Ethereal-users: [Ethereal-users] Skinny Capture!

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Sarbeswsar Mohapatra" <smohapatra@xxxxxxxxxxxxxxx>
Date: Fri, 2 May 2003 22:29:21 -0500
Title: Message
Greetings,
I am new to SKINNY protocol, I have created a simple message "StationRegisterAckMessage" with following data,
 
  0: 00 00 00 10 00 00 00 00      00 81 00 00 00 00 00 00      ................
 16: 00 00 00 00 00 00 00 00          ........
 
I established a client-server connection between two machines and sent the above message from server and client in two different instances. Ran the ethereal in both the machines and captured all TCP packet. When I filtered SKINNY protocol it does not filter anything, where as I see the packet in the TCP filter. I have attached the ethereal capture for reference. Can anybody tell me , if I am making any mistake.
 
Ethereal - 0.9.4
OS - Windows XP, NT.
 
Thanks in advance.
 
Regards
Sarbeswar
Frame 7 (78 on wire, 78 captured)
    Arrival Time: May  2, 2003 22:25:52.872749000
    Time delta from previous packet: 0.000000000 seconds
    Time relative to first packet: 2.708443000 seconds
    Frame Number: 7
    Packet Length: 78 bytes
    Capture Length: 78 bytes
Ethernet II
    Destination: 00:a0:c9:65:ca:a8 (PC58)
    Source: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Type: IP (0x0800)
Internet Protocol, Src Addr: ACCORD.mshome.net (192.1.2.200), Dst Addr: PC58 (192.1.2.239)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 64
    Identification: 0x8823
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xecda (correct)
    Source: ACCORD.mshome.net (192.1.2.200)
    Destination: PC58 (192.1.2.239)
Transmission Control Protocol, Src Port: 2000 (2000), Dst Port: 1692 (1692), Seq: 1639652186, Ack: 306716705, Len: 24
    Source port: 2000 (2000)
    Destination port: 1692 (1692)
    Sequence number: 1639652186
    Next sequence number: 1639652210
    Acknowledgement number: 306716705
    Header length: 20 bytes
    Flags: 0x0018 (PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 5840
    Checksum: 0x85ec (incorrect, should be 0x54af)
Data (24 bytes)

0000  00 a0 c9 65 ca a8 00 06 5b d8 ec 66 08 00 45 00   ...e....[..f..E.
0010  00 40 88 23 40 00 80 06 ec da c0 01 02 c8 c0 01   .@.#@...........
0020  02 ef 07 d0 06 9c 61 bb 1b 5a 12 48 20 21 50 18   ......a..Z.H !P.
0030  16 d0 85 ec 00 00 00 00 00 10 00 00 00 00 00 81   ................
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00         ..............  

Frame 8 (60 on wire, 60 captured)
    Arrival Time: May  2, 2003 22:25:52.873316000
    Time delta from previous packet: 0.000567000 seconds
    Time relative to first packet: 2.709010000 seconds
    Frame Number: 8
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II
    Destination: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Source: 00:a0:c9:65:ca:a8 (PC58)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol, Src Addr: PC58 (192.1.2.239), Dst Addr: ACCORD.mshome.net (192.1.2.200)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0x938a
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xe18b (correct)
    Source: PC58 (192.1.2.239)
    Destination: ACCORD.mshome.net (192.1.2.200)
Transmission Control Protocol, Src Port: 1692 (1692), Dst Port: 2000 (2000), Seq: 306716705, Ack: 303719479, Len: 0
    Source port: 1692 (1692)
    Destination port: 2000 (2000)
    Sequence number: 306716705
    Header length: 20 bytes
    Flags: 0x0004 (RST)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .1.. = Reset: Set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 0
    Checksum: 0x7300 (correct)

0000  00 06 5b d8 ec 66 00 a0 c9 65 ca a8 08 00 45 00   ..[..f...e....E.
0010  00 28 93 8a 40 00 80 06 e1 8b c0 01 02 ef c0 01   .(..@...........
0020  02 c8 06 9c 07 d0 12 48 20 21 12 1a 64 37 50 04   .......H !..d7P.
0030  00 00 73 00 00 00 00 00 00 00 00 00               ..s.........    

