Kerberos authentication oddities
Lukas Hejtmanek
xhejtman at ics.muni.cz
Fri Mar 7 14:02:39 EST 2008
On Fri, Mar 07, 2008 at 01:18:10PM -0500, Kevin Coffman wrote:
> Could you get a network trace and check what the server is returning
> in the NULL call reply? I'm guessing that it is GSS_S_NO_CONTEXT
> (0x00080000). If so, it is the same problem reported here:
I attached dump from wireshark. If raw tcpdump would be more helpfull I can do
that as well.
Is seems that is has no problem with GSS_S_NO_CONTEXT as one can see. It looks
like the server returns NFS4ERR_PERM.
this is how my exports file looks like:
/mnt/export/nfs4 gss/krb(rw,sync,fsid=0,no_subtree_check)
ls -ld /mnt/export/nfs4/
drwxr-xr-x 2 root root 6 2008-03-07 16:11 /mnt/export/nfs4/
--
Lukáš Hejtmánek
-------------- next part --------------
No. Time Source Destination Protocol Info
4 4.268914 192.168.1.2 147.251.9.8 TCP 56761 > shilp [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=20944473 TSER=0 WS=7
Frame 4 (74 bytes on wire, 74 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.151089000
[Time delta from previous captured frame: 0.267238000 seconds]
[Time delta from previous displayed frame: 4.268914000 seconds]
[Time since reference or first frame: 4.268914000 seconds]
Frame Number: 4
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0xc5a0 (50592)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x166e [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: 56761 (56761), Dst Port: shilp (2049), Seq: 0, Len: 0
Source port: 56761 (56761)
Destination port: shilp (2049)
Sequence number: 0 (relative sequence number)
Header length: 40 bytes
Flags: 0x02 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0x582a [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 20944473, TSecr 0
NOP
Window scale: 7 (multiply by 128)
No. Time Source Destination Protocol Info
5 4.275673 147.251.9.8 192.168.1.2 TCP shilp > 56761 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3226484 TSER=20944473 WS=7
Frame 5 (74 bytes on wire, 74 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.157848000
[Time delta from previous captured frame: 0.006759000 seconds]
[Time delta from previous displayed frame: 0.006759000 seconds]
[Time since reference or first frame: 4.275673000 seconds]
Frame Number: 5
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0xe20e [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: 56761 (56761), Seq: 0, Ack: 1, Len: 0
Source port: shilp (2049)
Destination port: 56761 (56761)
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 40 bytes
Flags: 0x12 (SYN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5792
Checksum: 0x8629 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 3226484, TSecr 20944473
NOP
Window scale: 7 (multiply by 128)
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 4]
[The RTT to ACK the segment was: 0.006759000 seconds]
No. Time Source Destination Protocol Info
6 4.275714 192.168.1.2 147.251.9.8 TCP 56761 > shilp [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=20944475 TSER=3226484
Frame 6 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.157889000
[Time delta from previous captured frame: 0.000041000 seconds]
[Time delta from previous displayed frame: 0.000041000 seconds]
[Time since reference or first frame: 4.275714000 seconds]
Frame Number: 6
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xc5a1 (50593)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x1675 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: 56761 (56761), Dst Port: shilp (2049), Seq: 1, Ack: 1, Len: 0
Source port: 56761 (56761)
Destination port: shilp (2049)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0xcb65 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944475, TSecr 3226484
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 5]
[The RTT to ACK the segment was: 0.000041000 seconds]
No. Time Source Destination Protocol Info
7 4.275780 192.168.1.2 147.251.9.8 NFS V4 NULL Call (Reply In 9)[Unreassembled Packet [incorrect TCP checksum]]
Frame 7 (110 bytes on wire, 110 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.157955000
[Time delta from previous captured frame: 0.000066000 seconds]
[Time delta from previous displayed frame: 0.000066000 seconds]
[Time since reference or first frame: 4.275780000 seconds]
Frame Number: 7
Frame Length: 110 bytes
Capture Length: 110 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 96
Identification: 0xc5a2 (50594)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x1648 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: 56761 (56761), Dst Port: shilp (2049), Seq: 1, Ack: 1, Len: 44
Source port: 56761 (56761)
Destination port: shilp (2049)
Sequence number: 1 (relative sequence number)
[Next sequence number: 45 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x5f00 [incorrect, should be 0xba71 (maybe caused by "TCP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944475, TSecr 3226484
Remote Procedure Call, Type:Call XID:0x6dc49c28
Fragment header: Last fragment, 40 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 0010 1000 = Fragment Length: 40
XID: 0x6dc49c28 (1841601576)
Message Type: Call (0)
RPC Version: 2
Program: NFS (100003)
Program Version: 4
Procedure: NULL (0)
[The reply to this request is in frame 9]
Credentials
Flavor: AUTH_NULL (0)
Length: 0
Verifier
Flavor: AUTH_NULL (0)
Length: 0
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
[Unreassembled Packet [incorrect TCP checksum]: RPC]
No. Time Source Destination Protocol Info
8 4.280605 147.251.9.8 192.168.1.2 TCP shilp > 56761 [ACK] Seq=1 Ack=45 Win=5888 Len=0 TSV=3226486 TSER=20944475
Frame 8 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.162780000
[Time delta from previous captured frame: 0.004825000 seconds]
[Time delta from previous displayed frame: 0.004825000 seconds]
[Time since reference or first frame: 4.280605000 seconds]
Frame Number: 8
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x88d2 (35026)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x5944 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: 56761 (56761), Seq: 1, Ack: 45, Len: 0
Source port: shilp (2049)
Destination port: 56761 (56761)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 45 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0xcb37 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226486, TSecr 20944475
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 7]
[The RTT to ACK the segment was: 0.004825000 seconds]
