Attachment 864407 Details for Bug 1066273 – Wireshark communication

Wireshark communication

google.mail.packets (text/plain), 29.49 KB, created by Johannes on 2014-02-18 07:52:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Johannes

Created: 2014-02-18 07:52:57 UTC

Size: 29.49 KB

patch

obsolete

>No.     Time           Source                Destination           Protocol Length Info
>     40 3.099525000    172.16.8.133          173.194.65.16         TCP      74     37063 > urd [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=7086985 TSecr=0 WS=128
>
>Frame 40: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
>    Interface id: 0
>    Encapsulation type: Ethernet (1)
>    Arrival Time: Feb 18, 2014 08:44:41.364969000 CET
>    [Time shift for this packet: 0.000000000 seconds]
>    Epoch Time: 1392709481.364969000 seconds
>    [Time delta from previous captured frame: 0.000597000 seconds]
>    [Time delta from previous displayed frame: 0.000000000 seconds]
>    [Time since reference or first frame: 3.099525000 seconds]
>    Frame Number: 40
>    Frame Length: 74 bytes (592 bits)
>    Capture Length: 74 bytes (592 bits)
>    [Frame is marked: False]
>    [Frame is ignored: False]
>    [Protocols in frame: eth:ip:tcp]
>    [Coloring Rule Name: TCP SYN/FIN]
>    [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
>Ethernet II, Src: WistronI_38:51:9a (3c:97:0e:38:51:9a), Dst: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>    Destination: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        Address: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Source: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        Address: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Type: IP (0x0800)
>Internet Protocol Version 4, Src: 172.16.8.133 (172.16.8.133), Dst: 173.194.65.16 (173.194.65.16)
>    Version: 4
>    Header length: 20 bytes
>    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
>        0000 00.. = Differentiated Services Codepoint: Default (0x00)
>        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
>    Total Length: 60
>    Identification: 0xed50 (60752)
>    Flags: 0x02 (Don't Fragment)
>        0... .... = Reserved bit: Not set
>        .1.. .... = Don't fragment: Set
>        ..0. .... = More fragments: Not set
>    Fragment offset: 0
>    Time to live: 64
>    Protocol: TCP (6)
>    Header checksum: 0xaa03 [correct]
>        [Good: True]
>        [Bad: False]
>    Source: 172.16.8.133 (172.16.8.133)
>    Destination: 173.194.65.16 (173.194.65.16)
>    [Source GeoIP: Unknown]
>    [Destination GeoIP: Unknown]
>Transmission Control Protocol, Src Port: 37063 (37063), Dst Port: urd (465), Seq: 0, Len: 0
>    Source port: 37063 (37063)
>    Destination port: urd (465)
>    [Stream index: 2]
>    Sequence number: 0    (relative sequence number)
>    Header length: 40 bytes
>    Flags: 0x002 (SYN)
>        000. .... .... = Reserved: Not set
>        ...0 .... .... = Nonce: Not set
>        .... 0... .... = Congestion Window Reduced (CWR): Not set
>        .... .0.. .... = ECN-Echo: Not set
>        .... ..0. .... = Urgent: Not set
>        .... ...0 .... = Acknowledgment: Not set
>        .... .... 0... = Push: Not set
>        .... .... .0.. = Reset: Not set
>        .... .... ..1. = Syn: Set
>            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port urd]
>                [Message: Connection establish request (SYN): server port urd]
>                [Severity level: Chat]
>                [Group: Sequence]
>        .... .... ...0 = Fin: Not set
>    Window size value: 29200
>    [Calculated window size: 29200]
>    Checksum: 0xa396 [validation disabled]
>        [Good Checksum: False]
>        [Bad Checksum: False]
>    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
>        Maximum segment size: 1460 bytes
>            Kind: MSS size (2)
>            Length: 4
>            MSS Value: 1460
>        TCP SACK Permitted Option: True
>            Kind: SACK Permission (4)
>            Length: 2
>        Timestamps: TSval 7086985, TSecr 0
