04 cb z .+...g.-c 0220 42 2a 82 d5 2 a d7 d6 43 2a 9b ff fb 92 04 e8 0f B *.... 0290 5d 4b 2a 93 4 2 04 1e 14 89 d8 83 42 ba d6 38 06 ] K*.+..j.N...sn&Cb 01b0 8d 2e 0f 8c 0 0 02 07 01 07 1c 1e c1 00 cd 95 ae .d%^.... .[:.B.'T...8BP^......E..w]... 0210 b5 66 ac b7 5 2 48 74 18 00 6a d3 22 30 ee 2d 63 .H.

..Q....0... 0330 49 48 a6 c6 6 c 0a 0e 91 c9 f0 30 43 44 d4 bf 78 I H.x 0340 e9 d5 b3 fa 9 f fa f1 d7 90 c5 ad f7 1f bf 31 57 .F. ......c.... *G..M PV.. [. -)...s".&.n*2C....r. ....."}?N! 02f0 39 08 0e 3c 2 e b0 b9 90 23 4e 3c 50 4c 75 ee 0a 9 ..9...UK.Z..>H. .(...A8.#N<PLu..$...02a0 e3 ec 05 55 4 b 06 93 7a 04 99 6b d5 f0 8a 5a c6 . .k..x.dH......rIGc/...........b. .B.. 0320 f2 e0 a1 53 2 f 20 db 41 10 da 48 05 64 48 8f b7 .I2f..D.M.. 0370 df f5 30 9a 2 8 9e 6a d5 20 70 13 24 2c 99 9a d1 . p.0CD.S/ ... .m5! 02c0 d4 bb 44 e6 5 1 14 0e cd 04 4d 20 50 56 89 11 a6 ...1~I..<. . 02e0 d9 ec bf 08 8 8 72 49 47 63 2f e8 22 7d 3f 4e 21 .. 0360 02 cd 78 d7 b c d9 49 32 66 dc d5 2d 4b 4a 8e 80 . 03b0 05 b7 ce ba e .A... .9*g.l.... 0300 3c 06 a9 73 2 2 e9 4d ca 69 04 c8 63 93 a9 29 55 < .. 0380 9a 5b 87 39 2 a 67 e0 c3 bb 99 30 9b 05 c4 44 7d .1.H.z..c...1W 0350 af ae d9 da 3 1 7e 49 87 42 eb 07 cc 81 1a 31 e1 .i.......j.....-KJ.)U 0310 57 d1 62 e2 3 9 84 b9 9a 72 9f b0 e2 13 e4 51 d4 W . 02d0 e9 2d 29 b1 e 9 20 2a 47 af 82 04 88 ac b7 a7 99 .. 02b0 72 11 8c 41 3 8 08 f8 82 9d 26 ea b2 00 6d 35 21 r .. 03a0 40 a2 ba 03 8 2 6d 52 69 b2 32 86 3e 48 c5 92 a1 @ .0...mRi....D} 0390 35 a4 8e 46 d 4 6e 2a 32 43 88 63 10 86 18 c8 84 5 .....2.Q.

.G 0450 88 b9 2e 1f 4 7 db d4 35 1a 38 25 99 02 12 31 f6 .5Y...Q@Mi... 0420 a7 35 47 78 f 5 1d e3 79 4c c9 63 62 30 a9 af a9 .m. ..P.Zr.. .iK 0470 13 b5 50 ac a 1 98 9d 38 0f 6d bf 32 8a a7 89 68 .\C..m.j.|Z... ... 04a0 85 ee 50 e0 2 3 ec 7c 5a cd a9 39 3d ae 47 ac 90 ... :. 03c0 c5 e7 5d a1 d f 3c 9c 5e fe df bb ff ff fb 92 04 ....h 0480 8b 3a dd d0 f e 35 59 dd a2 1b a7 a8 11 f5 28 c9 ...=6 0410 a3 71 52 30 9 a 07 6a 19 b4 bc e8 30 1a 5d c4 f8 .2..>z...9 8d 88 db 60 8a e1 e2 67 fc 27 89 .l.Bb.. ....0.`. .>. w.*.v..].4.^. 5Gx........ 0440 c3 77 7f 7f 9 b bf 95 d2 ee ff 3e ff af d0 c1 47 . 03d0 eb 0f f2 f9 3 3 59 01 ec 2a e0 5c 43 db 20 3d 86 ....g..cb0.#....h..... 04b0 b1 03 0d 36 a 2 73 82 ba 42 62 c3 64 61 29 f8 cd . qR0...L[1V.6.da)...... .3Y...`....yL.. 0430 ee 38 ba e0 d 6 f2 34 a3 99 b7 f1 1b 6a a2 6d eb .. =.8%...<.].1. 0490 8f 4f b4 d0 e 4 5a 72 92 9c a6 96 ff f9 c2 a8 1a . 03e0 4a 0c 10 cb 6 8 07 a4 6b 81 95 99 6c c0 f4 99 70 J . 8.G....9=..& 0400 42 55 ff a3 4 c 5b 31 56 0b 96 3b 89 a4 b2 3d 36 B U....... ..k..(..5. 0460 80 dc 87 13 9 9 51 40 4d 69 aa 60 8e 76 86 69 4b ........ O...G.8...s. ...'........ 04c0 18 97 6f 4f 8 5 52 cc 70 3e bd c3 ... .j..p 03f0 fe e9 5f 47 f 4 a3 8a 4f cb 19 d6 85 3e 7a f9 26 ..P._G..O.

559805000 s econds [Time delta fro m previous captured frame: 0. ..G.dllstx01.$..com pc13.I#..oO. 876 bytes captur ed (7008 bits) on i nterface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.H.g.home TCP 876 http→49 574 [PSH.000 000000 seconds] Epoch Time: 141 5615216.0.p>.Hv.t....s}J.....T.....vC. 04f0 4a 39 0f 0f 6 c d1 e5 a7 34 e3 e6 e1 30 ed 8a 48 J 9. Time Source Destination Protocol Length Info 96 3.] 04d0 c9 6a d9 ce 1 c 1e 54 c9 c0 f4 c5 e6 49 23 12 79 .R.H 0500 75 27 c6 ba 8 1 51 a3 92 74 06 59 94 24 06 68 02 u '.y 04e0 f5 90 91 0b 7 6 43 f6 a4 67 97 48 76 d4 f2 48 be .049867000 seconds] [Time delta fro m previous displaye .... 0520 67 5f g _ No...16 ae 97 e0 5d ..4.l....Y..... 0510 2d 55 13 ce 7 3 7d 4a 88 ac 1b 47 04 80 75 13 17 U.Q. .corexc hange.. ACK] Seq= 56439 Ack=1 Win=46 Len=822 Frame 96: 876 bytes on wire (7008 bits ).u.h.. j.559805000 Romance Standard Time [Time shift for this packet: 0.. 2014 11:26:5 6.509875000 cust-74-124-12138.

. = LG bit: Globally unique address (fac tory default) ........0 .... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. . .. .0 . ...... ... . = LG bit: Globally unique address (fac tory default) .. .......0.. ..0. Src: cust -74-124-12-138. . .......509875000 sec onds] Frame Number: 9 6 Frame Length: 8 76 bytes (7008 bits ) Capture Length: 876 bytes (7008 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. .. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. .. ..d frame: 0... .. .. . ......dlls tx01...corexchange..port == 80 || http 2] Ethernet II.... ....co .. ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .. .04986700 0 seconds] [Time since ref erence or first fra me: 3. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..

.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 62 Identification: 0xf1a6 (61862) Flags: 0x02 (Do n't Fragment) 0.. = Differentiated Ser vices Codepoint: De fault (0x00) . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c3a [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..1. Seq: 56439.1.124.138)... Dst: pc13... ..12. Src Por t: http (80).dllstx0 1.168. Ack: 1 .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.home (192 .12.m (74.0. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..home (192. .1. Dst P ort: 49574 (49574).. = Don't fragment: Se t .168..corexchange.138) Destination: pc 13.124. .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.com ( 74. Len: 822 Source Port: ht tp (80) .... .. = Reserved bit: Not set ...

. ACK) 000... 0...Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 822] Sequence number : 56439 (relativ e sequence number) [Next sequence number: 57261 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. . ....0 .. = Push: Set ... = Reset: Not se t .. .. = Reserved: Not set ... .. ....1 . = Congestion Wi ndow Reduced (CWR): Not set ... 0000 0001 1000 = Flags: 0x018 (PSH. .0... 1 . ... ...0.. . = Urgent: Not s et .. = Syn: Not set .0. ............ . .... . = Acknowledgmen t: Set . = ECN-Echo: Not set ... ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xc5d a [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2082] .... .. .. .. .......... . .. .. ... = Nonce: Not se t . . .. 0...

n= 1.v.<:J|..n...i.... ^... 0070 36 14 b2 74 7 3 08 82 42 c7 0b 0b 91 69 c9 04 05 6 ..*.+] 00e0 78 f2 bd af e e 5e e3 7b 3c c5 fa 2d 7e b5 e7 b9 x ...... 00b0 27 c5 b8 fe 5 3 d4 c3 6e 3d 20 31 ab a7 82 28 4d ' ..... .....{<.Q 0100 51 e1 11 64 a a 76 bd 3e 85 1d 25 0a b8 2d f2 0c Q .J...@.. .(....A.....E.P.0... 0010 03 5e f1 a6 4 0 00 31 06 3c 3a 4a 7c 0c 8a c0 a8 .p..>..q.h 0060 70 7d f8 4a 8 1 c1 17 14 a5 d9 4f ea af 41 d5 9a p }.y.........K@=&LL$.1.ts.S..Z.b 0090 58 e5 4b 40 3 d 26 4c 4c 24 f3 64 07 a4 cb 81 9e X ..0.....@.0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .lI 00d0 88 4a 2c 46 8 b dd 09 83 3c 4e 3c 55 f7 eb 2b 5d .P.GY.. ..dx...>. 00f0 7c 00 50 f1 5 0 e3 c3 e7 07 28 b9 30 f9 69 c9 51 | .d.^...<N<U. 0030 00 2e c5 da 0 0 00 e5 11 a4 a1 ed 79 9b 0f d1 13 .. `n. 0080 82 a2 ff fb 9 2 04 e9 0f f2 c6 2a da 81 e9 1a 62 . ..%.P...-~...}........ 00a0 9c 2c 40 f6 1 9 70 c9 53 c1 67 95 aa ff f5 30 b1 .g.....B..F... J. 0050 65 41 ec e3 8 b 01 04 12 c2 e6 67 1e 0a 04 ce 68 e A..d.. ..+.S........ 0040 b9 27 44 32 2 5 1b 9c 30 ad c3 cd ec 6e 8d 5a 96 .i....(M 00c0 2a 34 b2 88 4 7 59 15 0f a8 71 0f 8a 7d a4 6c 49 * 4. 0020 01 0b 00 50 c 1 a6 2b c9 3e a4 9e 87 4e aa 50 18 . 'D2%.....N.O.P.-...0.g......

w 0200 d7 66 d7 cc d e 85 65 76 fe b2 de f5 d8 fc fc a4 ...ll.v.He!g.0110 32 5b 56 d9 5 8 30 b0 b8 28 61 e4 55 8b 51 38 39 2 [V..we.%..B...........+.V.EqFTu 0180 10 22 14 ab 1 6 5a 68 6c c3 68 11 9a d1 32 25 64 . 01f0 4f 96 74 39 6 8 34 6a 39 f7 1c bc 49 2d ba 0e 77 O ..M..%.. R..I-... 0210 34 02 25 12 0 a 07 20 ac 32 a4 bc 0c e8 ab 85 92 4 .f.......k.. ".=..U..Y) 01d0 ee 87 42 e7 9 0 1d 11 64 f7 9f 42 a4 87 61 e5 4b ..2D|.2.. +W'... 0220 e2 08 2c 33 f .....V.+ 0140 23 1a 99 f7 f d 56 be c4 33 e7 c6 c7 b6 e9 23 99 # ...cO...2%d 0190 f1 52 b7 09 6 8 58 e4 76 ef b5 31 d2 d8 a3 29 ae .B..k...i.....d.c2D 01b0 55 e7 b2 2f e 6 2d b2 ad de d2 5d 35 ea d4 0a 34 U . 0150 39 aa 7b 78 b 6 cd 77 65 87 0c a4 ec 98 2d c4 5e 9 ..B..Zhl....a..#....\..... 01a0 3a 1a 63 4f b d b2 4d b3 be 1a b3 e6 bd 63 32 44 : .....^ 0160 4b e1 42 15 b 3 f5 f8 5a 07 db 6b 94 2b c2 c8 0e K .]5. .)... 0170 60 60 1f cb 6 c 23 ed 69 1a 86 04 45 71 46 54 75 ` `.-..{x..h 0130 0e 2b 57 27 c 9 a7 3d ef b5 32 44 7c a8 ac a9 2b ....4 01c0 48 a8 2c f0 4 8 65 21 67 10 00 91 66 d7 d3 59 29 H .../.l#.. e....h...X0.(a..hX....1.Z.K 01e0 41 13 c7 25 0 b c6 b1 00 bc 4b 12 b9 6c 6c 8b cc A ..3.-. f.ev.. .t9h4j9..Q89 0120 ac 65 d1 0c 6 4 da d7 56 84 5c 9d 1c 6b 8e ab 68 ..d.K..

s..Q..T. y.V. 02b0 8f 42 d1 64 6 7 b9 08 16 54 8b 2a 82 94 49 b6 2d ..cK..\...C... ... h. .... 0230 1a e0 5a 66 4 b 00 3d 26 5c 0c 54 e5 5c 0c 30 cb .T36z. 0300 41 60 33 1b 4 3 b1 cc d2 56 8e cf fa 19 4b 02 06 A `3. ...Lc...H08.|...fk 0280 39 31 49 78 e 8 2c fe ec c8 54 33 36 7a ce d7 a6 9 1Ix.\.UXR..0.ZfK....K..f fb 92 04 ea 8f f2 f9 3a 58 03 0c ..I....H...UU.O.G... {e..O.. 02e0 f2 0b 86 9b 9 f b2 a5 b4 4c 63 3b 99 bb 51 bd 00 ...M.I....*. 02a0 11 b5 47 c2 e 7 43 84 5c e2 a1 06 96 55 55 2c 8c .... 0320 62 61 61 50 4 5 7a 92 57 da 1e 7b d6 e8 8e 0f a0 b aaPEz... .+@. 0330 30 5b 1b 84 b 5 a7 fb c3 e6 2c 78 ...G..2Lj.02c0 1a 68 f6 da 4 5 40 74 a9 93 b1 47 a2 49 a1 2e d5 ... 0310 c0 08 16 b6 a e 22 09 e9 16 c2 07 88 33 4b 31 0f ..". .... 02d0 9a 7b 65 f2 1 d 42 87 08 32 4c 6a 1d cf 48 0a 3b . B.B.. .t 0260 64 aa 07 47 5 7 16 d0 48 30 38 0e 03 28 91 26 7e d ...3...:X. 0290 b2 79 18 d1 4 d 92 f3 1a c4 bf d9 47 94 7c 0e 13 ...W..L(P...dg..(..i]. .........p.&~ 0270 01 d1 12 8c 2 a ad 4f 03 c2 69 5d b7 92 87 66 6b ...... 02f0 5c 3a 60 b8 0 5 63 4b b0 4c 28 50 b8 ba c5 4f b1 \ :`.G...3K1....[w 0250 56 c8 55 58 5 2 0a 0e cc 18 a5 aa 06 e0 ac b3 74 V .*...=&\.{..C. 0240 89 8b 1e 2b 4 0 f4 99 70 1c f2 ac 73 05 aa 5b 77 .GW..E@t...T....

. GL.510046000 sec onds] Frame Number: 9 7 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ..dllstx01.. 0360 f5 03 62 23 7 1 46 4e 27 b3 eb fa 95 . 54 bytes captured (432 bits) on inter face 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10......[.000 000000 seconds] Epoch Time: 141 5615216.cor exchange. .5... No.000171000 seconds] [Time delta fro m previous displaye d frame: 0.1.3d 51 c9 63 75 0 [..4..... 0350 e6 47 4c e9 0 f 09 e9 f3 5b a6 f7 1e 96 51 61 11 .....home cust-74-12412-138.x=Q.cu 0340 34 96 46 b4 3 5 09 c6 31 cc 94 86 2c 34 0e aa e6 4 .com TCP 54 49574→h ttp [ACK] Seq=1 Ack =57261 Win=41059 Le n=0 Frame 97: 54 bytes on wire (432 bits)..00017100 0 seconds] [Time since ref erence or first fra me: 3.559976000 Romance Standard Time [Time shift for this packet: 0. 2014 11:26:5 6...b#qFN'.510046000 pc13.F. Time Source Destination Protocol Length Info 97 3..Qa.559976000 s econds [Time delta fro m previous captured frame: 0.

.. . .. = LG bit: Globally unique address (fac tory default) .home (192.com (74..... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.0 . = . ... ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. .. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .... ...0.) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .co rexchange.0 .....1 24. ... . .. .. ...port == 80 || http 2] Ethernet II.11 ). = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. ... ....0. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). ...dllstx01.... ....12...168. .. ....... Dst: cust-74-124 -12-138. = LG bit: Globally unique address (fac tory default) ..1. ... ........ . .. Src: pc13 ...

= Don't fragment: Se t .12. D st Port: http (80). Ack: 57261 . Seq: 1.. . Src Por t: 49574 (49574). = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.0.124. ..dl lstx01.11) Destination: cu st-74-124-12-138... . = Reserved bit: Not set .. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 57261 (r elative ack number) Header Length: 20 bytes ..1...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f3d (20285) Flags: 0x02 (Do n't Fragment) 0.ho me (192.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.Differentiated Ser vices Codepoint: De fault (0x00) . .1.. com (74....168.corexchange......

. = Push: Not set ...dx.000171000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .. .+.. = ECN-Echo: Not set ..... ...`n.. = Urgent: Not s et .... . . ....0.......... . (O=@......A.N.. ...0.... .E.0. ... = Nonce: Not se t ......... 0000 0001 0000 = Flags: 0x010 (ACK) 000....... 0... = Reset: Not se t . . ....... = Acknowledgmen t: Set .1 . = Congestion Wi ndow Reduced (CWR): Not set ....0 . .... . ... .....0 = Fin: Not set Window size val ue: 41059 [Calculated win dow size: 41059] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 96] [The RTT to ACK the segment wa s: 0.... . .. 0 .. . . .....P. .... . = Reserved: Not set . .J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 41 da 50 10 . .P. = Syn: Not set .. .. . 0.. 0010 00 28 4f 3d 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .

dllstx01.000 000000 seconds] Epoch Time: 141 5615216.home TCP 1314 http→49 574 [ACK] Seq=57261 Ack=1 Win=46 Len=1 260 Frame 98: 1314 byte s on wire (10512 bi ts).528135000 cust-74-124-12138. No.com pc13.018089000 seconds] [Time delta fro m previous displaye d frame: 0. c..01808900 0 seconds] [Time since ref erence or first fra me: 3.578065000 Romance Standard Time [Time shift for this packet: 0.578065000 s econds [Time delta fro m previous captured frame: 0.0030 a0 63 18 d4 0 0 00 . 1314 bytes cap tured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.corexc hange. 2014 11:26:5 6. Time Source Destination Protocol Length Info 98 3.528135000 sec onds] Frame Number: 9 8 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule ...

dlls tx01.....168.co m (74.0 ..1. ... . .....124. ....12......0.. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). .. .138).Name: HTTP] [Coloring Rule String: http || tcp ... ...... ..... = LG bit: Globally unique address (fac tory default) .0 ... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ... Dst: pc13.. .. . .. . . .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) ...... . .... ..0.... Src: cust -74-124-12-138.. = Differentiated Ser vices Codepoint: De fault (0x00) .. . . . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. .port == 80 || http 2] Ethernet II......... = LG bit: Globally unique address (fac tory default) . ..corexchange..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. .home (192 ..

.138) Destination: pc 13. Seq: 57261. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 57261 (relativ e sequence number) [Next sequence number: 58521 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . 0000 0001 0000 = Flags: 0x010 (ACK) 000...corexchange.. Ack: 1 . Dst P ort: 49574 (49574).124.1.12. . ...... . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a83 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138....168. . ..0.Total Length: 1 300 Identification: 0xf1a7 (61863) Flags: 0x02 (Do n't Fragment) 0.com ( 74.. . Src Por t: http (80).1...dllstx0 1. = Don't fragment: Se t . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.home (192.. = Reserved bit: Not set ...

...dx..D+...+.. . .. .. .. 0.%...N...... 0030 00 2e 46 6c 0 0 00 66 29 54 72 a4 25 8b 57 05 0c ..0...Fl..0..A.. = Urgent: Not s et .S...P. ...........E. .. `n.... ...1. 0.. 0 . . = ECN-Echo: Not set . 0040 f9 40 e9 82 4 4 2b 9b c5 53 e3 dc cb d1 7a 78 40 ..........P. = Reset: Not se t .0.0 .... = Syn: Not set . 0020 01 0b 00 50 c 1 a6 2b c9 41 da 9e 87 4e aa 50 10 . .. = Congestion Wi ndow Reduced (CWR): Not set ..1 .. . = Acknowledgmen t: Set . = Reserved: Not set .. . 0010 05 14 f1 a7 4 0 00 31 06 3a 83 4a 7c 0c 8a c0 a8 . .. ..... . ...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x466 c [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ... ..W. ..@. = Nonce: Not se t . . = Push: Not set . . .f)Tr.... . ...:. @......... .... .J|...zx@ 0050 5f 33 e3 43 3 .

.B.....l&.X#... 0130 96 a5 3f 99 1 e a9 14 e0 d2 b4 36 f3 f9 42 ac a6 .6#2. 0100 ad e5 23 00 3 6 2e b2 7d 54 4e 39 b5 36 2e 9e 64 .Y. ("9T...a&\....XR.. 0140 88 cc 69 4c 9 f 68 ac d9 98 81 8b 87 c8 d9 ba 30 ..w..C5.}b 0080 54 9d 05 10 f 2 65 64 96 b1 82 ac 09 30 d0 08 ea T ..X.... `..6.#.iL...-.m..@.p.w..* 00b0 c1 87 a1 70 c 5 85 d7 c6 58 52 9f f4 2d a4 a8 31 .. 8C*U.....wE 0120 64 05 36 72 2 c 23 88 1a 0b 92 91 b0 00 04 a5 05 d . . ZY. .. .A|.... 00a0 8a c0 61 26 5 c 0b 54 99 58 0c 3c c9 41 7c 1d 2a . 0070 cd 38 43 2a 5 5 b5 1c e5 b5 93 e0 93 81 00 7d 62 ...0.. 00d0 2c 28 22 39 5 4 cf 4f 2d 31 16 27 ad 6d f8 cc 14 ..#..#T..ed.. ~x..<....P.nq.C 00f0 dc 5a 59 ba 3 3 d1 c9 a7 6d 05 2d 2a f5 ef 40 9d ..s.. ..X.2``.. .h..?.'. 00e0 29 4a c7 36 2 3 32 a6 01 59 c0 73 81 cb 40 8f 43 ) J. 0090 ff fb 92 04 e a 0f f2 f7 2c d6 83 0c 32 60 60 c6 ..-*..i>q......5 3b 77 13 0d 6e 71 08 ad 23 54 cb _ 3..@..m./.O-1.3....6.0.. ..6r.._.1 00c0 96 60 b9 20 1 2 58 23 f0 a8 93 a4 50 c5 c3 e5 a9 .. ...[.0 0150 fc 7e 78 fe 9 b 30 8c 2f c5 69 3e 71 95 6c 26 cc .... 0160 5b 24 54 55 e 8 0b 01 96 54 07 91 ...T....6...d 0110 18 45 85 bd 5 3 f4 c3 bd 5f f8 bb ea 77 95 77 45 . 0060 c9 1b 44 9c 5 8 d8 8f c5 17 96 b1 5b 9f cf a4 d6 .}TN9..........D. ....S. E.

01c0 fe 5b 6d 7d a e f5 b9 fb 5c df 6f f0 c0 33 89 ac .mZ.nN..o.......A..3...^nyb*V.a......2 0180 49 77 df 52 0 4 5c a4 72 56 09 85 a8 6a a2 c2 f4 I w.k). . 0210 d5 27 72 d8 c c 6a 78 a7 8c 61 b8 5a e7 5e b2 e6 .K....j...Y..V.3U..q.. 0230 c3 66 ff fb 9 2 04 ec 0f f3 16 27 d5 03 2f 4a 50 ..G.u...$ 01e0 4c 50 75 c6 5 9 0b d8 aa 5e 89 db 91 4b 99 4b 9b L Pu.Z.... . -..jr.^.. f... 0170 d8 c7 75 ad 7 e 7b a7 fd 6f ca 19 10 12 71 18 32 .. .e.. 01a0 30 db d3 5a 8 3 06 0d 6b 29 b8 18 76 3b 7c cd 58 0 . 'r. .#.Z.\.\. [m}.9(A 0260 86 11 8f e9 a 4 62 70 2c 75 d4 62 2c ef 15 57 56 . 0190 ca 94 a2 9a 3 b 6e da 5e 6e 79 62 2a 56 1d c6 9b ..13 b5 23 1e 01 [ $TU..1.c.bp....n.Lc&. 0220 8c c6 6e 4e 1 1 cf 3f 0a 86 c6 ab bf a4 10 20 83 ...rV.?..WV 0270 bf 72 60 16 c 7 8e 27 8c 02 da ad 74 da 84 61 ec ...LKL.gk.f..jx..K......T..v..)Ax 0250 1c ea 41 97 9 9 70 d0 85 1a 2c b5 56 ad 39 28 41 .. 01f0 26 77 63 22 c c 96 e7 1d 5a c9 67 6b b8 a8 ec 09 & wc".R....'..o...Z....... 01d0 f3 06 6d 5a d 7 b1 6a 72 0c 4c 63 26 d4 ca 1a 24 . .u....R..X 01b0 b9 2d b7 66 a 9 20 ee ed b9 a8 cb be 63 ff 31 b7 ..... K...p. ...b..../JP 0240 61 45 4a 90 6 5 e6 4c 4b 4c 9b 52 0c bd 29 41 78 a EJ. . .. 0200 8c 4b b2 f9 4 7 d4 0a 8c 90 b6 a1 33 55 8b 16 11 .|.~{.^. ..

hL5. 0280 18 2d ea 95 c 9 69 2e b5 30 87 57 7a 84 cf f6 6e ..:.. 0330 1d 79 51 bc 3 1 ed 0d 58 4e 9d c1 98 27 5b d2 39 .....n 0290 43 12 a9 4b 7 7 26 bb ff 87 84 2d 95 5f 36 10 13 C .. =._6.H.~... 02b0 86 35 75 aa 2 e aa d3 ff af ea 4b c3 1a f8 03 0c ..g... 0370 7f 05 05 00 a c 07 e5 5a 6c ff 77 ca d5 10 04 31 .XN.WO. 0320 04 0d fc 46 3 9 8c 60 5c 89 48 94 eb f4 b2 09 d5 .. s.i.. ............... 5u.A-.0.G.. ..F9..u.. 0310 ba 3d d3 e1 2 6 61 fa c7 33 6d df 17 bf a1 92 11 ..... 0350 43 25 0a 12 4 3 14 a7 db 1a 12 ca 20 73 be 75 96 C %.3m.A....'[.. -...K..z.C.. 02f0 8b a1 00 2c c c 53 8a b5 48 b0 9c a8 4b 1b 8f 61 .CKe.... .... )P..... Hd..A.. P0%.. 02e0 07 29 50 c5 3 2 ea ad b0 2c 8a 52 31 e2 15 9a a0 ....Y ... 02a0 9a 48 64 02 4 0 f9 92 e7 67 ab 20 50 30 25 17 2c .Zl.2...a 0300 a3 26 62 5e 9 4 41 15 bd 2e fd cc 47 a8 b7 ea e7 . 02c0 74 38 30 48 1 9 43 4b 65 cc a4 b2 0d f3 ab 01 5a t 80H..e.. .@.`\........K.q.-..1 0380 a4 0c 22 b3 0 e bc 41 2d 7f a6 a5 58 60 c3 82 59 .1.'.....H.".Z 02d0 1d 42 d7 3a 9 8 dc 0c 57 4f dd 19 a1 d4 bf 87 01 .....Wz....9 0340 98 a3 2c 65 b d 89 a9 b1 c6 90 68 4c 35 16 17 be .r`.Kw&. yQ. B......S..a..... &b^. ....... 0360 21 8e 9d 7a a a 41 fd 71 c8 f5 8e d9 7e 2e a6 e8 ! .R1.t.....X`..&a...w......