No. Time Source Destination Protocol Info
9 4.281674 147.251.9.8 192.168.1.2 NFS V4 NULL Reply (Call In 7)[Malformed Packet]
Frame 9 (94 bytes on wire, 94 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.163849000
[Time delta from previous captured frame: 0.001069000 seconds]
[Time delta from previous displayed frame: 0.001069000 seconds]
[Time since reference or first frame: 4.281674000 seconds]
Frame Number: 9
Frame Length: 94 bytes
Capture Length: 94 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 80
Identification: 0x88d3 (35027)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x5927 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: 56761 (56761), Seq: 1, Ack: 45, Len: 28
Source port: shilp (2049)
Destination port: 56761 (56761)
Sequence number: 1 (relative sequence number)
[Next sequence number: 29 (relative sequence number)]
Acknowledgement number: 45 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x410d [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226486, TSecr 20944475
Remote Procedure Call, Type:Reply XID:0x6dc49c28
Fragment header: Last fragment, 24 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 0001 1000 = Fragment Length: 24
XID: 0x6dc49c28 (1841601576)
Message Type: Reply (1)
[Program: NFS (100003)]
[Program Version: 4]
[Procedure: NULL (0)]
Reply State: accepted (0)
[This is a reply to a request in frame 7]
[Time from request: 0.005894000 seconds]
Verifier
Flavor: AUTH_NULL (0)
Length: 0
Accept State: RPC executed successfully (0)
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
[Malformed Packet: RPC]
No. Time Source Destination Protocol Info
10 4.281691 192.168.1.2 147.251.9.8 TCP 56761 > shilp [ACK] Seq=45 Ack=29 Win=5888 Len=0 TSV=20944476 TSER=3226486
Frame 10 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.163866000
[Time delta from previous captured frame: 0.000017000 seconds]
[Time delta from previous displayed frame: 0.000017000 seconds]
[Time since reference or first frame: 4.281691000 seconds]
Frame Number: 10
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xc5a3 (50595)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x1673 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: 56761 (56761), Dst Port: shilp (2049), Seq: 45, Ack: 29, Len: 0
Source port: 56761 (56761)
Destination port: shilp (2049)
Sequence number: 45 (relative sequence number)
Acknowledgement number: 29 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0xcb1a [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944476, TSecr 3226486
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 9]
[The RTT to ACK the segment was: 0.000017000 seconds]
No. Time Source Destination Protocol Info
11 4.281762 192.168.1.2 147.251.9.8 TCP 56761 > shilp [FIN, ACK] Seq=45 Ack=29 Win=5888 Len=0 TSV=20944476 TSER=3226486
Frame 11 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.163937000
[Time delta from previous captured frame: 0.000071000 seconds]
[Time delta from previous displayed frame: 0.000071000 seconds]
[Time since reference or first frame: 4.281762000 seconds]
Frame Number: 11
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xc5a4 (50596)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x1672 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: 56761 (56761), Dst Port: shilp (2049), Seq: 45, Ack: 29, Len: 0
Source port: 56761 (56761)
Destination port: shilp (2049)
Sequence number: 45 (relative sequence number)
Acknowledgement number: 29 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
Window size: 5888 (scaled)
Checksum: 0xcb19 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944476, TSecr 3226486
No. Time Source Destination Protocol Info
12 4.288425 192.168.1.2 147.251.9.8 TCP xact-backup > shilp [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=20944478 TSER=0 WS=7
Frame 12 (74 bytes on wire, 74 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.170600000
[Time delta from previous captured frame: 0.006663000 seconds]
[Time delta from previous displayed frame: 0.006663000 seconds]
[Time since reference or first frame: 4.288425000 seconds]
Frame Number: 12
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x32ea (13034)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa924 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 0, Len: 0
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 0 (relative sequence number)
Header length: 40 bytes
Flags: 0x02 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0xe185 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 20944478, TSecr 0
NOP
Window scale: 7 (multiply by 128)
No. Time Source Destination Protocol Info
13 4.292948 147.251.9.8 192.168.1.2 TCP shilp > 56761 [FIN, ACK] Seq=29 Ack=46 Win=5888 Len=0 TSV=3226490 TSER=20944476
Frame 13 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.175123000
[Time delta from previous captured frame: 0.004523000 seconds]
[Time delta from previous displayed frame: 0.004523000 seconds]
[Time since reference or first frame: 4.292948000 seconds]
Frame Number: 13
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x88d4 (35028)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x5942 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: 56761 (56761), Seq: 29, Ack: 46, Len: 0
Source port: shilp (2049)
Destination port: 56761 (56761)
Sequence number: 29 (relative sequence number)
Acknowledgement number: 46 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
Window size: 5888 (scaled)
Checksum: 0xcb14 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226490, TSecr 20944476
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 11]
[The RTT to ACK the segment was: 0.011186000 seconds]
No. Time Source Destination Protocol Info
14 4.292978 192.168.1.2 147.251.9.8 TCP 56761 > shilp [ACK] Seq=46 Ack=30 Win=5888 Len=0 TSV=20944480 TSER=3226490
Frame 14 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.175153000
[Time delta from previous captured frame: 0.000030000 seconds]
[Time delta from previous displayed frame: 0.000030000 seconds]
[Time since reference or first frame: 4.292978000 seconds]
Frame Number: 14
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xc5a5 (50597)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x1671 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: 56761 (56761), Dst Port: shilp (2049), Seq: 46, Ack: 30, Len: 0
Source port: 56761 (56761)
Destination port: shilp (2049)
Sequence number: 46 (relative sequence number)
Acknowledgement number: 30 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0xcb10 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944480, TSecr 3226490
