#ifndef _TEST_PACKETS_H #define _TEST_PACKETS_H #ifdef __cpluscplus extern "C" { #endif /****************************************************************************** * test packet: HTTP www.example.com ******************************************************************************/ /* * Frame 1: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface en0, id 0 * Ethernet II, Src: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea), Dst: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Destination: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Source: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 192.168.38.105, Dst: 93.184.216.34 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 64 * Identification: 0x0000 (0) * 010. .... = Flags: 0x2, Don't fragment * 0... .... = Reserved bit: Not set * .1.. .... = Don't fragment: Set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 64 * Protocol: TCP (6) * Header Checksum: 0x1dcc [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x1dcc] * Source Address: 192.168.38.105 * Destination Address: 93.184.216.34 * Transmission Control Protocol, Src Port: 60111, Dst Port: 80, Seq: 0, Len: 0 * Source Port: 60111 * Destination Port: 80 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 0 (relative sequence number) * Sequence Number (raw): 2089584940 * [Next Sequence Number: 1 (relative sequence number)] * Acknowledgment Number: 0 * Acknowledgment number (raw): 0 * 1011 .... = Header Length: 44 bytes (11) * Flags: 0x002 (SYN) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...0 .... = Acknowledgment: Not set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..1. = Syn: Set * [Expert Info (Chat/Sequence): Connection establish request (SYN): server port 80] * [Connection establish request (SYN): server port 80] * [Severity level: Chat] * [Group: Sequence] * .... .... ...0 = Fin: Not set * [TCP Flags: ··········S·] * Window: 65535 * [Calculated window size: 65535] * Checksum: 0xca71 [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xca71] * Urgent Pointer: 0 * Options: (24 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), Timestamps, SACK permitted, End of Option List (EOL), End of Option List (EOL) * TCP Option - Maximum segment size: 1460 bytes * Kind: Maximum Segment Size (2) * Length: 4 * MSS Value: 1460 * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Window scale: 6 (multiply by 64) * Kind: Window Scale (3) * Length: 3 * Shift count: 6 * [Multiplier: 64] * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 741028506: TSval 741028506, TSecr 0 * Timestamp echo reply: 0 * TCP Option - SACK permitted * Kind: SACK Permitted (4) * Length: 2 * TCP Option - End of Option List (EOL) * Kind: End of Option List (0) * TCP Option - End of Option List (EOL) * Kind: End of Option List (0) * [Timestamps] * [Time since first frame in this TCP stream: 0.000000000 seconds] * [Time since previous frame in this TCP stream: 0.000000000 seconds] */ unsigned char tcp_pkt1_c2s_syn[] = { 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x08, 0x00, 0x45, 0x00, 0x00, 0x40, 0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0x1d, 0xcc, 0xc0, 0xa8, 0x26, 0x69, 0x5d, 0xb8, 0xd8, 0x22, 0xea, 0xcf, 0x00, 0x50, 0x7c, 0x8c, 0x89, 0x2c, 0x00, 0x00, 0x00, 0x00, 0xb0, 0x02, 0xff, 0xff, 0xca, 0x71, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x01, 0x03, 0x03, 0x06, 0x01, 0x01, 0x08, 0x0a, 0x2c, 0x2b, 0x32, 0x9a, 0x00, 0x00, 0x00, 0x00, 0x04, 0x02, 0x00, 0x00}; /* * Frame 2: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface en0, id 0 * Ethernet II, Src: NewH3CTe_96:38:0e (48:73:97:96:38:0e), Dst: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Destination: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Source: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 93.184.216.34, Dst: 192.168.38.105 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 60 * Identification: 0x0000 (0) * 010. .... = Flags: 0x2, Don't fragment * 0... .... = Reserved bit: Not set * .1.. .... = Don't fragment: Set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 42 * Protocol: TCP (6) * Header Checksum: 0x33d0 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x33d0] * Source Address: 93.184.216.34 * Destination Address: 192.168.38.105 * Transmission Control Protocol, Src Port: 80, Dst Port: 60111, Seq: 0, Ack: 1, Len: 0 * Source Port: 80 * Destination Port: 60111 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 0 (relative sequence number) * Sequence Number (raw): 1381452130 * [Next Sequence Number: 1 (relative sequence number)] * Acknowledgment Number: 1 (relative ack number) * Acknowledgment number (raw): 2089584941 * 1010 .... = Header Length: 40 bytes (10) * Flags: 0x012 (SYN, ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..1. = Syn: Set * [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port 80] * [Connection establish acknowledge (SYN+ACK): server port 80] * [Severity level: Chat] * [Group: Sequence] * .... .... ...0 = Fin: Not set * [TCP Flags: ·······A··S·] * Window: 65535 * [Calculated window size: 65535] * Checksum: 0xc5aa [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xc5aa] * Urgent Pointer: 0 * Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale * TCP Option - Maximum segment size: 1300 bytes * Kind: Maximum Segment Size (2) * Length: 4 * MSS Value: 1300 * TCP Option - SACK permitted * Kind: SACK Permitted (4) * Length: 2 * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 1215574570: TSval 1215574570, TSecr 741028506 * Timestamp echo reply: 741028506 * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Window scale: 9 (multiply by 512) * Kind: Window Scale (3) * Length: 3 * Shift count: 9 * [Multiplier: 512] * [Timestamps] * [Time since first frame in this TCP stream: 0.262288000 seconds] * [Time since previous frame in this TCP stream: 0.262288000 seconds] * [SEQ/ACK analysis] * [This is an ACK to the segment in frame: 1] * [The RTT to ACK the segment was: 0.262288000 seconds] * [iRTT: 0.262565000 seconds] */ unsigned char tcp_pkt2_s2c_syn_ack[] = { 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x08, 0x00, 0x45, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x40, 