.z..1.p{... 0470 2c 9d ca 58 9 0 09 b8 bd 4d 35 b7 83 11 c5 ba 8e ..g.E 0400 cc 22 1c 2f 9 9 9b 1a 0c 17 39 28 4d 03 60 72 cb .w..dl.<..._.X.. 0410 4a db c7 f2 0 4 89 95 a6 35 35 6d 35 e4 54 b2 74 J .. ....C#v 0460 7d 02 21 8b d 4 1a 29 b2 28 21 73 34 d7 fe 7a 98 } ..55m5....:..4l..@R{......)../.... .^.v...x...f..!.b...(..e.)..mFMS..Y.X 03e0 4a 60 5b 84 6 a 80 65 e9 4a 0c 78 cb 4e 0d 3d 0b J `[. 0490 52 ce 2a 0c 5 9 14 ae 4a 37 09 e2 6d 46 4d 53 95 R ....9(M...T..i.! 0430 40 65 63 86 f f 28 0c 91 58 fe 6a f5 ea 90 3d 69 @ ec..... "...../.. 03b0 e1 93 cd 2e 2 f 94 d2 f0 95 92 9a ae 9e 31 e5 21 .1T...c.N.=i 0440 62 f3 84 dc 4 a 81 fb 28 e5 f9 20 fd 9d 84 67 a9 b .. .J7..`r...J.g... 03f0 81 79 99 69 c 1 97 a1 70 7b b6 5f 10 a4 92 eb 45 .(. .0390 29 a6 58 14 9 2 dd b8 0e 40 52 7b d8 89 48 5c 27 ) . 0480 81 13 16 34 6 c 9b 46 cb 73 6e ab 0a 64 6c ae ce .. 0450 34 7b c6 ee 0 6 05 c0 86 08 a8 f1 62 8f 43 23 76 4 {... y.. 04a0 ae 56 6d 7a 6 ..H

03a0 70 fc f5 29 1 2 d1 19 a2 ab a7 b1 50 a5 c1 15 a8 p .U.(!s4......X.J..j..F.t 0420 d5 92 55 9a a 1 67 ac 7d b1 3a d7 ed c8 29 f2 21 ....P..=.! 03c0 1d bf 76 15 7 7 14 5f e7 63 cf 66 ee 5e 11 3c b5 ...). .M5... 03d0 70 8e c5 3b f f fb 92 04 ec 8f f3 1c 31 54 03 58 p ._.X.sn.}.... ....j.*.

..home TCP 1301 http→49 574 [PSH./. )bTE.... ..Zt. No..... 04b0 a0 20 d9 87 0 1 41 4a 54 84 04 1c 59 eb 4e 94 e8 .. 0510 20 1a 18 06 1 7 13 2f 00 b5 65 ac 84 1d 5a 74 08 ... ...$.AJT.. 2014 11:26:5 6.@.. Time Source Destination Protocol Length Info 99 3. 0500 0d cb ca d7 7 5 64 6b d4 a3 f4 da 8f a9 df 67 a0 . 04c0 ff f5 0a 08 5 f 61 19 40 ad c8 87 10 47 0d 98 e9 .com pc13.%.659141000 cust-74-124-12138. Vmzn>..`+U..t^Di(..l.e. 04e0 23 74 bf 9e 0 b b7 cf 98 25 3b 60 2b 55 91 24 dc # t._a.3.dllstx01..8. 1301 bytes cap tured (10408 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.000 000000 seconds] .. 04f0 a4 29 62 54 4 5 88 8d 96 0f 42 73 24 25 3f 1c d3 . .Y....udk. 04d0 32 67 94 a5 3 8 dc 74 5e 44 69 28 ca 6c 8b 33 84 2 g...N. 0520 b9 0f . .......e 3e a4 ae d5 dd e6 5f 62 06 0b 81 .G..709071000 Romance Standard Time [Time shift for this packet: 0.Bs$%?.corexc hange.._b.. ACK] Seq= 58521 Ack=1 Win=46 Len=1247 Frame 99: 1301 byte s on wire (10408 bi ts)..g.......

.......0 .. .. ......... .709071000 s econds [Time delta fro m previous captured frame: 0.port == 80 || http 2] Ethernet II. . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).. .. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..13100600 0 seconds] [Time since ref erence or first fra me: 3. = LG bit: Globally unique address (fac tory default) ...0.. . ..... .0.. ...131006000 seconds] [Time delta fro m previous displaye d frame: 0. . = LG bit: Globally unique address (fac tory default) ... . . .. ...659141000 sec onds] Frame Number: 9 9 Frame Length: 1 301 bytes (10408 bi ts) Capture Length: 1301 bytes (10408 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ....... . ... .... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ..0 ....Epoch Time: 141 5615216. .

138) Destination: pc 13.dllstx0 1. Dst: pc13. = Don't fragment: Se t ... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a8f [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.0...12...124..co m (74. . .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.1..home (192....168. ......home (192 .138)..corexchange..12. 11) [Source GeoIP: Unknown] [Destination Ge . Src: cust -74-124-12-138...11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.... = Reserved bit: Not set .dlls tx01.168...1. ..124.. .1. = Differentiated Ser vices Codepoint: De fault (0x00) . . .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..com ( 74.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 287 Identification: 0xf1a8 (61864) Flags: 0x02 (Do n't Fragment) 0.corexchange.

. 0. . ACK) 000... . ........... = Push: Set .. = Reset: Not se t .0..0 . 1 . ... . 0000 0001 1000 = Flags: 0x018 (PSH. = Congestion Wi ndow Reduced (CWR): Not set ... ............ .. = ECN-Echo: Not set . Len: 1247 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1247] Sequence number : 58521 (relativ e sequence number) [Next sequence number: 59768 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .. . ..... ... .oIP: Unknown] Transmission Contro l Protocol. . . = Reserved: Not set . .. .. ..... .. Dst P ort: 49574 (49574).... ..1 .. ...0..0.. = Acknowledgmen t: Set .... = Nonce: Not se t ... = Syn: Not set . . Src Por t: http (80). 0... Ack: 1 ...0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x8e0 b [validation disab led] [Good Check .. . Seq: 58521. = Urgent: Not s et ... ..... .

\.E.... 00e0 15 59 3c c5 5 1 95 92 50 74 18 aa 94 3b 50 92 74 ... . ...N..8.. 00b0 0a ac 6b 9e f 2 b9 63 9f a4 44 18 46 60 72 21 89 ..J|. ...dx..:..$`.P[K..... ... `n..3K 0080 4c 0b bc 04 c 6 3c 19 9d 09 b4 ff fb 92 04 ea 8f L .K.D.. 0050 ad 9e 12 e8 2 8 d6 e6 6f 20 41 ba e9 cb d0 34 14 ..o A... ... 0040 18 80 1c 09 b e 7d 16 14 18 b0 a4 2e 50 5b 4b 80 .F`r!.. 00a0 18 b3 4e 0c b d 29 81 86 15 69 81 97 a5 30 0a a6 .vc.+...... ..-.. 0060 24 71 c5 a9 9 c a0 0b 2d aa a5 5e 51 01 ef 8e 0a $ q.P...........F. ....4..0.sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2507] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . ....<.(.P....}*...R....k. 0020 01 0b 00 50 c 1 a6 2b c9 46 c6 9e 87 4e aa 50 18 ..i. 00d0 40 39 8e a5 0 8 95 4b 12 98 46 d9 d2 38 98 cc 10 @ 9..z`g.1.F.<.!H"a-t..@....c. ..L.. 0070 2a df 3c be 7 d 2a fa fd 5c fb fd 9a ad a9 33 4b * .OJbb... 0030 00 2e 8e 0b 0 0 00 ff 52 10 08 56 a3 24 60 cb 96 .)...V..j. 00c0 2c 5e b4 21 4 8 22 61 2d 74 b9 6a d1 89 76 63 e0 ... ^. 0090 f2 f3 2c d3 8 3 4f 4a 62 62 05 7a 60 67 09 4c 0c .... 0010 05 07 f1 a8 4 0 00 31 06 3a 8f 4a 7c 0c 8a c0 a8 .^Q..}..N...

.....o]}.{..#... 0110 29 2c 34 9b 7 d ad cd 20 40 39 87 85 dd 19 13 c6 ) .......Yk.....J. 01c0 35 ce 41 72 2 0 59 1a 02 cb 19 51 17 f6 6c e6 aa 5 ..J.. 01b0 48 36 bd 7c f 0 b2 f6 1d 6f 5d 7d bf c7 ff 15 c3 H 6. 0100 66 76 7e f4 8 c 34 7c 58 8a 45 88 08 4a 89 9e 0d f v~...h.Pt.Ar Y..B.U.f..2 0180 60 10 b5 1e 3 0 01 d4 45 93 d1 cd 92 21 59 e5 33 ` ..!...-.V.. 0130 5e 4d bf 75 8 b 65 4d 65 e1 10 0a 09 b7 57 18 29 ^ M.t 00f0 5e 3b 67 7d 8 8 d5 ed cf 21 da c7 8c 53 d0 a0 8b ^ .. Q.[..........b0..H..Q.V..g}..E.eMe.U..3.0.u...P. .t.b 0160 3d 2a fb 23 2 c fd bc f5 74 d4 86 2d ab 00 b1 6d = *.}. 0120 16 51 9e 1c a c 65 cf 55 03 5b 1d a6 bd 74 f1 0c .l..<.... .Y.[.P...... 01e0 10 b3 88 14 7 b f0 5b 9f 05 ad 66 b9 93 89 33 14 ....3 0190 58 30 ca 59 6 b d4 d9 e1 56 ee 55 9f 75 17 62 bd X 0..P.u.Y<.b.S...v(.!Y.....eC 0150 26 9b 56 08 5 8 8b 17 d3 b6 cc 4a e3 0c c4 94 62 & .. .sH. 01d0 10 14 04 07 2 c 3c 05 00 30 31 c0 cf 14 e8 50 a9 .|.e.f.t....4|X.W......'B.. 01f0 73 22 b0 2a 6 e 2f 79 8b b1 68 f1 76 28 de d7 83 s ".) 0140 2b 63 94 90 e 6 50 d6 f1 27 42 1a 62 30 1b 65 43 + c..X..m 0170 53 c2 17 7a 8 4 42 89 50 00 66 0a 18 73 48 0d 32 S .....E.....Q. @9. 01a0 59 8d d2 13 1 0 e7 59 ce de c5 99 48 b3 44 0f dc Y ...D..01....P.4.z.*n/y...

... .T 02f0 e9 d5 20 b3 c b 4f 2b 2f 5b 3b 24 f1 4f 46 f7 d3 .O+/[...(H>Jf.P...(B.Ap..... ... .Z.. 02c0 66 00 9f cb a 6 4c 04 10 59 2a cd 3b a7 79 55 28 f ..pH..yU( 02d0 ea b6 89 5f 3 1 2b a7 42 7c 39 72 20 14 21 33 a6 ...0200 df 5b 59 88 c 8 82 a8 63 c8 5a 2c 92 20 50 27 91 .. 9.Z....?O* 0270 71 86 6a 45 2 4 86 86 43 02 3f ac 41 70 bd af fd q .. 0220 9d b9 63 7f f 9 2f 8e d5 5c 45 a0 10 ff fb 92 04 .'.. 0230 e8 0f f2 e6 2 7 d3 83 4f 62 50 5f 04 ea 60 69 ec . .(.. ....C...l. 0300 ec 86 c7 57 a 0 ce 9a ad 8d e9 52 8a 8d a5 ab 1e .....u 02a0 9b 39 d7 22 6 c fc aa b2 70 48 ae 6f f0 d4 b1 34 .....!..@.\. 02e0 29 27 29 d7 6 b ea 03 cf 50 84 66 64 d2 21 01 54 ) ').. 0240 4a 0b 90 b3 4 c 0d 61 29 81 6c 13 a9 81 ac 3d 28 J .?.o.a).c. 0310 c1 4d 0d c4 c .<...P..._1+.....Y*. I..L. 0280 e9 e6 32 34 b 5 06 8a 3c 0d 82 19 b5 98 5c a9 81 . ...L...24..B|9r ."l..OF.U.. ..^ 0260 a2 49 9e 21 1 0 82 24 98 c8 83 c7 f1 a8 3f 4f 2a .... 0290 36 58 9e 40 f 4 d2 0f 64 69 70 f3 55 a2 10 ca 75 6 X.\E.$.=( 0250 6a 32 b3 28 4 2 d2 53 b7 a0 28 81 04 80 8f 81 5e j 2.`i. ...W./. 0210 a1 92 28 48 3 e 4a 66 0c 94 b9 d5 97 50 f4 ee e5 .4 02b0 92 2e b5 10 4 4 7a 93 b8 ab ee 4b 1a 5a 86 08 e1 .c.$...S.. P'.ObP_.....dip.fd.jE$.!3.k.R.Dz...!.K.. [Y........ .....

...... 03a0 d2 fe 8b 72 5 4 d7 48 e1 f2 4d 63 c4 f0 1c 18 3e .Mc.........> 03b0 20 15 03 0a 2 8 e1 30 aa d9 02 21 aa 69 a7 d7 4a .XJ`a.@ 03e0 67 09 4c 0b 4 c a3 4c 0d 61 89 41 7c 97 69 01 9c g ..tx.I....*. l<.&.^..9 58 40 b3 01 0e 9d 85 b6 e4 38 ac ..... 0370 24 db 2a f4 5 5 24 02 a3 83 a0 8c b0 60 14 90 77 $ ...!.o+.N. 0390 38 ce fc 20 9 7 a0 c8 1f 81 67 1d 09 3c 2a 2a 10 8 ..#k-.rT..%.*. 03d0 92 04 ed 0f f 3 26 2c d2 83 58 4a 60 61 e5 8a 40 ..!..3. !.... 0420 e1 16 31 5b a e cb c3 11 b7 4f 8e ..`..4g..... 0410 b7 6c 3c a8 a 7 2b b3 d3 00 e5 d1 e4 40 8f bf f7 .(.C..H......w 0380 36 76 64 c3 2 1 81 80 a2 88 ea 5e bb 6e 05 d8 80 6 vd.L....(. 03f0 3d 30 5f 35 d 7 f2 34 67 ed 77 ff ff fa 9a 4b 58 = 0_5....i.<**..9/.. ...8.. 0340 6a 44 66 1c 2 a b7 11 b5 2d 1c 6f 2b 05 e4 7d 64 j Df. _....w..U$.m... 0330 ca c0 a8 94 4 d 44 11 62 19 a7 7f 25 8c 85 e0 86 ... ..g.KX 0400 32 2b 28 b1 4 9 05 05 28 2c d9 39 2f 88 33 97 c3 2 +(..-.@.J 0360 62 b3 6f c2 d 6 b7 fe f5 9f ad 63 fd 49 d4 6e cf b ....A|.a..c...MD.0.orM.o..n...}d 0350 bc 5f 9b ab 2 3 6b 2d f0 af 99 6d 8d ee cf f1 4a ..+...X@. .L...J 03c0 2d 1e dd 74 7 8 b3 ff 6f 72 4d df 4e d3 08 ff fb . 0320 d3 21 b9 d0 1 3 65 60 5e d1 d9 78 a5 43 a9 18 92 ...L. ...... M.n.b..I.e`^.x....i.

... ....F.P|. 04a0 32 7c 20 4c 3 c 7c bb 6c fa 8a 47 94 47 ed c8 74 2 | L<|..w.G.659327000 ...%.... 0430 a9 65 64 4c 6 3 47 eb 54 4d 6d 25 98 bb d2 a6 b4 .. . No.>B..d.G.!|.c. ..y.7.......yi...s 04f0 df 53 ef 8a e 5 fe a0 50 c1 f3 88 3e 7c 06 27 72 .x.g...S 04c0 8b 72 2a d7 0 3 e3 8e 80 73 26 2f 96 00 51 4c 76 ..."3|. H. r*.g....j.C..0a 20 70 98 b1 .TMm%.. . edLcG..RM 04e0 15 3c bb 39 4 6 9e 79 05 08 82 e9 46 19 18 ca 73 .. . <.L..>|. Time Source Destination Protocol Length Info 100 3. .K.. 0490 0c 18 47 b3 9 4 2a 9d 15 cd ff 14 63 0c c9 a0 10 .. .z. p.u... 0470 1e 48 0b 19 8 e eb 8e 20 2e 8b 81 01 79 69 b3 57 .....*.#....7Ww 0510 93 83 ca 67 e b .)E.'r 0500 c8 cd 35 14 0 7 1e 68 a5 93 f4 4b b3 a6 37 57 77 .t 04b0 ff d3 d4 4c 9 b 3e 42 01 67 e4 0b 77 9a 50 80 53 .. 0440 c5 9d 7a d2 a f 63 fc c1 d5 37 df d7 1f e7 75 c6 .5.9F..P.P.1[.......s&/....QLv 04d0 11 02 35 90 2 2 33 7c be 78 00 43 14 23 17 52 4d ...G.W 0480 fb c4 40 08 c a 86 d7 8a 19 21 7c f5 a8 ae 7d b3 ... 0460 44 45 9e 84 f 0 64 93 ed 8e 25 bb d0 16 50 7c 03 D E...c.. 0450 b5 f1 7f 2e f a 29 45 b4 f2 1e ef ff ff 6a 94 ec ...O..}... .. S.....h.. ..5... .l..@.

709257000 Romance Standard Time [Time shift for this packet: 0.dllstx01.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =59768 Win=40432 Le n=0 Frame 100: 54 bytes on wire (432 bits) . 54 bytes captured (432 bits) on inte rface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.000186000 seconds] [Time delta fro m previous displaye d frame: 0.pc13. 2014 11:26:5 6. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa .709257000 s econds [Time delta fro m previous captured frame: 0.port == 80 || http 2] Ethernet II.000 000000 seconds] Epoch Time: 141 5615216.659327000 sec onds] Frame Number: 1 00 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .cor exchange.home cust-74-12412-138. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).00018600 0 seconds] [Time since ref erence or first fra me: 3.

. ...... .12... ... .1 24.. = LG bit: Globally unique address (fac tory default) ..1.. ..0.1.... . = Don't fragment: Se t . ..138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ..gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... . . ....com (74..co rexchange.... ... = Reserved bit: Not set ...11 ).0. . .dllstx01..0 .... .... Src: pc13 . . ... . = Differentiated Ser vices Codepoint: De fault (0x00) ...... . ... .....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f3e (20286) Flags: 0x02 (Do n't Fragment) 0... . .. = LG bit: Globally unique address (fac tory default) ....0 ......home (192. ..... ....... Dst: cust-74-124 -12-138... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .168. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..

. . Seq: 1. .. .. = Nonce: Not se t . ...12.. .1.. ... ..... = Reserved: Not set . ... = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. Src Por t: 49574 (49574). ......124. .0. Ack: 59768 .....ho me (192. ....138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol... . com (74.. = Urgent: Not s et . = ECN-Echo: Not set . 0000 0001 0000 = Flags: 0x010 (ACK) 000... D st Port: http (80). Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 59768 (r elative ack number) Header Length: 20 bytes ..dl lstx01.....0. 0.168. .1 .. = Acknowledgmen .....11) Destination: cu st-74-124-12-138.. .0. . = Congestion Wi ndow Reduced (CWR): Not set .0 ... ..corexchange.

dllstx01.. = Push: Not set ... 0010 00 28 4f 3e 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ......+. ... = Reset: Not se t .0.......com pc13... . . 0...N...0 = Fin: Not set Window size val ue: 40432 [Calculated win dow size: 40432] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 99] [The RTT to ACK the segment wa s: 0..`n.. 0 .. (O>@.. . . . .. . . .dx. No..corexc hange.. ...... 0030 9d f0 18 d4 0 0 00 .E..t: Set ....home TCP 1314 http→49 574 [ACK] Seq=59768 Ack=1 Win=46 Len=1 260 Frame 101: 1314 byt . = Syn: Not set .......K. .J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 4b a5 50 10 .000186000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ....P.. Time Source Destination Protocol Length Info 101 3.P..670141000 cust-74-124-12138..

.. = LG bit: Globally unique address (fac .01081400 0 seconds] [Time since ref erence or first fra me: 3..0.. . .000 000000 seconds] Epoch Time: 141 5615216.010814000 seconds] [Time delta fro m previous displaye d frame: 0.port == 80 || http 2] Ethernet II.670141000 sec onds] Frame Number: 1 01 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ...720071000 Romance Standard Time [Time shift for this packet: 0. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)....es on wire (10512 b its).. . 2014 11:26:5 6.. 1314 bytes ca ptured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.... .720071000 s econds [Time delta fro m previous captured frame: 0. .

= IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .124..........168...tory default) ..0. . = Reserved bit: Not set ..corexchange. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) . ..... = Differentiated Ser vices Codepoint: De fault (0x00) ..home (192 . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . .0 .. .. ...11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.0 .... . = Don't fragment: Se t .... . .. ...dlls tx01..1. .1.0........ Src: cust -74-124-12-138. . ....... .138).. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1a9 (61865) Flags: 0x02 (Do n't Fragment) 0...12.. .... ..... .co m (74.. = LG bit: Globally unique address (fac tory default) ... . Dst: pc13... . .

..0 ..0. = Congestion Wi ndow Reduced (CWR): Not set ...home (192. = Reserved: Not set ... .. Dst P ort: 49574 (49574).. .1 . . = ECN-Echo: Not set .. Src Por t: http (80)... . .....168. = Acknowledgmen t: Set .138) Destination: pc 13. .. Ack: 1 .... 0000 0001 0000 = Flags: 0x010 (ACK) 000.0..dllstx0 1... . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol...com ( 74. ... ... . . .. Seq: 59768... . .12.124... .. .. 0.Header checksum : 0x3a81 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..1. 0 ... . = Push: Not set .... ..... = Urgent: Not s et ... Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 59768 (relativ e sequence number) [Next sequence number: 61028 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes .... ... = Nonce: Not se t ...corexchange.

I 0080 e8 32 11 94 1 a 0f 85 8c b5 9d ab 7d f2 8d fd 22 ..I. ........V...N...OB. ....a 00a0 05 da 50 67 0 f 4c 0b 10 85 5a 0c . `n.a 0050 a1 5c 3a 02 2 0 b0 49 00 50 34 16 8a 67 86 d3 f9 .0. ..Ht...k..K...4:.@...$A. ..g.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xf4a e [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .."6S. \:.}." 0090 84 ff fb 92 0 4 eb 8f f3 22 36 53 03 4f 42 e0 61 ... 0020 01 0b 00 50 c 1 a6 2b c9 4b a5 9e 87 4e aa 50 10 ... ...l..p... 0060 db 05 0a 48 7 4 a0 e5 ec 3b 3c cc 6b cc 56 bb ef ..... .. 0030 00 2e f4 ae 0 0 00 2e a0 17 1d 61 69 05 12 01 54 . .....<..P.|. 0070 66 66 ab 45 c 0 70 d3 0b 34 3a fe 1f 7a 6a 1a 49 f f... . = Syn: Not set . 2...dx.....E...1.P.T 0040 74 1c e3 6c 1 9 13 cc a8 7c c9 24 41 d7 a2 98 61 t ..ai.. ..P4..:... ..J|. 0010 05 14 f1 a9 4 0 00 31 06 3a 81 4a 7c 0c 8a c0 a8 ..E.0. .+.zj.... ...... = Reset: Not se t ...

.. 0160 bc f8 ef d4 f a 0b b0 be 5c 22 2d f5 78 65 25 9c ...... . 0110 2c 1f 9f 87 e 9 b3 eb 20 5d 6a 9c 58 2e 6d e9 13 ..1)Ay.. . 00d0 a6 49 5c d9 e 1 d1 dd 9a 69 e1 e8 66 80 42 55 87 .R.$.. vN... .X...w3/.}%.Z. O~.m.e.. ...[-w 0180 dd 98 76 40 e 3 46 2d b6 b1 a4 d4 02 2c c9 33 66 . ]j..31 29 41 79 13 . 00e0 b2 dc cf 49 7 e b6 b9 22 cf 6a d8 b4 f6 17 be 31 .!(...(`... ..U.j.~...X........I~.1.....v@..x.D. ..Y... 00b0 ab 01 86 21 2 8 d2 85 40 0a 58 e4 9c a1 5e 40 c5 ..... I\...1 00f0 b9 76 4e 05 4 9 81 04 09 06 44 86 ca 84 8a 85 54 .T 0100 f1 16 e0 78 6 b e7 05 c5 ab 35 28 c5 bc e3 1c f6 . .BU....@. ..".. 0170 91 4f 7e e9 7 8 b5 55 f8 dc e2 55 f6 14 5b 2d 77 .~.. 00c0 88 fe 24 ca c 8 26 e8 a7 2f 6f 54 96 06 91 d0 fc .. .. 01b0 ff ee f8 b7 3 4 db 0e ff f9 18 76 4f 2f 55 c8 de .xk...!.....I....&.......5(........ 0150 be ef b3 bf f f 9a e7 e3 90 8f fd 28 60 94 52 c7 ..F-...f.pl</... .qADf 0130 7e e9 09 ac 5 9 d5 2e 16 8b d2 31 f3 ce 7e 13 ac ~ ..Pg.L.. . .KH7u 01a0 5c 68 d5 a9 9 f 89 ea 07 9b 5e dd 7d 25 d1 19 9b \ h.U..^@..8Cc..i....^.###BOT_TEXT###quot;-..... 0140 b2 d1 fe 7e c b be 1a a5 ef 29 d2 83 77 33 2f a8 ..3f 0190 26 dd ac aa 0 c 65 98 9d 38 43 63 19 4b 48 37 75 & ...xe%. 0120 b1 c2 21 a2 e 2 10 70 6c 3c 2f ca c1 71 41 44 66 ..)./oT.

.. 0210 db c3 d8 ef b 4 3b ff bf 61 ea ba b3 2d 2d 4b b9 ..... 0270 c2 4c 50 70 d b e3 44 43 64 8a cc f1 d7 7b 83 ed ..\c..s.g...Q.a.$W6.. .!..o..........?7.e. 01e0 69 3e fc 24 7 b ce 32 28 b4 8f 95 06 22 f7 dd 2b i >.vO/U. ... 02c0 96 11 54 4d 7 d 0d 24 4d 97 5d b2 d8 34 20 2b a7 ...Y..b.X.h. 0220 46 14 df f8 c 5 0a 3a d3 7d 22 bf 9a 2b 91 c4 86 F .=..S..^.+. 0290 f8 99 ca 52 d d 3b bc 63 5f a2 b5 1e 67 fb ad b7 ...N.(X...R......4..TM}. .{......S..:.{..T... ..$M... 02a0 d5 1d f3 51 d 5 5b 49 90 b4 7a b6 ad 59 8c fd 0d . 0260 01 c8 62 98 c 5 f3 95 ac 5c 63 2c a9 25 6d c5 a8 . LPp.z..+ 01f0 27 24 e8 f1 5 3 c7 25 97 e3 58 cc 3d 94 bf 9a ed ' $.2(......=. .DCd.. 0230 c5 e2 55 ff f b 90 04 ec 8f f3 09 28 58 01 e9 32 ...${.W. 01d0 cb 3c b7 0b 6 5 13 53 14 18 68 aa 41 87 21 11 85 . . ]. ...4 +. 01c0 ad 11 b3 d4 d f 24 57 36 86 3d 20 1a 4e c8 7b df .:. <.[I.........= . ...M.. 0280 8d fc 1c 40 d c ee 4d 93 d2 d5 f0 ab 17 12 5e b8 .@..%. ...2 0240 50 63 e4 1a f 0 3d 89 4a 0b 70 65 62 07 bc c7 09 P c.Y.}... 0250 76 0f ab c1 8 4 a1 29 66 09 f1 bf 89 df bf 8d 89 v ..M.. 0200 3e 55 34 0c 4 d 01 96 54 f5 57 cd 3f 37 bb 7d 85 > U4........)f..c_."...U...}"...A.J..peb... 02b0 da 5d a8 18 7 3 a5 80 cf 6f de 59 ff 3a 93 18 a3 .%m.]..--K....