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 13]
[The RTT to ACK the segment was: 0.000030000 seconds]
No. Time Source Destination Protocol Info
15 4.302256 147.251.9.8 192.168.1.2 TCP shilp > xact-backup [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3226490 TSER=20944478 WS=7
Frame 15 (74 bytes on wire, 74 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.184431000
[Time delta from previous captured frame: 0.009278000 seconds]
[Time delta from previous displayed frame: 0.009278000 seconds]
[Time since reference or first frame: 4.302256000 seconds]
Frame Number: 15
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0xe20e [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: xact-backup (911), Seq: 0, Ack: 1, Len: 0
Source port: shilp (2049)
Destination port: xact-backup (911)
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 40 bytes
Flags: 0x12 (SYN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5792
Checksum: 0x444a [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 3226490, TSecr 20944478
NOP
Window scale: 7 (multiply by 128)
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 12]
[The RTT to ACK the segment was: 0.013831000 seconds]
No. Time Source Destination Protocol Info
16 4.302295 192.168.1.2 147.251.9.8 TCP xact-backup > shilp [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=20944483 TSER=3226490
Frame 16 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.184470000
[Time delta from previous captured frame: 0.000039000 seconds]
[Time delta from previous displayed frame: 0.000039000 seconds]
[Time since reference or first frame: 4.302295000 seconds]
Frame Number: 16
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x32eb (13035)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa92b [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 1, Ack: 1, Len: 0
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x8983 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944483, TSecr 3226490
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 15]
[The RTT to ACK the segment was: 0.000039000 seconds]
No. Time Source Destination Protocol Info
17 4.302345 192.168.1.2 147.251.9.8 NFS V4 NULL Call (Reply In 19)[Unreassembled Packet [incorrect TCP checksum]]
Frame 17 (110 bytes on wire, 110 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.184520000
[Time delta from previous captured frame: 0.000050000 seconds]
[Time delta from previous displayed frame: 0.000050000 seconds]
[Time since reference or first frame: 4.302345000 seconds]
Frame Number: 17
Frame Length: 110 bytes
Capture Length: 110 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 96
Identification: 0x32ec (13036)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa8fe [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 1, Ack: 1, Len: 44
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 1 (relative sequence number)
[Next sequence number: 45 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x5f00 [incorrect, should be 0xe6b4 (maybe caused by "TCP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944483, TSecr 3226490
Remote Procedure Call, Type:Call XID:0x99ed01da
Fragment header: Last fragment, 40 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 0010 1000 = Fragment Length: 40
XID: 0x99ed01da (2582446554)
Message Type: Call (0)
RPC Version: 2
Program: NFS (100003)
Program Version: 4
Procedure: NULL (0)
[The reply to this request is in frame 19]
Credentials
Flavor: AUTH_NULL (0)
Length: 0
Verifier
Flavor: AUTH_NULL (0)
Length: 0
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
[Unreassembled Packet [incorrect TCP checksum]: RPC]
No. Time Source Destination Protocol Info
18 4.307579 147.251.9.8 192.168.1.2 TCP shilp > xact-backup [ACK] Seq=1 Ack=45 Win=5888 Len=0 TSV=3226494 TSER=20944483
Frame 18 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.189754000
[Time delta from previous captured frame: 0.005234000 seconds]
[Time delta from previous displayed frame: 0.005234000 seconds]
[Time since reference or first frame: 4.307579000 seconds]
Frame Number: 18
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x45f4 (17908)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x9c22 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: xact-backup (911), Seq: 1, Ack: 45, Len: 0
Source port: shilp (2049)
Destination port: xact-backup (911)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 45 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x8953 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226494, TSecr 20944483
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 17]
[The RTT to ACK the segment was: 0.005234000 seconds]
No. Time Source Destination Protocol Info
19 4.308472 147.251.9.8 192.168.1.2 NFS V4 NULL Reply (Call In 17)[Malformed Packet]
Frame 19 (94 bytes on wire, 94 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.190647000
[Time delta from previous captured frame: 0.000893000 seconds]
[Time delta from previous displayed frame: 0.000893000 seconds]
[Time since reference or first frame: 4.308472000 seconds]
Frame Number: 19
Frame Length: 94 bytes
Capture Length: 94 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 80
Identification: 0x45f5 (17909)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x9c05 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: xact-backup (911), Seq: 1, Ack: 45, Len: 28
Source port: shilp (2049)
Destination port: xact-backup (911)
Sequence number: 1 (relative sequence number)
[Next sequence number: 29 (relative sequence number)]
Acknowledgement number: 45 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x6d4e [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226494, TSecr 20944483
Remote Procedure Call, Type:Reply XID:0x99ed01da
Fragment header: Last fragment, 24 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 0001 1000 = Fragment Length: 24
XID: 0x99ed01da (2582446554)
Message Type: Reply (1)
[Program: NFS (100003)]
[Program Version: 4]
[Procedure: NULL (0)]
Reply State: accepted (0)
[This is a reply to a request in frame 17]
[Time from request: 0.006127000 seconds]
Verifier
Flavor: AUTH_NULL (0)
Length: 0
Accept State: RPC executed successfully (0)
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
[Malformed Packet: RPC]
No. Time Source Destination Protocol Info
20 4.308488 192.168.1.2 147.251.9.8 TCP xact-backup > shilp [ACK] Seq=45 Ack=29 Win=5888 Len=0 TSV=20944484 TSER=3226494
