C :\U sers\U ser\D ow nloads\intro-w ireshark-trace1.

pcap 651 total packets, 4 show n

No. Time Source Destination Protocol Length Info

286 2021/028 02:22:53 10.0.0.44 128.119.245.12 HTTP 904 GET /wireshark-labs/INTRO-wireshark-file1.html
HTTP/1.1
Frame 286: 904 bytes on wire (7232 bits), 904 bytes captured (7232 bits)
Ethernet II, Src: Apple_98:d9:27 (78:4f:43:98:d9:27), Dst: Maxlinea_80:00:00 (00:50:f1:80:00:00)
Internet Protocol Version 4, Src: 10.0.0.44, Dst: 128.119.245.12
Transmission Control Protocol, Src Port: 53962, Dst Port: 80, Seq: 1, Ack: 1, Len: 838
Source Port: 53962
Destination Port: 80
[Stream index: 5]
[Conversation completeness: Incomplete, DATA (15)]
[TCP Segment Len: 838]
Sequence Number: 1 (relative sequence number)
Sequence Number (raw): 1105091364
[Next Sequence Number: 839 (relative sequence number)]
Acknowledgment Number: 1 (relative ack number)
Acknowledgment number (raw): 3934899257
1000 .... = Header Length: 32 bytes (8)
Flags: 0x018 (PSH, ACK)
Window: 2058
[Calculated window size: 131712]
[Window size scaling factor: 64]
Checksum: 0x9def [unverified]
[Checksum Status: Unverified]
Urgent Pointer: 0
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[Timestamps]
[SEQ/ACK analysis]
TCP payload (838 bytes)
Hypertext Transfer Protocol
GET /wireshark-labs/INTRO-wireshark-file1.html HTTP/1.1\r\n
[Expert Info (Chat/Sequence): GET /wireshark-labs/INTRO-wireshark-file1.html HTTP/1.1\r\n]
[GET /wireshark-labs/INTRO-wireshark-file1.html HTTP/1.1\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: GET
Request URI: /wireshark-labs/INTRO-wireshark-file1.html
Request Version: HTTP/1.1
Host: gaia.cs.umass.edu\r\n
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:84.0) Gecko/20100101 Firefox/84.0\r\n
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\n
Accept-Language: en-US,en;q=0.5\r\n
Accept-Encoding: gzip, deflate\r\n
DNT: 1\r\n
Connection: keep-alive\r\n
[truncated]Cookie: _ga=GA1.2.539094814.1610028235; _fbp=fb.1.1581132068304.462218827; _hjid=721b807f-ada0-4c94-9043-2eb27649f9ca;
__utma=256026397.1028181125.1581132067.1591882172.1592821633.16; __hstc=105286364.d3fd391638592931a16c5b7b6
Cookie pair: _ga=GA1.2.539094814.1610028235
Cookie pair: _fbp=fb.1.1581132068304.462218827
Cookie pair: _hjid=721b807f-ada0-4c94-9043-2eb27649f9ca
Cookie pair: __utma=256026397.1028181125.1581132067.1591882172.1592821633.16
Cookie pair: __hstc=105286364.d3fd391638592931a16c5b7b6597e858.1594774327890.1611173216083.1611582561401.5
Cookie pair: hubspotutk=d3fd391638592931a16c5b7b6597e858
Cookie pair: _gcl_au=1.1.376140751.1604588637
Cookie pair: nmstat=77fbdeba-976e-24bf-cea5-c9ff2bc254f5
Cookie pair: _gid=GA1.2.595525379.1611580770
Cookie pair: __hssrc=1
Upgrade-Insecure-Requests: 1\r\n
\r\n
[Full request URI: http://gaia.cs.umass.edu/wireshark-labs/INTRO-wireshark-file1.html]
[HTTP request 1/1]
[Response in frame: 288]
No. Time Source Destination Protocol Length Info
288 2021/028 02:22:53 128.119.245.12 10.0.0.44 HTTP 504 HTTP/1.1 200 OK (text/html)
Frame 288: 504 bytes on wire (4032 bits), 504 bytes captured (4032 bits)
Ethernet II, Src: Maxlinea_80:00:00 (00:50:f1:80:00:00), Dst: Apple_98:d9:27 (78:4f:43:98:d9:27)
Internet Protocol Version 4, Src: 128.119.245.12, Dst: 10.0.0.44
Transmission Control Protocol, Src Port: 80, Dst Port: 53962, Seq: 1, Ack: 839, Len: 438
Source Port: 80
Destination Port: 53962
[Stream index: 5]
[Conversation completeness: Incomplete, DATA (15)]
[TCP Segment Len: 438]
Sequence Number: 1 (relative sequence number)
Sequence Number (raw): 3934899257
[Next Sequence Number: 439 (relative sequence number)]
Acknowledgment Number: 839 (relative ack number)
Acknowledgment number (raw): 1105092202
1000 .... = Header Length: 32 bytes (8)
Flags: 0x018 (PSH, ACK)
C :\U sers\U ser\D ow nloads\intro-w ireshark-trace1.pcap 651 total packets, 4 show n