Frame 12 (60 on wire, 60 captured)
    Arrival Time: May  2, 2003 22:25:55.485294000
    Time delta from previous packet: 2.611978000 seconds
    Time relative to first packet: 5.320988000 seconds
    Frame Number: 12
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II
    Destination: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Source: 00:a0:c9:65:ca:a8 (PC58)
    Type: IP (0x0800)
    Trailer: 0000
Internet Protocol, Src Addr: PC58 (192.1.2.239), Dst Addr: ACCORD.mshome.net (192.1.2.200)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 44
    Identification: 0xbb8a
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xb987 (correct)
    Source: PC58 (192.1.2.239)
    Destination: ACCORD.mshome.net (192.1.2.200)
Transmission Control Protocol, Src Port: 1693 (1693), Dst Port: 2000 (2000), Seq: 306966793, Ack: 0, Len: 0
    Source port: 1693 (1693)
    Destination port: 2000 (2000)
    Sequence number: 306966793
    Header length: 24 bytes
    Flags: 0x0002 (SYN)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..1. = Syn: Set
        .... ...0 = Fin: Not set
    Window size: 8192
    Checksum: 0xe0aa (correct)
    Options: (4 bytes)
        Maximum segment size: 1460 bytes

0000  00 06 5b d8 ec 66 00 a0 c9 65 ca a8 08 00 45 00   ..[..f...e....E.
0010  00 2c bb 8a 40 00 80 06 b9 87 c0 01 02 ef c0 01   .,..@...........
0020  02 c8 06 9d 07 d0 12 4b f1 09 00 00 00 00 60 02   .......K......`.
0030  20 00 e0 aa 00 00 02 04 05 b4 00 00                ...........    

Frame 13 (58 on wire, 58 captured)
    Arrival Time: May  2, 2003 22:25:55.485477000
    Time delta from previous packet: 0.000183000 seconds
    Time relative to first packet: 5.321171000 seconds
    Frame Number: 13
    Packet Length: 58 bytes
    Capture Length: 58 bytes
Ethernet II
    Destination: 00:a0:c9:65:ca:a8 (PC58)
    Source: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Type: IP (0x0800)
Internet Protocol, Src Addr: ACCORD.mshome.net (192.1.2.200), Dst Addr: PC58 (192.1.2.239)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 44
    Identification: 0x8c18
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xe8f9 (correct)
    Source: ACCORD.mshome.net (192.1.2.200)
    Destination: PC58 (192.1.2.239)
Transmission Control Protocol, Src Port: 2000 (2000), Dst Port: 1693 (1693), Seq: 1703023731, Ack: 306966794, Len: 0
    Source port: 2000 (2000)
    Destination port: 1693 (1693)
    Sequence number: 1703023731
    Acknowledgement number: 306966794
    Header length: 24 bytes
    Flags: 0x0012 (SYN, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..1. = Syn: Set
        .... ...0 = Fin: Not set
    Window size: 5840
    Checksum: 0x6fd4 (correct)
    Options: (4 bytes)
        Maximum segment size: 1460 bytes

0000  00 a0 c9 65 ca a8 00 06 5b d8 ec 66 08 00 45 00   ...e....[..f..E.
0010  00 2c 8c 18 40 00 80 06 e8 f9 c0 01 02 c8 c0 01   .,..@...........
0020  02 ef 07 d0 06 9d 65 82 14 73 12 4b f1 0a 60 12   ......e..s.K..`.
0030  16 d0 6f d4 00 00 02 04 05 b4                     ..o.......      

Frame 14 (60 on wire, 60 captured)
    Arrival Time: May  2, 2003 22:25:55.485658000
    Time delta from previous packet: 0.000181000 seconds
    Time relative to first packet: 5.321352000 seconds
    Frame Number: 14
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II
    Destination: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Source: 00:a0:c9:65:ca:a8 (PC58)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol, Src Addr: PC58 (192.1.2.239), Dst Addr: ACCORD.mshome.net (192.1.2.200)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0xbc8a
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xb88b (correct)
    Source: PC58 (192.1.2.239)
    Destination: ACCORD.mshome.net (192.1.2.200)
Transmission Control Protocol, Src Port: 1693 (1693), Dst Port: 2000 (2000), Seq: 306966794, Ack: 1703023732, Len: 0
    Source port: 1693 (1693)
    Destination port: 2000 (2000)
    Sequence number: 306966794
    Acknowledgement number: 1703023732
    Header length: 20 bytes
    Flags: 0x0010 (ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 8760
    Checksum: 0x7c29 (correct)