Frame 20 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.190663000
[Time delta from previous captured frame: 0.000016000 seconds]
[Time delta from previous displayed frame: 0.000016000 seconds]
[Time since reference or first frame: 4.308488000 seconds]
Frame Number: 20
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x32ed (13037)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa929 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 45, Ack: 29, Len: 0
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 45 (relative sequence number)
Acknowledgement number: 29 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x8936 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944484, TSecr 3226494
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 19]
[The RTT to ACK the segment was: 0.000016000 seconds]
No. Time Source Destination Protocol Info
21 4.310974 192.168.1.2 147.251.9.8 TCP oob-ws-http > shilp [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=20944485 TSER=0 WS=7
Frame 21 (74 bytes on wire, 74 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.193149000
[Time delta from previous captured frame: 0.002486000 seconds]
[Time delta from previous displayed frame: 0.002486000 seconds]
[Time since reference or first frame: 4.310974000 seconds]
Frame Number: 21
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0xec0d (60429)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xf000 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: oob-ws-http (623), Dst Port: shilp (2049), Seq: 0, Len: 0
Source port: oob-ws-http (623)
Destination port: shilp (2049)
Sequence number: 0 (relative sequence number)
Header length: 40 bytes
Flags: 0x02 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0x0cd4 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 20944485, TSecr 0
NOP
Window scale: 7 (multiply by 128)
No. Time Source Destination Protocol Info
22 4.322707 147.251.9.8 192.168.1.2 TCP shilp > oob-ws-http [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3226499 TSER=20944485 WS=7
Frame 22 (74 bytes on wire, 74 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.204882000
[Time delta from previous captured frame: 0.011733000 seconds]
[Time delta from previous displayed frame: 0.011733000 seconds]
[Time since reference or first frame: 4.322707000 seconds]
Frame Number: 22
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0xe20e [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: oob-ws-http (623), Seq: 0, Ack: 1, Len: 0
Source port: shilp (2049)
Destination port: oob-ws-http (623)
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 40 bytes
Flags: 0x12 (SYN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5792
Checksum: 0xf361 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 3226499, TSecr 20944485
NOP
Window scale: 7 (multiply by 128)
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 21]
[The RTT to ACK the segment was: 0.011733000 seconds]
No. Time Source Destination Protocol Info
23 4.322749 192.168.1.2 147.251.9.8 TCP oob-ws-http > shilp [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=20944489 TSER=3226499
Frame 23 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.204924000
[Time delta from previous captured frame: 0.000042000 seconds]
[Time delta from previous displayed frame: 0.000042000 seconds]
[Time since reference or first frame: 4.322749000 seconds]
Frame Number: 23
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xec0e (60430)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xf007 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: oob-ws-http (623), Dst Port: shilp (2049), Seq: 1, Ack: 1, Len: 0
Source port: oob-ws-http (623)
Destination port: shilp (2049)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x389c [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944489, TSecr 3226499
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 22]
[The RTT to ACK the segment was: 0.000042000 seconds]
No. Time Source Destination Protocol Info
24 4.323662 192.168.1.2 147.251.9.8 NFS V4 NULL Call (Reply In 26)
Frame 24 (590 bytes on wire, 590 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.205837000
[Time delta from previous captured frame: 0.000913000 seconds]
[Time delta from previous displayed frame: 0.000913000 seconds]
[Time since reference or first frame: 4.323662000 seconds]
Frame Number: 24
Frame Length: 590 bytes
Capture Length: 590 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc:gss-api:spnego-krb5]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 576
Identification: 0xec0f (60431)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xedfa [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: oob-ws-http (623), Dst Port: shilp (2049), Seq: 1, Ack: 1, Len: 524
Source port: oob-ws-http (623)
Destination port: shilp (2049)
Sequence number: 1 (relative sequence number)
[Next sequence number: 525 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x60e0 [incorrect, should be 0xb999 (maybe caused by "TCP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944489, TSecr 3226499
Remote Procedure Call, Type:Call XID:0x46d2c60e
Fragment header: Last fragment, 520 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0010 0000 1000 = Fragment Length: 520
XID: 0x46d2c60e (1188218382)
Message Type: Call (0)
RPC Version: 2
Program: NFS (100003)
Program Version: 4
Procedure: NULL (0)
[The reply to this request is in frame 26]
Credentials
Flavor: RPCSEC_GSS (6)
Length: 20
GSS Version: 1
GSS Procedure: RPCSEC_GSS_INIT (1)
GSS Sequence Number: 0
GSS Service: rpcsec_gss_svc_none (1)
GSS Context: <EMPTY>
length: 0
contents: <EMPTY>
Verifier
Flavor: AUTH_NULL (0)
Length: 0
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
GSS Token
GSS Token Length: 454
GSS-API Generic Security Service Application Program Interface
OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_blob: 01006E8201B1308201ADA003020105A10302010EA2070305...
krb5_tok_id: KRB5_AP_REQ (0x0001)
Kerberos AP-REQ
Pvno: 5
MSG Type: AP-REQ (14)
Padding: 0
APOptions: 20000000 (Mutual required)
.0.. .... .... .... .... .... .... .... = Use Session Key: Do NOT use the session key to encrypt the ticket
..1. .... .... .... .... .... .... .... = Mutual required: MUTUAL authentication is REQUIRED
Ticket
Tkt-vno: 5
Realm: ICS.MUNI.CZ
Server Name (Principal): nfs/smaug1.ics.muni.cz
Name-type: Principal (1)
Name: nfs
Name: smaug1.ics.muni.cz
enc-part des-cbc-crc
Encryption type: des-cbc-crc (1)
Kvno: 2
enc-part: 31817997C0FBD31A05B52FF04611E43572E0ED6906F878F6...