Window: 240
[Calculated window size: 30720]
[Window size scaling factor: 128]
Checksum: 0xe859 [unverified]
[Checksum Status: Unverified]
Urgent Pointer: 0
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[Timestamps]
[SEQ/ACK analysis]
TCP payload (438 bytes)
Hypertext Transfer Protocol
HTTP/1.1 200 OK\r\n
[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]
[HTTP/1.1 200 OK\r\n]
[Severity level: Chat]
[Group: Sequence]
Response Version: HTTP/1.1
Status Code: 200
[Status Code Description: OK]
Response Phrase: OK
Date: Wed, 27 Jan 2021 19:22:53 GMT\r\n
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.14 mod_perl/2.0.11 Perl/v5.16.3\r\n
Last-Modified: Wed, 27 Jan 2021 06:59:01 GMT\r\n
ETag: "51-5b9dc4e514f50"\r\n
Accept-Ranges: bytes\r\n
Content-Length: 81\r\n
[Content length: 81]
Keep-Alive: timeout=5, max=100\r\n
Connection: Keep-Alive\r\n
Content-Type: text/html; charset=UTF-8\r\n
\r\n
[HTTP response 1/1]
[Time since request: 0.028885000 seconds]
[Request in frame: 286]
[Request URI: http://gaia.cs.umass.edu/wireshark-labs/INTRO-wireshark-file1.html]
File Data: 81 bytes
Line-based text data: text/html (3 lines)
No. Time Source Destination Protocol Length Info
290 2021/028 02:22:54 10.0.0.44 128.119.245.12 HTTP 861 GET /favicon.ico HTTP/1.1
Frame 290: 861 bytes on wire (6888 bits), 861 bytes captured (6888 bits)
Ethernet II, Src: Apple_98:d9:27 (78:4f:43:98:d9:27), Dst: Maxlinea_80:00:00 (00:50:f1:80:00:00)
Internet Protocol Version 4, Src: 10.0.0.44, Dst: 128.119.245.12
Transmission Control Protocol, Src Port: 53961, Dst Port: 80, Seq: 1, Ack: 1, Len: 795
Source Port: 53961
Destination Port: 80
[Stream index: 4]
[Conversation completeness: Incomplete, DATA (15)]
[TCP Segment Len: 795]
Sequence Number: 1 (relative sequence number)
Sequence Number (raw): 2044392382
[Next Sequence Number: 796 (relative sequence number)]
Acknowledgment Number: 1 (relative ack number)
Acknowledgment number (raw): 1587871749
1000 .... = Header Length: 32 bytes (8)
Flags: 0x018 (PSH, ACK)
Window: 2058
[Calculated window size: 131712]
[Window size scaling factor: 64]
Checksum: 0xb246 [unverified]
[Checksum Status: Unverified]
Urgent Pointer: 0
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[Timestamps]
[SEQ/ACK analysis]
TCP payload (795 bytes)
Hypertext Transfer Protocol
GET /favicon.ico HTTP/1.1\r\n
[Expert Info (Chat/Sequence): GET /favicon.ico HTTP/1.1\r\n]
[GET /favicon.ico HTTP/1.1\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: GET
Request URI: /favicon.ico
Request Version: HTTP/1.1
Host: gaia.cs.umass.edu\r\n
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:84.0) Gecko/20100101 Firefox/84.0\r\n
Accept: image/webp,*/*\r\n
Accept-Language: en-US,en;q=0.5\r\n
Accept-Encoding: gzip, deflate\r\n
DNT: 1\r\n
C :\U sers\U ser\D ow nloads\intro-w ireshark-trace1.pcap 651 total packets, 4 show n