0000  00 06 5b d8 ec 66 00 a0 c9 65 ca a8 08 00 45 00   ..[..f...e....E.
0010  00 28 bc 8a 40 00 80 06 b8 8b c0 01 02 ef c0 01   .(..@...........
0020  02 c8 06 9d 07 d0 12 4b f1 0a 65 82 14 74 50 10   .......K..e..tP.
0030  22 38 7c 29 00 00 00 00 00 00 00 00               "8|)........    

Frame 16 (78 on wire, 78 captured)
    Arrival Time: May  2, 2003 22:25:56.600517000
    Time delta from previous packet: 1.114859000 seconds
    Time relative to first packet: 6.436211000 seconds
    Frame Number: 16
    Packet Length: 78 bytes
    Capture Length: 78 bytes
Ethernet II
    Destination: 00:a0:c9:65:ca:a8 (PC58)
    Source: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Type: IP (0x0800)
Internet Protocol, Src Addr: ACCORD.mshome.net (192.1.2.200), Dst Addr: PC58 (192.1.2.239)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 64
    Identification: 0x8d03
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xe7fa (correct)
    Source: ACCORD.mshome.net (192.1.2.200)
    Destination: PC58 (192.1.2.239)
Transmission Control Protocol, Src Port: 2000 (2000), Dst Port: 1693 (1693), Seq: 1703023732, Ack: 306966794, Len: 24
    Source port: 2000 (2000)
    Destination port: 1693 (1693)
    Sequence number: 1703023732
    Next sequence number: 1703023756
    Acknowledgement number: 306966794
    Header length: 20 bytes
    Flags: 0x0018 (PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 5840
    Checksum: 0x85ec (incorrect, should be 0x86e0)
Data (24 bytes)

0000  00 a0 c9 65 ca a8 00 06 5b d8 ec 66 08 00 45 00   ...e....[..f..E.
0010  00 40 8d 03 40 00 80 06 e7 fa c0 01 02 c8 c0 01   .@..@...........
0020  02 ef 07 d0 06 9d 65 82 14 74 12 4b f1 0a 50 18   ......e..t.K..P.
0030  16 d0 85 ec 00 00 00 00 00 10 00 00 00 00 00 81   ................
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00         ..............  

Frame 17 (60 on wire, 60 captured)
    Arrival Time: May  2, 2003 22:25:56.601172000
    Time delta from previous packet: 0.000655000 seconds
    Time relative to first packet: 6.436866000 seconds
    Frame Number: 17
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II
    Destination: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Source: 00:a0:c9:65:ca:a8 (PC58)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol, Src Addr: PC58 (192.1.2.239), Dst Addr: ACCORD.mshome.net (192.1.2.200)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0xc38a
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xb18b (correct)
    Source: PC58 (192.1.2.239)
    Destination: ACCORD.mshome.net (192.1.2.200)
Transmission Control Protocol, Src Port: 1693 (1693), Dst Port: 2000 (2000), Seq: 306966794, Ack: 303719479, Len: 0
    Source port: 1693 (1693)
    Destination port: 2000 (2000)
    Sequence number: 306966794
    Header length: 20 bytes
    Flags: 0x0004 (RST)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .1.. = Reset: Set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 0
    Checksum: 0xa212 (correct)

0000  00 06 5b d8 ec 66 00 a0 c9 65 ca a8 08 00 45 00   ..[..f...e....E.
0010  00 28 c3 8a 40 00 80 06 b1 8b c0 01 02 ef c0 01   .(..@...........
0020  02 c8 06 9d 07 d0 12 4b f1 0a 12 1a 64 37 50 04   .......K....d7P.
0030  00 00 a2 12 00 00 00 00 00 00 00 00               ............    