Authenticator des-cbc-crc
Encryption type: des-cbc-crc (1)
Authenticator data: 2B6387C2A56F2AF1666577FFE61D0C20911A21154A77F617...
No. Time Source Destination Protocol Info
25 4.328789 147.251.9.8 192.168.1.2 TCP shilp > oob-ws-http [ACK] Seq=1 Ack=525 Win=6912 Len=0 TSV=3226500 TSER=20944489
Frame 25 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.210964000
[Time delta from previous captured frame: 0.005127000 seconds]
[Time delta from previous displayed frame: 0.005127000 seconds]
[Time since reference or first frame: 4.328789000 seconds]
Frame Number: 25
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xc120 (49440)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x20f6 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: oob-ws-http (623), Seq: 1, Ack: 525, Len: 0
Source port: shilp (2049)
Destination port: oob-ws-http (623)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 525 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6912 (scaled)
Checksum: 0x3687 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226500, TSecr 20944489
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 24]
[The RTT to ACK the segment was: 0.005127000 seconds]
No. Time Source Destination Protocol Info
26 4.389564 147.251.9.8 192.168.1.2 NFS V4 NULL Reply (Call In 24)
Frame 26 (274 bytes on wire, 274 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.271739000
[Time delta from previous captured frame: 0.060775000 seconds]
[Time delta from previous displayed frame: 0.060775000 seconds]
[Time since reference or first frame: 4.389564000 seconds]
Frame Number: 26
Frame Length: 274 bytes
Capture Length: 274 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc:gss-api:spnego-krb5:gss-api:spnego-krb5]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 260
Identification: 0xc121 (49441)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x2025 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: oob-ws-http (623), Seq: 1, Ack: 525, Len: 208
Source port: shilp (2049)
Destination port: oob-ws-http (623)
Sequence number: 1 (relative sequence number)
[Next sequence number: 209 (relative sequence number)]
Acknowledgement number: 525 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6912 (scaled)
Checksum: 0x0c35 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226519, TSecr 20944489
Remote Procedure Call, Type:Reply XID:0x46d2c60e
Fragment header: Last fragment, 204 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 1100 1100 = Fragment Length: 204
XID: 0x46d2c60e (1188218382)
Message Type: Reply (1)
[Program: NFS (100003)]
[Program Version: 4]
[Procedure: NULL (0)]
Reply State: accepted (0)
[This is a reply to a request in frame 24]
[Time from request: 0.065902000 seconds]
Verifier
Flavor: RPCSEC_GSS (6)
GSS Token
GSS Token Length: 37
GSS-API Generic Security Service Application Program Interface
OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_blob: 01010000FFFFFFFF6CD37D7BC4014F352A076FE45102B5EB
krb5_tok_id: KRB5_GSS_GetMIC (0x0101)
krb5_sgn_alg: DES MAC MD5 (0x0000)
krb5_snd_seq: 6CD37D7BC4014F35
krb5_sgn_cksum: 2A076FE45102B5EB
Accept State: RPC executed successfully (0)
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
GSS Context: <DATA>
length: 4
contents: <DATA>
GSS Major Status: 0
GSS Minor Status: 0
GSS Sequence Window: 128
GSS Token
GSS Token Length: 114
GSS-API Generic Security Service Application Program Interface
OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_blob: 02006F61305FA003020105A10302010FA2533051A0030201...
krb5_tok_id: KRB5_AP_REP (0x0002)
Kerberos AP-REP
Pvno: 5
MSG Type: AP-REP (15)
enc-part des-cbc-crc
Encryption type: des-cbc-crc (1)
enc-part: 6978CDD67B9E239664DC5D39695BC926666A63D2EFCB01C3...