0x00, 0x2a, 0x06, 0x33, 0xd0, 0x5d, 0xb8, 0xd8, 0x22, 0xc0, 0xa8, 0x26, 0x69, 0x00, 0x50, 0xea, 0xcf, 0x52, 0x57, 0x49, 0x62, 0x7c, 0x8c, 0x89, 0x2d, 0xa0, 0x12, 0xff, 0xff, 0xc5, 0xaa, 0x00, 0x00, 0x02, 0x04, 0x05, 0x14, 0x04, 0x02, 0x08, 0x0a, 0x48, 0x74, 0x32, 0x2a, 0x2c, 0x2b, 0x32, 0x9a, 0x01, 0x03, 0x03, 0x09}; /* * Frame 3: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface en0, id 0 * Ethernet II, Src: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea), Dst: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Destination: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Source: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 192.168.38.105, Dst: 93.184.216.34 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 52 * Identification: 0x0000 (0) * 010. .... = Flags: 0x2, Don't fragment * 0... .... = Reserved bit: Not set * .1.. .... = Don't fragment: Set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 64 * Protocol: TCP (6) * Header Checksum: 0x1dd8 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x1dd8] * Source Address: 192.168.38.105 * Destination Address: 93.184.216.34 * Transmission Control Protocol, Src Port: 60111, Dst Port: 80, Seq: 1, Ack: 1, Len: 0 * Source Port: 60111 * Destination Port: 80 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 1 (relative sequence number) * Sequence Number (raw): 2089584941 * [Next Sequence Number: 1 (relative sequence number)] * Acknowledgment Number: 1 (relative ack number) * Acknowledgment number (raw): 1381452131 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x010 (ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...0 = Fin: Not set * [TCP Flags: ·······A····] * Window: 2052 * [Calculated window size: 131328] * [Window size scaling factor: 64] * Checksum: 0xeace [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xeace] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 741028768: TSval 741028768, TSecr 1215574570 * Timestamp echo reply: 1215574570 * [Timestamps] * [Time since first frame in this TCP stream: 0.262565000 seconds] * [Time since previous frame in this TCP stream: 0.000277000 seconds] * [SEQ/ACK analysis] * [This is an ACK to the segment in frame: 2] * [The RTT to ACK the segment was: 0.000277000 seconds] * [iRTT: 0.262565000 seconds] */ unsigned char tcp_pkt3_c2s_ack[] = { 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0x1d, 0xd8, 0xc0, 0xa8, 0x26, 0x69, 0x5d, 0xb8, 0xd8, 0x22, 0xea, 0xcf, 0x00, 0x50, 0x7c, 0x8c, 0x89, 0x2d, 0x52, 0x57, 0x49, 0x63, 0x80, 0x10, 0x08, 0x04, 0xea, 0xce, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x2c, 0x2b, 0x33, 0xa0, 0x48, 0x74, 0x32, 0x2a}; /* * Frame 4: 145 bytes on wire (1160 bits), 145 bytes captured (1160 bits) on interface en0, id 0 * Ethernet II, Src: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea), Dst: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Destination: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Source: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 192.168.38.105, Dst: 93.184.216.34 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 131 * Identification: 0x0000 (0) * 010. .... = Flags: 0x2, Don't fragment * 0... .... = Reserved bit: Not set * .1.. .... = Don't fragment: Set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 64 * Protocol: TCP (6) * Header Checksum: 0x1d89 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x1d89] * Source Address: 192.168.38.105 * Destination Address: 93.184.216.34 * Transmission Control Protocol, Src Port: 60111, Dst Port: 80, Seq: 1, Ack: 1, Len: 79 * Source Port: 60111 * Destination Port: 80 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 79] * Sequence Number: 1 (relative sequence number) * Sequence Number (raw): 2089584941 * [Next Sequence Number: 80 (relative sequence number)] * Acknowledgment Number: 1 (relative ack number) * Acknowledgment number (raw): 1381452131 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x018 (PSH, ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 1... = Push: Set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...0 = Fin: Not set * [TCP Flags: ·······AP···] * Window: 2052 * [Calculated window size: 131328] * [Window size scaling factor: 64] * Checksum: 0x59f8 [correct] * [Checksum Status: Good] * [Calculated Checksum: 0x59f8] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 741028768: TSval 741028768, TSecr 1215574570 * Timestamp echo reply: 1215574570 * [Timestamps] * [Time since first frame in this TCP stream: 0.262783000 seconds] * [Time since previous frame in this TCP stream: 0.000218000 seconds] * [SEQ/ACK analysis] * [iRTT: 0.262565000 seconds] * [Bytes in flight: 79] * [Bytes sent since last PSH flag: 79] * TCP payload (79 bytes) * Hypertext Transfer Protocol * GET / HTTP/1.1\r\n * [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n] * [GET / HTTP/1.1\r\n] * [Severity level: Chat] * [Group: Sequence] * Request Method: GET * Request URI: / * Request Version: HTTP/1.1 * Host: www.example.com\r\n * User-Agent: curl/7.64.1\r\n */ // Accept: */*\r\n // \r\n // [Full request URI: http://www.example.com/] // [HTTP request 1/1] // [Response in frame: 7] unsigned char tcp_pkt4_c2s_http_req[] = { 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x08, 0x00, 0x45, 0x00, 0x00, 0x83, 0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0x1d, 0x89, 0xc0, 0xa8, 0x26, 0x69, 0x5d, 0xb8, 0xd8, 0x22, 0xea, 0xcf, 0x00, 0x50, 0x7c, 0x8c, 0x89, 0x2d, 0x52, 0x57, 0x49, 0x63, 0x80, 0x18, 0x08, 0x04, 0x59, 0xf8, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x2c, 0x2b, 0x33, 0xa0, 0x48, 0x74, 0x32, 0x2a, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x77, 0x77, 0x77, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x63, 0x75, 0x72, 0x6c, 0x2f, 0x37, 0x2e, 0x36, 0x34, 0x2e, 0x31, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a}; /* * Frame 5: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface en0, id 0 * Ethernet II, Src: NewH3CTe_96:38:0e (48:73:97:96:38:0e), Dst: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Destination: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Source: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 