>            Kind: Timestamp (8)
>            Length: 10
>            Timestamp value: 7086985
>            Timestamp echo reply: 0
>        No-Operation (NOP)
>            Type: 1
>                0... .... = Copy on fragmentation: No
>                .00. .... = Class: Control (0)
>                ...0 0001 = Number: No-Operation (NOP) (1)
>        Window scale: 7 (multiply by 128)
>            Kind: Window Scale (3)
>            Length: 3
>            Shift count: 7
>            [Multiplier: 128]
>
>No.     Time           Source                Destination           Protocol Length Info
>     77 4.102241000    172.16.8.133          173.194.65.16         TCP      74     [TCP Retransmission] 37063 > urd [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=7087988 TSecr=0 WS=128
>
>Frame 77: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
>    Interface id: 0
>    Encapsulation type: Ethernet (1)
>    Arrival Time: Feb 18, 2014 08:44:42.367685000 CET
>    [Time shift for this packet: 0.000000000 seconds]
>    Epoch Time: 1392709482.367685000 seconds
>    [Time delta from previous captured frame: 0.075581000 seconds]
>    [Time delta from previous displayed frame: 1.002716000 seconds]
>    [Time since reference or first frame: 4.102241000 seconds]
>    Frame Number: 77
>    Frame Length: 74 bytes (592 bits)
>    Capture Length: 74 bytes (592 bits)
>    [Frame is marked: False]
>    [Frame is ignored: False]
>    [Protocols in frame: eth:ip:tcp]
>    [Coloring Rule Name: Bad TCP]
>    [Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
>Ethernet II, Src: WistronI_38:51:9a (3c:97:0e:38:51:9a), Dst: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>    Destination: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        Address: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Source: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        Address: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Type: IP (0x0800)
>Internet Protocol Version 4, Src: 172.16.8.133 (172.16.8.133), Dst: 173.194.65.16 (173.194.65.16)
>    Version: 4
>    Header length: 20 bytes
>    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
>        0000 00.. = Differentiated Services Codepoint: Default (0x00)
>        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
>    Total Length: 60
>    Identification: 0xed51 (60753)
>    Flags: 0x02 (Don't Fragment)
>        0... .... = Reserved bit: Not set
>        .1.. .... = Don't fragment: Set
>        ..0. .... = More fragments: Not set
>    Fragment offset: 0
>    Time to live: 64
>    Protocol: TCP (6)
>    Header checksum: 0xaa02 [correct]
>        [Good: True]
>        [Bad: False]
>    Source: 172.16.8.133 (172.16.8.133)
>    Destination: 173.194.65.16 (173.194.65.16)
>    [Source GeoIP: Unknown]
>    [Destination GeoIP: Unknown]
>Transmission Control Protocol, Src Port: 37063 (37063), Dst Port: urd (465), Seq: 0, Len: 0
>    Source port: 37063 (37063)
>    Destination port: urd (465)
>    [Stream index: 2]
>    Sequence number: 0    (relative sequence number)
>    Header length: 40 bytes
>    Flags: 0x002 (SYN)
>        000. .... .... = Reserved: Not set
>        ...0 .... .... = Nonce: Not set
>        .... 0... .... = Congestion Window Reduced (CWR): Not set
>        .... .0.. .... = ECN-Echo: Not set
>        .... ..0. .... = Urgent: Not set
>        .... ...0 .... = Acknowledgment: Not set
>        .... .... 0... = Push: Not set
>        .... .... .0.. = Reset: Not set
>        .... .... ..1. = Syn: Set
>            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port urd]
>                [Message: Connection establish request (SYN): server port urd]
>                [Severity level: Chat]
>                [Group: Sequence]
>        .... .... ...0 = Fin: Not set
>    Window size value: 29200
>    [Calculated window size: 29200]
>    Checksum: 0xa396 [validation disabled]
>        [Good Checksum: False]
>        [Bad Checksum: False]
>    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
>        Maximum segment size: 1460 bytes