No. Time Source Destination Protocol Info
27 4.389580 192.168.1.2 147.251.9.8 TCP oob-ws-http > shilp [ACK] Seq=525 Ack=209 Win=6912 Len=0 TSV=20944509 TSER=3226519
Frame 27 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.271755000
[Time delta from previous captured frame: 0.000016000 seconds]
[Time delta from previous displayed frame: 0.000016000 seconds]
[Time since reference or first frame: 4.389580000 seconds]
Frame Number: 27
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xec10 (60432)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xf005 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: oob-ws-http (623), Dst Port: shilp (2049), Seq: 525, Ack: 209, Len: 0
Source port: oob-ws-http (623)
Destination port: shilp (2049)
Sequence number: 525 (relative sequence number)
Acknowledgement number: 209 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6912 (scaled)
Checksum: 0x3590 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944509, TSecr 3226519
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 26]
[The RTT to ACK the segment was: 0.000016000 seconds]
No. Time Source Destination Protocol Info
28 4.390402 192.168.1.2 147.251.9.8 TCP oob-ws-http > shilp [FIN, ACK] Seq=525 Ack=209 Win=6912 Len=0 TSV=20944509 TSER=3226519
Frame 28 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.272577000
[Time delta from previous captured frame: 0.000822000 seconds]
[Time delta from previous displayed frame: 0.000822000 seconds]
[Time since reference or first frame: 4.390402000 seconds]
Frame Number: 28
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xec11 (60433)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xf004 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: oob-ws-http (623), Dst Port: shilp (2049), Seq: 525, Ack: 209, Len: 0
Source port: oob-ws-http (623)
Destination port: shilp (2049)
Sequence number: 525 (relative sequence number)
Acknowledgement number: 209 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
Window size: 6912 (scaled)
Checksum: 0x358f [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944509, TSecr 3226519
No. Time Source Destination Protocol Info
29 4.390478 192.168.1.2 147.251.9.8 NFS V4 COMPOUND Call (Reply In 32) <EMPTY> PUTROOTFH;GETFH;GETATTR
Frame 29 (210 bytes on wire, 210 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.272653000
[Time delta from previous captured frame: 0.000076000 seconds]
[Time delta from previous displayed frame: 0.000076000 seconds]
[Time since reference or first frame: 4.390478000 seconds]
Frame Number: 29
Frame Length: 210 bytes
Capture Length: 210 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc:gss-api:spnego-krb5]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 196
Identification: 0x32ee (13038)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa898 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 45, Ack: 29, Len: 144
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 45 (relative sequence number)
[Next sequence number: 189 (relative sequence number)]
Acknowledgement number: 29 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x5f64 [incorrect, should be 0xd1d3 (maybe caused by "TCP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944509, TSecr 3226494
Remote Procedure Call, Type:Call XID:0x9aed01da
Fragment header: Last fragment, 140 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 1000 1100 = Fragment Length: 140
XID: 0x9aed01da (2599223770)
Message Type: Call (0)
RPC Version: 2
Program: NFS (100003)
Program Version: 4
Procedure: COMPOUND (1)
[The reply to this request is in frame 32]
Credentials
Flavor: RPCSEC_GSS (6)
Length: 24
GSS Version: 1
GSS Procedure: RPCSEC_GSS_DATA (0)
GSS Sequence Number: 1
GSS Service: rpcsec_gss_svc_none (1)
GSS Context: <DATA>
length: 4
contents: <DATA>
Verifier
Flavor: RPCSEC_GSS (6)
GSS Token
GSS Token Length: 37
GSS-API Generic Security Service Application Program Interface
OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_blob: 01010000FFFFFFFF931A201F70942E636197734FC29664E6
krb5_tok_id: KRB5_GSS_GetMIC (0x0101)
krb5_sgn_alg: DES MAC MD5 (0x0000)
krb5_snd_seq: 931A201F70942E63
krb5_sgn_cksum: 6197734FC29664E6
Network File System
[Program Version: 4]
[V4 Procedure: COMPOUND (1)]
Tag: <EMPTY>
length: 0
contents: <EMPTY>
minorversion: 0
Operations (count: 3)
Opcode: PUTROOTFH (24)
Opcode: GETFH (10)
Opcode: GETATTR (9)
attrmask
mand_attr: FATTR4_TYPE (1)
mand_attr: FATTR4_CHANGE (3)
mand_attr: FATTR4_SIZE (4)
mand_attr: FATTR4_FSID (8)
recc_attr: FATTR4_FILEID (20)
recc_attr: FATTR4_MODE (33)
recc_attr: FATTR4_NUMLINKS (35)
recc_attr: FATTR4_OWNER (36)
recc_attr: FATTR4_OWNER_GROUP (37)
recc_attr: FATTR4_RAWDEV (41)
recc_attr: FATTR4_SPACE_USED (45)
recc_attr: FATTR4_TIME_ACCESS (47)
recc_attr: FATTR4_TIME_METADATA (52)
recc_attr: FATTR4_TIME_MODIFY (53)
No. Time Source Destination Protocol Info
30 4.394657 147.251.9.8 192.168.1.2 TCP shilp > oob-ws-http [FIN, ACK] Seq=209 Ack=526 Win=6912 Len=0 TSV=3226520 TSER=20944509
Frame 30 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.276832000
[Time delta from previous captured frame: 0.004179000 seconds]
[Time delta from previous displayed frame: 0.004179000 seconds]
[Time since reference or first frame: 4.394657000 seconds]
Frame Number: 30
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xc122 (49442)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x20f4 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: oob-ws-http (623), Seq: 209, Ack: 526, Len: 0
Source port: shilp (2049)
Destination port: oob-ws-http (623)
Sequence number: 209 (relative sequence number)
Acknowledgement number: 526 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
Window size: 6912 (scaled)
Checksum: 0x358d [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226520, TSecr 20944509
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 28]
[The RTT to ACK the segment was: 0.004255000 seconds]
No. Time Source Destination Protocol Info
31 4.394679 192.168.1.2 147.251.9.8 TCP oob-ws-http > shilp [ACK] Seq=526 Ack=210 Win=6912 Len=0 TSV=20944510 TSER=3226520
Frame 31 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.276854000
[Time delta from previous captured frame: 0.000022000 seconds]
[Time delta from previous displayed frame: 0.000022000 seconds]