93.184.216.34, Dst: 192.168.38.105 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 52 * Identification: 0xd6b0 (54960) * 000. .... = Flags: 0x0 * 0... .... = Reserved bit: Not set * .0.. .... = Don't fragment: Not set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 42 * Protocol: TCP (6) * Header Checksum: 0x9d27 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x9d27] * Source Address: 93.184.216.34 * Destination Address: 192.168.38.105 * Transmission Control Protocol, Src Port: 80, Dst Port: 60111, Seq: 1, Ack: 80, Len: 0 * Source Port: 80 * Destination Port: 60111 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 1 (relative sequence number) * Sequence Number (raw): 1381452131 * [Next Sequence Number: 1 (relative sequence number)] * Acknowledgment Number: 80 (relative ack number) * Acknowledgment number (raw): 2089585020 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x010 (ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...0 = Fin: Not set * [TCP Flags: ·······A····] * Window: 128 * [Calculated window size: 65536] * [Window size scaling factor: 512] * Checksum: 0xf0fd [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xf0fd] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 1215574832: TSval 1215574832, TSecr 741028768 * Timestamp echo reply: 741028768 * [Timestamps] * [Time since first frame in this TCP stream: 0.568134000 seconds] * [Time since previous frame in this TCP stream: 0.305351000 seconds] * [SEQ/ACK analysis] * [This is an ACK to the segment in frame: 4] * [The RTT to ACK the segment was: 0.305351000 seconds] * [iRTT: 0.262565000 seconds] */ unsigned char tcp_pkt5_s2c_ack[] = { 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0xd6, 0xb0, 0x00, 0x00, 0x2a, 0x06, 0x9d, 0x27, 0x5d, 0xb8, 0xd8, 0x22, 0xc0, 0xa8, 0x26, 0x69, 0x00, 0x50, 0xea, 0xcf, 0x52, 0x57, 0x49, 0x63, 0x7c, 0x8c, 0x89, 0x7c, 0x80, 0x10, 0x00, 0x80, 0xf0, 0xfd, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x48, 0x74, 0x33, 0x30, 0x2c, 0x2b, 0x33, 0xa0}; /* * Frame 6: 1354 bytes on wire (10832 bits), 1354 bytes captured (10832 bits) on interface en0, id 0 * Ethernet II, Src: NewH3CTe_96:38:0e (48:73:97:96:38:0e), Dst: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Destination: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Source: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 93.184.216.34, Dst: 192.168.38.105 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 1340 * Identification: 0xd6b1 (54961) * 000. .... = Flags: 0x0 * 0... .... = Reserved bit: Not set * .0.. .... = Don't fragment: Not set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 42 * Protocol: TCP (6) * Header Checksum: 0x981e [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x981e] * Source Address: 93.184.216.34 * Destination Address: 192.168.38.105 * Transmission Control Protocol, Src Port: 80, Dst Port: 60111, Seq: 1, Ack: 80, Len: 1288 * Source Port: 80 * Destination Port: 60111 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 1288] * Sequence Number: 1 (relative sequence number) * Sequence Number (raw): 1381452131 * [Next Sequence Number: 1289 (relative sequence number)] * Acknowledgment Number: 80 (relative ack number) * Acknowledgment number (raw): 2089585020 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x010 (ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...0 = Fin: Not set * [TCP Flags: ·······A····] * Window: 128 * [Calculated window size: 65536] * [Window size scaling factor: 512] * Checksum: 0xe543 [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xe543] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 1215574833: TSval 1215574833, TSecr 741028768 * Timestamp echo reply: 741028768 * [Timestamps] * [Time since first frame in this TCP stream: 0.568147000 seconds] * [Time since previous frame in this TCP stream: 0.000013000 seconds] * [SEQ/ACK analysis] * [iRTT: 0.262565000 seconds] * [Bytes in flight: 1288] * [Bytes sent since last PSH flag: 1288] * TCP payload (1288 bytes) * [Reassembled PDU in frame: 7] * TCP segment data (1288 bytes) */ unsigned char tcp_pkt6_s2c_http_resq_1[] = { 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x08, 0x00, 0x45, 0x00, 0x05, 0x3c, 0xd6, 0xb1, 0x00, 0x00, 0x2a, 0x06, 0x98, 0x1e, 0x5d, 0xb8, 0xd8, 0x22, 0xc0, 0xa8, 0x26, 0x69, 0x00, 0x50, 0xea, 0xcf, 0x52, 0x57, 0x49, 0x63, 0x7c, 0x8c, 0x89, 0x7c, 0x80, 0x10, 0x00, 0x80, 0xe5, 0x43, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x48, 0x74, 0x33, 0x31, 0x2c, 0x2b, 0x33, 0xa0, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x41, 0x67, 0x65, 0x3a, 0x20, 0x33, 0x34, 0x32, 0x30, 0x34, 0x38, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6d, 0x61, 0x78, 0x2d, 0x61, 0x67, 0x65, 0x3d, 0x36, 0x30, 0x34, 0x38, 0x30, 0x30, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3b, 0x20, 0x63, 0x68, 0x61, 0x72, 0x73, 0x65, 0x74, 0x3d, 0x55, 0x54, 0x46, 0x2d, 0x38, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x54, 0x75, 0x65, 0x2c, 0x20, 0x31, 0x39, 0x20, 0x44, 0x65, 0x63, 0x20, 0x32, 0x30, 0x32, 0x33, 0x20, 0x30, 0x38, 0x3a, 0x32, 0x36, 0x3a, 0x35, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x74, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x33, 0x31, 0x34, 0x37, 0x35, 0x32, 0x36, 0x39, 0x34, 0x37, 0x22, 0x0d, 0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x75, 0x65, 0x2c, 0x20, 0x32, 0x36, 0x20, 0x44, 0x65, 0x63, 0x20, 0x32, 0x30, 0x32, 0x33, 0x20, 0x30, 0x38, 0x3a, 0x32, 0x36, 0x3a, 0x35, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x31, 0x37, 0x20, 0x4f, 0x63, 0x74, 0x20, 0x32, 0x30, 0x31, 0x39, 0x20, 0x30, 0x37, 0x3a, 0x31, 0x38, 0x3a, 0x32, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x45, 0x43, 0x53, 0x20, 0x28, 0x73, 0x65, 0x64, 0x2f, 0x35, 0x38, 0x41, 0x41, 0x29, 0x0d, 0x0a, 0x56, 0x61, 0x72, 0x79, 0x3a, 0x20, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, 0x67, 0x0d, 0x0a, 0x58, 0x2d, 0x43, 0x61, 0x63, 0x68, 0x65, 0x3a, 0x20, 0x48, 0x49, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x32, 0x35, 0x36, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x21, 0x64, 0x6f, 0x63, 0x74, 0x79, 0x70, 0x65, 