Frame 19 (60 on wire, 60 captured)
    Arrival Time: May  2, 2003 22:26:00.490961000
    Time delta from previous packet: 3.889789000 seconds
    Time relative to first packet: 10.326655000 seconds
    Frame Number: 19
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II
    Destination: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Source: 00:a0:c9:65:ca:a8 (PC58)
    Type: IP (0x0800)
    Trailer: 0000
Internet Protocol, Src Addr: PC58 (192.1.2.239), Dst Addr: ACCORD.mshome.net (192.1.2.200)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 44
    Identification: 0xea8a
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0x8a87 (correct)
    Source: PC58 (192.1.2.239)
    Destination: ACCORD.mshome.net (192.1.2.200)
Transmission Control Protocol, Src Port: 1694 (1694), Dst Port: 2000 (2000), Seq: 306971766, Ack: 0, Len: 0
    Source port: 1694 (1694)
    Destination port: 2000 (2000)
    Sequence number: 306971766
    Header length: 24 bytes
    Flags: 0x0002 (SYN)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..1. = Syn: Set
        .... ...0 = Fin: Not set
    Window size: 8192
    Checksum: 0xcd3c (correct)
    Options: (4 bytes)
        Maximum segment size: 1460 bytes

0000  00 06 5b d8 ec 66 00 a0 c9 65 ca a8 08 00 45 00   ..[..f...e....E.
0010  00 2c ea 8a 40 00 80 06 8a 87 c0 01 02 ef c0 01   .,..@...........
0020  02 c8 06 9e 07 d0 12 4c 04 76 00 00 00 00 60 02   .......L.v....`.
0030  20 00 cd 3c 00 00 02 04 05 b4 00 00                ..<........    

Frame 20 (58 on wire, 58 captured)
    Arrival Time: May  2, 2003 22:26:00.491064000
    Time delta from previous packet: 0.000103000 seconds
    Time relative to first packet: 10.326758000 seconds
    Frame Number: 20
    Packet Length: 58 bytes
    Capture Length: 58 bytes
Ethernet II
    Destination: 00:a0:c9:65:ca:a8 (PC58)
    Source: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Type: IP (0x0800)
Internet Protocol, Src Addr: ACCORD.mshome.net (192.1.2.200), Dst Addr: PC58 (192.1.2.239)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 44
    Identification: 0x91a1
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xe370 (correct)
    Source: ACCORD.mshome.net (192.1.2.200)
    Destination: PC58 (192.1.2.239)
Transmission Control Protocol, Src Port: 2000 (2000), Dst Port: 1694 (1694), Seq: 1705200297, Ack: 306971767, Len: 0
    Source port: 2000 (2000)
    Destination port: 1694 (1694)
    Sequence number: 1705200297
    Acknowledgement number: 306971767
    Header length: 24 bytes
    Flags: 0x0012 (SYN, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..1. = Syn: Set
        .... ...0 = Fin: Not set
    Window size: 5840
    Checksum: 0x260f (correct)
    Options: (4 bytes)
        Maximum segment size: 1460 bytes

0000  00 a0 c9 65 ca a8 00 06 5b d8 ec 66 08 00 45 00   ...e....[..f..E.
0010  00 2c 91 a1 40 00 80 06 e3 70 c0 01 02 c8 c0 01   .,..@....p......
0020  02 ef 07 d0 06 9e 65 a3 4a a9 12 4c 04 77 60 12   ......e.J..L.w`.
0030  16 d0 26 0f 00 00 02 04 05 b4                     ..&.......      

Frame 21 (60 on wire, 60 captured)
    Arrival Time: May  2, 2003 22:26:00.491250000
    Time delta from previous packet: 0.000186000 seconds
    Time relative to first packet: 10.326944000 seconds
    Frame Number: 21
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II
    Destination: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Source: 00:a0:c9:65:ca:a8 (PC58)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol, Src Addr: PC58 (192.1.2.239), Dst Addr: ACCORD.mshome.net (192.1.2.200)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0xeb8a
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0x898b (correct)
    Source: PC58 (192.1.2.239)
    Destination: ACCORD.mshome.net (192.1.2.200)
Transmission Control Protocol, Src Port: 1694 (1694), Dst Port: 2000 (2000), Seq: 306971767, Ack: 1705200298, Len: 0
    Source port: 1694 (1694)
    Destination port: 2000 (2000)
    Sequence number: 306971767
    Acknowledgement number: 1705200298
    Header length: 20 bytes
    Flags: 0x0010 (ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 8760
    Checksum: 0x3264 (correct)