[Time since reference or first frame: 4.394679000 seconds]
Frame Number: 31
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0xec12 (60434)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xf003 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: oob-ws-http (623), Dst Port: shilp (2049), Seq: 526, Ack: 210, Len: 0
Source port: oob-ws-http (623)
Destination port: shilp (2049)
Sequence number: 526 (relative sequence number)
Acknowledgement number: 210 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6912 (scaled)
Checksum: 0x358c [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944510, TSecr 3226520
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 30]
[The RTT to ACK the segment was: 0.000022000 seconds]
No. Time Source Destination Protocol Info
32 4.395929 147.251.9.8 192.168.1.2 NFS V4 COMPOUND Reply (Call In 29) <EMPTY> PUTROOTFH
Frame 32 (154 bytes on wire, 154 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.278104000
[Time delta from previous captured frame: 0.001250000 seconds]
[Time delta from previous displayed frame: 0.001250000 seconds]
[Time since reference or first frame: 4.395929000 seconds]
Frame Number: 32
Frame Length: 154 bytes
Capture Length: 154 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc:gss-api:spnego-krb5]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 140
Identification: 0x45f6 (17910)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x9bc8 [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: xact-backup (911), Seq: 29, Ack: 189, Len: 88
Source port: shilp (2049)
Destination port: xact-backup (911)
Sequence number: 29 (relative sequence number)
[Next sequence number: 117 (relative sequence number)]
Acknowledgement number: 189 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6912 (scaled)
Checksum: 0xc7fc [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226521, TSecr 20944509
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 29]
[The RTT to ACK the segment was: 0.005451000 seconds]
Remote Procedure Call, Type:Reply XID:0x9aed01da
Fragment header: Last fragment, 84 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 0101 0100 = Fragment Length: 84
XID: 0x9aed01da (2599223770)
Message Type: Reply (1)
[Program: NFS (100003)]
[Program Version: 4]
[Procedure: COMPOUND (1)]
Reply State: accepted (0)
[This is a reply to a request in frame 29]
[Time from request: 0.005451000 seconds]
Verifier
Flavor: RPCSEC_GSS (6)
GSS Token
GSS Token Length: 37
GSS-API Generic Security Service Application Program Interface
OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_blob: 01010000FFFFFFFFFD9875E3FF1B07434F6B7405B1C26CBF
krb5_tok_id: KRB5_GSS_GetMIC (0x0101)
krb5_sgn_alg: DES MAC MD5 (0x0000)
krb5_snd_seq: FD9875E3FF1B0743
krb5_sgn_cksum: 4F6B7405B1C26CBF
Accept State: RPC executed successfully (0)
Network File System
[Program Version: 4]
[V4 Procedure: COMPOUND (1)]
Status: NFS4ERR_PERM (1)
Tag: <EMPTY>
length: 0
contents: <EMPTY>
Operations (count: 1)
Opcode: PUTROOTFH (24)
Status: NFS4ERR_PERM (1)
No. Time Source Destination Protocol Info
33 4.395951 192.168.1.2 147.251.9.8 TCP xact-backup > shilp [ACK] Seq=189 Ack=117 Win=5888 Len=0 TSV=20944511 TSER=3226521
Frame 33 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.278126000
[Time delta from previous captured frame: 0.000022000 seconds]
[Time delta from previous displayed frame: 0.000022000 seconds]
[Time since reference or first frame: 4.395951000 seconds]
Frame Number: 33
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x32ef (13039)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa927 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 189, Ack: 117, Len: 0
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 189 (relative sequence number)
Acknowledgement number: 117 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x8818 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944511, TSecr 3226521
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 32]
[The RTT to ACK the segment was: 0.000022000 seconds]
No. Time Source Destination Protocol Info
34 4.396305 192.168.1.2 147.251.9.8 NFS V4 NULL Call (Reply In 35)
Frame 34 (174 bytes on wire, 174 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.278480000
[Time delta from previous captured frame: 0.000354000 seconds]
[Time delta from previous displayed frame: 0.000354000 seconds]
[Time since reference or first frame: 4.396305000 seconds]
Frame Number: 34
Frame Length: 174 bytes
Capture Length: 174 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc:gss-api:spnego-krb5]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 160
Identification: 0x32f0 (13040)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa8ba [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 189, Ack: 117, Len: 108
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 189 (relative sequence number)
[Next sequence number: 297 (relative sequence number)]
Acknowledgement number: 117 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x5f40 [incorrect, should be 0x7694 (maybe caused by "TCP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944511, TSecr 3226521
Remote Procedure Call, Type:Call XID:0x9bed01da
Fragment header: Last fragment, 104 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 0110 1000 = Fragment Length: 104
XID: 0x9bed01da (2616000986)
Message Type: Call (0)
RPC Version: 2
Program: NFS (100003)
Program Version: 4
Procedure: NULL (0)
[The reply to this request is in frame 35]
Credentials
Flavor: RPCSEC_GSS (6)
Length: 24
GSS Version: 1
GSS Procedure: RPCSEC_GSS_DESTROY (3)
GSS Sequence Number: 2
GSS Service: rpcsec_gss_svc_none (1)
GSS Context: <DATA>
length: 4
contents: <DATA>
Verifier
Flavor: RPCSEC_GSS (6)
GSS Token
GSS Token Length: 37
GSS-API Generic Security Service Application Program Interface
OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_blob: 01010000FFFFFFFF469B2C286A118C08EC8B16C7B84D6E14
krb5_tok_id: KRB5_GSS_GetMIC (0x0101)
krb5_sgn_alg: DES MAC MD5 (0x0000)
krb5_snd_seq: 469B2C286A118C08
krb5_sgn_cksum: EC8B16C7B84D6E14
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
No. Time Source Destination Protocol Info
35 4.403565 147.251.9.8 192.168.1.2 NFS V4 NULL Reply (Call In 34)