0x20, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x0a, 0x3c, 0x68, 0x65, 0x61, 0x64, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x3e, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x3c, 0x2f, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x3e, 0x0a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x61, 0x20, 0x63, 0x68, 0x61, 0x72, 0x73, 0x65, 0x74, 0x3d, 0x22, 0x75, 0x74, 0x66, 0x2d, 0x38, 0x22, 0x20, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x61, 0x20, 0x68, 0x74, 0x74, 0x70, 0x2d, 0x65, 0x71, 0x75, 0x69, 0x76, 0x3d, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x74, 0x79, 0x70, 0x65, 0x22, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x3d, 0x22, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3b, 0x20, 0x63, 0x68, 0x61, 0x72, 0x73, 0x65, 0x74, 0x3d, 0x75, 0x74, 0x66, 0x2d, 0x38, 0x22, 0x20, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x61, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x76, 0x69, 0x65, 0x77, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x3d, 0x22, 0x77, 0x69, 0x64, 0x74, 0x68, 0x3d, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x2d, 0x77, 0x69, 0x64, 0x74, 0x68, 0x2c, 0x20, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x2d, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x3d, 0x31, 0x22, 0x20, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x73, 0x74, 0x79, 0x6c, 0x65, 0x20, 0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x63, 0x73, 0x73, 0x22, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x62, 0x6f, 0x64, 0x79, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x62, 0x61, 0x63, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x6e, 0x64, 0x2d, 0x63, 0x6f, 0x6c, 0x6f, 0x72, 0x3a, 0x20, 0x23, 0x66, 0x30, 0x66, 0x30, 0x66, 0x32, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x6d, 0x61, 0x72, 0x67, 0x69, 0x6e, 0x3a, 0x20, 0x30, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x3a, 0x20, 0x30, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x66, 0x6f, 0x6e, 0x74, 0x2d, 0x66, 0x61, 0x6d, 0x69, 0x6c, 0x79, 0x3a, 0x20, 0x2d, 0x61, 0x70, 0x70, 0x6c, 0x65, 0x2d, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2c, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2d, 0x75, 0x69, 0x2c, 0x20, 0x42, 0x6c, 0x69, 0x6e, 0x6b, 0x4d, 0x61, 0x63, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x46, 0x6f, 0x6e, 0x74, 0x2c, 0x20, 0x22, 0x53, 0x65, 0x67, 0x6f, 0x65, 0x20, 0x55, 0x49, 0x22, 0x2c, 0x20, 0x22, 0x4f, 0x70, 0x65, 0x6e, 0x20, 0x53, 0x61, 0x6e, 0x73, 0x22, 0x2c, 0x20, 0x22, 0x48, 0x65, 0x6c, 0x76, 0x65, 0x74, 0x69, 0x63, 0x61, 0x20, 0x4e, 0x65, 0x75, 0x65, 0x22, 0x2c, 0x20, 0x48, 0x65, 0x6c, 0x76, 0x65, 0x74, 0x69, 0x63, 0x61, 0x2c, 0x20, 0x41, 0x72, 0x69, 0x61, 0x6c, 0x2c, 0x20, 0x73, 0x61, 0x6e, 0x73, 0x2d, 0x73, 0x65, 0x72, 0x69, 0x66, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x64, 0x69, 0x76, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x77, 0x69, 0x64, 0x74, 0x68, 0x3a, 0x20, 0x36, 0x30, 0x30, 0x70, 0x78, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x6d, 0x61, 0x72, 0x67, 0x69, 0x6e, 0x3a, 0x20, 0x35, 0x65, 0x6d, 0x20, 0x61, 0x75, 0x74, 0x6f, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x3a, 0x20, 0x32, 0x65, 0x6d, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x62, 0x61, 0x63, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x6e, 0x64, 0x2d, 0x63, 0x6f, 0x6c, 0x6f, 0x72, 0x3a, 0x20, 0x23, 0x66, 0x64, 0x66, 0x64, 0x66, 0x66, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x62, 0x6f, 0x72, 0x64, 0x65, 0x72, 0x2d, 0x72, 0x61, 0x64, 0x69, 0x75, 0x73, 0x3a, 0x20, 0x30, 0x2e, 0x35, 0x65, 0x6d, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x62, 0x6f, 0x78, 0x2d, 0x73, 0x68, 0x61, 0x64, 0x6f, 0x77, 0x3a, 0x20, 0x32, 0x70, 0x78, 0x20, 0x33, 0x70, 0x78, 0x20, 0x37, 0x70, 0x78, 0x20, 0x32, 0x70, 0x78, 0x20, 0x72, 0x67, 0x62, 0x61, 0x28, 0x30, 0x2c, 0x30, 0x2c, 0x30, 0x2c, 0x30, 0x2e, 0x30, 0x32, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x61, 0x3a, 0x6c, 0x69, 0x6e, 0x6b, 0x2c, 0x20, 0x61, 0x3a, 0x76, 0x69, 0x73, 0x69, 0x74, 0x65, 0x64, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x6f, 0x6c, 0x6f, 0x72, 0x3a, 0x20, 0x23, 0x33, 0x38, 0x34, 0x38, 0x38, 0x66, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2d, 0x64, 0x65, 0x63, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x6e, 0x6f, 0x6e, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x40, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x20, 0x28, 0x6d, 0x61, 0x78, 0x2d, 0x77, 0x69, 0x64, 0x74, 0x68, 0x3a, 0x20, 0x37, 0x30, 0x30, 0x70, 0x78, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x64, 0x69, 0x76, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x6d, 0x61, 0x72, 0x67, 0x69, 0x6e, 0x3a, 0x20, 0x30, 0x20, 0x61, 0x75, 0x74, 0x6f, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x77, 0x69, 0x64, 0x74, 0x68, 0x3a, 0x20, 0x61, 0x75, 0x74, 0x6f, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x2f, 0x73, 0x74, 0x79, 0x6c, 0x65, 0x3e, 0x20, 0x20, 0x20, 0x20, 0x0a, 0x3c, 0x2f, 0x68, 0x65}; /* * Frame 7: 385 bytes on wire (3080 bits), 385 bytes captured (3080 bits) on interface en0, id 0 * Ethernet II, Src: NewH3CTe_96:38:0e (48:73:97:96:38:0e), Dst: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Destination: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Source: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 93.184.216.34, Dst: 192.168.38.105 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 371 * Identification: 0xd6b2 (54962) * 000. .... = Flags: 0x0 * 0... .... = Reserved bit: Not set * .0.. .... = Don't fragment: Not set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 42 * Protocol: TCP (6) * Header Checksum: 0x9be6 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x9be6] * Source Address: 93.184.216.34 * Destination Address: 192.168.38.105 * Transmission Control Protocol, Src Port: 80, Dst Port: 60111, Seq: 1289, Ack: 80, Len: 319 * Source Port: 80 * Destination Port: 60111 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 319] * Sequence Number: 1289 (relative sequence number) * Sequence Number (raw): 1381453419 * [Next Sequence Number: 1608 (relative sequence