>            Kind: MSS size (2)
>            Length: 4
>            MSS Value: 1460
>        TCP SACK Permitted Option: True
>            Kind: SACK Permission (4)
>            Length: 2
>        Timestamps: TSval 7087988, TSecr 0
>            Kind: Timestamp (8)
>            Length: 10
>            Timestamp value: 7087988
>            Timestamp echo reply: 0
>        No-Operation (NOP)
>            Type: 1
>                0... .... = Copy on fragmentation: No
>                .00. .... = Class: Control (0)
>                ...0 0001 = Number: No-Operation (NOP) (1)
>        Window scale: 7 (multiply by 128)
>            Kind: Window Scale (3)
>            Length: 3
>            Shift count: 7
>            [Multiplier: 128]
>    [SEQ/ACK analysis]
>        [TCP Analysis Flags]
>            [This frame is a (suspected) retransmission]
>                [Expert Info (Note/Sequence): Retransmission (suspected)]
>                    [Message: Retransmission (suspected)]
>                    [Severity level: Note]
>                    [Group: Sequence]
>            [The RTO for this segment was: 1.002716000 seconds]
>            [RTO based on delta from frame: 40]
>
>No.     Time           Source                Destination           Protocol Length Info
>    100 6.106244000    172.16.8.133          173.194.65.16         TCP      74     [TCP Retransmission] 37063 > urd [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=7089992 TSecr=0 WS=128
>
>Frame 100: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
>    Interface id: 0
>    Encapsulation type: Ethernet (1)
>    Arrival Time: Feb 18, 2014 08:44:44.371688000 CET
>    [Time shift for this packet: 0.000000000 seconds]
>    Epoch Time: 1392709484.371688000 seconds
>    [Time delta from previous captured frame: 0.070334000 seconds]
>    [Time delta from previous displayed frame: 2.004003000 seconds]
>    [Time since reference or first frame: 6.106244000 seconds]
>    Frame Number: 100
>    Frame Length: 74 bytes (592 bits)
>    Capture Length: 74 bytes (592 bits)
>    [Frame is marked: False]
>    [Frame is ignored: False]
>    [Protocols in frame: eth:ip:tcp]
>    [Coloring Rule Name: Bad TCP]
>    [Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
>Ethernet II, Src: WistronI_38:51:9a (3c:97:0e:38:51:9a), Dst: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>    Destination: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        Address: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Source: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        Address: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Type: IP (0x0800)
>Internet Protocol Version 4, Src: 172.16.8.133 (172.16.8.133), Dst: 173.194.65.16 (173.194.65.16)
>    Version: 4
>    Header length: 20 bytes
>    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
>        0000 00.. = Differentiated Services Codepoint: Default (0x00)
>        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
>    Total Length: 60
>    Identification: 0xed52 (60754)
>    Flags: 0x02 (Don't Fragment)
>        0... .... = Reserved bit: Not set
>        .1.. .... = Don't fragment: Set
>        ..0. .... = More fragments: Not set
>    Fragment offset: 0
>    Time to live: 64
>    Protocol: TCP (6)
>    Header checksum: 0xaa01 [correct]
>        [Good: True]
>        [Bad: False]
>    Source: 172.16.8.133 (172.16.8.133)
>    Destination: 173.194.65.16 (173.194.65.16)
>    [Source GeoIP: Unknown]
>    [Destination GeoIP: Unknown]
>Transmission Control Protocol, Src Port: 37063 (37063), Dst Port: urd (465), Seq: 0, Len: 0
>    Source port: 37063 (37063)
>    Destination port: urd (465)
>    [Stream index: 2]
>    Sequence number: 0    (relative sequence number)
>    Header length: 40 bytes
>    Flags: 0x002 (SYN)
>        000. .... .... = Reserved: Not set
>        ...0 .... .... = Nonce: Not set
>        .... 0... .... = Congestion Window Reduced (CWR): Not set
>        .... .0.. .... = ECN-Echo: Not set
>        .... ..0. .... = Urgent: Not set
>        .... ...0 .... = Acknowledgment: Not set
