No. Time Source Destination Protocol Info 151 2.632363 172.18.179.48 208.117.224.240 TCP ada-cip > http [SYN] Seq=0 Win=65535 Len=0 MSS=1460 Frame 151 (62 bytes on wire, 62 bytes captured) Arrival Time: Oct 13, 2008 16:29:31.236590000 [Time delta from previous captured frame: 0.038476000 seconds] [Time delta from previous displayed frame: 2.632363000 seconds] [Time since reference or first frame: 2.632363000 seconds] Frame Number: 151 Frame Length: 62 bytes Capture Length: 62 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x3b7a (15226) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xaea4 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 0, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 0 (relative sequence number) Header length: 28 bytes Flags: 0x02 (SYN) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgment: Not set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x6c31 [correct] [Good Checksum: True] [Bad Checksum: False] Options: (8 bytes) Maximum segment size: 1460 bytes NOP NOP SACK permitted No. Time Source Destination Protocol Info 170 2.816888 208.117.224.240 172.18.179.48 TCP http > ada-cip [SYN, ACK] Seq=0 Ack=1 Win=8760 Len=0 MSS=1460 Frame 170 (62 bytes on wire, 62 bytes captured) Arrival Time: Oct 13, 2008 16:29:31.421115000 [Time delta from previous captured frame: 0.010271000 seconds] [Time delta from previous displayed frame: 0.184525000 seconds] [Time since reference or first frame: 2.816888000 seconds] Frame Number: 170 Frame Length: 62 bytes Capture Length: 62 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0xba49 (47689) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x72d5 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 0, Ack: 1, Len: 0 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 28 bytes Flags: 0x12 (SYN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 8760 Checksum: 0x70fc [correct] [Good Checksum: True] [Bad Checksum: False] Options: (8 bytes) Maximum segment size: 1460 bytes NOP NOP SACK permitted [SEQ/ACK analysis] [This is an ACK to the segment in frame: 151] [The RTT to ACK the segment was: 0.184525000 seconds] No. Time Source Destination Protocol Info 171 2.816910 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=1 Ack=1 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 171 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:31.421137000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 2.816910000 seconds] Frame Number: 171 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b88 (15240) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae9e [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xbff8 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 170] [The RTT to ACK the segment was: 0.000022000 seconds] No. Time Source Destination Protocol Info 172 2.817046 172.18.179.48 208.117.224.240 HTTP GET /get_video?video_id=oEkJvvGEtB4&ip=137.132.3.11&signature=57E3161CD70A3A51DBCA480A4859C8FABDD0A394.23AEF3FFE3C8FF8F9161C20E8CFBADC250A227BA&sver=2&expire=1223897370&key=yt4&ipbits=2 HTTP/1.1 Frame 172 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:31.421273000 [Time delta from previous captured frame: 0.000136000 seconds] [Time delta from previous displayed frame: 0.000136000 seconds] [Time since reference or first frame: 2.817046000 seconds] Frame Number: 172 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:http] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x3b89 (15241) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xa8e9 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 1, Ack: 1, Len: 1460 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 1 (relative sequence number) [Next sequence number: 1461 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x1678 [incorrect, should be 0x76d1 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Hypertext Transfer Protocol GET /get_video?video_id=oEkJvvGEtB4&ip=137.132.3.11&signature=57E3161CD70A3A51DBCA480A4859C8FABDD0A394.23AEF3FFE3C8FF8F9161C20E8CFBADC250A227BA&sver=2&expire=1223897370&key=yt4&ipbits=2 HTTP/1.1\r\n Request Method: GET Request URI: /get_video?video_id=oEkJvvGEtB4&ip=137.132.3.11&signature=57E3161CD70A3A51DBCA480A4859C8FABDD0A394.23AEF3FFE3C8FF8F9161C20E8CFBADC250A227BA&sver=2&expire=1223897370&key=yt4&ipbits=2 Request Version: HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.30 Safari/525.13\r\n Referer: http://www.youtube.com/watch?v=oEkJvvGEtB4\r\n Accept: */*\r\n [truncated] Cookie: VISITOR_INFO1_LIVE=7ZIsEeC10CI; __utmz=27069237.1221828300.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); LOGIN_INFO=f5d7bd97e3034cf1b1d0467c29e50249e3QgAAAAbV91c2VyX2lkX0FORF9zZXNzaW9uX251bWJlcl9tZDVzIAAAAGQyMzI5Mz No. Time Source Destination Protocol Info 173 2.817055 172.18.179.48 208.117.224.240 HTTP Continuation or non-HTTP traffic Frame 173 (1441 bytes on wire, 1441 bytes captured) Arrival Time: Oct 13, 2008 16:29:31.421282000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 2.817055000 seconds] Frame Number: 173 Frame Length: 1441 bytes Capture Length: 1441 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:http:data] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1427 Identification: 0x3b8a (15242) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xa931 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 1461, Ack: 1, Len: 1387 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 1461 (relative sequence number) [Next sequence number: 2848 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x162f [incorrect, should be 0x3d74 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Hypertext Transfer Protocol Data (1387 bytes) 0000 42 54 55 30 38 34 63 77 73 41 41 41 42 4e 56 54 BTU084cwsAAABNVT 0010 67 77 52 30 35 70 53 32 4a 4e 51 58 4d 4c 41 41 gwR05pS2JNQXMLAA 0020 41 41 4e 45 64 51 4c 57 39 6b 4c 58 6c 4c 4e 32 AANEdQLW9kLXlLN2 0030 74 7a 43 77 41 41 41 45 45 74 4f 57 6c 53 54 46 tzCwAAAEEtOWlSTF 0040 5a 50 63 57 49 30 63 77 73 41 41 41 42 4e 51 31 ZPcWI0cwsAAABNQ1 0050 41 35 54 44 68 71 64 30 74 4a 54 58 4d 4c 41 41 A5TDhqd0tJTXMLAA 0060 41 41 4f 45 59 31 51 6e 59 31 65 6e 56 73 64 55 AAOEY1QnY1enVsdU 0070 56 7a 43 77 41 41 41 46 64 48 65 6e 56 6c 64 6b VzCwAAAFdHenVldk 0080 6b 33 64 58 68 6a 63 77 73 41 41 41 42 4c 63 33 k3dXhjcwsAAABLc3 0090 56 61 65 6e 63 77 62 56 64 35 52 58 4d 4c 41 41 VaencwbVd5RXMLAA 00a0 41 41 54 56 4e 6d 64 55 70 56 4d 57 31 6f 57 6a AATVNmdUpVMW1oWj 00b0 68 7a 43 77 41 41 41 46 4e 77 4f 56 4a 68 56 32 hzCwAAAFNwOVJhV2 00c0 6c 4d 52 57 39 52 63 77 73 41 41 41 42 52 4e 45 lMRW9RcwsAAABRNE 00d0 55 30 4e 33 5a 48 55 6e 70 68 63 33 4d 4c 41 41 U0N3ZHUnphc3MLAA 00e0 41 41 62 32 64 43 57 47 39 6e 4e 6e 56 30 62 30 AAb2dCWG9nNnV0b0 00f0 31 7a 43 77 41 41 41 45 4d 79 61 31 4e 46 54 30 1zCwAAAEMya1NFT0 0100 52 4f 63 55 35 4a 63 77 73 41 41 41 41 78 54 6e ROcU5JcwsAAAAxTn 0110 4a 6a 64 6b 5a 59 5a 46 4a 6c 4d 48 4d 4c 41 41 JjdkZYZFJlMHMLAA 0120 41 41 56 55 52 59 62 54 41 31 4e 31 68 76 64 6e AAVURYbTA1N1hvdn 0130 64 7a 43 77 41 41 41 46 39 30 52 7a 52 74 58 32 dzCwAAAF90RzRtX2 0140 35 54 5a 58 70 6e 63 77 73 41 41 41 42 71 5a 7a 5TZXpncwsAAABqZz 0150 4a 54 53 58 6c 52 5a 6b 31 6b 53 58 4d 4c 41 41 JTSXlRZk1kSXMLAA 0160 41 41 53 30 39 6b 51 6d 39 6d 63 6b 46 73 57 47 AAS09kQm9mckFsWG 0170 64 7a 43 77 41 41 41 45 78 76 53 55 64 50 59 69 dzCwAAAExvSUdPYi 0180 31 69 4f 58 56 33 63 77 73 41 41 41 41 31 55 54 1iOXV3cwsAAAA1UT 0190 42 50 4d 58 70 47 57 57 64 6e 4e 48 4d 4c 41 41 BPMXpGWWdnNHMLAA 01a0 41 41 5a 6c 67 77 52 6c 68 6f 56 32 6c 6a 52 55 AAZlgwRlhoV2ljRU 01b0 6c 7a 43 77 41 41 41 47 46 44 4f 55 56 32 61 46 lzCwAAAGFDOUV2aF 01c0 39 54 55 32 52 4a 63 77 73 41 41 41 42 7a 53 58 9TU2RJcwsAAABzSX 01d0 41 33 4e 31 42 56 64 6b 78 55 52 58 4d 4c 41 41 A3N1BVdkxURXMLAA 01e0 41 41 4d 33 6c 6e 63 6a 68 51 56 48 4a 6e 52 7a AAM3lncjhQVHJnRz 01f0 42 7a 43 77 41 41 41 45 6c 35 53 45 51 34 62 58 BzCwAAAEl5SEQ4bX 0200 46 32 53 6b 49 30 63 77 73 41 41 41 42 4f 54 55 F2SkI0cwsAAABOTU 0210 6c 34 53 47 46 61 65 6e 70 4b 53 58 4d 4c 41 41 l4SGFaenpKSXMLAA 0220 41 41 53 30 56 51 63 6b 39 75 63 30 73 31 62 30 AAS0VQck9uc0s1b0 0230 31 7a 43 77 41 41 41 47 31 77 55 6d 74 71 4e 6c 1zCwAAAG1wUmtqNl 0240 4e 33 61 48 5a 4a 63 77 73 41 41 41 41 33 65 55 N3aHZJcwsAAAA3eU 0250 35 4c 56 47 74 6e 51 6e 46 34 57 58 4d 4c 41 41 5LVGtnQnF4WXMLAA 0260 41 41 4f 55 4e 55 57 6e 6c 4e 55 6c 52 6f 5a 7a AAOUNUWnlNUlRoZz 0270 68 7a 43 77 41 41 41 44 52 36 55 46 6f 35 56 54 hzCwAAADR6UFo5VT 0280 6c 78 65 45 35 76 63 77 73 41 41 41 42 4c 63 47 lxeE5vcwsAAABLcG 0290 52 6f 62 56 68 52 4d 30 39 5a 53 58 4d 4c 41 41 RobVhRM09ZSXMLAA 02a0 41 41 61 46 4a 48 4e 47 5a 59 5a 46 70 4e 63 54 AAaFJHNGZYZFpNcT 02b0 68 7a 43 77 41 41 41 46 6c 6e 52 58 5a 35 4d 6a hzCwAAAFlnRXZ5Mj 02c0 4e 33 53 32 6c 6e 63 77 73 41 41 41 42 77 5a 46 N3S2lncwsAAABwZF 02d0 52 52 52 33 63 34 54 58 4e 4c 56 58 4d 4c 41 41 RRR3c4TXNLVXMLAA 02e0 41 41 55 56 56 55 4d 47 51 78 4d 32 70 68 4e 46 AAUVVUMGQxM2phNF 02f0 46 7a 43 77 41 41 41 44 6c 32 53 6c 39 68 61 47 FzCwAAADl2Sl9haG 0300 59 74 4e 57 52 4e 63 77 73 41 41 41 42 6f 56 56 YtNWRNcwsAAABoVV 0310 56 76 53 45 35 66 56 55 31 68 59 33 4d 4c 41 41 VvSE5fVU1hY3MLAA 0320 41 41 4d 31 68 66 4f 54 52 43 64 6a 56 32 52 32 AAM1hfOTRCdjV2R2 0330 39 7a 43 77 41 41 41 45 52 35 62 6c 4a 7a 4e 32 9zCwAAAER5blJzN2 0340 56 76 54 31 4e 7a 63 77 73 41 41 41 42 51 65 6c VvT1NzcwsAAABQel 0350 4a 58 54 56 42 44 53 54 45 35 52 58 4d 4c 41 41 JXTVBDSTE5RXMLAA 0360 41 41 64 30 5a 72 63 56 64 6c 63 30 31 76 65 56 AAd0ZrcVdlc01veV 0370 6c 7a 43 77 41 41 41 43 31 6c 62 32 35 45 5a 44 lzCwAAAC1lb25EZD 0380 64 33 62 43 31 6e 63 77 73 41 41 41 42 56 58 33 d3bC1ncwsAAABVX3 0390 4e 74 53 30 68 72 65 54 46 58 51 58 4d 4c 41 41 NtS0hreTFXQXMLAA 03a0 41 41 4e 7a 4a 34 57 6d 46 6c 64 32 51 79 63 6c AANzJ4WmFld2Qycl 03b0 46 7a 43 77 41 41 41 46 4a 72 59 30 52 47 5a 7a FzCwAAAFJrY0RGZz 03c0 6b 77 52 46 52 76 63 77 73 41 41 41 41 33 63 48 kwRFRvcwsAAAA3cH 03d0 4a 44 57 6e 49 31 61 55 68 74 4f 48 4d 4c 41 41 JDWnI1aUhtOHMLAA 03e0 41 41 5a 6d 56 51 56 31 39 78 62 55 31 4a 56 30 AAZmVQV19xbU1JV0 03f0 56 7a 43 77 41 41 41 48 6f 7a 5a 44 68 72 4d 47 VzCwAAAHozZDhrMG 0400 35 61 64 58 68 76 63 77 73 41 41 41 42 54 4d 6a 5adXhvcwsAAABTMj 0410 5a 73 61 47 52 43 55 56 68 6c 64 33 4d 4c 41 41 ZsaGRCUVhld3MLAA 0420 41 41 62 48 4a 31 54 46 5a 31 4e 31 6c 66 52 31 AAbHJ1TFZ1N1lfR1 0430 56 7a 43 77 41 41 41 44 68 74 56 30 52 57 59 6e VzCwAAADhtV0RWYn 0440 59 79 4f 54 64 6a 3b 20 75 73 65 5f 68 69 74 62 YyOTdj; use_hitb 0450 6f 78 3d 37 32 63 34 36 66 66 36 63 62 63 64 62 ox=72c46ff6cbcdb 0460 37 63 35 35 38 35 63 33 36 34 31 31 62 36 62 33 7c5585c36411b6b3 0470 33 34 65 64 41 45 41 41 41 41 77 3b 20 47 45 4f 34edAEAAAAw; GEO 0480 3d 64 65 62 30 30 35 31 39 37 34 65 65 32 62 37 =deb0051974ee2b7 0490 32 32 62 31 65 34 33 62 61 39 38 65 36 36 64 33 22b1e43ba98e66d3 04a0 37 63 77 77 41 41 41 41 79 55 30 65 4a 68 41 4d 7cwwAAAAyU0eJhAM 04b0 4c 41 41 77 47 38 30 67 3d 3b 20 50 52 45 46 3d LAAwG80g=; PREF= 04c0 67 6c 3d 55 53 26 68 6c 3d 65 6e 0d 0a 41 63 63 gl=US&hl=en..Acc 04d0 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65 6e ept-Language: en 04e0 2d 55 53 2c 65 6e 0d 0a 41 63 63 65 70 74 2d 43 -US,en..Accept-C 04f0 68 61 72 73 65 74 3a 20 49 53 4f 2d 38 38 35 39 harset: ISO-8859 0500 2d 31 2c 2a 2c 75 74 66 2d 38 0d 0a 41 63 63 65 -1,*,utf-8..Acce 0510 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 pt-Encoding: gzi 0520 70 2c 64 65 66 6c 61 74 65 2c 62 7a 69 70 32 0d p,deflate,bzip2. 0530 0a 48 6f 73 74 3a 20 64 61 6c 2d 76 31 31 33 2e .Host: dal-v113. 0540 64 61 6c 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 0d dal.youtube.com. 0550 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 .Connection: Kee 0560 70 2d 41 6c 69 76 65 0d 0a 0d 0a p-Alive.... Data: 425455303834637773414141424E56546777523035705332... No. Time Source Destination Protocol Info 180 2.975901 208.117.224.240 172.18.179.48 TCP http > ada-cip [ACK] Seq=1 Ack=1461 Win=16384 Len=0 Frame 180 (60 bytes on wire, 60 bytes captured) Arrival Time: Oct 13, 2008 16:29:31.580128000 [Time delta from previous captured frame: 0.007695000 seconds] [Time delta from previous displayed frame: 0.158846000 seconds] [Time since reference or first frame: 2.975901000 seconds] Frame Number: 180 Frame Length: 60 bytes Capture Length: 60 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xca49 (51785) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xa2dd [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 1, Ack: 1461, Len: 0 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 1 (relative sequence number) Acknowledgement number: 1461 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x7a44 [correct] [Good Checksum: True] [Bad Checksum: False] No. Time Source Destination Protocol Info 181 2.975906 208.117.224.240 172.18.179.48 TCP http > ada-cip [ACK] Seq=1 Ack=2848 Win=14997 Len=0 Frame 181 (60 bytes on wire, 60 bytes captured) Arrival Time: Oct 13, 2008 16:29:31.580133000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 2.975906000 seconds] Frame Number: 181 Frame Length: 60 bytes Capture Length: 60 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xcb49 (52041) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xa1dd [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 1, Ack: 2848, Len: 0 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 1 (relative sequence number) Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14997 Checksum: 0x7a44 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 173] [The RTT to ACK the segment was: 0.158851000 seconds] No. Time Source Destination Protocol Info 188 3.926429 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 188 (361 bytes on wire, 361 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.530656000 [Time delta from previous captured frame: 0.939987000 seconds] [Time delta from previous displayed frame: 0.950523000 seconds] [Time since reference or first frame: 3.926429000 seconds] Frame Number: 188 Frame Length: 361 bytes Capture Length: 361 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:http] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 347 Identification: 0x1b4a (6986) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x50aa [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 1, Ack: 2848, Len: 307 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 1 (relative sequence number) [Next sequence number: 308 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x81bd [correct] [Good Checksum: True] [Bad Checksum: False] TCP segment data (307 bytes) No. Time Source Destination Protocol Info 189 3.927486 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 189 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.531713000 [Time delta from previous captured frame: 0.001057000 seconds] [Time delta from previous displayed frame: 0.001057000 seconds] [Time since reference or first frame: 3.927486000 seconds] Frame Number: 189 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x1c4a (7242) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x4b29 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 308, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 308 (relative sequence number) [Next sequence number: 1768 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x5775 [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 190 3.927519 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=1768 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 190 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.531746000 [Time delta from previous captured frame: 0.000033000 seconds] [Time delta from previous displayed frame: 0.000033000 seconds] [Time since reference or first frame: 3.927519000 seconds] Frame Number: 190 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b92 (15250) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae94 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 1768, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 1768 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xadf2 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 189] [The RTT to ACK the segment was: 0.000033000 seconds] No. Time Source Destination Protocol Info 191 3.972887 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 191 (1203 bytes on wire, 1203 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.577114000 [Time delta from previous captured frame: 0.045368000 seconds] [Time delta from previous displayed frame: 0.045368000 seconds] [Time since reference or first frame: 3.972887000 seconds] Frame Number: 191 Frame Length: 1203 bytes Capture Length: 1203 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1189 Identification: 0x1f4a (8010) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x4960 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 1768, Ack: 2848, Len: 1149 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 1768 (relative sequence number) [Next sequence number: 2917 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xbdc7 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 190] [The RTT to ACK the segment was: 0.045368000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1149 bytes) No. Time Source Destination Protocol Info 192 4.073662 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=2917 Win=64386 [TCP CHECKSUM INCORRECT] Len=0 Frame 192 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.677889000 [Time delta from previous captured frame: 0.100775000 seconds] [Time delta from previous displayed frame: 0.100775000 seconds] [Time since reference or first frame: 4.073662000 seconds] Frame Number: 192 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b93 (15251) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae93 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 2917, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 2917 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64386 Checksum: 0x10c4 [incorrect, should be 0xadf2 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 191] [The RTT to ACK the segment was: 0.100775000 seconds] No. Time Source Destination Protocol Info 193 4.165936 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 193 (1502 bytes on wire, 1502 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.770163000 [Time delta from previous captured frame: 0.092274000 seconds] [Time delta from previous displayed frame: 0.092274000 seconds] [Time since reference or first frame: 4.165936000 seconds] Frame Number: 193 Frame Length: 1502 bytes Capture Length: 1502 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1488 Identification: 0x2c4a (11338) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x3b35 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 2917, Ack: 2848, Len: 1448 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 2917 (relative sequence number) [Next sequence number: 4365 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xad58 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 192] [The RTT to ACK the segment was: 0.092274000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1448 bytes) No. Time Source Destination Protocol Info 194 4.169853 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 194 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.774080000 [Time delta from previous captured frame: 0.003917000 seconds] [Time delta from previous displayed frame: 0.003917000 seconds] [Time since reference or first frame: 4.169853000 seconds] Frame Number: 194 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x2d4a (11594) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x3a29 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 4365, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 4365 (relative sequence number) [Next sequence number: 5825 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x599a [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 195 4.169877 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=5825 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 195 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.774104000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 4.169877000 seconds] Frame Number: 195 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b94 (15252) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae92 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 5825, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 5825 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x9e19 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 194] [The RTT to ACK the segment was: 0.000024000 seconds] No. Time Source Destination Protocol Info 196 4.205680 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 196 (1490 bytes on wire, 1490 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.809907000 [Time delta from previous captured frame: 0.035803000 seconds] [Time delta from previous displayed frame: 0.035803000 seconds] [Time since reference or first frame: 4.205680000 seconds] Frame Number: 196 Frame Length: 1490 bytes Capture Length: 1490 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1476 Identification: 0x304a (12362) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x3741 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 5825, Ack: 2848, Len: 1436 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 5825 (relative sequence number) [Next sequence number: 7261 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x0378 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 195] [The RTT to ACK the segment was: 0.035803000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1436 bytes) No. Time Source Destination Protocol Info 197 4.375417 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=7261 Win=64099 [TCP CHECKSUM INCORRECT] Len=0 Frame 197 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:32.979644000 [Time delta from previous captured frame: 0.169737000 seconds] [Time delta from previous displayed frame: 0.169737000 seconds] [Time since reference or first frame: 4.375417000 seconds] Frame Number: 197 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b95 (15253) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae91 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 7261, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 7261 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64099 Checksum: 0x10c4 [incorrect, should be 0x9e19 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 196] [The RTT to ACK the segment was: 0.169737000 seconds] No. Time Source Destination Protocol Info 198 4.419748 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 198 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.023975000 [Time delta from previous captured frame: 0.044331000 seconds] [Time delta from previous displayed frame: 0.044331000 seconds] [Time since reference or first frame: 4.419748000 seconds] Frame Number: 198 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x484a (18506) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x1f29 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 7261, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 7261 (relative sequence number) [Next sequence number: 8721 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x75de [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 197] [The RTT to ACK the segment was: 0.044331000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 199 4.423616 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 199 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.027843000 [Time delta from previous captured frame: 0.003868000 seconds] [Time delta from previous displayed frame: 0.003868000 seconds] [Time since reference or first frame: 4.423616000 seconds] Frame Number: 199 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x494a (18762) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x1e29 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 8721, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 8721 (relative sequence number) [Next sequence number: 10181 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x0757 [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 200 4.423633 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=10181 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 200 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.027860000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 4.423633000 seconds] Frame Number: 200 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b96 (15254) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae90 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 10181, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 10181 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x8d15 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 199] [The RTT to ACK the segment was: 0.000017000 seconds] No. Time Source Destination Protocol Info 201 4.580671 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 201 (1478 bytes on wire, 1478 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.184898000 [Time delta from previous captured frame: 0.157038000 seconds] [Time delta from previous displayed frame: 0.157038000 seconds] [Time since reference or first frame: 4.580671000 seconds] Frame Number: 201 Frame Length: 1478 bytes Capture Length: 1478 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1464 Identification: 0x4a4a (19018) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x1d4d [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 10181, Ack: 2848, Len: 1424 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 10181 (relative sequence number) [Next sequence number: 11605 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x1a38 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 200] [The RTT to ACK the segment was: 0.157038000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1424 bytes) No. Time Source Destination Protocol Info 202 4.633647 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 202 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.237874000 [Time delta from previous captured frame: 0.052976000 seconds] [Time delta from previous displayed frame: 0.052976000 seconds] [Time since reference or first frame: 4.633647000 seconds] Frame Number: 202 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x544a (21578) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x1329 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 11605, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 11605 (relative sequence number) [Next sequence number: 13065 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x191d [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 203 4.633689 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=13065 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 203 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.237916000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 4.633689000 seconds] Frame Number: 203 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b97 (15255) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae8f [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 13065, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 13065 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x81d1 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 202] [The RTT to ACK the segment was: 0.000042000 seconds] No. Time Source Destination Protocol Info 204 4.811486 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 204 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.415713000 [Time delta from previous captured frame: 0.177797000 seconds] [Time delta from previous displayed frame: 0.177797000 seconds] [Time since reference or first frame: 4.811486000 seconds] Frame Number: 204 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x624a (25162) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x0529 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 13065, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 13065 (relative sequence number) [Next sequence number: 14525 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xd289 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 203] [The RTT to ACK the segment was: 0.177797000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 205 4.812324 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 205 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.416551000 [Time delta from previous captured frame: 0.000838000 seconds] [Time delta from previous displayed frame: 0.000838000 seconds] [Time since reference or first frame: 4.812324000 seconds] Frame Number: 205 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x634a (25418) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x0429 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 14525, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 14525 (relative sequence number) [Next sequence number: 15985 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xf1de [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 206 4.812342 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=15985 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 206 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.416569000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 4.812342000 seconds] Frame Number: 206 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b98 (15256) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae8e [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 15985, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 15985 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x7669 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 205] [The RTT to ACK the segment was: 0.000018000 seconds] No. Time Source Destination Protocol Info 207 4.812677 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 207 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.416904000 [Time delta from previous captured frame: 0.000335000 seconds] [Time delta from previous displayed frame: 0.000335000 seconds] [Time since reference or first frame: 4.812677000 seconds] Frame Number: 207 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x644a (25674) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x0329 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 15985, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 15985 (relative sequence number) [Next sequence number: 17445 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xcb8a [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 206] [The RTT to ACK the segment was: 0.000335000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 208 4.816197 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 208 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.420424000 [Time delta from previous captured frame: 0.003520000 seconds] [Time delta from previous displayed frame: 0.003520000 seconds] [Time since reference or first frame: 4.816197000 seconds] Frame Number: 208 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x654a (25930) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x0229 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 17445, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 17445 (relative sequence number) [Next sequence number: 18905 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xe753 [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 209 4.816208 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 209 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.420435000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 4.816208000 seconds] Frame Number: 209 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3b99 (15257) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae8d [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x6b01 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 208] [The RTT to ACK the segment was: 0.000011000 seconds] No. Time Source Destination Protocol Info 210 4.925593 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 210 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.529820000 [Time delta from previous captured frame: 0.109385000 seconds] [Time delta from previous displayed frame: 0.109385000 seconds] [Time since reference or first frame: 4.925593000 seconds] Frame Number: 210 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x724a (29258) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xf528 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 20365, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 20365 (relative sequence number) [Next sequence number: 21825 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x2af7 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 209] [The RTT to ACK the segment was: 0.109385000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 211 4.925620 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#1] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=20365 SRE=21825 Frame 211 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.529847000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 4.925620000 seconds] Frame Number: 211 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3b9a (15258) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae80 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xde43 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 20365-21825 left edge = 20365 (relative) right edge = 21825 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 212 4.925629 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 212 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.529856000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 4.925629000 seconds] Frame Number: 212 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x734a (29514) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xf428 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 21825, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 21825 (relative sequence number) [Next sequence number: 23285 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xaed9 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 211] [The RTT to ACK the segment was: 0.000009000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 213 4.925637 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#2] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=20365 SRE=23285 Frame 213 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.529864000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 4.925637000 seconds] Frame Number: 213 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3b9b (15259) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae7f [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xd88f (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 20365-23285 left edge = 20365 (relative) right