number)] * Acknowledgment Number: 80 (relative ack number) * Acknowledgment number (raw): 2089585020 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x018 (PSH, ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 1... = Push: Set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...0 = Fin: Not set * [TCP Flags: ·······AP···] * Window: 128 * [Calculated window size: 65536] * [Window size scaling factor: 512] * Checksum: 0x955e [correct] * [Checksum Status: Good] * [Calculated Checksum: 0x955e] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 1215574833: TSval 1215574833, TSecr 741028768 * Timestamp echo reply: 741028768 * [Timestamps] * [Time since first frame in this TCP stream: 0.568149000 seconds] * [Time since previous frame in this TCP stream: 0.000002000 seconds] * [SEQ/ACK analysis] * [iRTT: 0.262565000 seconds] * [Bytes in flight: 1607] * [Bytes sent since last PSH flag: 1607] * TCP payload (319 bytes) * TCP segment data (319 bytes) * [2 Reassembled TCP Segments (1607 bytes): #6(1288), #7(319)] * [Frame: 6, payload: 0-1287 (1288 bytes)] * [Frame: 7, payload: 1288-1606 (319 bytes)] * [Segment count: 2] * [Reassembled TCP length: 1607] * [Reassembled TCP Data: 485454502f312e3120323030204f4b0d0a4163636570742d52616e6765733a2062797465…] * Hypertext Transfer Protocol * HTTP/1.1 200 OK\r\n * [Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n] * [HTTP/1.1 200 OK\r\n] * [Severity level: Chat] * [Group: Sequence] * Response Version: HTTP/1.1 * Status Code: 200 * [Status Code Description: OK] * Response Phrase: OK * Accept-Ranges: bytes\r\n * Age: 342048\r\n * Cache-Control: max-age=604800\r\n * Content-Type: text/html; charset=UTF-8\r\n * Date: Tue, 19 Dec 2023 08:26:56 GMT\r\n * Etag: "3147526947"\r\n * Expires: Tue, 26 Dec 2023 08:26:56 GMT\r\n * Last-Modified: Thu, 17 Oct 2019 07:18:26 GMT\r\n * Server: ECS (sed/58AA)\r\n * Vary: Accept-Encoding\r\n * X-Cache: HIT\r\n * Content-Length: 1256\r\n * [Content length: 1256] * \r\n * [HTTP response 1/1] * [Time since request: 0.305366000 seconds] * [Request in frame: 4] * [Request URI: http://www.example.com/] * File Data: 1256 bytes * Line-based text data: text/html (46 lines) * \n * \n * \n * Example Domain\n * \n * \n * \n * \n * \n * \n * \n * \n *
\n *

Example Domain

\n *

This domain is for use in illustrative examples in documents. You may use this\n * domain in literature without prior coordination or asking for permission.

\n *

More information...

\n *
\n * \n * \n */ unsigned char tcp_pkt7_s2c_http_resp_2[] = { 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x08, 0x00, 0x45, 0x00, 0x01, 0x73, 0xd6, 0xb2, 0x00, 0x00, 0x2a, 0x06, 0x9b, 0xe6, 0x5d, 0xb8, 0xd8, 0x22, 0xc0, 0xa8, 0x26, 0x69, 0x00, 0x50, 0xea, 0xcf, 0x52, 0x57, 0x4e, 0x6b, 0x7c, 0x8c, 0x89, 0x7c, 0x80, 0x18, 0x00, 0x80, 0x95, 0x5e, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x48, 0x74, 0x33, 0x31, 0x2c, 0x2b, 0x33, 0xa0, 0x61, 0x64, 0x3e, 0x0a, 0x0a, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x0a, 0x3c, 0x64, 0x69, 0x76, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x68, 0x31, 0x3e, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x70, 0x3e, 0x54, 0x68, 0x69, 0x73, 0x20, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x69, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x75, 0x73, 0x65, 0x20, 0x69, 0x6e, 0x20, 0x69, 0x6c, 0x6c, 0x75, 0x73, 0x74, 0x72, 0x61, 0x74, 0x69, 0x76, 0x65, 0x20, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x59, 0x6f, 0x75, 0x20, 0x6d, 0x61, 0x79, 0x20, 0x75, 0x73, 0x65, 0x20, 0x74, 0x68, 0x69, 0x73, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x69, 0x6e, 0x20, 0x6c, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x75, 0x72, 0x65, 0x20, 0x77, 0x69, 0x74, 0x68, 0x6f, 0x75, 0x74, 0x20, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x20, 0x63, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6f, 0x72, 0x20, 0x61, 0x73, 0x6b, 0x69, 0x6e, 0x67, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x3c, 0x2f, 0x70, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x70, 0x3e, 0x3c, 0x61, 0x20, 0x68, 0x72, 0x65, 0x66, 0x3d, 0x22, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x69, 0x61, 0x6e, 0x61, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x2f, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x22, 0x3e, 0x4d, 0x6f, 0x72, 0x65, 0x20, 0x69, 0x6e, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x2e, 0x2e, 0x3c, 0x2f, 0x61, 0x3e, 0x3c, 0x2f, 0x70, 0x3e, 0x0a, 0x3c, 0x2f, 0x64, 0x69, 0x76, 0x3e, 0x0a, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x0a, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x0a}; /* * Frame 8: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface en0, id 0 * Ethernet II, Src: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea), Dst: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Destination: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Source: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 192.168.38.105, Dst: 93.184.216.34 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 52 * Identification: 0x0000 (0) * 010. .... = Flags: 0x2, Don't fragment * 0... .... = Reserved bit: Not set * .1.. .... = Don't fragment: Set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 64 * Protocol: TCP (6) * Header Checksum: 0x1dd8 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x1dd8] * Source Address: 192.168.38.105 * Destination Address: 93.184.216.34 * Transmission Control Protocol, Src Port: 60111, Dst Port: 80, Seq: 80, Ack: 1608, Len: 0 * Source Port: 60111 * Destination Port: 80 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 80 (relative sequence number) * Sequence Number (raw): 2089585020 * [Next Sequence Number: 80 (relative sequence number)] * Acknowledgment Number: 1608 (relative ack number) * Acknowledgment number (raw): 1381453738 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x010 (ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...0 = Fin: Not set * [TCP Flags: ·······A····] * Window: 2027 * [Calculated window size: 129728] * [Window size scaling factor: 64] * Checksum: 0xe219 [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xe219] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 