0).....gS>.&.._ 0380 eb fd 2a 11 9 4 01 3c 84 23 d5 03 e9 a0 17 4a 4c ....5......i 0370 06 89 07 e9 0 9 a2 9d e5 55 6a fd 4f a0 0c bd 5f .V..q......O....<.}.........i 03c0 33 73 78 dc a 3 7c df d8 bd 93 d7 84 cc 32 1f 16 3 sx.02d0 08 f9 51 d8 3 d 14 58 4a 28 42 79 10 9d a1 a0 95 .. xI'.. .). ... 0300 e5 b2 29 9b a e dd 7c 6f b8 b4 4d b5 a8 0e 8e 38 .JL 0390 2a 63 04 0c 7 0 bd 0e 43 b9 84 84 84 4b 03 c3 a4 * c..3u 03b0 b6 78 49 27 c 4 9e d9 68 d0 94 30 29 8a 95 f6 69 .XJ(By.Q...<gC%.K. e*rL.....=. 0360 fe 65 ad ce 6 7 53 3e fc ca 11 16 34 3e 78 16 69 ....b. e.....2. ..\.... 0340 54 99 d0 b7 f 0 e0 91 26 d7 15 94 e3 5c d1 f4 64 T ...VHQ{Q@.=V..d 0350 25 6b 6a c5 b 9 aa 58 b7 b5 bf ea 9d 9c 73 6d da % kj...y*r.Uj...*..C.... .h.......#...8 0310 f0 c8 b6 05 6 b fa 56 d2 aa 79 2a 72 2c 7d ff ff ...... 03e0 1a e2 5d e9 7 ..|o..*.. ......k.X.....sm... 02e0 78 fb 07 ea b 9 56 48 51 7b 51 40 b1 f1 71 d3 56 x .i.4>x...V 0330 f5 2c 35 87 2 a d9 d4 03 e0 72 43 39 8e 18 ce 09 ...w. .p....V 02f0 c1 65 2a 72 4 c 19 77 56 ce 0a 8b a4 fc cb 62 2c ..M...rC9... 03a0 0d 07 13 fc b f 3c 67 43 25 b6 58 8f d5 83 33 75 .. 03d0 4a c5 69 90 f f fb 92 04 ec 0f f3 1d 3d 56 83 0c J .. 0320 fc 89 80 01 8 a 09 ce 92 19 a4 da f6 77 83 85 56 ..wV.... .|.X. .

a2..4.O 0490 1f 2c 3d 48 a 5 7e 73 ad dd fd 17 6b 36 a4 ab d9 ...#P..z.).U..~s. ...peD 0410 69 40 ae 43 4 0 5b 0a d8 8e 2c 82 61 29 db 04 e5 i @...P.. 0430 fd 56 46 52 5 2 e0 fb 7b b3 8c 52 de 91 ff ab 7f . . R..R 0450 c3 cf c3 6e 1 1 0b ed 57 fe da 93 c4 2c 14 91 d1 .Y......=H. 0470 56 8a f4 e0 3 4 df ed 68 02 7e bb 21 43 d6 33 95 V .G.{g."L.#&h.X..r. 04a0 84 d7 f5 bf 5 c b7 36 db c0 f8 ae a1 47 f5 a7 bc ..n..xPZ.1t. 04e0 3c a7 72 27 4 d f4 87 a7 25 0f 84 fc a9 31 74 fd < .r'M.. ..\.!C.~....... 04f0 4f 1d 26 0b b 9 a7 dc 4b c5 c2 7f ...l.... 0460 a1 8a 61 32 1 8 58 ca 6a 3a 95 22 4c 1c 20 5a 01 ..^...j:...p...%.. .h.{..3.. VFRR.W. 0400 46 21 24 47 7 c 03 06 29 c8 70 d8 8d 1d 70 65 44 F !$G|.. .C@[.h..a d0 61 e2 5e 0c 84 af 50 0c bd 69 .}t. ......v.. T.R...a). 0480 d1 54 0a e6 f 4 34 4c 9b d4 56 d3 72 b8 68 b2 4f ...<_8....y.a..i 04d0 46 24 ea 5c a 9 6c d3 9c 50 12 25 46 eb c2 83 87 F $.h.T.%F.. 0420 53 32 42 a2 e d 3c 5f 38 b6 6e a6 6c 3c 81 68 d3 S 2B......k6.6...\. 04b0 0f 78 9a 54 f a b0 23 50 0a b2 59 86 78 50 5a df .].u.l<. 0440 2d df a1 7b 6 7 f7 be 75 f1 e2 76 0d 7d 74 3b 52 ..(....4L. Z..T.P...i 03f0 81 83 13 aa 0 1 97 b1 28 90 b0 ba b4 55 d1 a7 a8 .n.. 04c0 ea 52 c0 a7 2 3 26 68 cd 0c 79 0b bc 82 54 9c 69 ..V. x..

.com pc13...&. 2014 11:26:5 6.13900700 0 seconds] [Time since ref erence or first fra me: 3...dllstx01.6]. No. .. 1314 bytes ca ptured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...93 14 53 68 57 O .859078000 s econds [Time delta fro m previous captured frame: 0..809148000 cust-74-124-12138...corexc hange. h.139007000 seconds] [Time delta fro m previous displaye d frame: 0.K.859078000 Romance Standard Time [Time shift for this packet: 0..d/cE.home TCP 1314 http→49 574 [ACK] Seq=61028 Ack=1 Win=46 Len=1 260 Frame 102: 1314 byt es on wire (10512 b its).|. 0510 98 68 98 64 2 f 63 45 80 ab 49 12 88 e4 2f 4b 22 .)[..000 000000 seconds] Epoch Time: 141 5615216./K" 0520 b5 ba . Time Source Destination Protocol Length Info 102 3.|.I.809148000 sec onds] Frame Number: 1 02 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: .. .ShW 0500 ef c5 d0 7c c 7 05 36 5d 8d f6 29 5b d2 7c ed b0 .

. Dst: pc13. ...... = LG bit: Globally unique address (fac tory default) . .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.... Src: cust -74-124-12-138.1. ...0 . ... .124..port == 80 || http 2] Ethernet II........0 . ....0. . ..... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..co m (74. .. ......1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)..12. ..0.corexchange. .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. .home (192 .. ........dlls tx01. . .168. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) ..... . . ... = LG bit: Globally unique address (fac tory default) ..... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..138).. .. ..

.12.138) Destination: pc 13.. . Dst P ort: 49574 (49574)...1.com ( 74.. Ack: 1 .. = Reserved bit: Not set ....dllstx0 1. = Don't fragment: Se t . Src Por t: http (80).0..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1aa (61866) Flags: 0x02 (Do n't Fragment) 0.0000 00.1.corexchange. Seq: 61028. . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a80 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 61028 (relativ e sequence number) [Next sequence number: 62288 (r elative sequence nu .. = Differentiated Ser vices Codepoint: De fault (0x00) . 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.124... ..home (192...168.. .

0..... 0 .. .. = Congestion Wi ndow Reduced (CWR): Not set .:....... `n. 0. .. ..E. . = Syn: Not set ...@. 0020 01 0b 00 50 c 1 a6 2b c9 50 91 9e 87 4e aa 50 10 .....1 ...... ..... = Nonce: Not se t . ...... ... = Reset: Not se t . . ... ........ = Reserved: Not set ..mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ..... . . ...... . .. = Urgent: Not s et .J|. . .1.. 0.. 0000 0001 0000 = Flags: 0x010 (ACK) 000.. .......0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x4ee 0 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2520] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. ...0. = Push: Not set ..0... .... . .0 . . . . 0010 05 14 f1 aa 4 0 00 31 06 3a 80 4a 7c 0c 8a c0 a8 ... . = Acknowledgmen t: Set .. = ECN-Echo: Not set .....dx.

...P.*.+.M..A.]i.. 0050 54 29 71 22 8 d d1 2d a7 be 18 8d 69 a0 40 f1 db T )q"... ..!.t.'.. . $B).-..ZK... i...S...1(....... 0110 56 bf 53 c0 d 8 b4 33 81 ce 2d 33 3c b5 54 08 08 V .&h`....N...N. 0120 35 e3 20 34 5 f a1 eb 2a 91 ba a6 65 3c 28 09 c7 5 .1.-3<.. .P.X$..g. f. 00d0 28 91 04 69 3 e ad 3f 8b da da da 26 71 a4 6d 9b ( .U.zN.. 0080 38 7f 09 7a 4 e 94 91 74 99 73 ff fb 92 04 e7 8f 8 .b.i.....k!f..*K..#... 0060 75 92 8a 24 2 e a9 31 07 a6 4c 87 c8 a5 4a 44 b2 u .A . .....t.. 0100 e3 69 c4 5f 2 d 70 e9 78 d6 40 4f af 9e 11 fe fe ... 00c0 c1 24 42 29 d 2 18 5a 4b 8d 58 24 b0 21 c2 91 19 ..R 00f0 b4 ac 67 06 9 4 2a 4b 0c 49 b4 e7 ab b2 81 bb 94 .@. 0030 00 2e 4e e0 0 0 00 df 5d 69 00 10 c6 55 e0 5a b9 ..K0.$...m. (4e5@... 4_. 00e0 86 66 90 11 6 5 41 f5 90 9f 97 23 99 75 08 80 52 ..J. 0040 9f 28 34 65 3 5 40 81 53 cc c0 b1 1e 4b 30 8c c0 ..... 0090 f2 c6 24 d3 8 3 2f 62 50 5a 84 ea 70 65 ec 4a 0c ...eA.@O. .JD.L.. 0130 05 d4 62 de 4 d 17 11 93 8c e7 5b 48 a4 27 df 41 . .s..i>....pe.P..._-p.x.J....T....f.e<(..[H.. 00a0 d8 b3 4a 0d 3 d e9 81 8a 93 a9 41 ac 31 28 c0 6e .&q.=.3.....I./bPZ.. .... 0070 88 82 02 f3 8 d ac a7 c4 c2 95 6b 21 66 3b ca a7 ..S.Z.u.$.n 00b0 00 b5 99 a7 e 2 74 dc 10 c4 26 68 60 c2 66 0c 87 ...?.....

0200 9d e3 d4 8b 6 6 5c df bf b1 80 9e 2d fb 21 39 cc ..I... 0150 03 3f b5 55 0 c f0 9e cf 1b 19 c5 63 da 0f ce 33 ..`.V 01b0 f4 6b 54 4b b 0 c3 7d 1a cb a4 bc ab 88 52 c7 cd .2... +...B...uo..d.. 01d0 dc 3e a4 0a a c 55 00 de 46 aa 34 2a 70 19 60 09 .... .. 0230 e8 0f f2 cc 2 7 d3 03 58 4a 50 5b 64 da 50 6d e9 . 01e0 51 a4 9c 60 5 d af 15 ec e3 44 4a 03 91 44 e5 58 Q ..c.1j_Z. 0180 46 25 7b 4f 3 0 29 1a d4 1b c7 e8 29 37 5e 58 e2 F %{O0)... 0190 bd 2b 96 47 4 4 bb 9b 78 54 9b 08 a3 4f 66 ce 5b ..i....Ek..=. .`]....>.8...7.-.. ...'.F...xT.....}..-=k..J....e8.DJ.)7^X.&a. 0240 4a 4c 74 a1 4 a 0d 3d e9 49 9a 97 a9 01 ac 3d 30 J Lt.XJP[d.....-..V.yOr 0220 48 62 b5 b3 2 6 61 89 64 ce 75 6f b9 ff fb 92 04 H b..[ 01a0 24 8f cd d7 b 1 89 56 14 86 ac 4c c9 aa 1f 89 56 $ ...0140 be a1 95 03 c a 2d de 30 da 32 9b 69 f3 42 90 3b . ...L.Of..2.U.......U.!9.GD.D..F...l...3 0160 ad e1 82 87 8 1 b8 ac f5 16 76 25 7b 8e d0 e9 f2 .... kTK..-. 0170 ec a3 bf fd 6 5 38 04 e0 37 85 c8 46 97 86 10 b0 . 01c0 e8 ea 2d 3d 6 b af 99 31 6a 5f 5a 81 ef 13 3e fb ..f\..R.. ?.. 0210 19 58 bc 9f 2 d ec b7 f4 42 31 32 7d e8 79 4f 72 .=0 0250 1a 52 38 4e 4 ..B12}. .0..4*p....Pm..X 01f0 86 1f c0 7f 6 c 9d 38 1b ea 45 6b 88 e6 2e 32 d7 . .. >... X...v%{..... ..

.d ab de 77 af fd 2b f1 02 67 30 c8 .. 0320 14 30 03 98 8 b a8 fe 31 2a 92 54 65 47 b8 1b 6c ..R..@P.q 0310 52 7c aa 7e b 4 06 83 67 9c 61 f0 d8 8c 40 50 13 R |.Y...k..^z..m.O. 0.) 0350 cb 8f 2d c3 f 5 7b 43 a3 3f 80 c6 f5 a5 73 59 a6 .1*...Z 02a0 72 a7 8e 5e 7 a b9 3a ca ea e4 cd af 59 77 98 94 r . ...x 02c0 d4 ae 4f 14 c d 57 00 a6 a1 3c 5b 2e ca 84 81 11 ..... ...'.r.-..?..Ec..sY..ZK.g0. .. R8NM..n.R...N........~.. ...TeG.W... . 0290 a2 b3 72 98 e 0 ef bc e1 eb d6 a1 ca 89 f5 ae 5a ..T......r.H..<[. . 0260 c8 96 50 87 c c 8c 64 f3 16 19 12 a4 5a 6e 34 81 .. 02f0 a5 19 da 36 b 2 77 0e 6e e1 ea 6d ea f4 09 6b 15 . 0300 1b b4 f3 27 c f cc cf da 9d af c7 bd 01 f5 9e 71 ......... 02b0 0f 63 35 9e 1 b fa d4 f0 50 81 65 cc 45 63 1c 78 ..g.d.....e. 0270 56 0b 12 1c 9 1 4e 17 72 ec 39 3f 07 59 82 2d d5 V .. c5...{C.. ....-... ......~.-..P..@... 02d0 ad 86 52 c2 d e 80 82 74 1e 35 8d 04 fd 2e e9 c2 . 02e0 c4 a9 82 84 2 d cc 7e 0b 91 da ab c6 d1 79 3b c9 . .N.w..x..r..p<..9?.{-.Zn4..:.....l 0330 f0 a8 7b 2d 8 2 e2 70 3c f2 4e c8 5a 4b 98 aa 21 .a.w.Z... 0360 4f f6 49 c9 d 4 4f 26 0a 01 8f 53 .....5..P..6..! 0340 71 89 78 9b 1 d d5 9d 06 ce 54 fd 09 48 f2 99 29 q .y..t..+. 0280 4d d8 72 b3 e 9 11 8c 52 e3 91 40 02 8f 9f 5a a6 M ..Yw..

f..L@....j.UY..B=..= 0390 68 bf 40 42 9 2 c7 4c 40 d5 0b 1b e7 ce cc f1 2c h .y/...... . #.O&...6............ ..mo.......>.1...I....h_. 03b0 2c 22 0d 1a 9 0 6b 75 9d 66 8c d6 d4 68 5f 1e 0a . 03f0 31 28 2f ff 8 9 03 05 14 8a 42 3d 9e 96 d4 93 48 1 (/.S.........-. 03d0 92 04 e7 0f f 2 d3 2c 53 03 4f 62 60 5b e5 8a 50 .0O. 0470 ec 76 60 22 f 4 a7 b5 97 97 17 96 d4 e6 6a 88 89 .. 0440 16 ab 49 ee f 6 de 0b 72 df b5 75 af bc 32 c5 de .Ob`[. 0380 46 34 25 86 3 e a6 0e c0 60 12 7a a1 20 7e 01 3d F 4%. 0420 d4 72 1d 99 9 a 70 e5 ae bb 6b 2f 89 53 cb 0c d1 . 0370 fa ac b2 fd 3 5 65 82 1a 46 34 a8 55 59 b8 fc 01 .fa... 0450 73 ab d6 3d 9 e e7 d0 14 84 30 4f c3 2c 50 c2 6e s .M.......S.f.k/.uQM7^. M&.P...F4.DY-m. .J..=..P 03e0 6b 0c 4c 0b c 8 b3 4a 0d 3d 89 81 7f 93 e9 01 ac k .I....S. ~.2. . . ". r..$E..^q.. .#... 0430 05 4d 26 f5 5 a cd 2b 8d 89 4d b5 03 6d 6f b1 a9 ......r....`.....5e.. 03a0 67 1d 45 c5 d b c9 f9 66 12 82 f4 ff 31 9b 20 d6 g .JP.`. .05 5e 71 d4 a2 O .=..z.u...... .p.E...n 0460 11 23 0a 79 2 f b1 c2 06 44 59 2d 6d 19 bc 6a e5 ..Z... 03c0 ed f3 aa da f f 1e 03 2d f7 8d e6 91 bc b0 ff fb ...H 0400 d0 81 66 61 0 0 82 88 60 02 c4 75 51 4d 37 5e 01 .L.+..@B.... 0410 88 ac 23 0c 2 4 45 e7 4a 50 06 f4 eb b5 0e 36 b0 .ku.

P.$. _.GR 0520 4c 03 L .s 04a0 a4 d6 6a 8b 9 c 66 0b 74 5f e4 be 7c 25 57 ff e3 . 0490 d3 5f c4 81 4 d cc d8 52 e6 b0 5f 9b 92 fb bf 73 .X.2"..... 0510 63 e3 78 6e d 6 b1 e0 ed 62 3b 4b 3d 2f ba 47 52 c ... 04e0 1c 08 fb 50 8 4 58 b9 4e 9b 32 a7 7d fc 8b 5b fb ..... 54 bytes captured (432 bits) on inte rface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B .....j...!..home cust-74-12412-138.xn.j. }.f...n. 04b0 13 7d ba ff 7 6 9a 20 42 1b 24 fb e2 3d 72 6a 94 .....2.v`".:... .809328000 pc13.M..dllstx01...|%W...b.... 04d0 82 c0 ec 56 6 5 ba ab e0 b0 6e c0 b4 21 d1 7e e8 .. 04c0 19 1c d0 90 2 c 0a 32 22 c3 9a 8b 13 47 e3 0e 09 ...... Time Source Destination Protocol Length Info 103 3.c*S.K=/.GY..}. ...O$.N.$. .. ..=rj.v.cor exchange.Ve.b..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =62288 Win=40320 Le n=0 Frame 103: 54 bytes on wire (432 bits) .'..G. . 04f0 69 c2 03 3a c d b6 8b 8f eb 81 c9 4f 24 ef 24 d7 i ...[.}...~...t_.. B... No._... 0500 c3 ad 62 91 e 7 ff ce 7d d7 17 b4 d8 f8 8d f1 9d . 0480 76 a9 27 9a a b dd 0f 47 59 a4 8e 63 2a 53 f0 0b v .R.....

. .... Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . ..-440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.... 2014 11:26:5 6.859258000 Romance Standard Time [Time shift for this packet: 0.859258000 s econds [Time delta fro m previous captured frame: 0.. . ... .000180000 seconds] [Time delta fro m previous displaye d frame: 0...0.809328000 sec onds] Frame Number: 1 03 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .... ... . ..0 ... ... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).000 000000 seconds] Epoch Time: 141 5615216.......port == 80 || http 2] Ethernet II. .00018000 0 seconds] [Time since ref erence or first fra me: 3. = LG bit: Globally unique address (fac tory default) .. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) . ..

1.. ...ho .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.... .. . ..1 24.. ...... ... = Reserved bit: Not set .168. . = Don't fragment: Se t ..0..home (192.dllstx01. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13... Src: pc13 .. = LG bit: Globally unique address (fac tory default) .... .....11 ).. .com (74..1. .0.. .Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ......co rexchange.. Dst: cust-74-124 -12-138. .. .. .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f3f (20287) Flags: 0x02 (Do n't Fragment) 0.. = Differentiated Ser vices Codepoint: De fault (0x00) ....0 ...12.

... = Acknowledgmen t: Set .. 0.. .. ... .....dl lstx01.me (192. ... .... Src Por t: 49574 (49574). = Reserved: Not set . = Nonce: Not se t . ....... .. = Push: Not set .11) Destination: cu st-74-124-12-138..0..1 ....... .. . . . .. . .0..0 . 0..0 = Fin: Not set Window size val ue: 40320 [Calculated win dow size: 40320] [Window size sc aling factor: -1 (u nknown)] .. com (74.... = ECN-Echo: Not set .......168..138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. . = Syn: Not set ...12.124. .. Seq: 1. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 62288 (r elative ack number) Header Length: 20 bytes ...0.. 0000 0001 0000 = Flags: 0x010 (ACK) 000. .corexchange. ...1..... 0 . D st Port: http (80).... = Congestion Wi ndow Reduced (CWR): Not set . . . . = Reset: Not se t .. ..... = Urgent: Not s et .. . Ack: 62288 ...

.N.corexc hange. 2014 11:26:5 6.860798000 Romance Standard Time [Time shift for this packet: 0.000 000000 seconds] . Time Source Destination Protocol Length Info 104 3.home TCP 889 http→49 574 [PSH...810868000 cust-74-124-12138.com pc13.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 55 7d 50 10 ....P... . No.dllstx01... . 0010 00 28 4f 3f 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ......Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 102] [The RTT to ACK the segment wa s: 0. ACK] Seq= 62288 Ack=1 Win=46 Len=835 Frame 104: 889 byte s on wire (7112 bit s).. 0030 9d 80 18 d4 0 0 00 . .+..000180000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 . 889 bytes captu red (7112 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...E.dx. (O?@..U}P.`n...

. .Epoch Time: 141 5615216...0.. . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... ..860798000 s econds [Time delta fro m previous captured frame: 0.0. .. ......... . .... .. ......810868000 sec onds] Frame Number: 1 04 Frame Length: 8 89 bytes (7112 bits ) Capture Length: 889 bytes (7112 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . ... .00154000 0 seconds] [Time since ref erence or first fra me: 3... . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .0 .. ......0 .. ..port == 80 || http 2] Ethernet II..... .. = LG bit: Globally unique address (fac tory default) .. . . = LG bit: Globally unique address (fac tory default) .. .001540000 seconds] [Time delta fro m previous displaye d frame: 0..... ..

.12..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..corexchange. .home (192.corexchange... = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3c28 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. 11) [Source GeoIP: Unknown] [Destination Ge .138).. .... = Differentiated Ser vices Codepoint: De fault (0x00) ..124..168.12.1..dllstx0 1.com ( 74...home (192 ... = Don't fragment: Se t .dlls tx01... Src: cust -74-124-12-138......00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 8 75 Identification: 0xf1ab (61867) Flags: 0x02 (Do n't Fragment) 0. .168. Dst: pc13. = Reserved bit: Not set .. .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.124.138) Destination: pc 13..0.1.. ..co m (74.. .1.

. ... . ... ....... . .. .... 0. ...1 ..0...oIP: Unknown] Transmission Contro l Protocol. ACK) 000.. = Acknowledgmen t: Set . Len: 835 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 835] Sequence number : 62288 (relativ e sequence number) [Next sequence number: 63123 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ...0. .. . .... ...... = ECN-Echo: Not set . .. .0 ....0.... ... 1 ..... = Reserved: Not set ... Dst P ort: 49574 (49574). = Nonce: Not se t .. .. . = Reset: Not se t ... 0. = Push: Set .. .. ... . ..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x11c a [validation disab led] [Good Check . .... = Urgent: Not s et .. Seq: 62288.. Ack: 1 .. ..... 0000 0001 1000 = Flags: 0x018 (PSH.. = Syn: Not set . .. = Congestion Wi ndow Reduced (CWR): Not set .. Src Por t: http (80).

N. u<jv. 0050 6f 4c 10 c6 c 7 57 27 e1 94 ce d7 33 2c 01 ee de o L.... ....!0..gVz...4.. L...1.iY...<..v... `n...%.. . 0010 03 6b f1 ab 4 0 00 31 06 3c 28 4a 7c 0c 8a c0 a8 . k. 0030 00 2e 11 ca 0 0 00 0e b8 d9 21 30 89 cd fd 93 3c .+. 00a0 81 85 17 a9 0 1 ac 3d 30 3c 0b fa cd b8 d9 67 1e ....L..3...a. 00b0 c4 de 95 a8 1 4 02 68 c8 02 0c 12 13 0b 0c 8a 18 .@...sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 835] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .W'.O 0090 7a 60 5f e5 8 a 40 6b 0f 4c 0c 40 bb 48 0d 61 e9 z `_.... #PM............H.P. 0020 01 0b 00 50 c 1 a6 2b c9 55 7d 9e 87 4e aa 50 18 . .......=0<.@.H...@k............ 0080 fe 9a ce 7e f f fb 92 04 eb 8f f3 1c 2e d2 03 4f . .. 00d0 39 fc 87 67 5 6 7a ff a7 bd 45 1d 8e 41 12 f7 83 9 ..P. 0070 bd 75 3c 6a 7 6 14 bd 9a dd db ff 69 59 be 25 cf .n..T.vb~.X... .h..~....U}.....E...... . 00c0 e8 0d 54 2e 0 a 4c d6 fb 34 a6 20 23 50 4d d2 07 ....L. 00e0 90 5c fd d1 1 8 0f 90 c3 f5 30 e9 3a 4f 50 9c 68 .<(J|..< 0040 31 4a 9c 76 c 8 6e 06 03 58 bb b9 bf 09 e0 3c ba 1 J.g.. 0060 88 4c ab fc 7 6 62 7e a9 8d e9 2e 9b e6 48 16 ae .....dx.. .A..E.

Q5.\.5gV...HK.........o. . .A}....u.a.]. ...h 00f0 f7 2e 4f 39 6 f 0f 6f b7 b9 9f a6 4a 77 4a 57 10 .. 01c0 a6 73 44 b2 1 b 96 35 67 56 b3 3d f3 7f 48 75 d7 ..$} 01b0 21 65 8f 81 d 5 7d 00 f0 f5 98 e6 b5 e9 9a 9c b8 ! e...d. h...b 0180 50 e7 51 35 f 4 5c 93 b1 91 10 8c 41 7d e4 12 53 P ..... t.*..R... $...!...dR.<.... 0120 56 26 34 fc 4 8 4b d0 86 f2 ec a6 82 27 6a eb e0 V &4....-...}...k... 0160 8e f7 fe f7 8 9 b0 fa b8 f8 b4 fb fe 39 87 d6 2a ..Hu. 01f0 70 81 1b 6b 1 2 0e 91 48 43 16 d2 f5 1d 0d aa f5 p .e.....s 0150 c5 68 ba 5a 8 c df a8 17 ff 09 eb c6 be 75 af 87 ....Y. 8......'j. sD.T ....... .B...D%q....\....... 01a0 42 29 a9 ae c a c8 43 6d fd fc e5 b5 d4 06 24 7d B ).......0.HC.\.....C 01e0 24 76 55 62 a e 93 64 95 a2 d0 a1 eb 0e a6 59 8f $ vUb... 0100 78 fd 4f d3 9 c f4 db ce a0 f5 9b 56 b3 7d 69 c2 x ...9. 0140 ee 38 d8 dd 3 c 80 a0 64 52 aa 1f 42 d5 2e b9 73 . `...V..}i. 0110 97 e7 d8 88 8 e 01 a7 ba 1d c9 5c cc 2a b9 b1 84 .X\M......* 0170 fd 24 97 e8 a 2 40 ac 80 52 18 cf 87 84 0e 10 62 .@...*...JwJW... 0130 ca 60 09 5d d 9 2a 9d 3c 8d d2 9e 65 e4 96 61 a2 .....:OP..O9o.Cm...O..=.......@.S 0190 50 60 e9 b8 2 d a7 44 25 71 fc 58 5c 4d 3b 21 fd P `. 01d0 f7 74 d5 40 c 2 1a a6 a0 e9 2c 83 54 20 ce a5 43 .<.Z....