>        .... .... 0... = Push: Not set
>        .... .... .0.. = Reset: Not set
>        .... .... ..1. = Syn: Set
>            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port urd]
>                [Message: Connection establish request (SYN): server port urd]
>                [Severity level: Chat]
>                [Group: Sequence]
>        .... .... ...0 = Fin: Not set
>    Window size value: 29200
>    [Calculated window size: 29200]
>    Checksum: 0xa396 [validation disabled]
>        [Good Checksum: False]
>        [Bad Checksum: False]
>    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
>        Maximum segment size: 1460 bytes
>            Kind: MSS size (2)
>            Length: 4
>            MSS Value: 1460
>        TCP SACK Permitted Option: True
>            Kind: SACK Permission (4)
>            Length: 2
>        Timestamps: TSval 7089992, TSecr 0
>            Kind: Timestamp (8)
>            Length: 10
>            Timestamp value: 7089992
>            Timestamp echo reply: 0
>        No-Operation (NOP)
>            Type: 1
>                0... .... = Copy on fragmentation: No
>                .00. .... = Class: Control (0)
>                ...0 0001 = Number: No-Operation (NOP) (1)
>        Window scale: 7 (multiply by 128)
>            Kind: Window Scale (3)
>            Length: 3
>            Shift count: 7
>            [Multiplier: 128]
>    [SEQ/ACK analysis]
>        [TCP Analysis Flags]
>            [This frame is a (suspected) retransmission]
>                [Expert Info (Note/Sequence): Retransmission (suspected)]
>                    [Message: Retransmission (suspected)]
>                    [Severity level: Note]
>                    [Group: Sequence]
>            [The RTO for this segment was: 3.006719000 seconds]
>            [RTO based on delta from frame: 40]
>
>No.     Time           Source                Destination           Protocol Length Info
>    191 10.114231000   172.16.8.133          173.194.65.16         TCP      74     [TCP Retransmission] 37063 > urd [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=7094000 TSecr=0 WS=128
>
>Frame 191: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
>    Interface id: 0
>    Encapsulation type: Ethernet (1)
>    Arrival Time: Feb 18, 2014 08:44:48.379675000 CET
>    [Time shift for this packet: 0.000000000 seconds]
>    Epoch Time: 1392709488.379675000 seconds
>    [Time delta from previous captured frame: 0.064896000 seconds]
>    [Time delta from previous displayed frame: 4.007987000 seconds]
>    [Time since reference or first frame: 10.114231000 seconds]
>    Frame Number: 191
>    Frame Length: 74 bytes (592 bits)
>    Capture Length: 74 bytes (592 bits)
>    [Frame is marked: False]
>    [Frame is ignored: False]
>    [Protocols in frame: eth:ip:tcp]
>    [Coloring Rule Name: Bad TCP]
>    [Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
>Ethernet II, Src: WistronI_38:51:9a (3c:97:0e:38:51:9a), Dst: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>    Destination: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        Address: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Source: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        Address: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Type: IP (0x0800)
>Internet Protocol Version 4, Src: 172.16.8.133 (172.16.8.133), Dst: 173.194.65.16 (173.194.65.16)
>    Version: 4
>    Header length: 20 bytes
>    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
>        0000 00.. = Differentiated Services Codepoint: Default (0x00)
>        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
>    Total Length: 60
>    Identification: 0xed53 (60755)
>    Flags: 0x02 (Don't Fragment)
>        0... .... = Reserved bit: Not set
>        .1.. .... = Don't fragment: Set
>        ..0. .... = More fragments: Not set
>    Fragment offset: 0
>    Time to live: 64
>    Protocol: TCP (6)
>    Header checksum: 0xaa00 [correct]
>        [Good: True]
>        [Bad: False]
>    Source: 172.16.8.133 (172.16.8.133)