0000  00 06 5b d8 ec 66 00 a0 c9 65 ca a8 08 00 45 00   ..[..f...e....E.
0010  00 28 eb 8a 40 00 80 06 89 8b c0 01 02 ef c0 01   .(..@...........
0020  02 c8 06 9e 07 d0 12 4c 04 77 65 a3 4a aa 50 10   .......L.we.J.P.
0030  22 38 32 64 00 00 00 00 00 00 00 00               "82d........    

Frame 22 (78 on wire, 78 captured)
    Arrival Time: May  2, 2003 22:26:00.941341000
    Time delta from previous packet: 0.450091000 seconds
    Time relative to first packet: 10.777035000 seconds
    Frame Number: 22
    Packet Length: 78 bytes
    Capture Length: 78 bytes
Ethernet II
    Destination: 00:a0:c9:65:ca:a8 (PC58)
    Source: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Type: IP (0x0800)
Internet Protocol, Src Addr: ACCORD.mshome.net (192.1.2.200), Dst Addr: PC58 (192.1.2.239)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 64
    Identification: 0x91eb
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0xe312 (correct)
    Source: ACCORD.mshome.net (192.1.2.200)
    Destination: PC58 (192.1.2.239)
Transmission Control Protocol, Src Port: 2000 (2000), Dst Port: 1694 (1694), Seq: 1705200298, Ack: 306971767, Len: 24
    Source port: 2000 (2000)
    Destination port: 1694 (1694)
    Sequence number: 1705200298
    Next sequence number: 1705200322
    Acknowledgement number: 306971767
    Header length: 20 bytes
    Flags: 0x0018 (PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 5840
    Checksum: 0x85ec (incorrect, should be 0x3d1b)
Data (24 bytes)

0000  00 a0 c9 65 ca a8 00 06 5b d8 ec 66 08 00 45 00   ...e....[..f..E.
0010  00 40 91 eb 40 00 80 06 e3 12 c0 01 02 c8 c0 01   .@..@...........
0020  02 ef 07 d0 06 9e 65 a3 4a aa 12 4c 04 77 50 18   ......e.J..L.wP.
0030  16 d0 85 ec 00 00 00 00 00 10 00 00 00 00 00 81   ................
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00         ..............  

Frame 23 (60 on wire, 60 captured)
    Arrival Time: May  2, 2003 22:26:00.941963000
    Time delta from previous packet: 0.000622000 seconds
    Time relative to first packet: 10.777657000 seconds
    Frame Number: 23
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II
    Destination: 00:06:5b:d8:ec:66 (ACCORD.mshome.net)
    Source: 00:a0:c9:65:ca:a8 (PC58)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol, Src Addr: PC58 (192.1.2.239), Dst Addr: ACCORD.mshome.net (192.1.2.200)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0xf38a
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0x818b (correct)
    Source: PC58 (192.1.2.239)
    Destination: ACCORD.mshome.net (192.1.2.200)
Transmission Control Protocol, Src Port: 1694 (1694), Dst Port: 2000 (2000), Seq: 306971767, Ack: 303719479, Len: 0
    Source port: 1694 (1694)
    Destination port: 2000 (2000)
    Sequence number: 306971767
    Header length: 20 bytes
    Flags: 0x0004 (RST)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...0 .... = Acknowledgment: Not set
        .... 0... = Push: Not set
        .... .1.. = Reset: Set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 0
    Checksum: 0x8ea4 (correct)

0000  00 06 5b d8 ec 66 00 a0 c9 65 ca a8 08 00 45 00   ..[..f...e....E.
0010  00 28 f3 8a 40 00 80 06 81 8b c0 01 02 ef c0 01   .(..@...........
0020  02 c8 06 9e 07 d0 12 4c 04 77 12 1a 64 37 50 04   .......L.w..d7P.
0030  00 00 8e a4 00 00 00 00 00 00 00 00               ............