...P......+.z....$^8.$ 02f0 ca be 0c 53 7 2 6d 59 bd 19 06 ce 17 dc 6c 45 6f . ....:.0200 3a 99 9e 04 e a 11 68 6f 87 15 b9 3a 95 81 06 42 : .@.Ow........ 0260 65 8d 9b 36 a b e4 40 78 73 cf 08 04 b0 0c 9f 2c e .6. Oz`[..... 02e0 86 8a 1a 8c 6 7 61 44 dd 16 36 35 09 ec 76 b8 24 . .p....) 02d0 d1 6c c4 a1 a a 76 48 c5 5a 24 3d 84 89 70 be ad ...TZ. 0310 0d 76 4b 96 7 .....a."b8Pb..O 0250 e9 97 47 53 b e 9d 0a 40 94 c3 1d 12 f0 98 40 80 .... 0280 ee 56 b2 e5 9 9 52 60 6a b8 b1 c7 7a f9 f4 64 1c ..lEo 0300 71 9e da ff f 9 54 5a f6 ce ab 5c 66 10 6a 72 0a q ... j0U.. 0290 43 e1 c6 f3 4 f 77 91 b5 d9 a9 23 6e a3 df fc ab C ....Z$=. ... 0230 83 4f 7a 60 5 b e5 da 40 6b 0b 4c 0c 7c c3 48 0d .X... l.GS.S...vH. 0220 4f 03 33 e3 f 8 f1 ff fb 92 04 e7 0f f2 d4 2c d2 O .v.MK=.. .B 0210 c7 6a 30 55 b e b7 da fc 4d 4b 3d dc f7 59 17 a2 ...3... V..65...R`j..L...#n......|......(a. 02a0 1f 6f de 2f c d de b8 58 c8 8c 04 eb a5 af c4 87 ...-pq.@.jr.U 02c0 70 b0 13 50 e 8 05 22 62 38 50 62 d0 2b 14 b7 29 p ....d. o.... 02b0 7a 9a 08 ae 5 3 12 08 5a 31 b6 a4 61 15 0c 03 55 z .. 0270 b6 80 02 b2 f a 24 5e 38 9c 89 f6 28 61 18 1b 05 .SrmY.... 0240 61 e9 81 7f 9 8 e8 c1 9c 2d 70 71 f7 9a ff 9d 4f a .....@xs.....H....ho........\f.Y./..@k...Z1.gaD...

. vK...4.b.com pc13.). 2014 11:26:5 7.$.`...Y..001082000 s econds [Time delta fro m previous captured frame: 0.>. Time Source Destination Protocol Length Info 105 3..d`... e.n. 0340 14 7d e7 62 6 d db 38 e9 00 3e 98 82 63 52 37 1d ..8....home TCP 1314 http→49 574 [ACK] Seq=63123 Ack=1 Win=46 Len=1 260 Frame 105: 1314 byt es on wire (10512 b its).H 0320 c1 34 01 40 7 2 e1 85 a0 06 29 1f cc c0 00 88 db .3 0360 7c 2c 81 24 d 2 9f f2 c5 03 c2 fc d7 b1 6e a6 38 | ...dllstx01... }.. No.140284000 seconds] [Time delta fro .. 0330 fa 73 01 e7 d a db 70 6d 60 67 69 ce ca 48 5b d5 .. s. 4.H[..001082000 Romance Standard Time [Time shift for this packet: 0.951152000 cust-74-124-12138...d 0a f0 60 e3 97 b0 64 60 82 11 48 .D..pm`gi....}..@r..000 000000 seconds] Epoch Time: 141 5615217..bm. 1314 bytes ca ptured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..8 0370 ff cd ac c4 8 7 34 9e d7 d6 .cR7.corexc hange..... . 0350 05 65 a8 80 5 9 1a 9e e2 44 a0 c4 c9 cd 62 0c 33 ....

. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... .. . .. ... .0.....dlls ....14028400 0 seconds] [Time since ref erence or first fra me: 3.. ...... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ... = LG bit: Globally unique address (fac tory default) .. .port == 80 || http 2] Ethernet II. = LG bit: Globally unique address (fac tory default) .. ......... . ...... .0... .m previous displaye d frame: 0..... . . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. . Src: cust -74-124-12-138..951152000 sec onds] Frame Number: 1 05 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..0 .. ..0 ...... .. ..... . . = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ..... .

.168.1. . Len: 1260 Source Port: ht . . Dst: pc13.... = Differentiated Ser vices Codepoint: De fault (0x00) ...12. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a7e [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. .12.home (192..com ( 74.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.corexchange. Ack: 1 . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.co m (74.tx01. Seq: 63123. = Don't fragment: Se t .0. ... = Reserved bit: Not set .124..1.1....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1ac (61868) Flags: 0x02 (Do n't Fragment) 0.corexchange. Dst P ort: 49574 (49574). 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol....home (192 .168.. Src Por t: http (80)..138) Destination: pc 13.138).124.dllstx0 1.

.. .... 0000 0001 0000 = Flags: 0x010 (ACK) 000.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xe13 5 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f ....0. . .. ..0.... = Nonce: Not se t ...... 0.... = Push: Not set ...... . . = Urgent: Not s et . . .tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 63123 (relativ e sequence number) [Next sequence number: 64383 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ... ... = ECN-Echo: Not set . ... = Reset: Not se t .. ... . = Congestion Wi ndow Reduced (CWR): Not set ...... = Acknowledgmen t: Set ... = Syn: Not set .. = Reserved: Not set . . . .. ..... .. .. 0 . .1 .... 0... ............0 .. ... .. .0.

!......}. `n.. .@.....J.8* 00c0 34 50 c5 91 8 e 08 87 8b c3 d7 aa 26 b8 92 a3 51 4 P..b 0050 47 a6 a4 a6 2 2 b5 7a dc 8e 3f 6f b3 e6 d6 98 63 G .$.."...light: 2095] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .....P....crb 00b0 c7 49 37 50 9 1 dc 84 08 30 d0 24 94 3f 14 38 2a .0... 0020 01 0b 00 50 c 1 a6 2b c9 58 c0 9e 87 4e aa 50 10 ....J.).Q-2G@ 0040 53 8a 2a a4 4 a 0b 1a 75 86 e5 06 be e3 c6 8a 62 S ..?..... 00e0 7d 66 1e 99 9 a b5 8f 8f e5 f2 3a cf 0c 54 e7 5c } f..... v.. .N.u...t.....U..*|...15.... I7P.@e... 0010 05 14 f1 ac 4 0 00 31 06 3a 7e 4a 7c 0c 8a c0 a8 .c 0060 01 6e d2 ab d 0 03 e9 19 8c 0a 41 2d 49 39 8b b8 ..?o.:...m 0100 5b a9 03 84 8 3 d3 a5 53 52 be 6f ba 8f 5b 89 5d [ ...J.E......-0.a 00a0 e9 81 8e 18 a 8 81 9c 2d 30 84 f7 de cf 63 72 62 ...\ 00f0 2b 5a 8b 9f 7 4 15 13 94 d8 dd 8d 29 a4 a3 e6 6d + Z..:~J|.1....Q 00d0 59 29 8c 54 f 4 ed 21 f3 a9 2a 7c ed c4 93 8e 0c Y )... 0030 00 2e e1 35 0 0 00 62 20 4b 26 a4 51 2d 32 47 40 .b K&.+... .P..1..T. n.....5.*....A-I9.... 0080 97 76 f8 7f 7 d ff fb 92 04 e8 8f f2 fb 2c d2 83 .z.... 0090 4f 7a 60 5a e 4 ea 40 65 ef 4a 0c 84 b1 4a 0d 61 O z`Z.&..T......... . 0070 e0 51 41 29 8 e ad 14 31 f3 9e 31 35 cf b5 55 ca ..... QA)..dx..X.

01e0 0c 33 88 ae 9 f c8 48 93 97 e4 04 3a 9c ad 35 3e .H.Z..[.. ...Ro......'?.7.qsh.] 0110 94 4b ca 5a 1 3 6a 50 c6 37 33 e6 cd 33 55 63 40 ..p... 0140 e4 be ac 04 7 2 ab 4b 55 63 d8 ad b8 88 c5 21 e4 ...{D 0190 e8 7b 28 ac 2 c eb 37 e1 f8 33 14 ae 87 dc 1c 1f .. K. ....:.. .. . .3.........dP.2.....=5Ek.:.....=..u.a...{..<Z<`w1 01d0 d5 4a c0 a4 8 1 be 09 01 b7 a6 80 17 cd 3d cb dc .... 3.....KUc.o.Mc4. 01c0 36 2b 3c 68 b f e3 38 d6 a5 9e 3c 5a 3c 60 77 31 6 +<h..... 0180 82 a8 70 09 1 0 c7 a3 f1 aa a2 00 8f 43 92 7b 44 ... 0130 6e 59 28 75 1 3 5a 02 8c 32 86 ea cb 1b a2 2b ea n Y(u...(.. .Gfv@4 0200 0b 30 ba 08 2 8 8d c4 f8 18 71 73 68 15 3a 4f 5a ..........!.p..+.a../.. .IW..73...>....r.C... 01a0 18 3b 5c 3b 4 8 2a 6e 6a 5a 2b 92 fa 3e 18 fa 68 .jP. ..H*njZ+.Z.q..8..+.... {(.SR....3Uc@ 0120 7a 40 8e 49 5 7 81 a2 97 e0 da 2b ce df 82 61 98 z @...x_... 0150 ad be 71 3b 3 d 35 45 6b 86 31 89 e0 d2 f0 2f 9b ..5> 01f0 0b 0b 1b e8 a f 15 88 7b f8 a4 bd 47 66 76 40 34 ..:OZ 0210 cb 18 bb 75 0 4 db 52 6f 84 27 3f 08 20 c9 d7 fb .. 0. J.8*t 0170 bb ed f4 3b a d b3 0a 64 50 a0 b1 c2 84 3a 2e 09 . 0160 67 3a f4 92 7 8 5f ff 4d 63 34 9f 94 03 38 2a 74 g :. . .\.h 01b0 ad f2 f5 c6 9 8 f2 66 5c 44 ce 61 dd 70 e5 9f f1 ......1.f\D....

. 02c0 cb bc a0 c5 c 4 fc e4 b9 c1 17 09 3e 88 10 e6 7b .. ..[Y..:. ...> 02b0 fe 27 9c ea 2 d d9 e9 e2 4b 06 31 ad 92 42 28 93 ..d.L 0240 0d 61 e9 81 7 0 96 29 01 9c 3d 30 3c 50 cc a3 5f ..0 02a0 92 ad a0 1e 4 0 2c 08 83 f3 42 02 68 26 5c d0 3e .=0<P.).... 02e0 5b 42 7d 2b d 7 1a 5b 59 81 2c d7 bc fb d5 b7 5c [ B}+.iz 0270 2e 94 c7 3c f 2 97 c3 92 29 ee 64 13 04 cd 0a cf ._....*@g..`b. .b..'t 0320 0a 86 00 8a 7 1 dc c8 7c 36 74 4b 70 2e 27 c7 03 ..C.... .. $rm .R..h&\...q.@.L.^..... 0260 f6 b8 ca 5e c 9 82 12 5e ca 63 11 5f 08 0b 69 7a ...x. 0310 b6 4e 73 a9 2 a cd 09 d8 8a ec 4c f6 3a ef 27 74 .{ 02d0 a6 11 49 ad a b a5 bb d3 96 51 af 68 e8 f4 4b 1c ...t.K.. Ns. 0280 0b 80 62 84 9 3 20 24 72 6d 20 0c 04 08 cd a0 b3 .YG..*..h..'.|6tKp.......>..B.. 0230 d2 83 58 4a 6 0 5b 06 2a 40 67 0d 4c 0c 64 b5 4c ....YE.@.\ 02f0 63 eb ea 9b d 5 e7 a8 d6 97 59 45 94 b1 c1 f2 67 c .1... ...Q.._ 0250 a1 7f 52 14 0 e d0 f0 e5 39 4a f4 f8 60 62 00 b2 ...g 0300 24 d0 78 9a 9 4 08 3a e2 ec 43 fa 59 47 f0 c7 bb $ .9J..0220 08 ea 06 41 f 9 a1 00 ff fb 92 04 e6 8f f2 e5 2c ..K......c.^...B(.......... . 0290 31 91 1b 90 4 0 bb 74 c2 69 59 3a 26 22 c5 f8 30 1 .:.... 0330 c7 f6 fe 4c 6 .iY:&"....d. ..p.....I. '.-. a.A...)..L... ... ......XJ`[.<... ..

.. 0400 cb c7 10 ae 2 a 36 6d 55 89 82 a9 a4 4a ca 5b e6 .... ..... Z.....0........[...Ljr...1..f...0MvM 03f0 49 6d 23 c0 a 8 35 31 56 e6 02 99 30 d4 91 ff be I m#.... 03a0 8c b2 bc 41 d 7 07 6d 1f f2 fd fd 18 c6 81 ed cc .a.. 0410 c4 46 51 ac 0 1 dd 28 86 c6 10 22 42 c3 df 28 91 ...vgx. .-y...Hj 0430 10 5e 1f b7 1 5 83 20 10 10 79 57 43 6a 94 2a 51 . 0380 6e 61 87 20 2 e 38 2a 21 4d 28 20 62 d8 40 e3 11 n a..P.O<j.$N+.6Ee.M..... 03d0 ed 2c d5 03 0 f 4a 60 61 65 1a 90 61 e9 4a 0b f8 ...?....^... 0360 a8 e1 90 c7 1 d 67 ab 77 e5 1d fb 97 5b d9 c3 e4 . ....J...Mj."B.51V.J`ae....8*!M( b... 03b0 26 e7 19 19 3 7 c7 93 0c 0c b3 c8 3f db a5 f9 b6 & ..7.l...*Q 0440 4c 20 89 72 2 5 10 c5 39 d8 fb c4 .(. 03c0 3f bb f7 00 d b af e7 3f fe ff fb 92 04 ea 0f f2 ? ..m. ...Ar..= 0350 37 ee cd b0 e f 6c d9 76 67 78 aa c7 24 4e 2b 08 7 .._.=.... .... ^. 03e0 91 5a 0c 3d e 9 41 72 16 6b 41 96 19 30 4d 76 4d .a 72 9c 6e b3 c9 e9 d3 26 c2 0c 01 .Hf..n. 0370 15 2c 4d 1e 2 1 6c 41 05 0b ac ad 2d 79 9f a5 eb ..yWCj.[. 0390 17 14 48 66 0 9 c9 db 4d 6a 15 15 36 45 65 18 80 .!lA.J... . 0420 94 5e 1a dc e f 50 e9 b8 31 ae 8c 5e 8e ea 48 6a . ...A. FQ...w......&..*6mU. ^.kA.@. .... bRD.. 0340 d0 62 52 44 8 d 5f 88 66 97 4f 3c 6a 0f d9 d7 3d ...(.g.?.. ..

.!%a..?yG..jD... 04d0 9c f4 ea 25 4 9 3a 54 f3 86 5b e7 db 13 86 9b 3b . . 04a0 98 ca 5e a7 3 9 03 68 da e3 c3 08 96 ea 4d 7d f7 ..c.h.... 04f0 a8 e1 2a f2 c b 49 2a 4d 92 3f 79 47 08 20 12 82 ..+.. No..s. 0500 53 82 af 31 b 0 9a 64 03 af 01 a2 40 ff 63 d2 e7 S .w.. ..Ky..Q.]40.....uc.%I:T... 04e0 55 a5 b2 4b 7 9 cc d6 73 b4 d1 32 1e 59 2d 52 0d U ..I*M..NPZ..M.un..% 0490 7d 76 cc eb 7 5 6e e6 75 63 b3 df 23 50 95 06 dc } v.xWQ 0520 5f 2e _ .. 04b0 63 d1 98 cc d b e6 c1 49 20 9b 89 88 dc 56 a0 9e c .%+3e.V. 0450 e6 af 5d 34 3 0 e4 4e 50 5a 00 5e 42 cc f2 f9 18 .p6&!.......M}. Time Source Destination Protocol Length Info 106 3...I ..hD.&...... .[.951327000 pc13.e1 77 cd c9 b0 L ..1..^B...{<.Y.Y-R.. .^. .com TCP .cor exchange. .B.. ..home cust-74-12412-138..*.. 0460 1d 05 dc fa 1 c 8c c6 6a 44 90 26 90 4d 04 05 c1 ..2..dllstx01..}"r0 0480 38 f9 89 16 8 7 7b 3c cf 2b d0 dc c5 af 59 f4 25 8 ..#P... .. 0470 94 cc 0e 91 6 3 8c 84 25 2b 33 65 e6 7d 22 72 30 .. ...........r%.c.. 04c0 b7 c1 20 b2 1 1 a8 68 44 c4 89 51 86 1b 42 d3 2e . 0510 44 d4 21 25 6 1 09 8d 88 70 36 26 21 84 78 57 51 D .d.@.9.9.

000175000 seconds] [Time delta fro m previous displaye d frame: 0.54 49574→h ttp [ACK] Seq=1 Ack =64383 Win=39796 Le n=0 Frame 106: 54 bytes on wire (432 bits) .00017500 0 seconds] [Time since ref erence or first fra me: 3.001257000 s econds [Time delta fro m previous captured frame: 0.port == 80 || http 2] Ethernet II.001257000 Romance Standard Time [Time shift for this packet: 0.951327000 sec onds] Frame Number: 1 06 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 . Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78). 54 bytes captured (432 bits) on inte rface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.000 000000 seconds] Epoch Time: 141 5615217. 2014 11:26:5 7.

.... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .home (192...11 ).1... . . ....... ..1..138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. Dst: cust-74-124 -12-138.. .12..... .0. .... . ... . = LG bit: Globally unique address (fac tory default) . ...0....... ....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f40 (20288) Flags: 0x02 (Do n't Fragment) 0...... ..0.:01:3b:d0:17:e1) .. . .. = Reserved bit: Not set ..co rexchange.0 ... Src: pc13 ...... = Differentiated Ser vices Codepoint: De fault (0x00) ...... = More fragments: No t set Fragment offset .. ....... ...... = LG bit: Globally unique address (fac tory default) . . ..0 ..... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.com (74.dllstx01. ..168.. .. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ..1 24. = Don't fragment: Se t . .. ..

= Nonce: Not se t . .. . Src Por t: 49574 (49574). com (74. = Push: Not set .:0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13......dl lstx01. ..138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol...... . ... 0 .. ..124. ...... Ack: 64383 .. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 64383 (r elative ack number) Header Length: 20 bytes ..168. = Reserved: Not set .11) Destination: cu st-74-124-12-138. .. = Acknowledgmen t: Set . ....0. D st Port: http (80). ...corexchange....12.....0..1 . .1. Seq: 1..... = Urgent: Not s et ... . . = ECN-Echo: Not set . 0....0 .... ..ho me (192. . ... = Congestion Wi ndow Reduced (CWR): Not set . . 0000 0001 0000 = Flags: 0x010 (ACK) 000... . ..

....0...com pc13.E. 0030 9b 74 18 d4 0 0 00 ..P.+.N.. t.P.. = Reset: Not se t ..... .. 0010 00 28 4f 40 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c .. = Syn: Not set . .0 = Fin: Not set Window size val ue: 39796 [Calculated win dow size: 39796] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 105] [The RTT to ACK the segment wa s: 0.0.dx.corexc hange...].. ..000175000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ..dllstx01. (O@@. ... .home TCP 1314 http→49 574 [ACK] Seq=64383 Ack=1 Win=46 Len=1 260 Frame 107: 1314 byt es on wire (10512 b its).`n.. ..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 5d ac 50 10 ... ... Time Source Destination Protocol Length Info 107 4. ... 1314 bytes ca ptured (10512 bits) on interface 0 .024721000 cust-74-124-12138..... No..

... ...074651000 Romance Standard Time [Time shift for this packet: 0.024721000 sec onds] Frame Number: 1 07 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ....port == 80 || http 2] Ethernet II. ...0 . .....Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. ..073394000 seconds] [Time delta fro m previous displaye d frame: 0. . .... = IG bit: Individua . .07339400 0 seconds] [Time since ref erence or first fra me: 4.000 000000 seconds] Epoch Time: 141 5615217.. ..074651000 s econds [Time delta fro m previous captured frame: 0. 2014 11:26:5 7. ...0. . = LG bit: Globally unique address (fac tory default) ... .... Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)..... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .

.. .1..138)... ... = Differentiated Ser vices Codepoint: De fault (0x00) .. Dst: pc13. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..co m (74....corexchange.. ..124..... . ... ..dlls tx01..168....... .. . . .home (192 ..... .. .12...1. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a7d [validatio n disabled] [Good: Fals ... ....0 .. ..0.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . = Don't fragment: Se t .0.....00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1ad (61869) Flags: 0x02 (Do n't Fragment) 0. .. = LG bit: Globally unique address (fac tory default) . = Reserved bit: Not set . Src: cust -74-124-12-138.

.. .. .0.. Seq: 64383..... = Acknowledgmen t: Set ..e] [Bad: False ] Source: cust-74 -124-12-138..... Dst P ort: 49574 (49574).. ..home (192. 0.0. .. Src Por t: http (80). . .. ..0.. = ECN-Echo: Not set .124. . . . = Reset: Not se t . 0 . = Syn: Not set .. = Urgent: Not s et .. = Reserved: Not set ..0 ............. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. .. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 64383 (relativ e sequence number) [Next sequence number: 65643 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ... .. 0000 0001 0000 = Flags: 0x010 (ACK) 000. Ack: 1 ..... = Push: Not set ... .corexchange. .12. = Congestion Wi ndow Reduced (CWR): Not set . .....1... .... . .138) Destination: pc 13.168. 0...1 . = Nonce: Not se t .com ( 74.. .dllstx0 1.. ......

.... `n.A......P..l.. 0040 34 a1 3f 6b 3 1 31 91 1f 30 e9 08 d4 40 90 5d 63 4 ..1. 0030 00 2e 66 11 0 0 00 f6 44 e2 dc 41 cc 0e 9e d9 e2 . .M.BRd...9..0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x661 1 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ...#.?k11.D. .....{ 00b0 05 87 00 28 d 3 73 96 41 4e d2 5b .f. 0090 10 61 29 4a 0 b f1 09 62 07 98 4b 89 6e 11 2c 80 .A._.).....h 0070 24 15 c2 bf 9 e 29 8f f0 af 4d f8 c2 1b 23 e6 ff $ ..].b..... . ...@....0.||-.P...N.+. ...... 0080 fb 92 04 eb 0 f f2 f6 1d d8 03 09 42 52 64 05 1b ....... ...... .. .n....' 0060 7b 25 df 05 b f 3f b3 6c dc 41 02 9b 67 f2 0a 68 { %. ..K..43...@.E.. 0020 01 0b 00 50 c 1 a6 2b c9 5d ac 9e 87 4e aa 50 10 .z... 0010 05 14 f1 ad 4 0 00 31 06 3a 7d 4a 7c 0c 8a c0 a8 .g.]c 0050 d4 f4 1f 5f b 7 7a a9 a1 ce d7 39 f2 d9 f1 eb 27 . 00a0 f4 99 28 3b d 8 d7 34 33 ed 7c 7c 2d 16 ca ae 7b .(.... a)J...:}J|..?....dx.

.. 00c0 39 44 ac a2 6 4 c0 da 92 80 a7 b4 30 1f 14 81 e1 9 D. .....c.s..*..K. 0160 5b ab fa 91 4 c 05 e3 1a dd b1 dd 2f 45 46 b1 5d [ . ..z...u=..MS.. .e.....*V.G..4.AN.!..R.. 00f0 90 e9 26 c1 a 7 88 80 21 a5 bb 15 30 c9 63 c9 64 .4.[..+..0.{Vup.[.R~....>..{s.u4 01a0 b3 76 8e d0 f d 2b d6 b3 af b0 e6 da d3 3e ea 4a ...+.?f 0140 2c cc ce fd f e af 52 7e d6 e8 7b 73 e7 6a d6 95 ..&..j....Hu%.}._l. 0130 e4 a7 a6 f4 3 4 74 22 d8 e2 4d ea f6 2a 9a 3f 66 . 0110 a4 58 e5 34 c f 47 a2 ec 17 85 f1 f8 75 3d 1f 48 .B.9.. ..... X..$&HvU. v...0.....E..8 0180 69 b4 d3 8b 7 3 93 8b 92 7a 9d 34 b5 02 2b a0 92 i ..... 0150 3e 80 9b 4a a a 45 85 52 d5 d3 a5 5d 7f d7 db 03 > ./EF. .&.s...4t".M. 00e0 3f 89 99 48 c e 24 26 48 76 55 ab 7b 56 75 70 99 ? .J.. .J 01b0 9d 94 48 75 2 5 9d 80 dd a4 b6 c5 ff 5f 6c b4 ea ....TJ.H 0120 1d 17 a8 a7 3 2 ad 42 8a 69 bb 89 fd 0a 43 ed ea .].d.. 01c0 6a fe 59 31 0 3 2c 88 b1 86 63 4c d4 c2 84 8c 31 j .] 0170 b0 b8 4d 53 d 5 b1 54 4a 9a 5b a1 9c 23 e9 dc 38 . .....H....C...i...*..6....2....8. ..d 0100 58 1a 36 d6 0 c 7f bb fd 65 b3 30 e2 81 42 03 88 X ...d.....11 2a 56 90 81 ....s.. 00d0 f2 13 0d 38 e b 26 06 95 9a 2a a9 0c cb 0a 73 a6 .0..#..(.L...B.. 0190 56 8c 4b d7 6 4 bd b0 8f 0e 9c 39 04 7d 13 75 34 V .