>    Destination: 173.194.65.16 (173.194.65.16)
>    [Source GeoIP: Unknown]
>    [Destination GeoIP: Unknown]
>Transmission Control Protocol, Src Port: 37063 (37063), Dst Port: urd (465), Seq: 0, Len: 0
>    Source port: 37063 (37063)
>    Destination port: urd (465)
>    [Stream index: 2]
>    Sequence number: 0    (relative sequence number)
>    Header length: 40 bytes
>    Flags: 0x002 (SYN)
>        000. .... .... = Reserved: Not set
>        ...0 .... .... = Nonce: Not set
>        .... 0... .... = Congestion Window Reduced (CWR): Not set
>        .... .0.. .... = ECN-Echo: Not set
>        .... ..0. .... = Urgent: Not set
>        .... ...0 .... = Acknowledgment: Not set
>        .... .... 0... = Push: Not set
>        .... .... .0.. = Reset: Not set
>        .... .... ..1. = Syn: Set
>            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port urd]
>                [Message: Connection establish request (SYN): server port urd]
>                [Severity level: Chat]
>                [Group: Sequence]
>        .... .... ...0 = Fin: Not set
>    Window size value: 29200
>    [Calculated window size: 29200]
>    Checksum: 0xa396 [validation disabled]
>        [Good Checksum: False]
>        [Bad Checksum: False]
>    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
>        Maximum segment size: 1460 bytes
>            Kind: MSS size (2)
>            Length: 4
>            MSS Value: 1460
>        TCP SACK Permitted Option: True
>            Kind: SACK Permission (4)
>            Length: 2
>        Timestamps: TSval 7094000, TSecr 0
>            Kind: Timestamp (8)
>            Length: 10
>            Timestamp value: 7094000
>            Timestamp echo reply: 0
>        No-Operation (NOP)
>            Type: 1
>                0... .... = Copy on fragmentation: No
>                .00. .... = Class: Control (0)
>                ...0 0001 = Number: No-Operation (NOP) (1)
>        Window scale: 7 (multiply by 128)
>            Kind: Window Scale (3)
>            Length: 3
>            Shift count: 7
>            [Multiplier: 128]
>    [SEQ/ACK analysis]
>        [TCP Analysis Flags]
>            [This frame is a (suspected) retransmission]
>                [Expert Info (Note/Sequence): Retransmission (suspected)]
>                    [Message: Retransmission (suspected)]
>                    [Severity level: Note]
>                    [Group: Sequence]
>            [The RTO for this segment was: 7.014706000 seconds]
>            [RTO based on delta from frame: 40]
>
>No.     Time           Source                Destination           Protocol Length Info
>    348 18.130256000   172.16.8.133          173.194.65.16         TCP      74     [TCP Retransmission] 37063 > urd [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=7102016 TSecr=0 WS=128
>
>Frame 348: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
>    Interface id: 0
>    Encapsulation type: Ethernet (1)
>    Arrival Time: Feb 18, 2014 08:44:56.395700000 CET
>    [Time shift for this packet: 0.000000000 seconds]
>    Epoch Time: 1392709496.395700000 seconds
>    [Time delta from previous captured frame: 0.110072000 seconds]
>    [Time delta from previous displayed frame: 8.016025000 seconds]
>    [Time since reference or first frame: 18.130256000 seconds]
>    Frame Number: 348
>    Frame Length: 74 bytes (592 bits)
>    Capture Length: 74 bytes (592 bits)
>    [Frame is marked: False]
>    [Frame is ignored: False]
>    [Protocols in frame: eth:ip:tcp]
>    [Coloring Rule Name: Bad TCP]
>    [Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
>Ethernet II, Src: WistronI_38:51:9a (3c:97:0e:38:51:9a), Dst: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>    Destination: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        Address: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Source: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        Address: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Type: IP (0x0800)
>Internet Protocol Version 4, Src: 172.16.8.133 (172.16.8.133), Dst: 173.194.65.16 (173.194.65.16)