edge = 23285 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 214 5.003427 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 214 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.607654000 [Time delta from previous captured frame: 0.077790000 seconds] [Time delta from previous displayed frame: 0.077790000 seconds] [Time since reference or first frame: 5.003427000 seconds] Frame Number: 214 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x764a (30282) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xf128 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 23285, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 23285 (relative sequence number) [Next sequence number: 24745 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x91a6 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 213] [The RTT to ACK the segment was: 0.077790000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 215 5.003449 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#3] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=20365 SRE=24745 Frame 215 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.607676000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 5.003449000 seconds] Frame Number: 215 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3b9d (15261) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae7d [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xd2db (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 20365-24745 left edge = 20365 (relative) right edge = 24745 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 3] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 216 5.004170 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 216 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.608397000 [Time delta from previous captured frame: 0.000721000 seconds] [Time delta from previous displayed frame: 0.000721000 seconds] [Time since reference or first frame: 5.004170000 seconds] Frame Number: 216 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x774a (30538) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xf028 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 24745, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 24745 (relative sequence number) [Next sequence number: 26205 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x0f37 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 215] [The RTT to ACK the segment was: 0.000721000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 217 5.004178 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#4] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=20365 SRE=26205 Frame 217 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.608405000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 5.004178000 seconds] Frame Number: 217 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3b9e (15262) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae7c [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xcd27 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 20365-26205 left edge = 20365 (relative) right edge = 26205 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 4] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 218 5.061267 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 218 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.665494000 [Time delta from previous captured frame: 0.057089000 seconds] [Time delta from previous displayed frame: 0.057089000 seconds] [Time since reference or first frame: 5.061267000 seconds] Frame Number: 218 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7c4a (31818) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xeb28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 27665, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 27665 (relative sequence number) [Next sequence number: 29125 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x559b [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 217] [The RTT to ACK the segment was: 0.057089000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 219 5.061289 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#5] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=27665 SRE=29125 SLE=20365 SRE=26205 Frame 219 (74 bytes on wire, 74 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.665516000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 5.061289000 seconds] Frame Number: 219 Frame Length: 74 bytes Capture Length: 74 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x3b9f (15263) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae73 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 40 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d8 [incorrect, should be 0x1d69 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (20 bytes) NOP NOP SACK: 27665-29125 20365-26205 left edge = 27665 (relative) right edge = 29125 (relative) left edge = 20365 (relative) right edge = 26205 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 5] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 220 5.063255 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 220 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.667482000 [Time delta from previous captured frame: 0.001966000 seconds] [Time delta from previous displayed frame: 0.001966000 seconds] [Time since reference or first frame: 5.063255000 seconds] Frame Number: 220 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7d4a (32074) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xea28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 29125, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 29125 (relative sequence number) [Next sequence number: 30585 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x0c4c [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 219] [The RTT to ACK the segment was: 0.001966000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 221 5.063266 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#6] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=27665 SRE=30585 SLE=20365 SRE=26205 Frame 221 (74 bytes on wire, 74 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.667493000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 5.063266000 seconds] Frame Number: 221 Frame Length: 74 bytes Capture Length: 74 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x3ba0 (15264) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae72 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 40 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d8 [incorrect, should be 0x17b5 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (20 bytes) NOP NOP SACK: 27665-30585 20365-26205 left edge = 27665 (relative) right edge = 30585 (relative) left edge = 20365 (relative) right edge = 26205 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 6] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 222 5.063270 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 222 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.667497000 [Time delta from previous captured frame: 0.000004000 seconds] [Time delta from previous displayed frame: 0.000004000 seconds] [Time since reference or first frame: 5.063270000 seconds] Frame Number: 222 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7e4a (32330) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xe928 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 30585, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 30585 (relative sequence number) [Next sequence number: 32045 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x3fa8 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 221] [The RTT to ACK the segment was: 0.000004000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 223 5.063277 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#7] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=27665 SRE=32045 SLE=20365 SRE=26205 Frame 223 (74 bytes on wire, 74 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.667504000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 5.063277000 seconds] Frame Number: 223 Frame Length: 74 bytes Capture Length: 74 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x3ba1 (15265) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae71 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 40 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d8 [incorrect, should be 0x1201 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (20 bytes) NOP NOP SACK: 27665-32045 20365-26205 left edge = 27665 (relative) right edge = 32045 (relative) left edge = 20365 (relative) right edge = 26205 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 7] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 224 5.065740 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 224 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.669967000 [Time delta from previous captured frame: 0.002463000 seconds] [Time delta from previous displayed frame: 0.002463000 seconds] [Time since reference or first frame: 5.065740000 seconds] Frame Number: 224 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7f4a (32586) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xe828 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 32045, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 32045 (relative sequence number) [Next sequence number: 33505 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x94c5 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 223] [The RTT to ACK the segment was: 0.002463000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 225 5.065755 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 209#8] ada-cip > http [ACK] Seq=2848 Ack=18905 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=27665 SRE=33505 SLE=20365 SRE=26205 Frame 225 (74 bytes on wire, 74 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.669982000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 5.065755000 seconds] Frame Number: 225 Frame Length: 74 bytes Capture Length: 74 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x3ba2 (15266) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae70 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 18905, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 18905 (relative ack number) Header length: 40 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d8 [incorrect, should be 0x0c4d (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (20 bytes) NOP NOP SACK: 27665-33505 20365-26205 left edge = 27665 (relative) right edge = 33505 (relative) left edge = 20365 (relative) right edge = 26205 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 8] [Duplicate to the ACK in frame: 209] No. Time Source Destination Protocol Info 226 5.150625 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 226 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.754852000 [Time delta from previous captured frame: 0.084870000 seconds] [Time delta from previous displayed frame: 0.084870000 seconds] [Time since reference or first frame: 5.150625000 seconds] Frame Number: 226 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x874a (34634) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xe028 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 18905, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 18905 (relative sequence number) [Next sequence number: 20365 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x1ab1 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 225] [The RTT to ACK the segment was: 0.084870000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.084885000 seconds] [RTO based on delta from frame: 224] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 227 5.150666 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=26205 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=27665 SRE=33505 Frame 227 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.754893000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 5.150666000 seconds] Frame Number: 227 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3ba3 (15267) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae77 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 26205, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 26205 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x779b (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 27665-33505 left edge = 27665 (relative) right edge = 33505 (relative) No. Time Source Destination Protocol Info 228 5.222196 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 228 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.826423000 [Time delta from previous captured frame: 0.071530000 seconds] [Time delta from previous displayed frame: 0.071530000 seconds] [Time since reference or first frame: 5.222196000 seconds] Frame Number: 228 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x8b4a (35658) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xdc28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 26205, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 26205 (relative sequence number) [Next sequence number: 27665 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x846f [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 227] [The RTT to ACK the segment was: 0.071530000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.156456000 seconds] [RTO based on delta from frame: 224] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 229 5.222245 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=33505 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 229 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.826472000 [Time delta from previous captured frame: 0.000049000 seconds] [Time delta from previous displayed frame: 0.000049000 seconds] [Time since reference or first frame: 5.222245000 seconds] Frame Number: 229 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3ba4 (15268) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae82 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 33505, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 33505 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x31f9 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 224] [The RTT to ACK the segment was: 0.156505000 seconds] No. Time Source Destination Protocol Info 230 5.308018 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 230 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.912245000 [Time delta from previous captured frame: 0.085773000 seconds] [Time delta from previous displayed frame: 0.085773000 seconds] [Time since reference or first frame: 5.308018000 seconds] Frame Number: 230 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x984a (38986) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xcf28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 33505, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 33505 (relative sequence number) [Next sequence number: 34965 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xcd96 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 229] [The RTT to ACK the segment was: 0.085773000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 231 5.308058 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=34965 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 231 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.912285000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 5.308058000 seconds] Frame Number: 231 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3ba5 (15269) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae81 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 34965, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 34965 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x2c45 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 230] [The RTT to ACK the segment was: 0.000040000 seconds] No. Time Source Destination Protocol Info 232 5.308860 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 232 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.913087000 [Time delta from previous captured frame: 0.000802000 seconds] [Time delta from previous displayed frame: 0.000802000 seconds] [Time since reference or first frame: 5.308860000 seconds] Frame Number: 232 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x994a (39242) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xce28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 34965, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 34965 (relative sequence number) [Next sequence number: 36425 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x466c [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 231] [The RTT to ACK the segment was: 0.000802000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 233 5.311178 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 233 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.915405000 [Time delta from previous captured frame: 0.002318000 seconds] [Time delta from previous displayed frame: 0.002318000 seconds] [Time since reference or first frame: 5.311178000 seconds] Frame Number: 233 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x9a4a (39498) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xcd28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 36425, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 36425 (relative sequence number) [Next sequence number: 37885 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xb62b [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 234 5.311193 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=37885 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 234 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.915420000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 5.311193000 seconds] Frame Number: 234 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3ba6 (15270) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae80 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 37885, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 37885 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x20dd (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 233] [The RTT to ACK the segment was: 0.000015000 seconds] No. Time Source Destination Protocol Info 235 5.313112 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 235 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.917339000 [Time delta from previous captured frame: 0.001919000 seconds] [Time delta from previous displayed frame: 0.001919000 seconds] [Time since reference or first frame: 5.313112000 seconds] Frame Number: 235 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x9b4a (39754) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xcc28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 37885, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 37885 (relative sequence number) [Next sequence number: 39345 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xc1cb [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 234] [The RTT to ACK the segment was: 0.001919000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 236 5.386509 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 236 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.990736000 [Time delta from previous captured frame: 0.073397000 seconds] [Time delta from previous displayed frame: 0.073397000 seconds] [Time since reference or first frame: 5.386509000 seconds] Frame Number: 236 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x9d4a (40266) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xca28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 39345, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 39345 (relative sequence number) [Next sequence number: 40805 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xd8d1 [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 237 5.386535 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=40805 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 237 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.990762000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 5.386535000 seconds] Frame Number: 237 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3ba7 (15271) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae7f [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 40805, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 40805 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x1575 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 236] [The RTT to ACK the segment was: 0.000026000 seconds] No. Time Source Destination Protocol Info 238 5.387480 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 238 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:33.991707000 [Time delta from previous captured frame: 0.000945000 seconds] [Time delta from previous displayed frame: 0.000945000 seconds] [Time since reference or first frame: 5.387480000 seconds] Frame Number: 238 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x9e4a (40522) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xc928 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 40805, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 40805 (relative sequence number) [Next sequence number: 42265 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x0661 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 237] [The RTT to ACK the segment was: 0.000945000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 244 5.480117 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 244 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.084344000 [Time delta from previous captured frame: 0.012412000 seconds] [Time delta from previous displayed frame: 0.092637000 seconds] [Time since reference or first frame: 5.480117000 seconds] Frame Number: 244 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xa84a (43082) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xbf28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 43725, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 43725 (relative sequence number) [Next sequence number: 45185 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x61ac [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 245 5.480139 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=42265 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=43725 SRE=45185 Frame 245 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.084366000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 5.480139000 seconds] Frame Number: 245 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bad (15277) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae6d [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 42265, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 42265 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xcc82 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 43725-45185 left edge = 43725 (relative) right edge = 45185 (relative) No. Time Source Destination Protocol Info 246 5.480169 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 246 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.084396000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 5.480169000 seconds] Frame Number: 246 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xa94a (43338) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xbe28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 45185, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 45185 (relative sequence number) [Next sequence number: 46645 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x340d [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 245] [The RTT to ACK the segment was: 0.000030000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 247 5.480177 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 245#1] ada-cip > http [ACK] Seq=2848 Ack=42265 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=43725 SRE=46645 Frame 247 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.084404000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 5.480177000 seconds] Frame Number: 247 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bae (15278) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae6c [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 42265, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 42265 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xc6ce (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 43725-46645 left edge = 43725 (relative) right edge = 46645 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 245] No. Time Source Destination Protocol Info 248 5.541177 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 248 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.145404000 [Time delta from previous captured frame: 0.061000000 seconds] [Time delta from previous displayed frame: 0.061000000 seconds] [Time since reference or first frame: 5.541177000 seconds] Frame Number: 248 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xad4a (44362) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xba28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 46645, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 46645 (relative sequence number) [Next sequence number: 48105 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xaa12 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 247] [The RTT to ACK the segment was: 0.061000000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 249 5.541202 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 245#2] ada-cip > http [ACK] Seq=2848 Ack=42265 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=43725 SRE=48105 Frame 249 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.145429000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 5.541202000 seconds] Frame Number: 249 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3baf (15279) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae6b [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 42265, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 42265 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xc11a (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 43725-48105 left edge = 43725 (relative) right edge = 48105 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 245] No. Time Source Destination Protocol Info 250 5.541536 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 250 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.145763000 [Time delta from previous captured frame: 0.000334000 seconds] [Time delta from previous displayed frame: 0.000334000 seconds] [Time since reference or first frame: 5.541536000 seconds] Frame Number: 250 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xae4a (44618) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xb928 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 48105, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 48105 (relative sequence number) [Next sequence number: 49565 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x1d21 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 249] [The RTT to ACK the segment was: 0.000334000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 251 5.541548 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 245#3] ada-cip > http [ACK] Seq=2848 Ack=42265 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=43725 SRE=49565 Frame 251 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.145775000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 5.541548000 seconds] Frame Number: 251 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bb0 (15280) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae6a [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 42265, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 42265 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xbb66 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 43725-49565 left edge = 43725 (relative) right edge = 49565 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 3] [Duplicate to the ACK in frame: 245] No. Time Source Destination Protocol Info 253 5.669929 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 253 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.274156000 [Time delta from previous captured frame: 0.040740000 seconds] [Time delta from previous displayed frame: 0.128381000 seconds] [Time since reference or first frame: 5.669929000 seconds] Frame Number: 253 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xc44a (50250) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xa328 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 42265, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 42265 (relative sequence number) [Next sequence number: 43725 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x7ea2 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 251] [The RTT to ACK the segment was: 0.128381000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.128393000 seconds] [RTO based on delta from frame: 250] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 254 5.669969 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=49565 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 254 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.274196000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 5.669969000 seconds] Frame Number: 254 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bb3 (15283) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae73 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 49565, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 49565 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xf33c (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 250] [The RTT to ACK the segment was: 0.128433000 seconds] No. Time Source Destination Protocol Info 255 5.779611 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 255 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.383838000 [Time delta from previous captured frame: 0.109642000 seconds] [Time delta from previous displayed frame: 0.109642000 seconds] [Time since reference or first frame: 5.779611000 seconds] Frame Number: 255 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xca4a (51786) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x9d28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 49565, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 49565 (relative sequence number) [Next sequence number: 51025 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xd0a1 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 254] [The RTT to ACK the segment was: 0.109642000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 257 5.798411 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 257 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.402638000 [Time delta from previous captured frame: 0.014823000 seconds] [Time delta from previous displayed frame: 0.018800000 seconds] [Time since reference or first frame: 5.798411000 seconds] Frame Number: 257 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xcc4a (52298) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x9b28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 51025, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 51025 (relative sequence number) [Next sequence number: 52485 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x0719 [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 258 5.798430 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=52485 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 258 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.402657000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 5.798430000 seconds] Frame Number: 258 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bb5 (15285) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae71 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 52485, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 52485 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xe7d4 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 257] [The RTT to ACK the segment was: 0.000019000 seconds] No. Time Source Destination Protocol Info 259 5.800257 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 259 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.404484000 [Time delta from previous captured frame: 0.001827000 seconds] [Time delta from previous displayed frame: 0.001827000 seconds] [Time since reference or first frame: 5.800257000 seconds] Frame Number: 259 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xcd4a (52554) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x9a28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 52485, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 52485 (relative sequence number) [Next sequence number: 53945 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xc613 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 258] [The RTT to ACK the segment was: 0.001827000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 260 5.890638 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 260 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.494865000 [Time delta from previous captured frame: 0.090381000 seconds] [Time delta from previous displayed frame: 0.090381000 seconds] [Time since reference or first frame: 5.890638000 seconds] Frame Number: 260 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xde4a (56906) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x8928 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 55405, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 55405 (relative sequence number) [Next sequence number: 56865 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x2c61 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 261 5.890662 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=53945 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=55405 SRE=56865 Frame 261 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.494889000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 5.890662000 seconds] Frame Number: 261 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bb6 (15286) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae64 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 53945, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 53945 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x43a2 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 55405-56865 left edge = 55405 (relative) right edge = 56865 (relative) No. Time Source Destination Protocol Info 262 5.892683 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 262 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.496910000 [Time delta from previous captured frame: 0.002021000 seconds] [Time delta from previous displayed frame: 0.002021000 seconds] [Time since