...3" 0260 16 44 3b 3a 8 e db 41 6d b5 59 93 6b a6 14 31 c0 ..E 0220 6b ff fb 92 0 4 eb 0f f3 12 27 57 03 2c 32 52 5b k .Y1.8. 0240 aa c1 87 b1 3 0 eb 59 a1 23 10 1e 59 71 d4 64 1e .5.......V......\..=....... D...(.T.]. 0250 86 cc b4 12 1 0 0d 96 da ca 34 dd 1c 2a f5 33 22 .....a(J.:.*.5.'W.. q....P.... D...Am.uN.y 0280 42 94 7f 0b 7 5 4e ca bd 71 87 be d3 5f 7f 3b ec B .z. 02a0 80 71 ca a5 4 a 5b 96 10 d6 5d cc dd f4 ac 72 60 .. 0210 60 19 d0 18 9 8 50 44 1d bd 65 0f 35 c9 59 95 45 ` .e.1.*..(.q. 0270 76 b3 c4 2f 4 a 65 98 5a 72 51 48 f5 e1 09 cf 79 v ./Je.ZrQH..d...Y..c.....2R[ 0230 24 7a f0 61 2 8 4a 0b 5c 9d 56 0d 3d 89 41 7e 14 $ z..S 01e0 cd 44 fa 2a 8 9 9d bc dd a2 a4 7a d5 50 83 8f 01 ......J.)... .PD.._... 0290 7f 57 29 ba e 4 d2 d7 9c cd ff b5 b3 2e f7 8d d6 .r` 02b0 6e a6 51 26 6 2 41 63 11 38 8d f4 54 05 26 05 1e n ..0..... 01f0 17 de 28 a8 e 6 9d 89 93 96 18 29 9d f5 5c 50 8e .J[..&.. W). ..#....nW.w.cL..1 01d0 d1 47 5a 05 1 4 71 05 22 51 50 74 27 dd 9a 8a 53 .......(...q. GZ..A~..Y.. .Q&bAc. .Y..4.aC ...Yq...w..k...B.. 02d0 cf f8 4a c5 d 1 90 ac 6e 57 c3 1e ca e6 15 61 43 ..\P.. 0200 7f 16 f5 1a 7 7 a8 d3 f6 d8 ba b3 d3 35 98 28 d9 ... 02c0 28 b9 95 b7 1 3 63 f9 91 86 28 ae 42 8e 77 9f ee ( ...."QPt'.. .....

.L.%...b.. 0330 d3 dd cd 55 1 1 ce e9 86 05 b3 39 88 fd 65 52 23 ..9. 02f0 66 8b 25 f7 9 8 5a 9a 69 fc 5a 6e f5 d6 e6 b6 31 f ..U..1 0300 8f ad 4f d7 4 c d9 7a 85 8b 2a e9 cc 6a 15 f5 50 ...... .c 0390 0d d3 72 e5 1 d 56 35 4b 16 4e 45 c1 6f 82 fc 79 .i.. 03b0 b3 7d a7 a4 5 d 4f 7f af 4d 63 fc 53 3d 9f 4f 49 ...02e0 2e 5f a9 d4 5 6 8c e6 f9 77 bc da 25 e2 56 8f 99 .j.j.y 03a0 23 9c b2 e0 d a a4 7b 0d f3 2a 92 7d c2 8b b8 99 # ..w.k.Z.D.]O.z..S#...S=...n5. 0350 16 14 52 35 1 a 53 23 98 76 97 67 d0 fb 6b de 69 ....O.P 0310 31 23 9e be 8 7 9e 30 e9 7e 51 35 af a6 90 e8 8d 1 #. }.....pr. 0370 6b 0a 8a 41 3 8 ad 62 22 45 08 20 0c 9b e4 ca 0b k . :....a.....OI 03c0 07 36 20 ff f b 92 04 ee 0f f2 fd 27 d5 03 2f 62 ...b"E.i...V5K.A8.f. 0320 f3 4b 80 a6 6 9 0e 62 f8 a3 6e 35 d8 24 6f 43 10 ...@.$oC..*...'. _.P..p. ../S.r.v.3./b 03d0 50 67 26 3a 8 0 61 ec 5c 0c 44 b1 50 0c bd e9 81 P g&:.0.....Mc...~Q5.}.R5. .\. .eR# 0340 6f 2b 1b 13 a 2 01 a4 00 d0 fe 18 70 72 17 33 80 o +.. 6 ......%..g..NE.... 0380 16 3a c2 12 9 1 40 be 1b a8 7c 15 13 50 fd a4 63 ..Zn.. j.. K...P. 03e0 84 9b 6a 01 9 7 a1 70 95 2c 9d 66 92 2f 53 18 bf ..|..w9...... ..V.i 0360 e9 6a eb d3 e e a6 fe e2 79 61 d1 e3 0c 77 39 db ..o. 03f0 a0 b9 61 d2 4 ..ya..*. .V..{....

*._M..s 0490 f5 48 d7 c6 3 f f9 6b ce ff ff 75 dc 98 b4 25 60 .?.B 04b0 33 a5 21 85 b 1 f6 00 aa 8d 29 50 ae d6 d6 31 4d 3 .b"..`8fn 0470 a2 e0 ec 37 0 4 cd 41 15 7a 3a 5d 78 12 62 22 b6 .1M 04c0 05 bb e5 84 3 4 5a 9a 50 4c 8f 8e 34 be 9e 99 e4 .$.{. ....X.)P..t.. 04d0 bc 77 97 57 a 9 24 e3 db 12 56 15 7a 99 bb 2a d6 .XU.P.4.p..........0.b<. H..../Ye 0460 35 ca 67 b6 9 5 58 a2 f3 ee ea dc 81 60 38 66 6e 5 . 04e0 b7 03 05 cb 1 1 ea 4e 72 b2 90 7b d0 82 28 5e 97 ..W.A..IcX. 0450 09 60 28 02 5 f 4d 17 7c c3 35 a0 92 2e 2f 59 65 . 0480 0a b2 22 9e d b b6 31 88 91 e0 a8 35 89 7c f0 73 .uN.. w..5.1.v.....a.[...8.P 0400 06 a8 dc 58 5 5 12 a2 25 43 f0 62 3c 8e f9 c2 29 ......B..0....u...7. ... `(..%` 04a0 61 bd 76 c3 b 9 cd 54 7f ba fd 1a 50 1b 00 aa 42 a ..cQ'W 0440 5d 2d 85 19 7 5 4e b1 1a 05 89 00 92 6d ea 29 09 ] -... ..'. 0430 9c 47 6a 4f d 7 ab 30 c0 30 2c c0 b8 63 51 27 57 ... ...... 04f0 70 28 b0 de b 3 42 b5 fa db cc a4 70 d7 69 47 52 p (.iGR 0500 c3 8e 15 4b 4 4 08 ff 6d 2a 2f 31 ...%C..|..V.@.k.4Z.... ..g.z. .m..S..9 63 58 01 93 0b 96 95 40 d6 c9 50 . ."....(^... .......g....Nr... GjO.!..z:]x..5.|.T..) 0410 ce d9 96 e7 a c 67 a6 03 90 87 74 e0 38 ca 27 9c .)...R*. 0420 be b7 84 f7 5 2 2a ab 5b 1d be 9e 53 fd 86 b6 dd .PL..

.dllstx01.04843700 0 seconds] [Time since ref erence or first fra me: 4.m*/1.f..com pc13. 0520 06 b4 .corexc hange..000 000000 seconds] Epoch Time: 141 5615217.. 1314 bytes ca ptured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.123088000 Romance Standard Time [Time shift for this packet: 0. .123088000 s econds [Time delta fro m previous captured frame: 0..073158000 sec onds] Frame Number: 1 08 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] .Ra<. .(0.82 0c 66 cd a2 .. .home TCP 1314 http→49 574 [ACK] Seq=65643 Ack=1 Win=46 Len=1 260 Frame 108: 1314 byt es on wire (10512 b its).048437000 seconds] [Time delta fro m previous displaye d frame: 0. 0510 69 8b 52 61 3 c 19 10 00 80 20 d2 e0 a8 28 30 1f i .. Time Source Destination Protocol Length Info 108 4.KD. No.073158000 cust-74-124-12138.. 2014 11:26:5 7..

... ..12.co m (74.. .port == 80 || http 2] Ethernet II.. . .. ..138).... .home (192 .. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. Src: cust -74-124-12-138. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... .......... . .......... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .124.. .. = Differentiated Ser vices Codepoint: De fault (0x00) .. = LG bit: Globally unique address (fac tory default) . .. . .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..[Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ....0.corexchange.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.0..... ..dlls tx01. . = LG bit: Globally unique address (fac tory default) ... .1.... ...168.. ... .. Dst: pc13.. ..0 . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)..... .0 .

...168.... .com ( 74. Seq: 65643.. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 65643 (relativ e sequence number) [Next sequence number: 66903 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) .dllstx0 1.00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1ae (61870) Flags: 0x02 (Do n't Fragment) 0.138) Destination: pc 13.home (192.1.. . Ack: 1 .124. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a7c [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138..... Src Por t: http (80).1.. = Reserved bit: Not set . = Don't fragment: Se t .0... Dst P ort: 49574 (49574)..12...corexchange..

= Congestion Wi ndow Reduced (CWR): Not set . ..1 . .:|J|.. .b.. `n..1.... 0.. .. .. .P...+.. . ... .... 0 . ...0....0 . . = Push: Not set .. 0...... .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0xe1b e [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2520] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..... = Reset: Not se t ...... = Nonce: Not se t ..Header Length: 20 bytes ..E.... = Syn: Not set .. = Urgent: Not s et ..P..0.. ......0. 0010 05 14 f1 ae 4 0 00 31 06 3a 7c 4a 7c 0c 8a c0 a8 . .dx....... = Reserved: Not set .@.. ....... 0000 0001 0000 = Flags: 0x010 (ACK) 000.. .. 0030 00 2e e1 be 0 0 00 11 27 34 dc 52 e9 c0 8c b9 30 .... . . . ... ... .. ..N. .. . 0020 01 0b 00 50 c 1 a6 2b c9 62 98 9e 87 4e aa 50 10 . = ECN-Echo: Not set .... ... . = Acknowledgmen t: Set ....

.....R.....q 00d0 4e c2 1c 73 c e ab 3d d6 b5 0e 03 54 6f 9a b8 34 N .d 0120 5c 9c 8a 7b 3 1 70 c2 36 95 ad 87 9c 53 b9 f3 c9 \ ..2nK.Rb....R..&.=.. P.p...8 0090 b3 50 0c e1 e 9 89 79 98 e9 c1 97 a1 70 e5 42 19 .....4 00e0 fa cf 84 7c 2 f 85 64 90 75 17 51 b7 e5 6e 7d f3 .....6.J.1..o3. '.a.. 00a0 e8 d6 d2 a6 e 3 ba 05 4e 25 18 ca 11 86 18 49 05 ..Y.M. .. ...s. 0070 75 2b c9 52 f 0 fa b2 67 84 ff fb 92 04 e8 0f f2 u +...n}. .R.j..d.r1....@).u. . ZX/.P 0110 27 d9 af fc 6 a 81 12 8c 32 44 8a a1 0e a1 16 64 ' . xS...To..'4... 0060 b3 4a 2a 86 3 d 4f f5 e8 72 31 ae b7 8c be e7 bf .[$...N%.. 0080 de 27 d4 83 2 f 7a 50 57 84 fa 80 61 ec 4a 0c 38 .E 0100 92 0e c0 3a b d 5b 69 fe b0 b0 31 a1 24 cb 85 50 ..|.... 00f0 a8 85 81 d3 c 1 e5 91 52 02 81 f3 60 c3 9c 81 45 .y..0 0040 30 06 4a 31 e 1 1e e6 7c 07 3b 5b 24 17 e3 7e 33 0 ..{1p.. J*.#...|/..$.S.Q......B.g..=O..`. s.... .. 0140 dd 78 53 2e 9 4 52 62 95 ae 2f a8 6f 33 0a f6 be ...I. .[i.2D.. 0130 c5 89 26 be 8 6 3f 2e cf db 89 50 f8 7f 2e ec d8 ....J1. ........./zPW..:..V9 00c0 1e 0c 4d a8 c 4 a1 8e 32 6e 4b ed 40 29 d1 11 71 ..?..~3 0050 e2 73 83 a7 9 7 20 5a 58 2f d5 0d ec 1e 23 1c bd .../.... ..... 00b0 d2 86 1c f5 e c 33 6c 45 8c 59 84 b1 86 01 56 39 ........P....3lE........

0250 1c 2a 4b 03 9 9 89 80 83 14 15 4d 50 c9 3d 0c 1f .nQ.3}..Q 0190 18 5a 2c 6e 5 1 9b ed 76 f3 fc aa b4 75 72 b3 2a .... Z.. ..... 01e0 b1 80 96 da 9 2 40 a1 96 49 c4 02 ae 66 6f 20 d0 ....(. .d.ur...y.k. 0200 4a cc 6a 04 3 8 4b 1b 49 c7 8d 98 ef dc 6b ec bf J ......I.jc... .u|G.......kt.*1S..(EQ...gw.. 0.0150 77 0d 5d fe a 0 d7 19 d5 22 ff f1 b9 75 7c 47 f7 w ......7 0170 2d 04 09 dc b 0 91 24 d1 0d 82 31 b1 1b 52 86 9e ...... 01f0 54 c3 6a 63 0 d 06 9f 32 53 4c 83 16 93 2a 17 90 T .........R.@.].j..*.8K.b.y 01b0 6d 96 87 b6 f a ae f5 a9 a3 ff eb 9b e7 30 bf fe m ....* 01a0 97 56 f4 28 a 0 67 77 bb 96 6b 74 fe 2f 4a da 79 .... ....I..1. *q._..J..MP....2SL..=.".. ...=pm 0240 39 e6 1a 16 2 2 c8 62 a7 18 0c 8a 64 7f a7 f5 81 9 .0.J.m...$...H.. 01c0 bf e7 12 ea e 5 33 7d 0e 5f f6 e8 06 0c 00 98 31 ..pg.^..v.J 0230 0c 30 b5 4e 0 d 3d e9 81 84 18 e9 c1 8c 3d 70 6d .1 01d0 e1 8c 4a 83 1 8 d0 da ab 09 12 02 04 05 54 61 ca ..".. 0260 98 e3 5e 91 c . 0180 95 f2 d9 3d 3 0 93 a0 48 ac 79 c1 79 1f 4a df 51 ..=.N.4*....Ta.y.. *K. 0210 36 63 61 7a d a f0 6d 07 5e b8 ce ff fb 92 04 ed 6 caz. 0160 15 2a 71 b9 3 4 2a aa b9 aa 28 45 51 08 c1 cc 37 ....=0......fo .. V...... 0220 0f f3 2a 31 5 3 83 4f 4a 60 62 44 aa 70 67 0f 4a .OJ`bD../J.

...".U.. 02d0 cf 0d a0 9b b 3 99 30 4f 96 ec 93 f6 d7 a4 bb b5 ......7 55 0a 00 23 33 f2 92 8c 39 98 4d .. 02b0 43 c2 c2 c1 4 6 0c 5c 60 13 24 80 22 11 90 ba 69 C ..[ 0300 5b ab fc bf 9 f 3f 89 fa 7a bf e8 04 80 30 69 c6 [ ....... ... . 02a0 dd ac b1 67 9 0 19 7d 2a 12 a9 94 31 4a 79 8a a4 ...[. |..k. .. 0340 35 86 bb a2 8 f 19 4f f6 9b 66 0d e3 67 55 6b db 5 .gUk.0O....?...~^.....#3....'. ~u#.......D. T.9.?0 0290 99 7e 75 23 b 7 6b 6e a0 ee 6e 6d 28 f5 ff 26 db . 02e0 0d 92 e7 19 3 7 a6 a6 47 cc 13 bc 0e 91 ee 68 d4 .O...w.g.^.i 02c0 83 08 4f 8d 0 2 2d 26 43 4c e7 7e 5e 95 80 da 8c .}*.A*{.. 0310 55 83 86 00 8 5 82 01 b2 64 3b af 73 1b 0c 20 a1 U .G..... 0280 0d 06 77 fc b d 4a 49 23 0e cb 36 85 e2 b6 3f 30 .....kn...}..nm(.$.O.z..<...F. . .M 0270 43 d1 58 e4 c c b5 bb 3c b4 f4 df 2d 64 37 aa 96 C .?n4.s.-d7...V(n..d.. ..0i..... 0330 f4 a4 a5 91 c 6 27 88 53 fd 08 56 28 6e ad 20 d8 .. 0320 72 cb 80 d5 0 1 86 1b 12 e0 71 ad 3f 6e 34 19 cf r . 0360 12 4a 3e 48 a 8 41 2a 7b f4 55 4d 53 3a e9 7d 88 .-F..UMS:.. 02f0 f5 54 1f 6b 8 d da cf 89 2d 46 b7 4f 15 0b 7f 5b .....7....JI#.S. MyDoc | Transmission Control Protocol | Internet Protocols

. 0370 57 8d 1a 3b c 1 47 cf 91 1c 32 c4 ..&. . J>H.O...X.f.1Jy..-&CL.q. 0350 e6 7c d7 1b e c 13 44 a6 31 9f 89 5b 0d 95 10 10 ..h....6.. ...1... ....

..s 0390 28 0e 1c 82 5 3 fe 27 2f 70 6f c4 8f 61 1c c2 57 ( .Y..9.Y?.U.... 03e0 28 3d a0 e6 5 3 8d 24 25 10 1c 53 85 6e ff ee a4 ( =.`g 03d0 0c 4c 0b c0 c 7 4e 0d bd 6b 81 78 93 a9 41 a7 bd .m] 0430 53 58 5e 4b 6 2 3b fd bc a5 29 78 d3 d7 1a dd b5 S X^Kb.W 03a0 c2 55 ea ec 5 9 3f a3 7c 51 76 ef f6 c7 0a e1 eb .-..G...S...t...2..S. F.. L.).>......_S^. 0440 0d 83 5f 53 5 e 98 f3 67 ef db 39 af 9e 5e b6 18 ..(.k. 0400 27 83 49 f3 0 0 e4 04 53 30 78 7a 33 95 f2 39 05 ' .2...LJ. 03f0 78 46 b2 63 a e 38 72 80 24 a2 5d b4 b4 a0 0f 14 x F..i.G..g. 0420 5c 23 28 29 7 5 86 f7 26 f4 2d f9 cd 1b 18 6d 5d \ #()u..9S.........)x. U..<.< 0480 93 c0 cd 52 8 e 3e 36 00 83 2d f5 76 42 81 c1 92 .. ......8r.^...$.&..x.I.... .M7.......... 03b0 5b 6d 29 0e 3 c cf ff d6 3e a1 4d 37 d5 ff fb 92 [ m). 0410 62 14 39 53 8 a d3 cd 10 69 15 68 95 19 eb 1d 89 b ..*..`.n. .. 0380 43 28 57 93 9 1 f5 59 14 47 d8 ad ff 75 69 2c 73 C (W..$%..c...'S....ui.. 0450 65 4f e9 29 8 0 28 c0 60 b4 c5 cd 4c 4a a0 c0 40 e O.9....KYu 0470 cc 11 1b 09 5 5 f4 e1 8a cc de c2 30 bd da c3 3c .OzP]... 03c0 04 e7 0f f3 0 1 27 53 83 4f 7a 50 5d e5 8a 60 67 ..|Qv..@ 0460 86 46 0c 74 c 8 bb b4 00 32 ca a5 2a 0f 4b 59 75 .11 fd a8 15 be W ....a..'/po.... .N.S....A.]..h..S0xz3...0.

54 bytes captured (432 bits) on inte rface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N .c>d#.mI. 04d0 ac 1e 03 a9 5 b 15 b4 14 24 d0 3e 08 aa d7 81 45 ......tC..Wa 0500 e8 94 b1 c7 0 c b1 42 06 01 c9 61 2e 52 95 4b d6 ..b..(FB... 04b0 55 00 a1 01 7 4 46 a6 18 28 46 42 a5 1c 14 42 11 U .8 04f0 a7 bc ae 44 e 4 2c 6d e9 82 c8 df 51 79 ca 57 61 ..Dwk.B.$..home cust-74-12412-138........$. .2./.. .m.D. )... 04a0 8e 29 8e f2 f 2 ad d7 2f d8 02 30 c5 d7 32 ed ab .k: 0520 86 92 .......Qy... 0510 12 0a d1 0f 0 5 63 3e 64 23 80 b8 62 0e c4 6b 3a .. Qn. ..tF.F.. 04c0 9f 51 6e 03 0 c 24 a3 74 43 08 ff 30 43 7e 47 c4 ... ..P...com TCP 54 49574→h ttp [ACK] Seq=1 Ack =66903 Win=40005 Le n=0 Frame 109: 54 bytes on wire (432 bits) ..a. 0490 73 d9 50 d7 f 4 c9 89 ee 39 d6 f2 e5 1c 8b da 0b s .>..>6....0C~G.[..9.E 04e0 49 cd 41 20 f d 46 1c 2c 6d 49 d5 44 77 6b 91 38 I . Time Source Destination Protocol Length Info 109 4..0.R.B...vB. No.cor exchange.K. ..073332000 pc13....R..A .dllstx01.-..

.. . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ... . ...123262000 Romance Standard Time [Time shift for this packet: 0..000174000 seconds] [Time delta fro m previous displaye d frame: 0......123262000 s econds [Time delta fro m previous captured frame: 0.0.. . . .. 2014 11:26:5 7... ... . ........ ...073332000 sec onds] Frame Number: 1 09 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . .0 .0..000 000000 seconds] Epoch Time: 141 5615217.00017400 0 seconds] [Time since ref erence or first fra me: 4. .ov 10..port == 80 || http 2] Ethernet II.. = LG bit: Globally unique address (fac tory default) ... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)... .

.... = Reserved bit: Not set . .. = Don't fragment: Se t .11 ). .. .. Dst: cust-74-124 -12-138. ...0.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ....co rexchange.1.corexchange.1...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f41 (20289) Flags: 0x02 (Do n't Fragment) 0. ..... .home (192....... ...168..dllstx01...dl lstx01...12.... . = LG bit: Globally unique address (fac tory default) ...1. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13. .com (74.. Src: pc13 . = Differentiated Ser vices Codepoint: De fault (0x00) .168..... .ho me (192.0 . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt... .11) Destination: cu st-74-124-12-138.1 24...

. Src Por t: 49574 (49574). ...... = Syn: Not set .... Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 66903 (r elative ack number) Header Length: 20 bytes .. . = Acknowledgmen t: Set .. = Congestion Wi ndow Reduced (CWR): Not set ..com (74. ...0 .124. .... . 0000 0001 0000 = Flags: 0x010 (ACK) 000.... ....... ... Seq: 1. 0.138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol... .1 . . . D st Port: http (80).... 0 ....... . ..0.. ....0 = Fin: Not set Window size val ue: 40005 [Calculated win dow size: 40005] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check . . .. = Reserved: Not set . 0. = Reset: Not se t .12...... ... = Push: Not set ...0..... . ...... . . .. = Urgent: Not s et .0.... = Nonce: Not se t . .. = ECN-Echo: Not set . .. Ack: 66903 ..

000174000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ..g.....P..+.P. ..dx...com pc13.... ..home TCP 1283 http→49 574 [PSH...sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 108] [The RTT to ACK the segment wa s: 0...N.`n. (OA@. ACK] Seq= 66903 Ack=1 Win=46 Len=1229 Frame 110: 1283 byt es on wire (10264 b its).150090000 s econds [Time delta fro . 0010 00 28 4f 41 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ..150090000 Romance Standard Time [Time shift for this packet: 0.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 67 84 50 10 .dllstx01. 1283 bytes ca ptured (10264 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10. E.000 000000 seconds] Epoch Time: 141 5615217. 0030 9c 45 18 d4 0 0 00 .corexc hange.. Time Source Destination Protocol Length Info 110 4..100160000 cust-74-124-12138..E. 2014 11:26:5 7. No.

......port == 80 || http 2] Ethernet II. .....100160000 sec onds] Frame Number: 1 10 Frame Length: 1 283 bytes (10264 bi ts) Capture Length: 1283 bytes (10264 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . . .... . .... .. . = LG bit: Globally unique address (fac tory default) ...m previous captured frame: 0..... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . . = IG bit: Individua l address (unicast) Type: IP (0x080 ........0. . .026828000 seconds] [Time delta fro m previous displaye d frame: 0..0 ..02682800 0 seconds] [Time since ref erence or first fra me: 4. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1). = LG bit: Globally unique address (fac tory default) ... . . ..0.. ..... .... ... .... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .... ... ..... ... .. .0 ...

home (192 ....corexchange.124.com ( 74.0..168..home (192.co m (74..... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ...124. .1.1.. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a9a [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.dllstx0 1.. Src: cust -74-124-12-138.138) Destination: pc 13..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.0) Internet Protocol V ersion 4... 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. = Differentiated Ser vices Codepoint: De fault (0x00) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 269 Identification: 0xf1af (61871) Flags: 0x02 (Do n't Fragment) 0. = Don't fragment: Se t .12. .168. Dst: pc13.138). Src Por t: http (80).1. Dst P . = Reserved bit: Not set .corexchange..12.dlls tx01.. .

.........0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x5fd 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: .. . ... ...... . = Reserved: Not set .. = Reset: Not se t . 0.. . ..0 ........ .... . = Nonce: Not se t ... = Congestion Wi ndow Reduced (CWR): Not set . Seq: 66903. ......... .. .0.. .... ..1 . .. = Acknowledgmen t: Set .0. . . ... . ..... Len: 1229 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1229] Sequence number : 66903 (relativ e sequence number) [Next sequence number: 68132 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . 0000 0001 1000 = Flags: 0x018 (PSH...0... 0.. .. . ... = Urgent: Not s et ..ort: 49574 (49574).... 1 . Ack: 1 . = Push: Set . = ECN-Echo: Not set ... . = Syn: Not set . ACK) 000.. ..

...?.... 00b0 88 89 59 80 9 1 3f 11 35 6e 44 69 22 e6 76 41 58 .7..N.+.4. . .'.. 0040 9c a7 82 d4 8 c ec 7e 29 5d 8c 34 ea 80 28 e2 27 ..@. 0030 00 2e 5f d2 0 0 00 52 51 a7 42 b0 47 59 54 7e 18 ...aIGi.g..vAX 00c0 90 57 6e ac 3 5 c2 7f de ca 58 a3 69 00 b3 88 1a .J|. h$.Z......A......`C._...TV[ 0060 8a 39 d2 6a 1 5 61 49 47 69 ad ac 6d d9 d7 26 75 .. `n..).lv 00f0 c8 95 74 3c 2 b 21 8f a4 12 69 60 41 c9 6a 5d d5 . .. .....Y.' 0050 0f 68 24 07 8 b 51 61 c8 fb c9 9b 43 1e 54 56 5b .nr[Z. 0020 01 0b 00 50 c 1 a6 2b c9 67 84 9e 87 4e aa 50 18 .P.GYT~.:...1...m..P..p. ...i...(.0 [SEQ/ACK analys is] [Bytes in f light: 1229] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 .. 9... Wn.. 00e0 8e 3b f0 78 5 7 34 86 29 ba cc 27 13 37 19 6c 76 ..RQ. ..L..>.. 00d0 3d 1c 8c d3 2 8 08 1f 6e 72 5b 5a 16 60 43 08 ee = .+..Pe. ... ...&R..X.{ 00a0 ad ad 0e 26 5 2 cf b1 ae bb 98 16 0e 70 01 32 99 . 0010 04 f5 f1 af 4 0 00 31 06 3a 9a 4a 7c 0c 8a c0 a8 .(..~)]..j.)..C..dx.Qa.Xz 0080 60 61 a6 1a 5 0 65 ef 4c 0b d4 b3 4c 0d e1 29 81 ` a. .&u 0070 96 c6 14 ff f b 92 04 e8 8f f3 0e 2b d3 03 58 7a .5nDi".B. 0090 76 13 e9 41 9 7 b1 28 17 16 00 3e d2 c6 5a fa 7b v .L.xW4.(....E..5....2...