>    Version: 4
>    Header length: 20 bytes
>    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
>        0000 00.. = Differentiated Services Codepoint: Default (0x00)
>        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
>    Total Length: 60
>    Identification: 0xed54 (60756)
>    Flags: 0x02 (Don't Fragment)
>        0... .... = Reserved bit: Not set
>        .1.. .... = Don't fragment: Set
>        ..0. .... = More fragments: Not set
>    Fragment offset: 0
>    Time to live: 64
>    Protocol: TCP (6)
>    Header checksum: 0xa9ff [correct]
>        [Good: True]
>        [Bad: False]
>    Source: 172.16.8.133 (172.16.8.133)
>    Destination: 173.194.65.16 (173.194.65.16)
>    [Source GeoIP: Unknown]
>    [Destination GeoIP: Unknown]
>Transmission Control Protocol, Src Port: 37063 (37063), Dst Port: urd (465), Seq: 0, Len: 0
>    Source port: 37063 (37063)
>    Destination port: urd (465)
>    [Stream index: 2]
>    Sequence number: 0    (relative sequence number)
>    Header length: 40 bytes
>    Flags: 0x002 (SYN)
>        000. .... .... = Reserved: Not set
>        ...0 .... .... = Nonce: Not set
>        .... 0... .... = Congestion Window Reduced (CWR): Not set
>        .... .0.. .... = ECN-Echo: Not set
>        .... ..0. .... = Urgent: Not set
>        .... ...0 .... = Acknowledgment: Not set
>        .... .... 0... = Push: Not set
>        .... .... .0.. = Reset: Not set
>        .... .... ..1. = Syn: Set
>            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port urd]
>                [Message: Connection establish request (SYN): server port urd]
>                [Severity level: Chat]
>                [Group: Sequence]
>        .... .... ...0 = Fin: Not set
>    Window size value: 29200
>    [Calculated window size: 29200]
>    Checksum: 0xa396 [validation disabled]
>        [Good Checksum: False]
>        [Bad Checksum: False]
>    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
>        Maximum segment size: 1460 bytes
>            Kind: MSS size (2)
>            Length: 4
>            MSS Value: 1460
>        TCP SACK Permitted Option: True
>            Kind: SACK Permission (4)
>            Length: 2
>        Timestamps: TSval 7102016, TSecr 0
>            Kind: Timestamp (8)
>            Length: 10
>            Timestamp value: 7102016
>            Timestamp echo reply: 0
>        No-Operation (NOP)
>            Type: 1
>                0... .... = Copy on fragmentation: No
>                .00. .... = Class: Control (0)
>                ...0 0001 = Number: No-Operation (NOP) (1)
>        Window scale: 7 (multiply by 128)
>            Kind: Window Scale (3)
>            Length: 3
>            Shift count: 7
>            [Multiplier: 128]
>    [SEQ/ACK analysis]
>        [TCP Analysis Flags]
>            [This frame is a (suspected) retransmission]
>                [Expert Info (Note/Sequence): Retransmission (suspected)]
>                    [Message: Retransmission (suspected)]
>                    [Severity level: Note]
>                    [Group: Sequence]
>            [The RTO for this segment was: 15.030731000 seconds]
>            [RTO based on delta from frame: 40]
>
>No.     Time           Source                Destination           Protocol Length Info
>    679 34.162244000   172.16.8.133          173.194.65.16         TCP      74     [TCP Retransmission] 37063 > urd [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=7118048 TSecr=0 WS=128
>
>Frame 679: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
>    Interface id: 0
>    Encapsulation type: Ethernet (1)
>    Arrival Time: Feb 18, 2014 08:45:12.427688000 CET
>    [Time shift for this packet: 0.000000000 seconds]
>    Epoch Time: 1392709512.427688000 seconds
>    [Time delta from previous captured frame: 0.015590000 seconds]
>    [Time delta from previous displayed frame: 16.031988000 seconds]
>    [Time since reference or first frame: 34.162244000 seconds]
>    Frame Number: 679
>    Frame Length: 74 bytes (592 bits)
>    Capture Length: 74 bytes (592 bits)