741029073: TSval 741029073, TSecr 1215574833 * Timestamp echo reply: 1215574833 * [Timestamps] * [Time since first frame in this TCP stream: 0.568399000 seconds] * [Time since previous frame in this TCP stream: 0.000250000 seconds] * [SEQ/ACK analysis] * [This is an ACK to the segment in frame: 7] * [The RTT to ACK the segment was: 0.000250000 seconds] * [iRTT: 0.262565000 seconds] */ unsigned char tcp_pkt8_c2s_ack[] = { 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0x1d, 0xd8, 0xc0, 0xa8, 0x26, 0x69, 0x5d, 0xb8, 0xd8, 0x22, 0xea, 0xcf, 0x00, 0x50, 0x7c, 0x8c, 0x89, 0x7c, 0x52, 0x57, 0x4f, 0xaa, 0x80, 0x10, 0x07, 0xeb, 0xe2, 0x19, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x2c, 0x2b, 0x34, 0xd1, 0x48, 0x74, 0x33, 0x31}; /* * Frame 9: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface en0, id 0 * Ethernet II, Src: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea), Dst: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Destination: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Source: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 192.168.38.105, Dst: 93.184.216.34 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 52 * Identification: 0x0000 (0) * 010. .... = Flags: 0x2, Don't fragment * 0... .... = Reserved bit: Not set * .1.. .... = Don't fragment: Set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 64 * Protocol: TCP (6) * Header Checksum: 0x1dd8 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x1dd8] * Source Address: 192.168.38.105 * Destination Address: 93.184.216.34 * Transmission Control Protocol, Src Port: 60111, Dst Port: 80, Seq: 80, Ack: 1608, Len: 0 * Source Port: 60111 * Destination Port: 80 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 80 (relative sequence number) * Sequence Number (raw): 2089585020 * [Next Sequence Number: 81 (relative sequence number)] * Acknowledgment Number: 1608 (relative ack number) * Acknowledgment number (raw): 1381453738 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x011 (FIN, ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...1 = Fin: Set * [Expert Info (Chat/Sequence): Connection finish (FIN)] * [Connection finish (FIN)] * [Severity level: Chat] * [Group: Sequence] * [TCP Flags: ·······A···F] * [Expert Info (Note/Sequence): This frame initiates the connection closing] * [This frame initiates the connection closing] * [Severity level: Note] * [Group: Sequence] * Window: 2048 * [Calculated window size: 131072] * [Window size scaling factor: 64] * Checksum: 0xe203 [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xe203] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 741029073: TSval 741029073, TSecr 1215574833 * Timestamp echo reply: 1215574833 * [Timestamps] * [Time since first frame in this TCP stream: 0.568964000 seconds] * [Time since previous frame in this TCP stream: 0.000565000 seconds] */ unsigned char tcp_pkt9_c2s_fin[] = { 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0x1d, 0xd8, 0xc0, 0xa8, 0x26, 0x69, 0x5d, 0xb8, 0xd8, 0x22, 0xea, 0xcf, 0x00, 0x50, 0x7c, 0x8c, 0x89, 0x7c, 0x52, 0x57, 0x4f, 0xaa, 0x80, 0x11, 0x08, 0x00, 0xe2, 0x03, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x2c, 0x2b, 0x34, 0xd1, 0x48, 0x74, 0x33, 0x31}; /* * Frame 10: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface en0, id 0 * Ethernet II, Src: NewH3CTe_96:38:0e (48:73:97:96:38:0e), Dst: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Destination: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Source: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 93.184.216.34, Dst: 192.168.38.105 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 52 * Identification: 0xd6b3 (54963) * 000. .... = Flags: 0x0 * 0... .... = Reserved bit: Not set * .0.. .... = Don't fragment: Not set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 42 * Protocol: TCP (6) * Header Checksum: 0x9d24 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x9d24] * Source Address: 93.184.216.34 * Destination Address: 192.168.38.105 * Transmission Control Protocol, Src Port: 80, Dst Port: 60111, Seq: 1608, Ack: 81, Len: 0 * Source Port: 80 * Destination Port: 60111 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 1608 (relative sequence number) * Sequence Number (raw): 1381453738 * [Next Sequence Number: 1609 (relative sequence number)] * Acknowledgment Number: 81 (relative ack number) * Acknowledgment number (raw): 2089585021 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x011 (FIN, ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...1 = Fin: Set * [Expert Info (Chat/Sequence): Connection finish (FIN)] * [Connection finish (FIN)] * [Severity level: Chat] * [Group: Sequence] * [TCP Flags: ·······A···F] * [Expert Info (Note/Sequence): This frame undergoes the connection closing] * [This frame undergoes the connection closing] * [Severity level: Note] * [Group: Sequence] * Window: 128 * [Calculated window size: 65536] * [Window size scaling factor: 512] * Checksum: 0xe851 [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xe851] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 1215575138: TSval 1215575138, TSecr 741029073 * Timestamp echo reply: 741029073 * [Timestamps] * [Time since first frame in this TCP stream: 0.876568000 seconds] * [Time since previous frame in this TCP stream: 0.307604000 seconds] * [SEQ/ACK analysis] * [This is an ACK to the segment in frame: 9] * [The RTT to ACK the segment was: 0.307604000 seconds] * [iRTT: 0.262565000 seconds] */ unsigned char tcp_pkt10_s2c_fin[] = { 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0xd6, 0xb3, 0x00, 0x00, 0x2a, 0x06, 0x9d, 0x24, 0x5d, 0xb8, 0xd8, 0x22, 0xc0, 0xa8, 0x26, 0x69, 0x00, 0x50, 0xea, 0xcf, 0x52, 0x57, 0x4f, 0xaa, 0x7c, 0x8c, 0x89, 0x7d, 0x80, 0x11, 0x00, 0x80, 0xe8, 0x51, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x48, 0x74, 0x34, 0x62, 0x2c, 0x2b, 0x34, 0xd1}; /* * Frame 11: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface en0, id 0 * Ethernet II, Src: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea), Dst: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Destination: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Source: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 