reference or first frame: 5.892683000 seconds] Frame Number: 262 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xdf4a (57162) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x8828 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 56865, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 56865 (relative sequence number) [Next sequence number: 58325 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xd6ea [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 261] [The RTT to ACK the segment was: 0.002021000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 263 5.892691 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 261#1] ada-cip > http [ACK] Seq=2848 Ack=53945 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=55405 SRE=58325 Frame 263 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.496918000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 5.892691000 seconds] Frame Number: 263 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bb7 (15287) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae63 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 53945, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 53945 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x3dee (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 55405-58325 left edge = 55405 (relative) right edge = 58325 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 261] No. Time Source Destination Protocol Info 264 5.972078 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 264 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.576305000 [Time delta from previous captured frame: 0.079387000 seconds] [Time delta from previous displayed frame: 0.079387000 seconds] [Time since reference or first frame: 5.972078000 seconds] Frame Number: 264 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xe34a (58186) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x8428 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 58325, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 58325 (relative sequence number) [Next sequence number: 59785 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xc340 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 263] [The RTT to ACK the segment was: 0.079387000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 265 5.972107 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 261#2] ada-cip > http [ACK] Seq=2848 Ack=53945 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=55405 SRE=59785 Frame 265 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.576334000 [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000029000 seconds] [Time since reference or first frame: 5.972107000 seconds] Frame Number: 265 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bb8 (15288) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae62 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 53945, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 53945 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x383a (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 55405-59785 left edge = 55405 (relative) right edge = 59785 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 261] No. Time Source Destination Protocol Info 266 6.361352 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 266 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.965579000 [Time delta from previous captured frame: 0.389245000 seconds] [Time delta from previous displayed frame: 0.389245000 seconds] [Time since reference or first frame: 6.361352000 seconds] Frame Number: 266 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x004b (75) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x6728 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 53945, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 53945 (relative sequence number) [Next sequence number: 55405 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xe377 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 265] [The RTT to ACK the segment was: 0.389245000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.389274000 seconds] [RTO based on delta from frame: 264] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 267 6.361393 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=59785 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 267 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:34.965620000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 6.361393000 seconds] Frame Number: 267 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bb9 (15289) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae6d [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 59785, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 59785 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xcb50 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 264] [The RTT to ACK the segment was: 0.389315000 seconds] No. Time Source Destination Protocol Info 273 6.432606 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 273 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.036833000 [Time delta from previous captured frame: 0.011404000 seconds] [Time delta from previous displayed frame: 0.071213000 seconds] [Time since reference or first frame: 6.432606000 seconds] Frame Number: 273 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x064b (1611) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x6128 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 61245, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 61245 (relative sequence number) [Next sequence number: 62705 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x99a4 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 267] [The RTT to ACK the segment was: 0.071213000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 274 6.432632 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 267#1] ada-cip > http [ACK] Seq=2848 Ack=59785 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=61245 SRE=62705 Frame 274 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.036859000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 6.432632000 seconds] Frame Number: 274 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bbd (15293) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae5d [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 59785, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 59785 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xff31 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 61245-62705 left edge = 61245 (relative) right edge = 62705 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 267] No. Time Source Destination Protocol Info 285 7.235680 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 285 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.839907000 [Time delta from previous captured frame: 0.446242000 seconds] [Time delta from previous displayed frame: 0.803048000 seconds] [Time since reference or first frame: 7.235680000 seconds] Frame Number: 285 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x3f4b (16203) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x2828 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 59785, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 59785 (relative sequence number) [Next sequence number: 61245 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x8016 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 274] [The RTT to ACK the segment was: 0.803048000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.803074000 seconds] [RTO based on delta from frame: 273] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 286 7.235728 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=62705 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 286 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.839955000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 7.235728000 seconds] Frame Number: 286 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bc9 (15305) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae5d [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 62705, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 62705 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xbfe8 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 273] [The RTT to ACK the segment was: 0.803122000 seconds] No. Time Source Destination Protocol Info 287 7.313725 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 287 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.917952000 [Time delta from previous captured frame: 0.077997000 seconds] [Time delta from previous displayed frame: 0.077997000 seconds] [Time since reference or first frame: 7.313725000 seconds] Frame Number: 287 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x454b (17739) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x2228 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 62705, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 62705 (relative sequence number) [Next sequence number: 64165 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x9251 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 286] [The RTT to ACK the segment was: 0.077997000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 288 7.317155 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 288 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.921382000 [Time delta from previous captured frame: 0.003430000 seconds] [Time delta from previous displayed frame: 0.003430000 seconds] [Time since reference or first frame: 7.317155000 seconds] Frame Number: 288 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x464b (17995) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x2128 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 64165, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 64165 (relative sequence number) [Next sequence number: 65625 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x60f0 [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 289 7.317174 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=65625 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 289 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.921401000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 7.317174000 seconds] Frame Number: 289 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bca (15306) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae5c [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 65625, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 65625 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xb480 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 288] [The RTT to ACK the segment was: 0.000019000 seconds] No. Time Source Destination Protocol Info 290 7.392254 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 290 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.996481000 [Time delta from previous captured frame: 0.075080000 seconds] [Time delta from previous displayed frame: 0.075080000 seconds] [Time since reference or first frame: 7.392254000 seconds] Frame Number: 290 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4d4b (19787) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x1a28 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 67085, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 67085 (relative sequence number) [Next sequence number: 68545 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x83e1 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 289] [The RTT to ACK the segment was: 0.075080000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 291 7.392277 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 289#1] ada-cip > http [ACK] Seq=2848 Ack=65625 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=67085 SRE=68545 Frame 291 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.996504000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 7.392277000 seconds] Frame Number: 291 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bcb (15307) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4f [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 65625, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 65625 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xbac1 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 67085-68545 left edge = 67085 (relative) right edge = 68545 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 289] No. Time Source Destination Protocol Info 292 7.392285 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 292 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.996512000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 7.392285000 seconds] Frame Number: 292 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4e4b (20043) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x1928 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 68545, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 68545 (relative sequence number) [Next sequence number: 70005 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x7647 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 291] [The RTT to ACK the segment was: 0.000008000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 293 7.392292 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 289#2] ada-cip > http [ACK] Seq=2848 Ack=65625 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=67085 SRE=70005 Frame 293 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:35.996519000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 7.392292000 seconds] Frame Number: 293 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bcc (15308) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4e [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 65625, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 65625 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xb50d (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 67085-70005 left edge = 67085 (relative) right edge = 70005 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 289] No. Time Source Destination Protocol Info 294 7.835693 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 294 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.439920000 [Time delta from previous captured frame: 0.443401000 seconds] [Time delta from previous displayed frame: 0.443401000 seconds] [Time since reference or first frame: 7.835693000 seconds] Frame Number: 294 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x684b (26699) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xff27 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 65625, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 65625 (relative sequence number) [Next sequence number: 67085 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x24d7 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 293] [The RTT to ACK the segment was: 0.443401000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.443408000 seconds] [RTO based on delta from frame: 292] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 295 7.835733 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=70005 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 295 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.439960000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 7.835733000 seconds] Frame Number: 295 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bcd (15309) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae59 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 70005, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 70005 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xa364 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 292] [The RTT to ACK the segment was: 0.443448000 seconds] No. Time Source Destination Protocol Info 296 7.961365 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 296 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.565592000 [Time delta from previous captured frame: 0.125632000 seconds] [Time delta from previous displayed frame: 0.125632000 seconds] [Time since reference or first frame: 7.961365000 seconds] Frame Number: 296 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x704b (28747) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xf727 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 70005, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 70005 (relative sequence number) [Next sequence number: 71465 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xf199 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 295] [The RTT to ACK the segment was: 0.125632000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 297 8.097036 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=71465 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 297 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.701263000 [Time delta from previous captured frame: 0.135671000 seconds] [Time delta from previous displayed frame: 0.135671000 seconds] [Time since reference or first frame: 8.097036000 seconds] Frame Number: 297 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bce (15310) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae58 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 71465, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 71465 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x9db0 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 296] [The RTT to