.z 01c0 62 b0 0c b0 f 8 a4 27 b4 04 80 b6 0a 34 3f 80 9e b .... 0150 d7 6c c3 02 f 9 ad 67 82 8b 9a 0d 0c ef 43 69 6f .X...)F..YN.(..%x.. .n..g......#...j]......B 0110 db 18 71 01 6 0 dd c7 00 1e 2f 4c df 34 b9 f4 b9 .. 0190 15 00 e2 36 a b 51 db 8b a7 eb 84 ae f6 e3 7d 45 ..M6.... 0100 99 e9 5d 82 1 1 31 22 00 a9 f1 6a 0c a6 b4 1c 42 ..%. 01f0 53 d1 08 70 d 8 98 54 7a 61 b0 09 0f 5b 30 27 65 S ..Q.g..6... ..i`A..H..B..u.Tza... 0180 0a 4d 7e c1 6 c 93 24 dc 75 a8 c1 44 8e 8d 6b 12 .$..D..k..a...}E 01a0 24 bf 07 ba e 4 08 b2 d0 23 8b aa ed fa 67 d9 95 $ ...4?...y 0130 40 9c d0 e6 e 1 48 f4 02 29 83 17 1e 49 32 c8 49 @ .. 01b0 14 30 2a c1 7 2 63 03 28 e9 ba 95 62 21 5b cb 7a . h.l.p...j..`.Cio 0160 4c 08 01 91 2 5 78 84 d1 11 af f9 ae c8 d0 25 a8 L ..4....K~./L....1".t<+!.I2...).... 01d0 5b 46 29 4b d 3 59 4e a5 09 8d ce 46 8a 67 33 34 [ F)K..%..........\.b..g34 01e0 86 68 10 a8 c 2 58 0b 86 17 86 cb fd 84 c7 b1 d0 .[C.C....u.... 0170 7c 0a a5 96 b b 09 42 1d c8 61 f9 b4 b9 68 ab bf | ........ . M~. l.... 0*.....b![.F.. 0120 67 e9 b3 3b 7 5 c9 7f 5c 88 25 a8 4d 36 f0 97 79 g ...'..... .I....h..[0'e 0200 4f 92 ed 43 1 5 49 ed ca 3b da a9 4b 7e ea 6e e5 O ..q....rc.I 0140 27 fb d6 da 2 9 46 95 62 84 cf f2 ef 5b 43 f6 aa ' .].

.L......3. . 0260 7d 8a 1f 1d a 6 68 16 0a 80 52 6b ed 84 46 65 8c } ......(.. 02c0 55 0b ac 29 8 c e2 1c 2f cc f4 0b b8 8d 28 e5 11 U ..C3.G.I.N..1(..2...Pg.=).h./..D..<.. 0220 38 62 50 60 4 5 8a 50 67 09 4c 0b a0 9f 4c 0d e1 8 bP`E. 0300 7d 0f ea 0a 0 d 19 cc 8c 12 01 56 46 f1 0a 28 c1 } . An....S8ab...o.(...... 0280 70 86 28 3c a f 57 76 8a ad fb f8 c3 d6 49 fe f1 p ......_.........0210 5c 48 04 b0 5 d ff fb 92 04 e7 8f f2 de 27 53 83 \ H..\].:..V.F+i...ahb!.'S..Rk.p.<.6s.(<...Fe...g 0250 61 60 3d f4 2 0 23 01 43 03 0f 1d fc 62 4d 3a 1e a `=...W.W..). 0310 e0 70 cf 00 4 4 a6 3d 29 9f 04 1c 46 2b 69 c9 51 .. 0230 89 41 6e 13 a 9 41 9c 31 28 3b 0f eb 52 3a 80 40 . 0290 af 97 aa dc f c d6 b4 ce b2 f0 5c 5d 90 32 cc 60 . ..C. p...L.R:....a....Wv. 02e0 57 3c 5b d6 3 6 73 b8 47 d5 1d 2e 71 8f f6 db 7a W <[....VF.. .l*...D..bM:...A.q. #..` 02a0 77 ea 57 81 6 1 d7 44 10 3a 9d 86 61 68 62 21 00 w .. 0270 66 37 92 3c 0 5 eb 33 f9 53 38 61 62 8a 57 c1 c6 f 7..z 02f0 7f 12 d8 f5 8 3 bf f5 6f f7 88 1f 5f 11 e9 3c 04 . 02d0 4a 6f 25 5c a a 56 8f c4 aa 3b 70 9c a2 d1 be 11 J o%\......qW.T2..]..@ 0240 35 26 30 06 1 8 6c 2a 02 03 c0 4e 82 54 32 e9 67 5 &0. 02b0 01 01 43 33 1 3 12 07 80 dd 71 57 8f e6 d7 a1 04 ...Q 0320 6b cd d1 c1 a .....

......I..>. 0390 f2 43 f9 98 a 5 83 48 0f 3e e1 60 ec 85 5c c4 7b .3'..~}..... d...a.... =*..... .G?2 0360 fb 3d 2a 8a 2 f 07 d1 17 ca a7 4d 2d 81 b0 80 60 ..50.4 42 8a 33 27 e6 30 dc 9e e5 b6 cb k ....../.` 0370 c6 41 01 04 5 6 32 e9 33 21 d2 84 2e 88 dc 74 f2 . 03c0 d3 03 2f 5a 6 0 65 65 8a 40 67 0f 4c 0c 20 bb 4a ..t.J 03d0 0d bd e9 81 7 d 98 a9 01 8c 35 30 7f 8f ff ac ce .....H....0. .. HS=52A5.z 03b0 43 9f fd 67 e 7 7e 7d ff fb 92 04 ec 0f f2 ed 2c C ... 0330 9a 0b c4 fe c 2 b8 30 a3 20 64 12 94 51 59 34 82 .*..QY4.Z 0410 00 fe 20 51 b 0 49 13 85 62 1a 07 c7 ab a6 5f 38 ..^+...P.!.....V2.. 0340 88 48 53 3d 3 5 32 41 35 0f e2 7c ea 5a ce ce a0 ..f. . .{ 03a0 5b 5a ec 76 7 8 c1 09 97 c0 d6 f2 f6 f8 89 bc 7a [ Z...9M....g. .. b7...].U...0..\... .vx...|.|.... 0380 32 67 63 3d e 6 5e 2b 8c 21 9e 66 87 ec 45 e1 b0 2 gc=.. 03e0 0d 62 37 ea 1 1 07 13 00 1a 50 a1 2d 8c 01 1f 45 ../Z`ee.3!.a... ........._8 0420 18 0b 86 a9 a 3 76 62 b1 39 4d 05 1e 4a d2 a2 fb ...*c 0400 8e 86 55 c1 9 a 61 08 09 9c a8 7c b6 5e d8 89 5a ... 0350 54 7b bb 2a a 4 f5 da a6 a6 8d e6 5d 13 47 3f 32 T {.@g.b.L.E.E 03f0 be 03 1a 61 f c 0b c1 c2 e4 af 15 e0 3b d8 2a 63 .vb..Z..... Q..-...`.M-... C..}.^. A.B.. 0430 bd 99 4e a7 d 9 94 9b 33 21 5a d6 .J......

J 0470 ce 19 09 90 8 0 20 d4 00 08 8d 68 82 19 9a 9e 5a ....*.k.. .0.$.E....... ...(+6.[...| 0490 30 5d cb c9 6 b e8 a6 53 f2 5f 53 97 97 79 31 c9 0 ].3!Z......|..corexc hange..._S.....qm.. ...h. ...x .N...... ..y1.214166000 cust-74-124-12138..... 0500 dd 53 a9 ... No... Time Source Destination Protocol Length Info 111 4. 0450 03 20 20 94 7 8 e1 99 3c ce c2 71 6d 0c 80 04 07 ..._. .S:\... 04c0 51 94 8e 0a c 6 c0 07 87 cd 28 2b 36 0f 92 ae 4e Q ...N 04d0 41 92 d3 98 b 1 95 80 c0 a1 03 19 08 3f 53 46 dc A ...d|f. .-Y.. . S.U.home TCP 1314 http→49 574 [ACK] Seq=68132 Ack=1 Win=46 Len=1 260 ...com pc13.. 0460 90 8c e4 cf 9 2 30 f1 c9 04 ff e3 a2 f4 c4 89 4a .6\.x.. 0440 bb f7 2d 59 c b 36 5c b5 8e 55 04 c3 ac ac 45 e3 .........<.. 04f0 3e fc a4 94 a 2 86 bb af 1a 04 7c e7 e5 1c 8a 9d > . 04a0 3a 61 39 7d d 9 ac 0c af 5f 82 f0 a3 20 aa 4b 43 : a9}..@.Z 0480 6d 06 19 9d f 5 a3 b3 64 7c 66 fc b7 84 40 83 7c m .dllstx01.KC 04b0 e1 e9 ce 5b c 7 f4 e8 53 3a 5c ec 17 03 f6 24 ae . L..77 6a 28 5b f8 .......... ...|......?SF.wj([. 04e0 66 f5 20 a2 0 c 78 20 10 0c 2a f0 7c d8 20 4c e0 f .S..

Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... .. .000 000000 seconds] Epoch Time: 141 5615217...214166000 sec onds] Frame Number: 1 11 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp . .. .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. 2014 11:26:5 7. ..port == 80 || http 2] Ethernet II...11400600 0 seconds] [Time since ref erence or first fra me: 4. .0. 1314 bytes ca ptured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..264096000 Romance Standard Time [Time shift for this packet: 0.264096000 s econds [Time delta fro m previous captured frame: 0.. .114006000 seconds] [Time delta fro m previous displaye d frame: 0.Frame 111: 1314 byt es on wire (10512 b its)...

.dlls tx01....home (192 . .0 ..138)..co m (74. . . = More fragments: No t set Fragment offset :0 Time to live: 4 9 ..1.......... ..124.. . = Differentiated Ser vices Codepoint: De fault (0x00) .= LG bit: Globally unique address (fac tory default) . ... .... = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . Src: cust -74-124-12-138. ... = LG bit: Globally unique address (fac tory default) .0........ = Don't fragment: Se t ... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.... Dst: pc13.. .. = Reserved bit: Not set . .....0 . ...0....12... . . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00....168...11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..corexchange. .. . ...1. . ...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1b0 (61872) Flags: 0x02 (Do n't Fragment) 0.... . ..

0....... Src Por t: http (80). ... . .. . . . . Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 68132 (relativ e sequence number) [Next sequence number: 69392 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . = Reserved: Not set ..1 .corexchange. ...Protocol: TCP ( 6) Header checksum : 0x3a7a [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.home (192... .. = Congestion Wi ndow Reduced (CWR): Not set .. Dst P ort: 49574 (49574)..124. Ack: 1 . 0000 0001 0000 = Flags: 0x010 (ACK) 000.. .....1.... .. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. . = Urgent: Not s et . . ... = ECN-Echo: Not set ...... .168..0 .0.138) Destination: pc 13..dllstx0 1.0... ..12. = Acknowledgmen t: Set .. = Nonce: Not se t ..... Seq: 68132..com ( 74. 0 ...

. ...... 0020 01 0b 00 50 c 1 a6 2b c9 6c 51 9e 87 4e aa 50 10 . ...1. . 0010 05 14 f1 b0 4 0 00 31 06 3a 7a 4a 7c 0c 8a c0 a8 ........Pe........P. 0030 00 2e 4d 26 0 0 00 10 cd 13 a0 55 83 67 41 69 8d .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x4d2 6 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2489] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ..p.......a..U.W.b.0.lQ... ..:zJ|.. . .. 0040 0e 28 1d e2 7 0 84 b1 61 bd a9 0f d4 b1 a4 b4 23 .j 0060 b5 96 62 9a 1 7 62 bf ca 00 ef 14 8f 30 7a 10 9f ....P. ......gAi.. 0090 e9 0f f2 e8 3 1 53 03 4f 7a 60 5e c5 da 50 65 ed .. 0070 b5 0f 18 af b 1 f2 08 af 36 de c8 ff 57 0c de ec ..... = Push: Not set ...dx......@..... 0... .+. = Syn: Not set .3. . .... `n....0z...Oz`^.6.N... . .I....... = Reset: Not se t . . .'... 0080 30 e5 a0 dd f f 7f ff fe 88 fe fc ce ff fb 92 04 0 .E..# 0050 e2 07 36 ed 4 9 eb d2 27 ac a6 aa 33 ac dc d5 6a .1S. .. (.6........M&.b...

/..)=.F....<. 0140 27 de b4 31 f 4 2f d7 e6 b4 31 4f d0 c7 e9 9f e3 ' ....1qG. q. 00c0 6e 2b a6 37 7 a 15 0c d5 52 e5 c5 51 36 1e 8f 6a n +. 0160 e4 c9 66 1d f 9 5b 47 87 bd af ff fa ed ab ca 70 .A..4 0110 00 71 ea ca 3 b 20 28 d0 6a a1 94 8d 45 60 41 93 . s.m/3K...5.a.. ...oV.j.....V_u...5". c... 01b0 b9 e0 90 26 f .. ..)2. .Q6.....jU.7z..k... 00f0 01 63 ae e8 7 a 1c a0 41 a2 ef 6a 0b c3 0f 01 8b .fK.00a0 4c 0b 94 b1 5 a 0c b0 c9 81 8e 91 ea c1 87 a5 28 L . 0130 a6 ca 18 41 5 1 19 31 71 47 af 63 b5 63 7c fb f3 ... 01a0 04 a9 05 80 9 f bb 41 51 14 ce e7 27 aa 6b f2 95 ..g... 00e0 2c 16 1d d1 0 0 a2 5c e3 bc 6b c1 dc a0 3c c0 82 ..j. 0150 2e f5 a8 ef f d f4 d4 fb 3e 8c ef 29 3d 1c d5 b6 ...c|.%I... 0120 a9 da 67 0f 5 8 e9 d4 cc 35 16 35 22 12 54 b4 cc . .[G.. .. (.....p.AQ. \..1O....z.k.".... 0190 9a a0 f8 11 0 9 41 d2 1a e8 46 c4 6c e8 66 4b d7 ..f.AQ. .. ..p 0170 a3 5c b0 c1 0 4 cb bc c3 e0 56 5f 75 e8 58 66 4b ..j 00d0 b8 ad 03 8a 9 9 aa 65 0d 25 49 8a 29 32 cd 22 ad ... .. 0100 15 e2 80 04 9 7 4a de 0f b5 8e 6d 2f 33 4b f4 34 .X........E`A. \..q}....l..... ..>.....R..( 00b0 fd 73 fb 34 0 4 70 ff f0 b5 c3 c4 6f 56 e8 61 ed ..e......XfK 0180 00 5c ac 86 9 0 6a 55 13 ed 16 0e 71 7d de ba 93 .A.'..1.......4.T.J....c.....Z.\..

\...K.l 02a0 68 e5 53 60 d e e0 89 1b 4b 8d 37 f7 97 f7 ff db h .. .... 0230 92 04 ea 0f f 3 02 1b d8 03 0f 49 c2 5b a3 ca f0 .A.&... 0240 61 86 4a 0b b 4 7f 62 0c 24 c9 49 84 0f ab c1 86 a ...7........@U...W 0220 4b 29 db bd f 8 36 33 83 0e c9 ef 74 21 8d ff fb K ).a.)T.......a..e df 80 67 1e 7f bc 40 4d 44 17 db .!.f..u 01f0 75 17 1c 29 5 4 13 10 2a d5 6a 1e 9e 31 2b 8e bc u ..v.. 0290 4e 82 bf 8a 4 b 94 c7 7d 0d ef 9a 89 ff da 1f 6c N . .WE..[..u. 0260 20 97 cf 0b f 4 ec 46 31 65 05 c0 38 05 04 84 2d . 01d0 45 f3 c4 12 7 a 30 02 32 c3 76 d0 f9 61 85 62 62 E .. 0250 0d 29 9b f5 5 c e9 af 52 6d 80 10 71 78 62 dc b6 ..8..... .....[.Rm.........QL.T 02c0 01 5c 91 a6 2 d 88 f2 47 f4 40 1d ......I.C 0280 39 d7 66 c7 5 b 82 a2 d3 4f 0f 1c ef 96 ef ed f7 9 ...F1e.bb 01e0 b0 a7 7a 03 a 8 75 11 fe 15 cc 92 be 84 e5 bd 75 . ).........I.. .. 01c0 fa e9 41 e3 f 2 9d 2c 8f 61 fb b6 bd db d3 ae a2 ..... d. 0200 c7 a6 d2 51 4 c ad 9b fe ff d7 95 57 ea 7e 53 3f .t!.^n".j..g...S`.0270 03 64 b0 5c 5 d a6 5d 32 13 84 c5 01 0d 4d da 43 ..*.....2.J.O.z.. '.......qxb..........]2..~S? 0210 1e 27 eb a6 9 8 df e8 57 45 e3 40 55 e6 15 16 57 .63...... 02b0 74 2c 5e 6e 2 2 af ff f7 0a df b6 21 b4 9a aa 54 t ..b.z0.\].W.M...$....@MD.......}.1+..K. .

". 0380 08 52 b8 18 1 a 7c 03 02 10 02 66 3e 15 ae 6a c3 . 0330 1d 1a ca 70 4 a d0 93 70 66 97 4d cb 93 69 38 42 .nM%........BFL_.b..B. j. .bn.F.k.. R....={Q.+.. ..U.I_. R7...pf. 0320 4f 74 0a 62 6 e 02 26 b2 f6 a5 b7 90 e2 8e 42 1d O t.J6U 03d0 ff fb 92 04 e b 8f f3 01 1e 57 83 2c 42 52 61 c3 .f>.S. 0390 f5 26 a2 7a 2 c 4e 4c 10 55 d2 42 46 4c 5f a4 62 .. 03c0 cb ff 0b fe 5 0 da af 2b ce d2 82 6b c8 4a 36 55 ..j..... 02f0 0a 52 37 b4 6 e 4d 25 2c 7d 54 5a 86 4b 2f da 89 .M..Wh.-.S(c..Y...|...z.G.E|g 0370 45 dd 57 68 f c 7d 31 e1 49 5f 99 22 06 0c d0 08 E ..1.. 0350 33 dd 3f df a d 99 ef bf 73 0b ef 10 12 43 d2 b2 3 .2bA90J.."....p.Y.E.NL..s.c5 2f 69 9c 25 .}TZ..@..K/./i.. .. . 0310 c4 e8 43 7e b 4 ee 77 ce b3 fa 85 62 16 70 c7 83 .H.C.i8B 0340 05 0f 80 3b 2 b ab 52 0c 2d cc e8 5e a3 46 df ec . 0300 f7 88 09 21 e 9 59 14 30 2d 11 8f 0d 06 05 96 92 .(. \..b 03a0 23 31 d7 32 6 2 41 39 30 4a a3 22 b0 b4 45 92 7f # 1.!.... &.. 0360 25 4f 09 a2 3 1 e1 a0 c0 b2 d2 59 b3 9f 45 7c 67 % O....0-. 03b0 94 ca c2 53 2 8 63 be 14 ff 53 bb 74 7c 2a a0 e9 ....Y&.......&.. ...P..t|*.?.. .R...^.C~.+.:..]D.pJ..P 02e0 3f d0 ac 59 2 6 b1 3d 7b 51 d9 c5 5d 44 90 cb a5 ? ... ..}1......w.% 02d0 15 6a 87 ca d 5 48 ae b5 b2 bf 3a a3 e5 28 cc 50 .-.

.!.a. 0430 d0 b2 e8 7b d 0 45 cf d4 4d b0 e5 96 7b 76 43 9a .!...aa)& 0470 7d 48 71 1d 0 8 6a 55 72 5f d9 e3 2e 98 de 2c 2b } Hq.....)7....sosv|. 04a0 f5 8f 9a db 6 6 0f 04 84 c5 88 06 9f 0e 21 8a 00 ..=)Am.{mG\v.E...H@... ..+ 0480 66 25 69 c5 5 0 18 2d 1c b9 8b c4 92 61 1e cf 75 f %i. >... :.P.4 . .m.M...jUr_. 04c0 63 42 09 a4 8 a 48 40 cc 8b 2c 9f 00 c7 3a 4c ed c B....Z. 0450 c7 3a 1a c1 9 b dc 52 e2 eb 33 87 cc f8 f3 2c 08 .... ...hB..2O..6..P..94..W.-.(...... 03f0 81 a7 99 28 d 6 de 8f 7e b3 68 42 99 34 20 0a 63 ... ....T. 04d0 48 64 03 9d 2 2 b8 73 6f 73 76 7c a0 6d a5 5a a5 H d..X.@0....:L.. 0440 ad bb f9 7b 6 d 47 5c 76 e9 64 a5 88 4e 92 5c 36 .....X1Q.+Q.3......e.{... 04e0 3f 00 f9 50 a b 9b 58 31 51 e4 29 37 8b d9 89 d5 ? ..V.x 0410 63 73 78 ed 8 9 a9 84 e0 58 be 18 65 12 a8 f4 8c c sx.a&JK.BRa....h.c 0400 8a 8b ca d2 d 0 c1 d9 50 d3 2c fc 4e b9 06 98 78 . . 03e0 ca d0 61 26 4 a 4b ec 9f 54 0d 3d 29 41 6d 93 ea ..P.. . 04b0 8e 3e 0b 9c 4 b 34 c8 68 14 d0 6d 7f e9 39 34 fa . ..L.....d.f..... .....R.. 0460 c2 df 07 40 3 0 8f 0c f8 04 32 4f b1 61 61 29 26 .".~....%.. 0420 68 2d 51 a4 2 1 80 4c 87 85 56 b3 ca 93 8a 8a 17 h -Q.m...N...u 0490 6f 13 2e 2b 5 1 b0 36 af de 82 25 ba ca fe b6 ed o ..K4..{vC.N............

.000182000 seconds] [Time delta fro m previous displaye d frame: 0.. 54 bytes captured (432 bits) on inte rface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10...214348000 pc13.home cust-74-12412-138.. Time Source Destination Protocol Length Info 112 4..000 000000 seconds] Epoch Time: 141 5615217.00018200 0 seconds] [Time since ref erence or first fra me: 4.E 0500 49 ef e9 9c f c ad a6 d9 d7 7d ab 62 18 2c b0 e0 I . 0510 5c 9b 9c 45 2 0 24 f6 20 51 74 0e 5f fa d5 24 60 \ .._.....E $..214348000 sec onds] Frame Number: 1 12 Frame Length: 5 4 bytes (432 bits) . No...u.?n.dllstx01..}. i.$` 0520 19 b5 ..04f0 ae 69 9a 8a 3 f ae df a9 75 9c cc 3f 6e e8 9c 45 .264278000 Romance Standard Time [Time shift for this packet: 0..b..264278000 s econds [Time delta fro m previous captured frame: 0. 2014 11:26:5 7. Qt.cor exchange.?.com TCP 54 49574→h ttp [ACK] Seq=1 Ack =69392 Win=40005 Le n=0 Frame 112: 54 bytes on wire (432 bits) .

.. Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78).. ...0 ... ECN: 0x00: NotECT (Not ECN-Capabl . .Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. .. .. .168.home (192.. .0 ..port == 80 || http 2] Ethernet II. . . Src: pc13 ... Dst: cust-74-124 -12-138.. .. .dllstx01... .com (74... ..... = LG bit: Globally unique address (fac tory default) .....0... .......11 )... .. .... = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4.1.1 24. = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . .co rexchange.. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .138) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.12. .... = LG bit: Globally unique address (fac tory default) .0. . ..... .... ... ........

.ho me (192.. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.. Ack: 69392 .. = Differentiated Ser vices Codepoint: De fault (0x00) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f42 (20290) Flags: 0x02 (Do n't Fragment) 0.... ....124..138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. .. com (74..0.168. Seq: 1. = Reserved bit: Not set ..dl lstx01.. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] Sequence number : 1 (relative se quence number) Acknowledgment number: 69392 (r elative ack number) .11) Destination: cu st-74-124-12-138. = Don't fragment: Se t . D st Port: http (80). Src Por t: 49574 (49574)..e Transport)) 0000 00.12.corexchange.1.1... . .

0 = Fin: Not set Window size val ue: 40005 [Calculated win dow size: 40005] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 111] [The RTT to ACK the segment wa s: 0..... 0000 0001 0000 = Flags: 0x010 (ACK) 000. 0010 00 28 4f 42 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c . = Acknowledgmen t: Set ...0.... .. . ...0 . = Nonce: Not se t ... .. = Reserved: Not set ... = Congestion Wi ndow Reduced (CWR): Not set ........ . . ...... 0......dx.Header Length: 20 bytes ... = ECN-Echo: Not set . ... ....E. ......0.. . . ... = Reset: Not se t .`n.. 0 ....... . .. ... .......0. . = Syn: Not set ..... .. .000182000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 ... (OB@. 0..J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b . .. = Push: Not set .1 .... .. . = Urgent: Not s et ..... .. .

.255.026818000 seconds] [Time delta fro m previous displaye d frame: 0. 0030 9c 45 18 d4 0 0 00 . No. 2014 11:26:5 7.P.1 Frame 113: 366 byte s on wire (2928 bit s).+.N. 250 SSDP 366 NOTIFY * HTT P/1..000 000000 seconds] Epoch Time: 141 5615217.291096000 Romance Standard Time [Time shift for this packet: 0. 366 bytes captu red (2928 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..241166000 sec onds] Frame Number: 1 13 Frame Length: 3 66 bytes (2928 bits ) Capture Length: 366 bytes (2928 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:http] [Coloring Rule Name: HTTP] . . Time Source Destination Protocol Length Info 113 4..q=P.291096000 s econds [Time delta fro m previous captured frame: 0.255.02681800 0 seconds] [Time since ref erence or first fra me: 4.. E..241166000 pc9.c9 71 3d 50 10 ..home 239.

. = Differentiated Ser vices Codepoint: De fault (0x00) .. .. ... Src: W esternD_d0:f3:c2 (0 0:90:a9:d0:f3:c2).. ..255.. 250 (239.. .. .... ..0 .....[Coloring Rule String: http || tcp . . .. ..1..168. ... = LG bit: Globally unique address (fac tory default) .13) .. .... ... .25 0) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt.. home (192... = IG bit: Group add ress (multicast/bro adcast) Source: Western D_d0:f3:c2 (00:90:a 9:d0:f3:c2) Address: We sternD_d0:f3:c2 (00 :90:a9:d0:f3:c2) . ... Src: pc9... ... .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 3 .port == 80 || http 2] Ethernet II.255.. .. ..255. .. Dst: IPv4mcast_7f:f f:fa (01:00:5e:7f:f f:fa) Destination: IP v4mcast_7f:ff:fa (0 1:00:5e:7f:ff:fa) Address: IP v4mcast_7f:ff:fa (0 1:00:5e:7f:ff:fa) ... .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. = LG bit: Globally unique address (fac tory default) ....255..0...1 ...... ....0......... Dst: 239. .

255... ..0.. = More fragments: No t set Fragment offset :0 Time to live: 4 Protocol: UDP ( 17) Header checksum : 0xbfb3 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc9..255. . = Reserved bit: Not set .168.52 Identification: 0x442a (17450) Flags: 0x00 0.0. .1\r\n] [Severi ty level: Chat] [Group: Sequence] Request Met hod: NOTIFY Request URI ..250 (239.255...1. Src Port: 5865 7 (58657)...1\r \n] [NOTIFY * HTTP/1.250) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.. 255.1\r\n [Expert Inf o (Chat/Sequence): NOTIFY * HTTP/1. Dst Port : ssdp (1900) Source Port: 58 657 (58657) Destination Por t: ssdp (1900) Length: 332 Checksum: 0xb01 9 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 1] Hypertext Transfer Protocol NOTIFY * HTTP/1 ..13) Destination: 23 9. = Don't fragment: No t set .hom e (192..