192.168.38.105, Dst: 93.184.216.34 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 52 * Identification: 0x0000 (0) * 010. .... = Flags: 0x2, Don't fragment * 0... .... = Reserved bit: Not set * .1.. .... = Don't fragment: Set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 64 * Protocol: TCP (6) * Header Checksum: 0x1dd8 [correct] * [Header checksum status: Good] * [Calculated Checksum: 0x1dd8] * Source Address: 192.168.38.105 * Destination Address: 93.184.216.34 * Transmission Control Protocol, Src Port: 60111, Dst Port: 80, Seq: 81, Ack: 1609, Len: 0 * Source Port: 60111 * Destination Port: 80 * [Stream index: 0] * [Conversation completeness: Complete, WITH_DATA (31)] * [TCP Segment Len: 0] * Sequence Number: 81 (relative sequence number) * Sequence Number (raw): 2089585021 * [Next Sequence Number: 81 (relative sequence number)] * Acknowledgment Number: 1609 (relative ack number) * Acknowledgment number (raw): 1381453739 * 1000 .... = Header Length: 32 bytes (8) * Flags: 0x010 (ACK) * 000. .... .... = Reserved: Not set * ...0 .... .... = Accurate ECN: Not set * .... 0... .... = Congestion Window Reduced: Not set * .... .0.. .... = ECN-Echo: Not set * .... ..0. .... = Urgent: Not set * .... ...1 .... = Acknowledgment: Set * .... .... 0... = Push: Not set * .... .... .0.. = Reset: Not set * .... .... ..0. = Syn: Not set * .... .... ...0 = Fin: Not set * [TCP Flags: ·······A····] * Window: 2048 * [Calculated window size: 131072] * [Window size scaling factor: 64] * Checksum: 0xdf9d [correct] * [Checksum Status: Good] * [Calculated Checksum: 0xdf9d] * Urgent Pointer: 0 * Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - No-Operation (NOP) * Kind: No-Operation (1) * TCP Option - Timestamps * Kind: Time Stamp Option (8) * Length: 10 * Timestamp value: 741029381: TSval 741029381, TSecr 1215575138 * Timestamp echo reply: 1215575138 * [Timestamps] * [Time since first frame in this TCP stream: 0.876872000 seconds] * [Time since previous frame in this TCP stream: 0.000304000 seconds] * [SEQ/ACK analysis] * [This is an ACK to the segment in frame: 10] * [The RTT to ACK the segment was: 0.000304000 seconds] * [iRTT: 0.262565000 seconds] */ unsigned char tcp_pkt11_c2s_ack[] = { 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0x1d, 0xd8, 0xc0, 0xa8, 0x26, 0x69, 0x5d, 0xb8, 0xd8, 0x22, 0xea, 0xcf, 0x00, 0x50, 0x7c, 0x8c, 0x89, 0x7d, 0x52, 0x57, 0x4f, 0xab, 0x80, 0x10, 0x08, 0x00, 0xdf, 0x9d, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x2c, 0x2b, 0x36, 0x05, 0x48, 0x74, 0x34, 0x62}; /****************************************************************************** * test packet: UDP www.badssl.com ******************************************************************************/ /* * Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface en0, id 0 * Ethernet II, Src: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea), Dst: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Destination: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Source: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 192.168.38.105, Dst: 121.14.154.93 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 60 * Identification: 0xaef9 (44793) * 000. .... = Flags: 0x0 * 0... .... = Reserved bit: Not set * .0.. .... = Don't fragment: Not set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 64 * Protocol: UDP (17) * Header Checksum: 0xd13a [correct] * [Header checksum status: Good] * [Calculated Checksum: 0xd13a] * Source Address: 192.168.38.105 * Destination Address: 121.14.154.93 * User Datagram Protocol, Src Port: 61099, Dst Port: 53 * Source Port: 61099 * Destination Port: 53 * Length: 40 * Checksum: 0xdcf1 [correct] * [Calculated Checksum: 0xdcf1] * [Checksum Status: Good] * [Stream index: 0] * [Timestamps] * [Time since first frame: 0.000000000 seconds] * [Time since previous frame: 0.000000000 seconds] * UDP payload (32 bytes) * Domain Name System (query) * Transaction ID: 0xa5af * Flags: 0x0100 Standard query * 0... .... .... .... = Response: Message is a query * .000 0... .... .... = Opcode: Standard query (0) * .... ..0. .... .... = Truncated: Message is not truncated * .... ...1 .... .... = Recursion desired: Do query recursively * .... .... .0.. .... = Z: reserved (0) * .... .... ...0 .... = Non-authenticated data: Unacceptable * Questions: 1 * Answer RRs: 0 * Authority RRs: 0 * Additional RRs: 0 * Queries * www.badssl.com: type A, class IN * Name: www.badssl.com * [Name Length: 14] * [Label Count: 3] * Type: A (Host Address) (1) * Class: IN (0x0001) * [Response In: 2] */ unsigned char udp_pkt1_dns_req[] = { 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x08, 0x00, 0x45, 0x00, 0x00, 0x3c, 0xae, 0xf9, 0x00, 0x00, 0x40, 0x11, 0xd1, 0x3a, 0xc0, 0xa8, 0x26, 0x69, 0x79, 0x0e, 0x9a, 0x5d, 0xee, 0xab, 0x00, 0x35, 0x00, 0x28, 0xdc, 0xf1, 0xa5, 0xaf, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x06, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01}; /* * Frame 2: 550 bytes on wire (4400 bits), 550 bytes captured (4400 bits) on interface en0, id 0 * Ethernet II, Src: NewH3CTe_96:38:0e (48:73:97:96:38:0e), Dst: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Destination: Apple_0a:c5:ea (3c:a6:f6:0a:c5:ea) * Source: NewH3CTe_96:38:0e (48:73:97:96:38:0e) * Type: IPv4 (0x0800) * Internet Protocol Version 4, Src: 121.14.154.93, Dst: 192.168.38.105 * 0100 .... = Version: 4 * .... 