ACK the segment was: 0.135671000 seconds] No. Time Source Destination Protocol Info 298 8.229764 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 298 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.833991000 [Time delta from previous captured frame: 0.132728000 seconds] [Time delta from previous displayed frame: 0.132728000 seconds] [Time since reference or first frame: 8.229764000 seconds] Frame Number: 298 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x804b (32843) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xe727 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 72925, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 72925 (relative sequence number) [Next sequence number: 74385 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xdeb8 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 297] [The RTT to ACK the segment was: 0.132728000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 299 8.229791 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 297#1] ada-cip > http [ACK] Seq=2848 Ack=71465 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=72925 SRE=74385 Frame 299 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.834018000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 8.229791000 seconds] Frame Number: 299 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bcf (15311) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4b [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 71465, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 71465 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x7651 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 72925-74385 left edge = 72925 (relative) right edge = 74385 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 297] No. Time Source Destination Protocol Info 300 8.229800 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 300 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.834027000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 8.229800000 seconds] Frame Number: 300 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x814b (33099) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xe627 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 74385, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 74385 (relative sequence number) [Next sequence number: 75845 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xc1a2 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 299] [The RTT to ACK the segment was: 0.000009000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 301 8.229808 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 297#2] ada-cip > http [ACK] Seq=2848 Ack=71465 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=72925 SRE=75845 Frame 301 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:36.834035000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 8.229808000 seconds] Frame Number: 301 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bd0 (15312) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4a [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 71465, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 71465 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x709d (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 72925-75845 left edge = 72925 (relative) right edge = 75845 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 297] No. Time Source Destination Protocol Info 302 8.627406 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 302 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.231633000 [Time delta from previous captured frame: 0.397598000 seconds] [Time delta from previous displayed frame: 0.397598000 seconds] [Time since reference or first frame: 8.627406000 seconds] Frame Number: 302 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x934b (37707) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xd427 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 71465, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 71465 (relative sequence number) [Next sequence number: 72925 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xa77e [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 301] [The RTT to ACK the segment was: 0.397598000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.397606000 seconds] [RTO based on delta from frame: 300] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 303 8.627446 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=75845 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 303 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.231673000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 8.627446000 seconds] Frame Number: 303 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bd1 (15313) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae55 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 75845, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 75845 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x8c94 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 300] [The RTT to ACK the segment was: 0.397646000 seconds] No. Time Source Destination Protocol Info 304 8.766410 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 304 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.370637000 [Time delta from previous captured frame: 0.138964000 seconds] [Time delta from previous displayed frame: 0.138964000 seconds] [Time since reference or first frame: 8.766410000 seconds] Frame Number: 304 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x9f4b (40779) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xc827 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 75845, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 75845 (relative sequence number) [Next sequence number: 77305 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xbc03 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 303] [The RTT to ACK the segment was: 0.138964000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 305 8.766424 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 305 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.370651000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 8.766424000 seconds] Frame Number: 305 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xa04b (41035) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xc727 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 77305, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 77305 (relative sequence number) [Next sequence number: 78765 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xbaec [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 306 8.766441 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=78765 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 306 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.370668000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 8.766441000 seconds] Frame Number: 306 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bd2 (15314) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae54 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 78765, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 78765 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x812c (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 305] [The RTT to ACK the segment was: 0.000017000 seconds] No. Time Source Destination Protocol Info 307 8.888356 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 307 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.492583000 [Time delta from previous captured frame: 0.121915000 seconds] [Time delta from previous displayed frame: 0.121915000 seconds] [Time since reference or first frame: 8.888356000 seconds] Frame Number: 307 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xa74b (42827) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xc027 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 78765, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 78765 (relative sequence number) [Next sequence number: 80225 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xb2b4 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 306] [The RTT to ACK the segment was: 0.121915000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 308 8.888397 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=80225 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 308 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.492624000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 8.888397000 seconds] Frame Number: 308 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bd3 (15315) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae53 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 80225, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 80225 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x7b78 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 307] [The RTT to ACK the segment was: 0.000041000 seconds] No. Time Source Destination Protocol Info 309 8.889065 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 309 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.493292000 [Time delta from previous captured frame: 0.000668000 seconds] [Time delta from previous displayed frame: 0.000668000 seconds] [Time since reference or first frame: 8.889065000 seconds] Frame Number: 309 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xa94b (43339) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xbe27 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 81685, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 81685 (relative sequence number) [Next sequence number: 83145 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x90e8 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 308] [The RTT to ACK the segment was: 0.000668000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 310 8.889078 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 308#1] ada-cip > http [ACK] Seq=2848 Ack=80225 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=81685 SRE=83145 Frame 310 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.493305000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 8.889078000 seconds] Frame Number: 310 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bd4 (15316) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae46 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 80225, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 80225 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x0fa9 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 81685-83145 left edge = 81685 (relative) right edge = 83145 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 308] No. Time Source Destination Protocol Info 311 9.033070 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 311 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.637297000 [Time delta from previous captured frame: 0.143992000 seconds] [Time delta from previous displayed frame: 0.143992000 seconds] [Time since reference or first frame: 9.033070000 seconds] Frame Number: 311 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xaf4b (44875) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xb827 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 83145, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 83145 (relative sequence number) [Next sequence number: 84605 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xbdbf [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 310] [The RTT to ACK the segment was: 0.143992000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 312 9.033094 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 308#2] ada-cip > http [ACK] Seq=2848 Ack=80225 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=81685 SRE=84605 Frame 312 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:37.637321000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 9.033094000 seconds] Frame Number: 312 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bd5 (15317) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae45 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 80225, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 80225 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x09f5 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 81685-84605 left edge = 81685 (relative) right edge = 84605 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 308] No. Time Source Destination Protocol Info 313 9.405546 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 313 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.009773000 [Time delta from previous captured frame: 0.372452000 seconds] [Time delta from previous displayed frame: 0.372452000 seconds] [Time since reference or first frame: 9.405546000 seconds] Frame Number: 313 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xc64b (50763) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xa127 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 80225, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 80225 (relative sequence number) [Next sequence number: 81685 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x321f [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 312] [The RTT to ACK the segment was: 0.372452000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.372476000 seconds] [RTO based on delta from frame: 311] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 314 9.405586 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=84605 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 314 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.009813000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 9.405586000 seconds] Frame Number: 314 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bd6 (15318) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae50 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 84605, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 84605 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x6a5c (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 311] [The RTT to ACK the segment was: 0.372516000 seconds] No. Time Source Destination Protocol Info 315 9.555957 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 315 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.160184000 [Time delta from previous captured frame: 0.150371000 seconds] [Time delta from previous displayed frame: 0.150371000 seconds] [Time since reference or first frame: 9.555957000 seconds] Frame Number: 315 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xd24b (53835) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x9527 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 84605, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 84605 (relative sequence number) [Next sequence number: 86065 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xe080 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 314] [The RTT to ACK the segment was: 0.150371000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 316 9.555973 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 316 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.160200000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 9.555973000 seconds] Frame Number: 316 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xd34b (54091) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x9427 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 86065, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 86065 (relative sequence number) [Next sequence number: 87525 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xd9d4 [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 317 9.555988 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=87525 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 317 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.160215000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 9.555988000 seconds] Frame Number: 317 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bd7 (15319) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4f [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 87525, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 87525 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x5ef4 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 316] [The RTT to ACK the segment was: 0.000015000 seconds] No. Time Source Destination Protocol Info 318 9.718587 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 318 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.322814000 [Time delta from previous captured frame: 0.162599000 seconds] [Time delta from previous displayed frame: 0.162599000 seconds] [Time since reference or first frame: 9.718587000 seconds] Frame Number: 318 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xe04b (57419) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x8727 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 87525, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 87525 (relative sequence number) [Next sequence number: 88985 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x776e [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 317] [The RTT to ACK the segment was: 0.162599000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 319 9.718623 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=88985 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 319 