.. Po rtable SDK for UPnP devices/1.2 55...2 0050 35 30 3a 31 3 9 30 30 0d 0a 43 41 43 48 45 2d 43 5 0:1900..CACHE-C 0060 4f 4e 54 52 4 f 4c 3a 20 6d 61 78 2d 61 67 65 3d O NTROL: max-age= 0070 31 30 30 0d 0 a 4c 4f 43 41 54 49 4f 4e 3a 20 68 1 00...E..0. UPnP/1..LOCATION: h 0080 74 74 70 3a 2 f 2f 31 39 32 2e 31 36 38 2e 31 2e t tp://192..255.1. .250:1900\r\n CACHE-CONTROL: max-age=100\r\n LOCATION: http: //192..6.1 HOST: 239. 0010 01 60 44 2a 0 0 00 04 11 bf b3 c0 a8 01 0d ef ff . 0020 ff fa e5 21 0 7 6c 01 4c b0 19 4e 4f 54 49 46 59 .1...250:1900*] 0000 01 00 5e 7f f f fa 00 90 a9 d0 f3 c2 08 00 45 00 ..!.26...255.. `D*.L. .168...:* Request Ver sion: HTTP/1..1.13:4915 3/nasdevice.255.NOTIFY 0030 20 2a 20 48 5 4 54 50 2f 31 2e 31 0d 0a 48 4f 53 * HTTP/1.168...6\r\n X-User-Agent: r edsonic\r\n USN: uuid:73656 761-7465-7375-636b0090a9d0f3c2::upnp: rootdevice\r\n \r\n [Full request U RI: http://239.HOS 0040 54 3a 20 32 3 3 39 2e 32 35 35 2e 32 35 35 2e 32 T : 239. 0090 31 33 3a 34 3 9 31 35 33 2f 6e 61 73 64 65 76 69 1 3:49153/nasdevi .255.2..xml\r\n NT: upnp:rootde vice\r\n NTS: ssdp:alive \r\n SERVER: Linux/3 ..^. 255...l.

. 0110 36 0d 0a 58 2 d 55 73 65 72 2d 41 67 65 6e 74 3a 6 .2. Po 00f0 72 74 61 62 6 c 65 20 53 44 4b 20 66 6f 72 20 55 r table SDK for U 0100 50 6e 50 20 6 4 65 76 69 63 65 73 2f 31 2e 36 2e P nP devices/1.NTS 00c0 3a 20 73 73 6 4 70 3a 61 6c 69 76 65 0d 0a 53 45 : ssdp:alive. 250 SSDP 375 NOTIFY * HTT P/1.xml.SE 00d0 52 56 45 52 3 a 20 4c 69 6e 75 78 2f 33 2e 32 2e R VER: Linux/3.1 Frame 114: 375 byte s on wire (3000 bit s). Time Source Destination Protocol Length Info 114 4.0.255..255. No..341418000 pc9. 375 bytes captu red (3000 bits) on .USN: 0130 75 75 69 64 3 a 37 33 36 35 36 37 36 31 2d 37 34 u uid:73656761-74 0140 36 35 2d 37 3 3 37 35 2d 36 33 36 62 2d 30 30 39 6 5-7375-636b-009 0150 30 61 39 64 3 0 66 33 63 32 3a 3a 75 70 6e 70 3a 0 a9d0f3c2::upnp: 0160 72 6f 6f 74 6 4 65 76 69 63 65 0d 0a 0d 0a r ootdevice.. UPnP/1. 00e0 32 36 2c 20 5 5 50 6e 50 2f 31 2e 30 2c 20 50 6f 2 6.NT: upnp 00b0 3a 72 6f 6f 7 4 64 65 76 69 63 65 0d 0a 4e 54 53 : rootdevice...home 239.00a0 63 65 2e 78 6 d 6c 0d 0a 4e 54 3a 20 75 70 6e 70 c e..X-User-Agent: 0120 20 72 65 64 7 3 6f 6e 69 63 0d 0a 55 53 4e 3a 20 redsonic..6.

.10025200 0 seconds] [Time since ref erence or first fra me: 4..391348000 s econds [Time delta fro m previous captured frame: 0. Dst: IPv4mcast_7f:f f:fa (01:00:5e:7f:f f:fa) Destination: IP v4mcast_7f:ff:fa (0 1:00:5e:7f:ff:fa) Address: IP v4mcast_7f:ff:fa (0 1:00:5e:7f:ff:fa) ...... 2014 11:26:5 7.. .000 000000 seconds] Epoch Time: 141 5615217.100252000 seconds] [Time delta fro m previous displaye d frame: 0. ... .... Src: W esternD_d0:f3:c2 (0 0:90:a9:d0:f3:c2)...... .interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.. .port == 80 || http 2] Ethernet II... . ..391348000 Romance Standard Time [Time shift for this packet: 0..341418000 sec onds] Frame Number: 1 14 Frame Length: 3 75 bytes (3000 bits ) Capture Length: 375 bytes (3000 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .. ... . . .1 ..0.... = LG bit: Globally unique address (fac tory default) . ..

. . = More fragments: No t set Fragment offset :0 Time to live: 4 Protocol: UDP ( 17) Header checksum : 0xbfa9 [validatio n disabled] [Good: Fals e] .....13) . .. ....0.. = Don't fragment: No t set .= IG bit: Group add ress (multicast/bro adcast) Source: Western D_d0:f3:c2 (00:90:a 9:d0:f3:c2) Address: We sternD_d0:f3:c2 (00 :90:a9:d0:f3:c2) . .. .25 0) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..0. . = Differentiated Ser vices Codepoint: De fault (0x00) . = Reserved bit: Not set ....... ... .....168..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 3 61 Identification: 0x442b (17451) Flags: 0x00 0. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4... Dst: 239. ..... .0 ... . . .255... = LG bit: Globally unique address (fac tory default) ..........255..0.255.1. Src: pc9.. 250 (239... .. . ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. home (192.255.

250) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.hom e (192.1. 255.xml\r\n NT: uuid:736567 61-7465-7375-636b-0 090a9d0f3c2\r\n NTS: ssdp:alive \r\n SERVER: Linux/3 .255.1\r\n [Expert Inf o (Chat/Sequence): NOTIFY * HTTP/1.255.255.13:4915 3/nasdevice.[Bad: False ] Source: pc9.168.1\r\n] [Severi ty level: Chat] [Group: Sequence] Request Met hod: NOTIFY Request URI :* Request Ver sion: HTTP/1. Po rtable SDK for UPnP devices/1.250:1900\r\n CACHE-CONTROL: max-age=100\r\n LOCATION: http: //192.13) Destination: 23 9.0.6.1.26.255.6\r\n X-User-Agent: r edsonic\r\n USN: uuid:73656 761-7465-7375-636b- . UPnP/1.250 (239.2.1 HOST: 239.1\r \n] [NOTIFY * HTTP/1. Src Port: 5865 7 (58657).2 55.168. Dst Port : ssdp (1900) Source Port: 58 657 (58657) Destination Por t: ssdp (1900) Length: 341 Checksum: 0x70f f [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 1] Hypertext Transfer Protocol NOTIFY * HTTP/1 .

NOTIFY 0030 20 2a 20 48 5 4 54 50 2f 31 2e 31 0d 0a 48 4f 53 * HTTP/1..250:1900*] 0000 01 00 5e 7f f f fa 00 90 a9 d0 f3 c2 08 00 45 00 .255. .LOCATION: h 0080 74 74 70 3a 2 f 2f 31 39 32 2e 31 36 38 2e 31 2e t tp://192.l.0090a9d0f3c2\r\n \r\n [Full request U RI: http://239... .2 0050 35 30 3a 31 3 9 30 30 0d 0a 43 41 43 48 45 2d 43 5 0:1900.HOS 0040 54 3a 20 32 3 3 39 2e 32 35 35 2e 32 35 35 2e 32 T : 239. 0020 ff fa e5 21 0 7 6c 01 55 70 ff 4e 4f 54 49 46 59 .. iD+... 0090 31 33 3a 34 3 9 31 35 33 2f 6e 61 73 64 65 76 69 1 3:49153/nasdevi 00a0 63 65 2e 78 6 d 6c 0d 0a 4e 54 3a 20 75 75 69 64 c e... 0010 01 69 44 2b 0 0 00 04 11 bf a9 c0 a8 01 0d ef ff .CACHE-C 0060 4f 4e 54 52 4 f 4c 3a 20 6d 61 78 2d 61 67 65 3d O NTROL: max-age= 0070 31 30 30 0d 0 a 4c 4f 43 41 54 49 4f 4e 3a 20 68 1 00....1...NT: uuid 00b0 3a 37 33 36 3 5 36 37 36 31 2d 37 34 36 35 2d 37 : 73656761-7465-7 00c0 33 37 35 2d 3 6 33 36 62 2d 30 30 39 30 61 39 64 3 75-636b-0090a9d 00d0 30 66 33 63 3 2 0d 0a 4e 54 53 3a 20 73 73 64 70 0 f3c2.. 255.....255..NTS: ssdp 00e0 3a 61 6c 69 7 6 65 0d 0a 53 45 52 56 45 52 3a 20 : alive.xml.E.!..255..Up....^..SERVER: 00f0 4c 69 6e 75 7 8 2f 33 2e 32 2e 32 36 2c 20 55 50 L ..168.1...

401655000 Romance Standard Time [Time shift for this packet: 0. No.USN: uuid:7 0150 33 36 35 36 3 7 36 31 2d 37 34 36 35 2d 37 33 37 3 656761-7465-737 0160 35 2d 36 33 3 6 62 2d 30 30 39 30 61 39 64 30 66 5 -636b-0090a9d0f 0170 33 63 32 0d 0 a 0d 0a 3 c2. 1314 bytes ca ptured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..6.6..26.home TCP 1314 http→49 574 [ACK] Seq=69392 Ack=1 Win=46 Len=1 260 Frame 115: 1314 byt es on wire (10512 b its).401655000 s . Time Source Destination Protocol Length Info 115 4.0. UP 0100 6e 50 2f 31 2 e 30 2c 20 50 6f 72 74 61 62 6c 65 n P/1. 2014 11:26:5 7..com pc13. Portable 0110 20 53 44 4b 2 0 66 6f 72 20 55 50 6e 50 20 64 65 SDK for UPnP de 0120 76 69 63 65 7 3 2f 31 2e 36 2e 36 0d 0a 58 2d 55 v ices/1.dllstx01.2..X-U 0130 73 65 72 2d 4 1 67 65 6e 74 3a 20 72 65 64 73 6f s er-Agent: redso 0140 6e 69 63 0d 0 a 55 53 4e 3a 20 75 75 69 64 3a 37 n ic.inux/3.corexc hange.351725000 cust-74-124-12138..000 000000 seconds] Epoch Time: 141 5615217.

... ..010307000 seconds] [Time delta fro m previous displaye d frame: 0.. ......0 . ..econds [Time delta fro m previous captured frame: 0.01030700 0 seconds] [Time since ref erence or first fra me: 4...port == 80 || http 2] Ethernet II.. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1)... ... .. ...0..... = IG bit: Individua ...351725000 sec onds] Frame Number: 1 15 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ... ..0. ..... ..... ..0 .. . = LG bit: Globally unique address (fac tory default) ... . . .... ........ . ... . .... = LG bit: Globally unique address (fac tory default) .. . ... .. Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) ..

. = Reserved bit: Not set . Src: cust -74-124-12-138. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro .corexchange.11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt..12.. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a79 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.dlls tx01..138) Destination: pc 13.corexchange.1.1.co m (74.home (192 .0.124... .. = Differentiated Ser vices Codepoint: De fault (0x00) .com ( 74..168.dllstx0 1..1.138)...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1b1 (61873) Flags: 0x02 (Do n't Fragment) 0.. = Don't fragment: Se t .124...home (192.. .. Dst: pc13. ...l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. .12.168.

... Ack: 1 . 0 .. = Reserved: Not set .. . = Reset: Not se t .. Dst P ort: 49574 (49574). ..... . 0. 0.0..... 0000 0001 0000 = Flags: 0x010 (ACK) 000.... .... Src Por t: http (80)... = Congestion Wi ndow Reduced (CWR): Not set ......0.. . . ..0 .. = Nonce: Not se t .1 . ... .. = Urgent: Not s et .... . = Push: Not set ..l Protocol......0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x9f1 5 [validation disab led] [Good Check sum: False] [Bad Checks ..... . ..... ... Seq: 69392.. = Syn: Not set .. . .... .. = Acknowledgmen t: Set . ..... = ECN-Echo: Not set .... . . .. .. Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 69392 (relativ e sequence number) [Next sequence number: 70652 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . .. .0...

b 00e0 d0 3a 35 0c 1 6 5e de 5c 7d dd 25 d7 44 38 70 56 .L.^... .... 0090 83 4f 4a 60 6 0 86 2a 80 61 eb 4c 0c 80 9b 4e 0d ..a.. 00b0 fa 82 2e 45 d f ff ff 59 05 c7 62 46 93 00 c3 0c ...NR.#g..Y.D8pV 00f0 a4 2d e4 ed 3 ... 0030 00 2e 9f 15 0 0 00 ad 99 87 a3 a7 0d 1e 01 21 20 . 0070 ea cd 0a a6 a a f5 90 4e 52 12 5f 8c 25 fb 0c 6d .N....jC....m 0080 2d b3 df 18 2 6 b4 ff fb 92 04 ec 0f f2 f4 30 d4 ....... 0050 3e bc e7 a3 d 7 ec 6c 92 09 ea 6a 43 c9 b9 8d e5 > .. `n.... ... 00a0 3d 89 41 81 1 5 e9 c1 87 b1 30 0e 59 97 20 a3 10 = .P.....P........ 00c0 a2 cb a4 cc c 7 17 5b 22 47 b2 58 a7 2c 37 25 cd .@..A.&..q=.1.["G...bF..:M.O}....E.l. 0020 01 0b 00 50 c 1 a6 2b c9 71 3d 9e 87 4e aa 50 10 .E...N. ..0..+.*... 0060 e0 93 12 23 6 7 96 26 98 54 24 44 0b b0 eb 68 bb .. OJ``....&.%..%.7`.. 00d0 76 04 89 91 3 a 4d 1b 86 e3 4f 7d b8 5d c5 3b 62 v . ._...X..dx.T$D.. ..! 0040 92 a0 01 e0 0 1 e5 8c 7e 65 cc a8 37 60 a1 a6 c9 .. :5..Y.um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 1260] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 ...].....:yJ|. .. ....\}.~e... 0010 05 14 f1 b1 4 0 00 31 06 3a 79 4a 7c 0c 8a c0 a8 .0........h. .. .7%..

.. -.....F 0180 65 2e 04 6c e 3 82 f8 f5 11 f2 ff 85 09 82 0f c4 e ..^bG..-&..A.. .:.nz.s. z...&S. . . R....b 58 66 44 6e 51 87 5d 20 d7 ff 5f .a..fF..3...H/.i..$@. 0110 09 49 05 47 e d fe df fa d2 15 1c 7a e0 d1 cc a1 . VC.XfDnQ..... 0150 41 90 e1 66 4 6 bb b4 8a 05 70 88 d9 ba 24 40 1e A ..T{O 01a0 0c 56 43 8c f e 0a 5e 62 47 17 08 cb 2b 2a 95 17 ...n..B.8.. .`)P 01e0 b8 24 30 25 0 c 2e 69 b3 c2 21 c1 3b f5 74 f0 e5 ...J.... ....|...r.Ii.] .!..(......... 5.. 01f0 40 2e af 18 9 b 68 eb 3a ad 01 53 88 2e 41 ad 6f @ .. 01b0 1d d7 2e a9 4 9 69 d8 86 e6 76 f6 72 9b 29 be e6 ..S. 0140 b1 52 a9 1f b 0 a2 32 5f 41 b0 48 2f f4 c2 a1 f1 ..z...).(.fJpBcMd .. 0190 39 3e 77 16 2 8 f5 6e 7a 86 1a c7 0b 93 54 7b 4f 9 >w...t.&. I.8...o 0200 0d 99 57 03 a 5 59 5a af 68 6f 5a . 0120 8f 35 8c be 4 a 14 04 00 3a c0 a0 85 38 bf 7c 8d .......v.:.$. 0170 9d 1e a5 33 8 1 55 8d 38 05 24 93 5d a0 27 b7 46 . 01c0 b9 7a 0d aa 2 d 26 dd 13 ea 61 9d 7f 55 22 2a 64 ..U...U"*d 01d0 a0 1c 10 66 4 a 70 42 63 4d 64 20 99 08 60 29 50 . 4...J..l...._ 0100 d2 8a 28 18 1 4 08 1c 1a 81 cd 0c 1d 42 18 87 c4 . 0160 a3 34 e7 97 1 9 ac 26 9a a2 73 bc c6 31 dc c5 aa .].+*.....G...'..h........ $0%..2_A. 0130 43 03 4a 1b e 5 c8 6e a7 9f b1 26 53 89 19 20 81 C ..1...p...

..a.+~.2. .rv.. S..B.x.-. 02c0 59 9c 9c 18 5 8 74 b8 61 04 99 25 00 2d bd 37 90 Y .J..*. . 0230 2c 53 83 4f 4 a 60 61 44 ea 60 67 09 4a 0b 70 c3 ... 0310 bc ad e0 d9 b 6 74 05 02 00 a5 04 d5 51 d2 f5 16 .7%.CL..7.... t..DJn.O 0250 5f fe 80 51 d 3 15 68 ca 83 31 c7 ca 87 95 72 fb _ .HP.....h. (......AQgEI 02b0 a9 74 a1 ae f 9 1a fe b4 86 41 a1 65 61 58 06 98 .. 0290 0c 28 f9 a2 c b 44 4a 6e 0d f7 96 a8 ee 73 e6 d8 ....{..X..6.p.@ 0220 e1 37 14 63 0 b 8a 86 c5 ff fb 92 04 e9 0f f3 0d ..~.....A...'._..YZ.`pDR$M 0270 15 e9 0b f1 7 2 76 c7 95 d2 e0 bc 27 dc a1 36 b2 ...1........c....eaX......W./(&. 02a0 9b cb 15 ca 2 f 28 26 0a 01 5c 91 41 51 67 45 49 ..OJ`aD. ...f5 48 50 a3 6f ....A'E.. 7...Xt... ....`g._.]G.... 02f0 d3 ad 41 27 4 5 cb 5f 92 8e a8 d5 26 52 36 55 8b ....Q.1V.o 0210 74 97 58 d6 9 b ab 5d 47 c6 fe 5b 5f 4d cb 02 40 t .m..s.U. 0300 47 b5 e5 b7 f c 7e 8d d4 36 60 9d b4 bf 2b 7e 95 G . 0280 37 47 61 0d 4 2 0e 7b e2 f6 60 5c 2e 98 f3 0a 1b 7 Ga...%..\.`\.6`.... . 02e0 67 90 c7 d4 5 4 47 7e 71 83 ed 32 d3 83 ca d8 2e g . 0260 42 54 68 08 7 8 b1 2a e7 55 05 60 70 44 52 24 4d B Th.r.[_M. 0240 4e 0c bd 09 8 9 5f 95 e9 81 87 ad 31 56 85 ea 4f N ... .. 02d0 96 8b 1a 6d c b 96 37 25 dd 1a 95 d9 43 4c 82 f6 .hoZ.TG~q..&R6U..

U....@-. 03c0 7f ac d2 fb f 0 27 db 1a 5c 48 ff fb 90 04 ec 8f .amj.#.... .^.....N.. .$..+....O.2.~.U...j. ..\H......e..P..Pi... 0420 3b 91 2a 47 9 3 72 99 d6 4d bf 89 ab b6 24 fc 83 .6t.~....OzPe.s.:@k.\.}..C.t..Qm'.. 0370 cc cc 21 a1 e 6 7e 39 bc 36 74 dc 11 40 2d a9 32 .... 0410 3c 2d 77 6e 0 4 8d 3c 10 74 a6 9a 22 dc 18 ea 8b < -wn. .'..M.'I. .*G.p. 0350 60 ce 0a 65 2 5 5b fd b5 d8 a7 6a 5b 74 78 20 0d ` .7. 0320 1e 9c 3a 40 6 b 0c 15 61 6d 6a 06 a5 50 ca 23 e0 .... 03b0 72 49 01 ed b 7 8f 17 10 df cb 98 98 be 29 de b8 r I..<..j[tx .....\.."..F..Q.=yp...y..... 0390 f2 ac ca 7e 1 4 00 bf 27 49 f2 3d 79 70 ac c4 15 .A........ 0340 d8 b3 ca ca c 3 a9 70 1d 5e ed 5c bd 62 f2 92 fd .. .).g. 0330 29 2a e0 7e 0 4 e9 80 b8 84 25 28 b4 65 83 73 f8 ) *.M....1............b.. .t. .r. .J. 03a0 30 5a 13 55 e f db 5c a0 ab a9 9b 67 13 46 8d 13 0 Z.\..W 03f0 58 db 55 98 3 2 9d 03 c6 86 86 98 c2 a9 85 41 54 X . ..(..=i.~9.AT 0400 85 c3 4d 00 4 3 eb 7f 18 02 2c 8b 03 d6 7d 94 94 ....(S... 0360 28 39 97 00 0 4 51 6d 27 d0 5c ea 19 d3 d0 31 02 ( 9...%(..!.2 0380 f3 12 2c be 8 1 b2 e2 6a 88 37 b2 4f a8 cf 2b 01 ...... .....e%[. 03d0 f3 0c 28 53 0 3 4f 7a 50 65 05 0a 50 69 ef 4a 0b .. 03e0 00 b3 4e 0d 3 d 69 81 79 93 e9 41 87 b1 28 c0 57 .

.=.. . 04e0 bc 0e 5d 33 1 0 97 42 1f 9b 98 64 36 12 f5 de 73 .c<` 0470 ce 73 30 19 e c 65 c7 88 63 9b 0b d5 31 ca 88 86 .'.... S No.......c... i.U. 0460 51 95 73 80 6 4 57 29 60 b8 14 20 60 03 63 3c 60 Q . 0450 f1 69 b2 ff 4 b 3f 7f b7 eb 80 c2 e2 64 50 12 89 ..'.kr...R..... 0490 d7 3b 02 17 9 b b0 f2 14 68 43 2f 74 3d 1c 5a 4a . 0480 e2 42 01 a8 6 0 87 53 12 b1 fb a8 26 e0 a3 4d de ...kx. `.#@...~..eg.dz........v..B.]3.&.. 0440 72 85 88 18 c 5 7e b3 bd 6b 78 85 5d 3f 5c c1 e9 r . A.e. .. B...dW)`...s.5.......V.{STU....hC/t=.. 04c0 2f 01 27 1d 6 5 67 a5 9b be 20 41 e6 6b 72 e8 15 / .0430 e9 f6 64 7a 9 2 d7 8b 02 07 d4 08 52 fd c2 49 c4 .... Time Source Destination Protocol ..p0..`. ].... ...K?.M........A.WT 0500 d6 db 59 26 c 6 e0 63 ef df 3b c7 ff 1a db ce d7 . ..Qf.I.d6....v.S...c.... s0.... 0520 b2 53 .]?\.0$A. 04b0 bc 5d c0 55 a 4 1a 76 f2 1a c0 91 1c 56 9a 8b 1b ..s. . 04d0 35 85 a1 00 b e 92 70 30 1e 7b 53 54 55 f3 a5 8c 5 .Y&. 0510 91 9f 51 66 9 6 35 a7 da 8a 30 24 41 d5 8f 10 f0 ..ZJ 04a0 cf a1 76 ab 1 7 88 3d 1d f2 9d c7 f2 d9 95 27 d8 ..s 04f0 7a ad 41 2e f 1 23 40 aa b2 2e 73 df c9 ac 57 54 z .dP.1.... ..

000 000000 seconds] Epoch Time: 141 5615217.Length Info 116 4. ACK] Seq= 70652 Ack=1 Win=46 Len=1246 Frame 116: 1300 byt es on wire (10400 b its).01044600 0 seconds] [Time since ref erence or first fra me: 4. 1300 bytes ca ptured (10400 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.corexc hange. Dst: AsustekC_7f:64 .362171000 cust-74-124-12138.home TCP 1300 http→49 574 [PSH. 2014 11:26:5 7.dllstx01.port == 80 || http 2] Ethernet II.010446000 seconds] [Time delta fro m previous displaye d frame: 0.412101000 Romance Standard Time [Time shift for this packet: 0.com pc13. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).412101000 s econds [Time delta fro m previous captured frame: 0.362171000 sec onds] Frame Number: 1 16 Frame Length: 1 300 bytes (10400 bi ts) Capture Length: 1300 bytes (10400 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http:data] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .

...0 ........0.... .corexchange.. Src: cust -74-124-12-138. = LG bit: Globally unique address (fac tory default) ....home (192 ..... ...12. . ..:78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) . ..0.124. .. . ... . .. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ......... . .1.. .11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt...0 . ... = LG bit: Globally unique address (fac tory default) .. = Differentiated Ser vices Codepoint: De fault (0x00) . . . ..dlls tx01........138).. Dst: pc13....168.. = Reserved bit: Not set ... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) ... ...... . .......co m (74.. .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 286 Identification: 0xf1b2 (61874) Flags: 0x02 (Do n't Fragment) 0..

Dst P ort: 49574 (49574).com ( 74. = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) Header checksum : 0x3a86 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol.. .138) Destination: pc 13.. ..1.... .. Seq: 70652..dllstx0 1.... ACK) 000.168. = Don't fragment: Se t ... .12.. = Nonce: Not se t .0. ..home (192..124. . Ack: 1 .... Src Por t: http (80).. = Congestion Wi ndow Reduced (CWR): Not set ..1.0 . Len: 1246 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1246] Sequence number : 70652 (relativ e sequence number) [Next sequence number: 71898 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes ... . = Reserved: Not set ... 0000 0001 1000 = Flags: 0x018 (PSH.corexchange.. .... 0... .

1. .. ....0.P... 0030 00 2e 56 a8 0 0 00 46 00 d6 2a 28 76 9b 29 1e 28 ..... . = ECN-Echo: Not set ..+. . 0..).. ... = Syn: Not set .@.. #c.. . 0020 01 0b 00 50 c 1 a6 2b c9 76 29 9e 87 4e aa 50 18 .=p...... . ... .0....]..1 ..... ...E.dx....k.....V. 1 .. .@.... `n. .... .N...( 0040 90 40 8c ab b 2 43 08 04 25 15 00 2f 80 cc c0 70 .q 0060 9f 23 63 a6 2 c 46 1e f5 ff 10 b7 ad e1 61 53 b8 ...9.. = Push: Set ....... 0070 b0 ae f6 24 6 8 70 a1 cc eb 5b ce .. = Reset: Not se t . ..v). = Acknowledgmen t: Set .0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x56a 8 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [Bytes in f light: 2506] 0000 08 60 6e 7f 6 4 78 90 01 3b d0 17 e1 08 00 45 00 . .. . .C.. 0010 05 06 f1 b2 4 0 00 31 06 3a 86 4a 7c 0c 8a c0 a8 . ..%.F. .J|./.F.0.:...p 0050 14 c8 5d b6 3 9 cc 16 40 8c 3d 70 f8 6b b2 9d 71 ...*(v. ...... = Urgent: Not s et . @.aS....P... ....

0100 c4 20 76 d2 e 3 de bc a2 9a 76 3b 36 a2 7b e9 33 .. =0.|A....g-Z.J.... !. 00d0 a7 a9 32 94 e 1 da 67 2d 5a df f4 ac 8e c3 11 99 ..}..P. 0120 83 21 c0 ce 1 3 96 8c 2c 41 57 b7 b9 00 50 ad d2 . ... ....C....AW.J..nf0./w..#...}*-6..@D. 0090 40 67 0f 4c 4 b fc bd 4a 0d bd 69 81 7d 16 69 41 @ g..L...$hp.K.{...... 0130 98 e9 64 3e 9 5 ef 0a 06 93 b0 9a b5 b1 53 4d 70 ..N... .......D 00f0 2d 5c 9f e5 2 3 a6 c9 28 a3 04 0a 4c bb bf d9 7f \..d>. :.. .v.\. ...3 0110 42 41 c6 4e f 0 10 65 a0 30 b3 4b a8 48 61 02 d2 B A.SMp 0140 08 e0 c2 0d 7 d 2a 2d 36 c6 51 cc ce 11 a7 f4 96 ... v.. 0160 76 8b b3 09 4 2 2b 4e fa 91 6e d5 04 5a 0a c0 e0 v ..w>.......&.0..fc 78 9b ff ff ..Oz`ee.]L 00b0 d4 05 14 f9 0 4 fc a8 03 38 42 a6 8a 4a 8c bc 19 .... 0170 38 da 7c 41 1 1 ba d2 b0 24 ac 40 44 9a 9c 7f b2 8 ....... ......2.B+N...8B..LK..x...n. 0080 fb 92 04 ec 8 f f3 10 2d 52 83 4f 7a 60 65 65 8a .Z...i... .e...-R.0. 0180 97 91 74 01 0 2 a4 bb 21 28 4e c5 5c 2b 21 3c 31 ..."hd... .iA 00a0 9c 3d 30 1a c c 96 81 5c 7f b8 9e 46 e9 e3 5d 4c ..[..$..Q. 00c0 0f 16 ad 2c e 2 91 a1 22 68 64 e6 98 6e 66 30 c7 .k.......Ha.(.F.. 00e0 56 2c 07 43 f 2 ed 6b 97 a0 30 b0 26 97 fc 10 44 V .. 0150 ca 3a c4 c7 2 f 77 88 9b 95 9d e7 77 3e f3 37 ad ...7...6..