Connection: keep-alive\r\n
Referer: http://gaia.cs.umass.edu/wireshark-labs/INTRO-wireshark-file1.html\r\n
[truncated]Cookie: _ga=GA1.2.539094814.1610028235; _fbp=fb.1.1581132068304.462218827; _hjid=721b807f-ada0-4c94-9043-2eb27649f9ca;
__utma=256026397.1028181125.1581132067.1591882172.1592821633.16; __hstc=105286364.d3fd391638592931a16c5b7b6
Cookie pair: _ga=GA1.2.539094814.1610028235
Cookie pair: _fbp=fb.1.1581132068304.462218827
Cookie pair: _hjid=721b807f-ada0-4c94-9043-2eb27649f9ca
Cookie pair: __utma=256026397.1028181125.1581132067.1591882172.1592821633.16
Cookie pair: __hstc=105286364.d3fd391638592931a16c5b7b6597e858.1594774327890.1611173216083.1611582561401.5
Cookie pair: hubspotutk=d3fd391638592931a16c5b7b6597e858
Cookie pair: _gcl_au=1.1.376140751.1604588637
Cookie pair: nmstat=77fbdeba-976e-24bf-cea5-c9ff2bc254f5
Cookie pair: _gid=GA1.2.595525379.1611580770
Cookie pair: __hssrc=1
\r\n
[Full request URI: http://gaia.cs.umass.edu/favicon.ico]
[HTTP request 1/1]
[Response in frame: 292]
No. Time Source Destination Protocol Length Info
292 2021/028 02:22:54 128.119.245.12 10.0.0.44 HTTP 551 HTTP/1.1 404 Not Found (text/html)
Frame 292: 551 bytes on wire (4408 bits), 551 bytes captured (4408 bits)
Ethernet II, Src: Maxlinea_80:00:00 (00:50:f1:80:00:00), Dst: Apple_98:d9:27 (78:4f:43:98:d9:27)
Internet Protocol Version 4, Src: 128.119.245.12, Dst: 10.0.0.44
Transmission Control Protocol, Src Port: 80, Dst Port: 53961, Seq: 1, Ack: 796, Len: 485
Source Port: 80
Destination Port: 53961
[Stream index: 4]
[Conversation completeness: Incomplete, DATA (15)]
[TCP Segment Len: 485]
Sequence Number: 1 (relative sequence number)
Sequence Number (raw): 1587871749
[Next Sequence Number: 486 (relative sequence number)]
Acknowledgment Number: 796 (relative ack number)
Acknowledgment number (raw): 2044393177
1000 .... = Header Length: 32 bytes (8)
Flags: 0x018 (PSH, ACK)
Window: 239
[Calculated window size: 30592]
[Window size scaling factor: 128]
Checksum: 0x7c49 [unverified]
[Checksum Status: Unverified]
Urgent Pointer: 0
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[Timestamps]
[SEQ/ACK analysis]
TCP payload (485 bytes)
Hypertext Transfer Protocol
HTTP/1.1 404 Not Found\r\n
[Expert Info (Chat/Sequence): HTTP/1.1 404 Not Found\r\n]
[HTTP/1.1 404 Not Found\r\n]
[Severity level: Chat]
[Group: Sequence]
Response Version: HTTP/1.1
Status Code: 404
[Status Code Description: Not Found]
Response Phrase: Not Found
Date: Wed, 27 Jan 2021 19:22:54 GMT\r\n
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.14 mod_perl/2.0.11 Perl/v5.16.3\r\n
Content-Length: 209\r\n
[Content length: 209]
Keep-Alive: timeout=5, max=100\r\n
Connection: Keep-Alive\r\n
Content-Type: text/html; charset=iso-8859-1\r\n
\r\n
[HTTP response 1/1]
[Time since request: 0.023968000 seconds]
[Request in frame: 290]
[Request URI: http://gaia.cs.umass.edu/favicon.ico]
File Data: 209 bytes
Line-based text data: text/html (7 lines)