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.322850000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 9.718623000 seconds] Frame Number: 319 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bd8 (15320) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4e [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 88985, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 88985 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x5940 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 318] [The RTT to ACK the segment was: 0.000036000 seconds] No. Time Source Destination Protocol Info 320 9.718932 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 320 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.323159000 [Time delta from previous captured frame: 0.000309000 seconds] [Time delta from previous displayed frame: 0.000309000 seconds] [Time since reference or first frame: 9.718932000 seconds] Frame Number: 320 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xe24b (57931) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x8527 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 90445, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 90445 (relative sequence number) [Next sequence number: 91905 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xd9f7 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 319] [The RTT to ACK the segment was: 0.000309000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 321 9.718948 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 319#1] ada-cip > http [ACK] Seq=2848 Ack=88985 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=90445 SRE=91905 Frame 321 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.323175000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 9.718948000 seconds] Frame Number: 321 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bd9 (15321) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae41 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 88985, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 88985 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xa900 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 90445-91905 left edge = 90445 (relative) right edge = 91905 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 319] No. Time Source Destination Protocol Info 322 9.860597 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 322 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.464824000 [Time delta from previous captured frame: 0.141649000 seconds] [Time delta from previous displayed frame: 0.141649000 seconds] [Time since reference or first frame: 9.860597000 seconds] Frame Number: 322 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xeb4b (60235) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x7c27 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 91905, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 91905 (relative sequence number) [Next sequence number: 93365 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x237e [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 321] [The RTT to ACK the segment was: 0.141649000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 323 9.860620 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 319#2] ada-cip > http [ACK] Seq=2848 Ack=88985 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=90445 SRE=93365 Frame 323 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.464847000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 9.860620000 seconds] Frame Number: 323 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bda (15322) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae40 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 88985, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 88985 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xa34c (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 90445-93365 left edge = 90445 (relative) right edge = 93365 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 319] No. Time Source Destination Protocol Info 324 10.288179 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 324 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.892406000 [Time delta from previous captured frame: 0.427559000 seconds] [Time delta from previous displayed frame: 0.427559000 seconds] [Time since reference or first frame: 10.288179000 seconds] Frame Number: 324 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x034c (844) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x6427 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 88985, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 88985 (relative sequence number) [Next sequence number: 90445 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xca91 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 323] [The RTT to ACK the segment was: 0.427559000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.427582000 seconds] [RTO based on delta from frame: 322] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 325 10.288220 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=93365 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 325 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:38.892447000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 10.288220000 seconds] Frame Number: 325 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bdb (15323) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4b [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 93365, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 93365 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x4824 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 322] [The RTT to ACK the segment was: 0.427623000 seconds] No. Time Source Destination Protocol Info 326 10.434758 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 326 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.038985000 [Time delta from previous captured frame: 0.146538000 seconds] [Time delta from previous displayed frame: 0.146538000 seconds] [Time since reference or first frame: 10.434758000 seconds] Frame Number: 326 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x0f4c (3916) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x5827 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 93365, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 93365 (relative sequence number) [Next sequence number: 94825 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x54b9 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 325] [The RTT to ACK the segment was: 0.146538000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 327 10.437187 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 327 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.041414000 [Time delta from previous captured frame: 0.002429000 seconds] [Time delta from previous displayed frame: 0.002429000 seconds] [Time since reference or first frame: 10.437187000 seconds] Frame Number: 327 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x104c (4172) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x5727 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 94825, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 94825 (relative sequence number) [Next sequence number: 96285 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x4a6d [correct] [Good Checksum: True] [Bad Checksum: False] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 328 10.437205 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=96285 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 328 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.041432000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 10.437205000 seconds] Frame Number: 328 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bdc (15324) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae4a [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 96285, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 96285 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x3cbc (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 327] [The RTT to ACK the segment was: 0.000018000 seconds] No. Time Source Destination Protocol Info 329 10.598709 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 329 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.202936000 [Time delta from previous captured frame: 0.161504000 seconds] [Time delta from previous displayed frame: 0.161504000 seconds] [Time since reference or first frame: 10.598709000 seconds] Frame Number: 329 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x194c (6476) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x4e27 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 96285, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 96285 (relative sequence number) [Next sequence number: 97745 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x7fc3 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 328] [The RTT to ACK the segment was: 0.161504000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 330 10.598745 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=97745 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 330 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.202972000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 10.598745000 seconds] Frame Number: 330 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bdf (15327) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae47 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 97745, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 97745 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x3708 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 329] [The RTT to ACK the segment was: 0.000036000 seconds] No. Time Source Destination Protocol Info 331 10.599081 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 331 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.203308000 [Time delta from previous captured frame: 0.000336000 seconds] [Time delta from previous displayed frame: 0.000336000 seconds] [Time since reference or first frame: 10.599081000 seconds] Frame Number: 331 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x1b4c (6988) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x4c27 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 99205, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 99205 (relative sequence number) [Next sequence number: 100665 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xddd8 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 330] [The RTT to ACK the segment was: 0.000336000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 332 10.599094 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 330#1] ada-cip > http [ACK] Seq=2848 Ack=97745 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=99205 SRE=100665 Frame 332 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.203321000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 10.599094000 seconds] Frame Number: 332 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3be0 (15328) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae3a [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 97745, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 97745 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x4258 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 99205-100665 left edge = 99205 (relative) right edge = 100665 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 330] No. Time Source Destination Protocol Info 333 10.742488 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 333 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.346715000 [Time delta from previous captured frame: 0.143394000 seconds] [Time delta from previous displayed frame: 0.143394000 seconds] [Time since reference or first frame: 10.742488000 seconds] Frame Number: 333 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x264c (9804) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x4127 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 100665, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 100665 (relative sequence number) [Next sequence number: 102125 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x6f7a [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 332] [The RTT to ACK the segment was: 0.143394000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 334 10.742511 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 330#2] ada-cip > http [ACK] Seq=2848 Ack=97745 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=99205 SRE=102125 Frame 334 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.346738000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 10.742511000 seconds] Frame Number: 334 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3be1 (15329) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae39 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 97745, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 97745 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x3ca4 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 99205-102125 left edge = 99205 (relative) right edge = 102125 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 330] No. Time Source Destination Protocol Info 335 11.132359 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 335 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.736586000 [Time delta from previous captured frame: 0.389848000 seconds] [Time delta from previous displayed frame: 0.389848000 seconds] [Time since reference or first frame: 11.132359000 seconds] Frame Number: 335 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x404c (16460) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x2727 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 97745, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 97745 (relative sequence number) [Next sequence number: 99205 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x932e [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 334] [The RTT to ACK the segment was: 0.389848000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.389871000 seconds] [RTO based on delta from frame: 333] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 336 11.132398 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=102125 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 336 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.736625000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 11.132398000 seconds] Frame Number: 336 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3be2 (15330) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae44 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 102125, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 102125 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x25ec (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 333] [The RTT to ACK the segment was: 0.389910000 seconds] No. Time Source Destination Protocol Info 337 11.259837 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 337 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:39.864064000 [Time delta from previous captured frame: 0.127439000 seconds] [Time delta from previous displayed frame: 0.127439000 seconds] [Time since reference or first frame: 11.259837000 seconds] Frame Number: 337 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x474c (18252) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x2027 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 102125, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 102125 (relative sequence number) [Next sequence number: 103585 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x2891 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 336] [The RTT to ACK the segment was: 0.127439000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 338 11.416311 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=103585 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 338 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.020538000 [Time delta from previous captured frame: 0.156474000 seconds] [Time delta from previous displayed frame: 0.156474000 seconds] [Time since reference or first frame: 11.416311000 seconds] Frame Number: 338 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3be3 (15331) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae43 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 103585, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 103585 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x2038 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 337] [The RTT to ACK the segment was: 0.156474000 seconds] No. Time Source Destination Protocol Info 339 11.511805 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 339 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.116032000 [Time delta from previous captured frame: 0.095494000 seconds] [Time delta from previous displayed frame: 0.095494000 seconds] [Time since reference or first frame: 11.511805000 seconds] Frame Number: 339 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x5a4c (23116) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x0d27 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 105045, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 105045 (relative sequence number) [Next sequence number: 106505 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x0700 