>    [Frame is marked: False]
>    [Frame is ignored: False]
>    [Protocols in frame: eth:ip:tcp]
>    [Coloring Rule Name: Bad TCP]
>    [Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
>Ethernet II, Src: WistronI_38:51:9a (3c:97:0e:38:51:9a), Dst: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>    Destination: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        Address: Hewlett-_22:e4:00 (2c:76:8a:22:e4:00)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Source: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        Address: WistronI_38:51:9a (3c:97:0e:38:51:9a)
>        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
>        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
>    Type: IP (0x0800)
>Internet Protocol Version 4, Src: 172.16.8.133 (172.16.8.133), Dst: 173.194.65.16 (173.194.65.16)
>    Version: 4
>    Header length: 20 bytes
>    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
>        0000 00.. = Differentiated Services Codepoint: Default (0x00)
>        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
>    Total Length: 60
>    Identification: 0xed55 (60757)
>    Flags: 0x02 (Don't Fragment)
>        0... .... = Reserved bit: Not set
>        .1.. .... = Don't fragment: Set
>        ..0. .... = More fragments: Not set
>    Fragment offset: 0
>    Time to live: 64
>    Protocol: TCP (6)
>    Header checksum: 0xa9fe [correct]
>        [Good: True]
>        [Bad: False]
>    Source: 172.16.8.133 (172.16.8.133)
>    Destination: 173.194.65.16 (173.194.65.16)
>    [Source GeoIP: Unknown]
>    [Destination GeoIP: Unknown]
>Transmission Control Protocol, Src Port: 37063 (37063), Dst Port: urd (465), Seq: 0, Len: 0
>    Source port: 37063 (37063)
>    Destination port: urd (465)
>    [Stream index: 2]
>    Sequence number: 0    (relative sequence number)
>    Header length: 40 bytes
>    Flags: 0x002 (SYN)
>        000. .... .... = Reserved: Not set
>        ...0 .... .... = Nonce: Not set
>        .... 0... .... = Congestion Window Reduced (CWR): Not set
>        .... .0.. .... = ECN-Echo: Not set
>        .... ..0. .... = Urgent: Not set
>        .... ...0 .... = Acknowledgment: Not set
>        .... .... 0... = Push: Not set
>        .... .... .0.. = Reset: Not set
>        .... .... ..1. = Syn: Set
>            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port urd]
>                [Message: Connection establish request (SYN): server port urd]
>                [Severity level: Chat]
>                [Group: Sequence]
>        .... .... ...0 = Fin: Not set
>    Window size value: 29200
>    [Calculated window size: 29200]
>    Checksum: 0xa396 [validation disabled]
>        [Good Checksum: False]
>        [Bad Checksum: False]
>    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
>        Maximum segment size: 1460 bytes
>            Kind: MSS size (2)
>            Length: 4
>            MSS Value: 1460
>        TCP SACK Permitted Option: True
>            Kind: SACK Permission (4)
>            Length: 2
>        Timestamps: TSval 7118048, TSecr 0
>            Kind: Timestamp (8)
>            Length: 10
>            Timestamp value: 7118048
>            Timestamp echo reply: 0
>        No-Operation (NOP)
>            Type: 1
>                0... .... = Copy on fragmentation: No
>                .00. .... = Class: Control (0)
>                ...0 0001 = Number: No-Operation (NOP) (1)
>        Window scale: 7 (multiply by 128)
>            Kind: Window Scale (3)
>            Length: 3
>            Shift count: 7
>            [Multiplier: 128]
>    [SEQ/ACK analysis]
>        [TCP Analysis Flags]
>            [This frame is a (suspected) retransmission]
>                [Expert Info (Note/Sequence): Retransmission (suspected)]
>                    [Message: Retransmission (suspected)]
>                    [Severity level: Note]
>                    [Group: Sequence]
>            [The RTO for this segment was: 31.062719000 seconds]
>            [RTO based on delta from frame: 40]

Actions: View

Attachments on bug 1066273: 864407