Frame 35 (134 bytes on wire, 134 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.285740000
[Time delta from previous captured frame: 0.007260000 seconds]
[Time delta from previous displayed frame: 0.007260000 seconds]
[Time since reference or first frame: 4.403565000 seconds]
Frame Number: 35
Frame Length: 134 bytes
Capture Length: 134 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp:rpc:gss-api:spnego-krb5]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 120
Identification: 0x45f7 (17911)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x9bdb [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: xact-backup (911), Seq: 117, Ack: 297, Len: 68
Source port: shilp (2049)
Destination port: xact-backup (911)
Sequence number: 117 (relative sequence number)
[Next sequence number: 185 (relative sequence number)]
Acknowledgement number: 297 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6912 (scaled)
Checksum: 0x6f49 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226522, TSecr 20944511
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 34]
[The RTT to ACK the segment was: 0.007260000 seconds]
Remote Procedure Call, Type:Reply XID:0x9bed01da
Fragment header: Last fragment, 64 bytes
1... .... .... .... .... .... .... .... = Last Fragment: Yes
.000 0000 0000 0000 0000 0000 0100 0000 = Fragment Length: 64
XID: 0x9bed01da (2616000986)
Message Type: Reply (1)
[Program: NFS (100003)]
[Program Version: 4]
[Procedure: NULL (0)]
Reply State: accepted (0)
[This is a reply to a request in frame 34]
[Time from request: 0.007260000 seconds]
Verifier
Flavor: RPCSEC_GSS (6)
GSS Token
GSS Token Length: 37
GSS-API Generic Security Service Application Program Interface
OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_blob: 01010000FFFFFFFFC3B4ADBB2A28B89E92441043204C741A
krb5_tok_id: KRB5_GSS_GetMIC (0x0101)
krb5_sgn_alg: DES MAC MD5 (0x0000)
krb5_snd_seq: C3B4ADBB2A28B89E
krb5_sgn_cksum: 92441043204C741A
Accept State: RPC executed successfully (0)
Network File System
[Program Version: 4]
[V4 Procedure: NULL (0)]
No. Time Source Destination Protocol Info
36 4.403671 192.168.1.2 147.251.9.8 TCP xact-backup > shilp [FIN, ACK] Seq=297 Ack=185 Win=5888 Len=0 TSV=20944513 TSER=3226522
Frame 36 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.285846000
[Time delta from previous captured frame: 0.000106000 seconds]
[Time delta from previous displayed frame: 0.000106000 seconds]
[Time since reference or first frame: 4.403671000 seconds]
Frame Number: 36
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x32f1 (13041)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa925 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 297, Ack: 185, Len: 0
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 297 (relative sequence number)
Acknowledgement number: 185 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
Window size: 5888 (scaled)
Checksum: 0x8764 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944513, TSecr 3226522
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 35]
[The RTT to ACK the segment was: 0.000106000 seconds]
No. Time Source Destination Protocol Info
37 4.408501 147.251.9.8 192.168.1.2 TCP shilp > xact-backup [FIN, ACK] Seq=185 Ack=298 Win=6912 Len=0 TSV=3226524 TSER=20944513
Frame 37 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.290676000
[Time delta from previous captured frame: 0.004830000 seconds]
[Time delta from previous displayed frame: 0.004830000 seconds]
[Time since reference or first frame: 4.408501000 seconds]
Frame Number: 37
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50), Dst: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Destination: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 147.251.9.8 (147.251.9.8), Dst: 192.168.1.2 (192.168.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x45f8 (17912)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x9c1e [correct]
[Good: True]
[Bad : False]
Source: 147.251.9.8 (147.251.9.8)
Destination: 192.168.1.2 (192.168.1.2)
Transmission Control Protocol, Src Port: shilp (2049), Dst Port: xact-backup (911), Seq: 185, Ack: 298, Len: 0
Source port: shilp (2049)
Destination port: xact-backup (911)
Sequence number: 185 (relative sequence number)
Acknowledgement number: 298 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
Window size: 6912 (scaled)
Checksum: 0x8759 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3226524, TSecr 20944513
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 36]
[The RTT to ACK the segment was: 0.004830000 seconds]
No. Time Source Destination Protocol Info
38 4.408519 192.168.1.2 147.251.9.8 TCP xact-backup > shilp [ACK] Seq=298 Ack=186 Win=5888 Len=0 TSV=20944514 TSER=3226524
Frame 38 (66 bytes on wire, 66 bytes captured)
Arrival Time: Mar 7, 2008 19:52:46.290694000
[Time delta from previous captured frame: 0.000018000 seconds]
[Time delta from previous displayed frame: 0.000018000 seconds]
[Time since reference or first frame: 4.408519000 seconds]
Frame Number: 38
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Usi_d2:bd:81 (00:1a:6b:d2:bd:81), Dst: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Destination: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
Address: AsustekC_3f:d9:50 (00:13:d4:3f:d9:50)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
Address: Usi_d2:bd:81 (00:1a:6b:d2:bd:81)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.1.2 (192.168.1.2), Dst: 147.251.9.8 (147.251.9.8)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x32f2 (13042)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xa924 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.2 (192.168.1.2)
Destination: 147.251.9.8 (147.251.9.8)
Transmission Control Protocol, Src Port: xact-backup (911), Dst Port: shilp (2049), Seq: 298, Ack: 186, Len: 0
Source port: xact-backup (911)
Destination port: shilp (2049)
Sequence number: 298 (relative sequence number)
Acknowledgement number: 186 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5888 (scaled)
Checksum: 0x8760 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 20944514, TSecr 3226524
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 37]
[The RTT to ACK the segment was: 0.000018000 seconds]
More information about the NFSv4
mailing list