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 338] [The RTT to ACK the segment was: 0.095494000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 340 11.511828 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 338#1] ada-cip > http [ACK] Seq=2848 Ack=103585 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=105045 SRE=106505 Frame 340 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.116055000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 11.511828000 seconds] Frame Number: 340 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3be4 (15332) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae36 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 103585, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 103585 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xfde7 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 105045-106505 left edge = 105045 (relative) right edge = 106505 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 338] No. Time Source Destination Protocol Info 341 11.512895 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 341 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.117122000 [Time delta from previous captured frame: 0.001067000 seconds] [Time delta from previous displayed frame: 0.001067000 seconds] [Time since reference or first frame: 11.512895000 seconds] Frame Number: 341 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x5b4c (23372) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0x0c27 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 106505, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 106505 (relative sequence number) [Next sequence number: 107965 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x67cb [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 340] [The RTT to ACK the segment was: 0.001067000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 342 11.512903 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 338#2] ada-cip > http [ACK] Seq=2848 Ack=103585 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=105045 SRE=107965 Frame 342 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.117130000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 11.512903000 seconds] Frame Number: 342 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3be5 (15333) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae35 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 103585, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 103585 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xf833 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 105045-107965 left edge = 105045 (relative) right edge = 107965 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 338] No. Time Source Destination Protocol Info 343 11.870761 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 343 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.474988000 [Time delta from previous captured frame: 0.357858000 seconds] [Time delta from previous displayed frame: 0.357858000 seconds] [Time since reference or first frame: 11.870761000 seconds] Frame Number: 343 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7a4c (31308) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xed26 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 103585, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 103585 (relative sequence number) [Next sequence number: 105045 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xe0e0 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 342] [The RTT to ACK the segment was: 0.357858000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.357866000 seconds] [RTO based on delta from frame: 341] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 344 11.870825 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=107965 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 344 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.475052000 [Time delta from previous captured frame: 0.000064000 seconds] [Time delta from previous displayed frame: 0.000064000 seconds] [Time since reference or first frame: 11.870825000 seconds] Frame Number: 344 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3be6 (15334) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae40 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 107965, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 107965 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x0f1c (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 341] [The RTT to ACK the segment was: 0.357930000 seconds] No. Time Source Destination Protocol Info 345 11.936062 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 345 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.540289000 [Time delta from previous captured frame: 0.065237000 seconds] [Time delta from previous displayed frame: 0.065237000 seconds] [Time since reference or first frame: 11.936062000 seconds] Frame Number: 345 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7f4c (32588) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xe826 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 107965, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 107965 (relative sequence number) [Next sequence number: 109425 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xbdb3 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 344] [The RTT to ACK the segment was: 0.065237000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 346 12.120400 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=109425 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 346 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.724627000 [Time delta from previous captured frame: 0.184338000 seconds] [Time delta from previous displayed frame: 0.184338000 seconds] [Time since reference or first frame: 12.120400000 seconds] Frame Number: 346 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3be7 (15335) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae3f [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 109425, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 109425 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0x0968 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 345] [The RTT to ACK the segment was: 0.184338000 seconds] No. Time Source Destination Protocol Info 347 12.207604 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 347 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.811831000 [Time delta from previous captured frame: 0.087204000 seconds] [Time delta from previous displayed frame: 0.087204000 seconds] [Time since reference or first frame: 12.207604000 seconds] Frame Number: 347 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x944c (37964) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xd326 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 110885, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 110885 (relative sequence number) [Next sequence number: 112345 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xe20f [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 346] [The RTT to ACK the segment was: 0.087204000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 348 12.207627 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 346#1] ada-cip > http [ACK] Seq=2848 Ack=109425 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=110885 SRE=112345 Frame 348 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.811854000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 12.207627000 seconds] Frame Number: 348 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3be8 (15336) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae32 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 109425, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 109425 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xb977 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 110885-112345 left edge = 110885 (relative) right edge = 112345 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 346] No. Time Source Destination Protocol Info 349 12.209301 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 349 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.813528000 [Time delta from previous captured frame: 0.001674000 seconds] [Time delta from previous displayed frame: 0.001674000 seconds] [Time since reference or first frame: 12.209301000 seconds] Frame Number: 349 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x954c (38220) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xd226 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 112345, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 112345 (relative sequence number) [Next sequence number: 113805 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x1d1c [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 348] [The RTT to ACK the segment was: 0.001674000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 350 12.209310 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 346#2] ada-cip > http [ACK] Seq=2848 Ack=109425 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=110885 SRE=113805 Frame 350 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:40.813537000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 12.209310000 seconds] Frame Number: 350 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3be9 (15337) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae31 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 109425, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 109425 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0xb3c3 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 110885-113805 left edge = 110885 (relative) right edge = 113805 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 346] No. Time Source Destination Protocol Info 369 12.609904 208.117.224.240 172.18.179.48 TCP [TCP Retransmission] [TCP segment of a reassembled PDU] Frame 369 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:41.214131000 [Time delta from previous captured frame: 0.039708000 seconds] [Time delta from previous displayed frame: 0.400594000 seconds] [Time since reference or first frame: 12.609904000 seconds] Frame Number: 369 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xb14c (45388) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xb626 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 109425, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 109425 (relative sequence number) [Next sequence number: 110885 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xee0c [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 350] [The RTT to ACK the segment was: 0.400594000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.400603000 seconds] [RTO based on delta from frame: 349] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 370 12.609934 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=113805 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 370 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:41.214161000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 12.609934000 seconds] Frame Number: 370 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bf3 (15347) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae33 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 113805, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 113805 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xf84b (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 349] [The RTT to ACK the segment was: 0.400633000 seconds] No. Time Source Destination Protocol Info 371 12.721797 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 371 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:41.326024000 [Time delta from previous captured frame: 0.111863000 seconds] [Time delta from previous displayed frame: 0.111863000 seconds] [Time since reference or first frame: 12.721797000 seconds] Frame Number: 371 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xb94c (47436) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xae26 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 113805, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 113805 (relative sequence number) [Next sequence number: 115265 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xcfbe [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 370] [The RTT to ACK the segment was: 0.111863000 seconds] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 374 12.824482 172.18.179.48 208.117.224.240 TCP ada-cip > http [ACK] Seq=2848 Ack=115265 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 Frame 374 (54 bytes on wire, 54 bytes captured) Arrival Time: Oct 13, 2008 16:29:41.428709000 [Time delta from previous captured frame: 0.068611000 seconds] [Time delta from previous displayed frame: 0.102685000 seconds] [Time since reference or first frame: 12.824482000 seconds] Frame Number: 374 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3bf6 (15350) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae30 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 115265, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 115265 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10c4 [incorrect, should be 0xf297 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 371] [The RTT to ACK the segment was: 0.102685000 seconds] No. Time Source Destination Protocol Info 377 13.012753 208.117.224.240 172.18.179.48 TCP [TCP Previous segment lost] [TCP segment of a reassembled PDU] Frame 377 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:41.616980000 [Time delta from previous captured frame: 0.070519000 seconds] [Time delta from previous displayed frame: 0.188271000 seconds] [Time since reference or first frame: 13.012753000 seconds] Frame Number: 377 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) Address: Cisco_66:18:00 (00:17:0f:66:18:00) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 208.117.224.240 (208.117.224.240), Dst: 172.18.179.48 (172.18.179.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xc64c (50764) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: TCP (0x06) Header checksum: 0xa126 [correct] [Good: True] [Bad : False] Source: 208.117.224.240 (208.117.224.240) Destination: 172.18.179.48 (172.18.179.48) Transmission Control Protocol, Src Port: http (80), Dst Port: ada-cip (2085), Seq: 116725, Ack: 2848, Len: 1460 Source port: http (80) Destination port: ada-cip (2085) Sequence number: 116725 (relative sequence number) [Next sequence number: 118185 (relative sequence number)] Acknowledgement number: 2848 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x8609 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 374] [The RTT to ACK the segment was: 0.188271000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] [Reassembled PDU in frame: 118258] TCP segment data (1460 bytes) No. Time Source Destination Protocol Info 378 13.012774 172.18.179.48 208.117.224.240 TCP [TCP Dup ACK 374#1] ada-cip > http [ACK] Seq=2848 Ack=115265 Win=65535 [TCP CHECKSUM INCORRECT] Len=0 SLE=116725 SRE=118185 Frame 378 (66 bytes on wire, 66 bytes captured) Arrival Time: Oct 13, 2008 16:29:41.617001000 [Time delta from previous captured frame: 0.000021000 seconds] [Time delta from previous displayed frame: 0.000021000 seconds] [Time since reference or first frame: 13.012774000 seconds] Frame Number: 378 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Ethernet II, Src: Dell_b0:20:d7 (00:1e:4f:b0:20:d7), Dst: All-HSRP-routers_02 (00:00:0c:07:ac:02) Destination: All-HSRP-routers_02 (00:00:0c:07:ac:02) Address: All-HSRP-routers_02 (00:00:0c:07:ac:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 172.18.179.48 (172.18.179.48), Dst: 208.117.224.240 (208.117.224.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3bf8 (15352) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xae22 [correct] [Good: True] [Bad : False] Source: 172.18.179.48 (172.18.179.48) Destination: 208.117.224.240 (208.117.224.240) Transmission Control Protocol, Src Port: ada-cip (2085), Dst Port: http (80), Seq: 2848, Ack: 115265, Len: 0 Source port: ada-cip (2085) Destination port: http (80) Sequence number: 2848 (relative sequence number) Acknowledgement number: 115265 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x10d0 [incorrect, should be 0x7507 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Options: (12 bytes) NOP NOP SACK: 116725-118185 left edge = 116725 (relative) right edge = 118185 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 374] No. Time Source Destination Protocol Info 379 13.013081 208.117.224.240 172.18.179.48 TCP [TCP segment of a reassembled PDU] Frame 379 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Oct 13, 2008 16:29:41.617308000 [Time delta from previous captured frame: 0.000307000 seconds] [Time delta from previous displayed frame: 0.000307000 seconds] [Time since reference or first frame: 13.013081000 seconds] Frame Number: 379 Frame Length: 1514 bytes Capture Length: 1514 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: HTTP] [Coloring Rule String: http || tcp.port == 80] Ethernet II, Src: Cisco_66:18:00 (00:17:0f:66:18:00), Dst: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Destination: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) Address: Dell_b0:20:d7 (00:1e:4f:b0:20:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_66:18:00 (00:17:0f:66:18:00) A