...J.@g..J.~I...Ka.<8.. ... ..<.. 0200 6e 92 81 5a 6 a ec 50 30 f5 bb 11 e2 c1 ae 1e d9 n .=i. . 7.. 0220 93 ff fb 92 0 4 e8 0f f2 ff 2f d2 83 4f 7a 60 5e .<y... :e. L.... .....g| 01f0 f8 4c a1 be 8 3 78 2e 21 fa b0 e9 91 77 2d 14 f1 .m.E.!<1 0190 db 9a c0 4c 3 d 4b 01 da dc b5 e5 78 7a 42 b5 63 . 0240 29 01 97 bd 2 8 eb 3d 86 d1 d2 4b 61 a6 d9 9a 38 ) .Zj.Y.=.....~"..B...8 0250 0c 83 6f 03 0 d f2 fb 89 24 cb 98 4a ba 42 8a ee .J (i...D"C.....D... 01e0 bc e6 c6 77 0 a fe a6 5d 26 dd 0b a6 9a 00 67 7c . . 0260 7a 39 9b 4a b a df d8 c2 fe a2 a5 a4 6d de 7a 5a z 9.L=K.zZ 0270 af eb 3c 07 4 5 d9 93 4a 60 67 5d df 7e 22 a6 45 .J`g].=..w.Y 0290 1c f2 3c 38 b a d4 d1 20 37 c6 89 9c d7 eb d2 9f .J....~. 0210 30 c3 0f 4f a f 6c 6e 90 a3 7f f3 5b fc 3d 69 d3 0 ....3..Oz`^ 0230 25 ea 40 67 0 b 4c 0b 84 b3 4a 0d 3d 89 81 6a 94 % ...(.ln..j...O.L...E 0280 04 3a 65 8b c 3 50 48 9e 5a a3 c8 8d 8c 11 e1 59 .H 01d0 09 ab c6 0a 2 2 5a c0 52 e1 c0 aa b2 08 fe 33 d1 .....o.....Z............R.. .P0.xzB.t.......PH.c 01a0 a2 bd 89 7e 0 b 24 b7 fd aa 3c 79 f0 7e 49 89 d6 .!........ 01c0 58 5a fb 92 d e 4a 20 28 69 e1 82 98 19 fa 86 48 X Z....x..]&....$.... 01b0 20 7d f6 cb 4 4 9b 59 89 af e3 3b bc 44 22 43 e6 }. ..... ...w-.[.!(N.$./.."Z. ..

........LJ....02a0 ff af 17 c8 e c bd 90 e2 35 93 d4 be c4 95 0e 99 .W..&$X.0. 0340 89 ab d7 f8 7 e 92 11 a9 23 36 df 49 0e 69 a2 b9 . 0370 46 f9 0a 04 0 9 30 54 4a ee 98 08 e0 92 83 10 12 F .... 02f0 ac 2c 3c f7 2 f e4 85 37 51 e2 15 b9 d5 df 0d 2f ...@.g4V:. ......+5 0330 81 23 12 d6 2 e ba 99 1b 4c 92 b7 45 bd 2f 81 1d ....C.7.y..... 02b0 25 20 ed c2 1 9 26 d8 71 86 26 24 58 0a 70 c4 13 % .p... #........ v.../ 0300 b9 a9 3a 67 f b 6f ef c1 a3 40 93 e5 11 85 53 5c .0....a. .. 02e0 8b 76 f0 30 5 2 b1 54 94 dd 89 38 ef 50 23 df d0 ..<.. t..q.#6.L.E../. 0350 c5 d5 57 d5 3 7 d4 ad b3 5a 04 69 6d ac e5 6a 1d ..S\ 0310 22 2a 89 8c a 1 eb a9 b4 f0 18 e0 76 37 17 40 30 " *..p.8.#dDv 03b0 b6 1c 28 fc 3 ........5.o.0TJ. 0390 0b 33 7d 5d 8 5 79 90 9c 3d cf 95 03 61 88 85 c2 .i...7Q. 03a0 78 f2 34 2c 0 d 43 e9 22 f2 cd a8 99 23 64 44 76 x .R......j.v7. 3}].. ..&..p.. 02c0 30 87 1c 25 2 f 70 fb 05 07 52 1d 9f 91 a4 74 6a 0 .y.a.tj 02d0 1c 74 1b 67 9 a 03 6b 11 14 79 a1 70 14 61 d4 a5 .=.P#. . 0360 6d 9a 67 34 5 6 3a f9 d7 d6 ff 86 41 81 86 dc 7f m ...A.../..I. .4.%/p....T...Z.g.im.(..0R... 0380 68 70 d8 30 8 0 18 70 80 9e 0a 28 e7 30 1a b1 19 h p.".F@36..~.....@0 0320 72 43 01 46 4 0 33 36 8d c4 4c 4a 80 9f a9 2b 35 r C.........k.:g..

..!...v..6. . .. 03f0 82 c9 cc bb 4 8 af 48 00 b3 2a 73 de f3 35 60 62 .zZ.<.p..).C.a.....+$.J@ 0410 0a f1 94 43 2 e ad 1d d8 25 cd 52 10 0b a3 0c 3f .... ... .*s.. 0450 ef 6e ee a4 0 2 09 34 7f ba 19 29 f2 08 e4 ec 7c .| 0460 ca 20 c3 14 4 1 4a 8a 82 98 9c 91 bd 02 e1 d3 ce ....=.......g.R.? 0420 6e 73 ff 76 f 5 4b d5 b6 98 34 8a c7 2f a9 bc 08 n s.H.|....EH....5`b 0400 a6 04 c9 a2 0 4 3d 1c 08 5c 59 89 f2 fd d6 4a 40 ...=0..%.. 0490 b3 ec dd 15 a 3 70 e8 c3 86 d9 29 a8 72 37 35 b4 ...G....L.z.Y.x. 3.)......AJ... 04a0 c9 f3 7d f9 1 e be d7 fa c6 ab 0f 7a fe 5f af 9b ..r75..3/S. 0470 c4 51 52 97 d a 2b 24 bc e1 c5 36 16 02 cd 13 34 ... QR.. .R... ...3 2f 53 cf 6a f5 3c e9 e2 3b 72 d6 .4..G.\Y......./......Oz 03d0 60 63 45 9a 3 0 67 0f 4c 0c 78 b3 48 0d 61 89 81 ` cE...4. 04c0 e0 53 18 62 f 5 82 47 42 90 35 29 . 04b0 79 dd 90 47 f 4 a5 01 92 21 a2 a9 ba e8 a4 e0 a9 y ....._.... .....H.. ... n.r..K.......).hXa.0g..H..}..j.....4 0480 a9 33 2e e6 4 7 b0 ed 4b da 04 18 0d f2 45 48 a7 . 0440 77 6f ef af e 4 8c eb d7 59 f5 d5 a9 bf 8e fe b3 w o...k...(.... 03c0 7c c0 98 ff f b 92 04 ec 8f f2 ff 2c 52 83 4f 7a | ... 03e0 86 96 29 01 9 c 3d 30 eb a6 7a 5a 90 7c da c4 f6 . 0430 34 3f b7 68 5 8 61 a4 f8 cd 6b 95 d4 67 d4 b5 1b 4 ?..K..

..5)$..362357000 pc13...... 0510 6e 12 fe 9a n . .e 0500 fa 32 fd d2 b 9 bd a0 cd fe a9 99 f5 8d 63 42 c8 . 04f0 25 56 bd f6 b 2 46 6b d9 bd 82 d1 9e 52 90 f1 65 % V. Time Source Destination Protocol Length Info 117 4.000186000 seconds] [Time delta fro m previous displaye d frame: 0....i..24 03 31 3e 8a .cor exchange..com TCP 54 49574→h ttp [ACK] Seq=1 Ack =71898 Win=40005 Le n=0 Frame 117: 54 bytes on wire (432 bits) . No..*.R.... 2014 11:26:5 7...RB.000 000000 seconds] Epoch Time: 141 5615217. 2.b. S....Fk.1>. 54 bytes captured (432 bits) on inte rface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10.412287000 Romance Standard Time [Time shift for this packet: 0.cB.'@L. 04e0 0f 0c c6 17 6 9 bf 27 40 4c b0 cc f3 2a f8 ef 18 ..412287000 s econds [Time delta fro m previous captured frame: 0..*..GB.00018600 0 seconds] [Time since ref erence or first fra .....dllstx01..XR. 04d0 37 15 a8 a6 1 6 2a bd 2c 52 42 ca e0 58 52 98 b9 7 ..home cust-74-12412-138..

me: 4. ..port == 80 || http 2] Ethernet II.1.138) Version: 4 Header Length: ... . = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..... ...0 .. ..dllstx01..com (74.0 ... .... . .. Dst: cust-74-124 -12-138. ....1 24. . ... .. Dst: Sagemcom_d0:17 :e1 (90:01:3b:d0:17 :e1) Destination: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) . = LG bit: Globally unique address (fac tory default) ..0.... .362357000 sec onds] Frame Number: 1 17 Frame Length: 5 4 bytes (432 bits) Capture Length: 54 bytes (432 bits ) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .co rexchange. = LG bit: Globally unique address (fac tory default) .....12.... Src: A sustekC_7f:64:78 (0 8:60:6e:7f:64:78)... Src: pc13 .11 ).. . . .. ..home (192..... .. ...168. . = IG bit: Individua l address (unicast) Source: Asustek C_7f:64:78 (08:60:6 e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .. ... ... .........0...

20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt... = Don't fragment: Se t . Src Por t: 49574 (49574)...12. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00..138) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol..00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 0 Identification: 0x4f43 (20291) Flags: 0x02 (Do n't Fragment) 0.. Seq: 1. com (74. . Ack: 71898 .. .corexchange.124..ho me (192.. ... = Reserved bit: Not set .. D st Port: http (80).. .168.11) Destination: cu st-74-124-12-138.1.dl lstx01.0. = Differentiated Ser vices Codepoint: De fault (0x00) .. = More fragments: No t set Fragment offset :0 Time to live: 1 28 Protocol: TCP ( 6) Header checksum : 0x0000 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc13.. Len: 0 Source Port: 49 574 (49574) Destination Por t: http (80) [Stream index: 0] [TCP Segment Le n: 0] ..1..

.. 0..... .1 .0 ...dx... = Reserved: Not set .... ..`n... = Reset: Not se t ....E.. . ... . = Congestion Wi ndow Reduced (CWR): Not set .....000186000 seco nds] 0000 90 01 3b d0 1 7 e1 08 60 6e 7f 64 78 08 00 45 00 .. . .. = Nonce: Not se t . . ....... . .. . 0000 0001 0000 = Flags: 0x010 (ACK) 000.........0..0. . ... .. = Urgent: Not s et ... .. ..0. . = Acknowledgmen t: Set .... = ECN-Echo: Not set ... 0 ... 0.0 = Fin: Not set Window size val ue: 40005 [Calculated win dow size: 40005] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x18d 4 [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is] [This is an ACK to the segment in frame: 116] [The RTT to ACK the segment wa s: 0.. .Sequence number : 1 (relative se quence number) Acknowledgment number: 71898 (r elative ack number) Header Length: 20 bytes . .. .... = Syn: Not set .... . . . .... = Push: Not set .... ....

454315000 s econds [Time delta fro m previous captured frame: 0..+. (OC@.N... .P. Time Source Destination Protocol Length Info 118 4.000 000000 seconds] Epoch Time: 141 5615217.042028000 seconds] [Time delta fro m previous displaye d frame: 0.. No..0010 00 28 4f 43 4 0 00 80 06 00 00 c0 a8 01 0b 4a 7c ..25 5 NBNS 92 Name query N B WORKGROUP<1d> Frame 118: 92 bytes on wire (736 bits) .404385000 pc9..{.home 192. E..1....404385000 sec onds] Frame Number: 1 18 Frame Length: 9 2 bytes (736 bits) Capture Length: 92 bytes (736 bits ) [Frame is marke d: False] [Frame is ignor ed: False] ... 0030 9c 45 18 d4 0 0 00 ..04202800 0 seconds] [Time since ref erence or first fra me: 4. 2014 11:26:5 7.168.J| 0020 0c 8a c1 a6 0 0 50 9e 87 4e aa 2b c9 7b 07 50 10 .P.454315000 Romance Standard Time [Time shift for this packet: 0. 92 bytes captured (736 bits) on inte rface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10..

1..... .... . = IG bit: Group add ress (multicast/bro adcast) Source: Western D_d0:f3:c2 (00:90:a 9:d0:f3:c2) Address: We sternD_d0:f3:c2 (00 :90:a9:d0:f3:c2) .. Src: pc9. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4... ...00 = Explicit Congestio .1..... Dst: 192. . home (192..[Protocols in f rame: eth:ethertype :ip:udp:nbns] [Coloring Rule Name: SMB] [Coloring Rule String: smb || nbss || nbns || nbipx | | ipxsap || netbios ] Ethernet II....... Dst: Broadcast (ff: ff:ff:ff:ff:ff) Destination: Br oadcast (ff:ff:ff:f f:ff:ff) Address: Br oadcast (ff:ff:ff:f f:ff:ff) .13) .. .168..... Src: W esternD_d0:f3:c2 (0 0:90:a9:d0:f3:c2). . ...0 .. . . ... ..... ...0.. = LG bit: Locally a dministered address (this is NOT the f actory default) ....1 .... = Differentiated Ser vices Codepoint: De fault (0x00) .... .1.168... .. .. = LG bit: Globally unique address (fac tory default) .. .168.25 5 (192. .. .. .1.. ....... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00.. ... .255) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ..

168..1......... ... = Don't fragment: No t set ..hom e (192..13) Destination: 19 2.168... = More fragments: No t set Fragment offset :0 Time to live: 6 4 Protocol: UDP ( 17) Header checksum : 0x6a9e [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc9. ..1.0. .16 8.1. . Src Port: netb ios-ns (137)... = Reserved bit: Not set .. = Response : Message is a quer y .0.. . .255) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col. .. Dst P ort: netbios-ns (13 7) Source Port: ne tbios-ns (137) Destination Por t: netbios-ns (137) Length: 58 Checksum: 0xda1 7 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 2] NetBIOS Name Servic e Transaction ID: 0x1d77 Flags: 0x0110 ( Name query) 0.255 (192...n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 7 8 Identification: 0x8ba4 (35748) Flags: 0x00 0.

250 SSDP 420 NOTIFY * HTT P/1.......... 0010 00 4e 8b a4 0 0 00 40 11 6a 9e c0 a8 01 0d c0 a8 ....... ..E. No. . . = Truncate d: Message is not t runcated . ... . = Recursio n desired: Do query recursively ...w.. = Broadcas t: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries WORKGROUP<1 d>: type NB.. .. .1 ... ........... N..255... . .. 0020 01 ff 00 89 0 0 89 00 3a da 17 1d 77 01 10 00 01 ...@..... ... .000 0..0. .... .1 .....:... . = Opcode: Name query (0) ... Time Source Destination Protocol Length Info 119 4.. .... 0030 00 00 00 00 0 0 00 20 46 48 45 50 46 43 45 4c 45 .home 239.. ...255.....j...1 ..440697000 pc9. class IN Name: W ORKGROUP<1d> (Local Master Browser) Type: N B Class: IN 0000 ff ff ff ff f f ff 00 90 a9 d0 f3 c2 08 00 45 00 .. FHEPFCELE 0040 48 46 43 45 5 0 46 46 46 41 43 41 43 41 43 41 43 H FCEPFFFACACACAC 0050 41 43 41 43 4 1 42 4e 00 00 20 00 01 A CACABN.

. .. Dst: IPv4mcast_7f:f f:fa (01:00:5e:7f:f f:fa) Destination: IP v4mcast_7f:ff:fa (0 1:00:5e:7f:ff:fa) Address: IP v4mcast_7f:ff:fa (0 1:00:5e:7f:ff:fa) .440697000 sec onds] Frame Number: 1 19 Frame Length: 4 20 bytes (3360 bits ) Capture Length: 420 bytes (3360 bi ts) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:udp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp .03631200 0 seconds] [Time since ref erence or first fra me: 4..... 420 bytes captu red (3360 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10....0...036312000 seconds] [Time delta fro m previous displaye d frame: 0. . .490627000 s econds [Time delta fro m previous captured frame: 0.000 000000 seconds] Epoch Time: 141 5615217.. 2014 11:26:5 7. . .port == 80 || http 2] Ethernet II..Frame 119: 420 byte s on wire (3360 bit s)... Src: W esternD_d0:f3:c2 (0 0:90:a9:d0:f3:c2). = LG bit: Globally .490627000 Romance Standard Time [Time shift for this packet: 0..

.. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4..13) . .255.. . = LG bit: Globally unique address (fac tory default) . ... ....... Dst: 239.. ...unique address (fac tory default) .255..... . home (192... .. .0...... = Don't fragment: No t set .. . 250 (239. ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. . . ... .. = More fragments: No t set Fragment offset :0 Time to live: 4 Protocol: UDP ( 17) Header checksum .... Src: pc9.....255. ..25 0) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt...0 ...1.......168. ...1 ... = Differentiated Ser vices Codepoint: De fault (0x00) .00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 4 06 Identification: 0x442c (17452) Flags: 0x00 0. ..0.. ..255... ... ... . = IG bit: Group add ress (multicast/bro adcast) Source: Western D_d0:f3:c2 (00:90:a 9:d0:f3:c2) Address: We sternD_d0:f3:c2 (00 :90:a9:d0:f3:c2) .. = Reserved bit: Not set ...0.

1\r\n] [Severi ty level: Chat] [Group: Sequence] Request Met hod: NOTIFY Request URI :* Request Ver sion: HTTP/1.2.250:1900\r\n CACHE-CONTROL: max-age=100\r\n LOCATION: http: //192.6.255.250) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] User Datagram Proto col.168.6\r\n .250 (239.xml\r\n NT: urn:schemas -wd-com:device:WdNA S-DEV_0064:1\r\n NTS: ssdp:alive \r\n SERVER: Linux/3 .2 55.13) Destination: 23 9.1 HOST: 239.0.1\r\n [Expert Inf o (Chat/Sequence): NOTIFY * HTTP/1.26.13:4915 3/nasdevice.255. Src Port: 5865 7 (58657).168.1. UPnP/1. Dst Port : ssdp (1900) Source Port: 58 657 (58657) Destination Por t: ssdp (1900) Length: 386 Checksum: 0x2d7 2 [validation disab led] [Good Check sum: False] [Bad Checks um: False] [Stream index: 1] Hypertext Transfer Protocol NOTIFY * HTTP/1 .: 0xbf7b [validatio n disabled] [Good: Fals e] [Bad: False ] Source: pc9.255.255. Po rtable SDK for UPnP devices/1.1.1\r \n] [NOTIFY * HTTP/1. 255.hom e (192.

...E....NT: urn: 00b0 73 63 68 65 6 d 61 73 2d 77 64 2d 63 6f 6d 3a 64 s chemas-wd-com:d 00c0 65 76 69 63 6 5 3a 57 64 4e 41 53 2d 44 45 56 5f e vice:WdNAS-DEV_ 00d0 30 30 36 34 3 a 31 0d 0a 4e 54 53 3a 20 73 73 64 0 064:1.255. 0020 ff fa e5 21 0 7 6c 01 82 2d 72 4e 4f 54 49 46 59 .250:1900*] 0000 01 00 5e 7f f f fa 00 90 a9 d0 f3 c2 08 00 45 00 . .. ..255..CACHE-C 0060 4f 4e 54 52 4 f 4c 3a 20 6d 61 78 2d 61 67 65 3d O NTROL: max-age= 0070 31 30 30 0d 0 a 4c 4f 43 41 54 49 4f 4e 3a 20 68 1 00..l....HOS 0040 54 3a 20 32 3 3 39 2e 32 35 35 2e 32 35 35 2e 32 T : 239...^.-rNOTIFY 0030 20 2a 20 48 5 4 54 50 2f 31 2e 31 0d 0a 48 4f 53 * HTTP/1..xml.2 0050 35 30 3a 31 3 9 30 30 0d 0a 43 41 43 48 45 2d 43 5 0:1900. 255..NTS: ssd .. .1.1.D.. 0010 01 96 44 2c 0 0 00 04 11 bf 7b c0 a8 01 0d ef ff .168.X-User-Agent: r edsonic\r\n USN: uuid:73656 761-7465-7375-636b0090a9d0f3c2::urn:s chemas-wd-com:devic e:WdNAS-DEV_0064:1\ r\n \r\n [Full request U RI: http://239.. 0090 31 33 3a 34 3 9 31 35 33 2f 6e 61 73 64 65 76 69 1 3:49153/nasdevi 00a0 63 65 2e 78 6 d 6c 0d 0a 4e 54 3a 20 75 72 6e 3a c e.LOCATION: h 0080 74 74 70 3a 2 f 2f 31 39 32 2e 31 36 38 2e 31 2e t tp://192....!.255.{.....

6.X0130 55 73 65 72 2 d 41 67 65 6e 74 3a 20 72 65 64 73 U ser-Agent: reds 0140 6f 6e 69 63 0 d 0a 55 53 4e 3a 20 75 75 69 64 3a o nic.USN: uuid: 0150 37 33 36 35 3 6 37 36 31 2d 37 34 36 35 2d 37 33 7 3656761-7465-73 0160 37 35 2d 36 3 3 36 62 2d 30 30 39 30 61 39 64 30 7 5-636b-0090a9d0 0170 66 33 63 32 3 a 3a 75 72 6e 3a 73 63 68 65 6d 61 f 3c2::urn:schema 0180 73 2d 77 64 2 d 63 6f 6d 3a 64 65 76 69 63 65 3a s -wd-com:device: 0190 57 64 4e 41 5 3 2d 44 45 56 5f 30 30 36 34 3a 31 W dNAS-DEV_0064:1 01a0 0d 0a 0d 0a ...6. U 0100 50 6e 50 2f 3 1 2e 30 2c 20 50 6f 72 74 61 62 6c P nP/1.00e0 70 3a 61 6c 6 9 76 65 0d 0a 53 45 52 56 45 52 3a p :alive.. No.0.SERVER: 00f0 20 4c 69 6e 7 5 78 2f 33 2e 32 2e 32 36 2c 20 55 Linux/3.2.dllstx01.corexc hange.26.. Time Source Destination Protocol Length Info 120 4.. .com pc13. Portabl 0110 65 20 53 44 4 b 20 66 6f 72 20 55 50 6e 50 20 64 e SDK for UPnP d 0120 65 76 69 63 6 5 73 2f 31 2e 36 2e 36 0d 0a 58 2d e vices/1.483646000 cust-74-124-12138.home TCP 1314 http→49 574 [ACK] Seq=71898 Ack=1 Win=46 Len=1 260 Frame 120: 1314 byt .

.. = LG bit: Globally unique address (fac .533576000 s econds [Time delta fro m previous captured frame: 0. .. . ..483646000 sec onds] Frame Number: 1 20 Frame Length: 1 314 bytes (10512 bi ts) Capture Length: 1314 bytes (10512 bits) [Frame is marke d: False] [Frame is ignor ed: False] [Protocols in f rame: eth:ethertype :ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp ..000 000000 seconds] Epoch Time: 141 5615217.es on wire (10512 b its).042949000 seconds] [Time delta fro m previous displaye d frame: 0..533576000 Romance Standard Time [Time shift for this packet: 0..04294900 0 seconds] [Time since ref erence or first fra me: 4.. 2014 11:26:5 7..0... . 1314 bytes ca ptured (10512 bits) on interface 0 Interface id: 0 (\Device\NPF_{12F8 8443-390D-4509-8D2B -440395E44894}) Encapsulation t ype: Ethernet (1) Arrival Time: N ov 10... .port == 80 || http 2] Ethernet II. Src: S agemcom_d0:17:e1 (9 0:01:3b:d0:17:e1).... Dst: AsustekC_7f:64 :78 (08:60:6e:7f:64 :78) Destination: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) Address: As ustekC_7f:64:78 (08 :60:6e:7f:64:78) .

. ... . = Don't fragment: Se t ....138).12. = IG bit: Individua l address (unicast) Type: IP (0x080 0) Internet Protocol V ersion 4. ...corexchange...tory default) ... . Src: cust -74-124-12-138. .... ....dlls tx01. . = More fragments: No t set Fragment offset :0 Time to live: 4 9 Protocol: TCP ( 6) .1.. = IG bit: Individua l address (unicast) Source: Sagemco m_d0:17:e1 (90:01:3 b:d0:17:e1) Address: Sa gemcom_d0:17:e1 (90 :01:3b:d0:17:e1) .. . ..co m (74. = Reserved bit: Not set .. Dst: pc13.home (192 .168...00 = Explicit Congestio n Notification: Not -ECT (Not ECN-Capab le Transport) (0x00 ) Total Length: 1 300 Identification: 0xf1b3 (61875) Flags: 0x02 (Do n't Fragment) 0. .0 . ... = Differentiated Ser vices Codepoint: De fault (0x00) .......... ... ECN: 0x00: NotECT (Not ECN-Capabl e Transport)) 0000 00. ... ....124....1..0. = LG bit: Globally unique address (fac tory default) . ...0 .... ... ..... ...... ..11) Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x0 0 (DSCP 0x00: Defau lt. ..0..

.0......168. Seq: 71898..124. ... Src Por t: http (80).... . .. Dst P ort: 49574 (49574). .. 0000 0001 0000 = Flags: 0x010 (ACK) 000... . .. ....dllstx0 1. .....com ( 74. .... . Len: 1260 Source Port: ht tp (80) Destination Por t: 49574 (49574) [Stream index: 0] [TCP Segment Le n: 1260] Sequence number : 71898 (relativ e sequence number) [Next sequence number: 73158 (r elative sequence nu mber)] Acknowledgment number: 1 (relat ive ack number) Header Length: 20 bytes . 0.. .home (192.0 . = Push: Not set . = Congestion Wi ndow Reduced (CWR): Not set ...0...138) Destination: pc 13....Header checksum : 0x3a77 [validatio n disabled] [Good: Fals e] [Bad: False ] Source: cust-74 -124-12-138.. = Reserved: Not set . = Acknowledgmen t: Set ... ... = Urgent: Not s et ... .. . = ECN-Echo: Not set ... .. Ack: 1 .....1 . . ..1.. = Nonce: Not se t . .12..corexchange.. .. 11) [Source GeoIP: Unknown] [Destination Ge oIP: Unknown] Transmission Contro l Protocol. 0 .

....n . .J 00a0 0c e5 e9 81 7 9 95 a9 01 9c 3d 30 .. 0060 bc 78 5c a2 9 7 d2 80 57 12 a2 1d 6e 20 08 f8 76 ...v 0070 46 9b 87 99 6 6 88 f6 41 50 3f d8 56 9e 9a 7b 88 F . . .{.0 = Fin: Not set Window size val ue: 46 [Calculated win dow size: 46] [Window size sc aling factor: -1 (u nknown)] Checksum: 0x151 e [validation disab led] [Good Check sum: False] [Bad Checks um: False] Urgent pointer: 0 [SEQ/ACK analys is