0101 = Header Length: 20 bytes (5) * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) * 0000 00.. = Differentiated Services Codepoint: Default (0) * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) * Total Length: 536 * Identification: 0xb578 (46456) * 000. .... = Flags: 0x0 * 0... .... = Reserved bit: Not set * .0.. .... = Don't fragment: Not set * ..0. .... = More fragments: Not set * ...0 0000 0000 0000 = Fragment Offset: 0 * Time to Live: 46 * Protocol: UDP (17) * Header Checksum: 0xdadf [correct] * [Header checksum status: Good] * [Calculated Checksum: 0xdadf] * Source Address: 121.14.154.93 * Destination Address: 192.168.38.105 * User Datagram Protocol, Src Port: 53, Dst Port: 61099 * Source Port: 53 * Destination Port: 61099 * Length: 516 * Checksum: 0x9aca [correct] * [Calculated Checksum: 0x9aca] * [Checksum Status: Good] * [Stream index: 0] * [Timestamps] * [Time since first frame: 0.525915000 seconds] * [Time since previous frame: 0.525915000 seconds] * UDP payload (508 bytes) * Domain Name System (response) * Transaction ID: 0xa5af * Flags: 0x8180 Standard query response, No error * 1... .... .... .... = Response: Message is a response * .000 0... .... .... = Opcode: Standard query (0) * .... .0.. .... .... = Authoritative: Server is not an authority for domain * .... ..0. .... .... = Truncated: Message is not truncated * .... ...1 .... .... = Recursion desired: Do query recursively * .... .... 1... .... = Recursion available: Server can do recursive queries * .... .... .0.. .... = Z: reserved (0) * .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server * .... .... ...0 .... = Non-authenticated data: Unacceptable * .... .... .... 0000 = Reply code: No error (0) * Questions: 1 * Answer RRs: 1 * Authority RRs: 13 * Additional RRs: 14 * Queries * www.badssl.com: type A, class IN * Name: www.badssl.com * [Name Length: 14] * [Label Count: 3] * Type: A (Host Address) (1) * Class: IN (0x0001) * Answers * www.badssl.com: type A, class IN, addr 104.154.89.105 * Name: www.badssl.com * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 3600 (1 hour) * Data length: 4 * Address: 104.154.89.105 * Authoritative nameservers * com: type NS, class IN, ns b.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 20 * Name Server: b.gtld-servers.net * com: type NS, class IN, ns e.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: e.gtld-servers.net * com: type NS, class IN, ns c.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: c.gtld-servers.net * com: type NS, class IN, ns f.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: f.gtld-servers.net * com: type NS, class IN, ns a.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: a.gtld-servers.net * com: type NS, class IN, ns k.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: k.gtld-servers.net * com: type NS, class IN, ns h.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: h.gtld-servers.net * com: type NS, class IN, ns d.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: d.gtld-servers.net * com: type NS, class IN, ns g.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: g.gtld-servers.net * com: type NS, class IN, ns i.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: i.gtld-servers.net * com: type NS, class IN, ns m.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: m.gtld-servers.net * com: type NS, class IN, ns l.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: l.gtld-servers.net * com: type NS, class IN, ns j.gtld-servers.net * Name: com * Type: NS (authoritative Name Server) (2) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 4 * Name Server: j.gtld-servers.net * Additional records * a.gtld-servers.net: type A, class IN, addr 192.5.6.30 * Name: a.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 22363 (6 hours, 12 minutes, 43 seconds) * Data length: 4 * Address: 192.5.6.30 * b.gtld-servers.net: type A, class IN, addr 192.33.14.30 * Name: b.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 94262 (1 day, 2 hours, 11 minutes, 2 seconds) * Data length: 4 * Address: 192.33.14.30 * c.gtld-servers.net: type A, class IN, addr 192.26.92.30 * Name: c.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 94829 (1 day, 2 hours, 20 minutes, 29 seconds) * Data length: 4 * Address: 192.26.92.30 * d.gtld-servers.net: type A, class IN, addr 192.31.80.30 * Name: d.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 94683 (1 day, 2 hours, 18 minutes, 3 seconds) * Data length: 4 * Address: 192.31.80.30 * e.gtld-servers.net: type A, class IN, addr 192.12.94.30 * Name: e.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 95571 (1 day, 2 hours, 32 minutes, 51 seconds) * Data length: 4 * Address: 192.12.94.30 * f.gtld-servers.net: type A, class IN, addr 192.35.51.30 * Name: f.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 94683 (1 day, 2 hours, 18 minutes, 3 seconds) * Data length: 4 * Address: 192.35.51.30 * g.gtld-servers.net: type A, class IN, addr 192.42.93.30 * Name: g.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 96370 (1 day, 2 hours, 46 minutes, 10 seconds) * Data length: 4 * Address: 192.42.93.30 * h.gtld-servers.net: type A, class IN, addr 192.54.112.30 * Name: h.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 96885 (1 day, 2 hours, 54 minutes, 45 seconds) * Data length: 4 * Address: 192.54.112.30 * i.gtld-servers.net: type A, class IN, addr 192.43.172.30 * Name: i.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 95037 (1 day, 2 hours, 23 minutes, 57 seconds) * Data length: 4 * Address: 192.43.172.30 * j.gtld-servers.net: type A, class IN, addr 192.48.79.30 * Name: j.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 94829 (1 day, 2 hours, 20 minutes, 29 seconds) * Data length: 4 * Address: 192.48.79.30 * k.gtld-servers.net: type A, class IN, addr 192.52.178.30 * Name: k.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 96885 (1 day, 2 hours, 54 minutes, 45 seconds) * Data length: 4 * Address: 192.52.178.30 * l.gtld-servers.net: type A, class IN, addr 192.41.162.30 * Name: l.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 96885 (1 day, 2 hours, 54 minutes, 45 seconds) * Data length: 4 * Address: 192.41.162.30 * m.gtld-servers.net: type A, class IN, addr 192.55.83.30 * Name: m.gtld-servers.net * Type: A (Host Address) (1) * Class: IN (0x0001) * Time to live: 94829 (1 day, 2 hours, 20 minutes, 29 seconds) * Data length: 4 * Address: 192.55.83.30 * a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30 * Name: a.gtld-servers.net * Type: AAAA (IPv6 Address) (28) * Class: IN (0x0001) * Time to live: 108314 (1 day, 6 hours, 5 minutes, 14 seconds) * Data length: 16 * AAAA Address: 2001:503:a83e::2:30 * [Request In: 1] * [Time: 0.525915000 seconds] */ unsigned char udp_pkt2_dns_resp[] = { 0x3c, 0xa6, 0xf6, 0x0a, 0xc5, 0xea, 0x48, 0x73, 0x97, 0x96, 0x38, 0x0e, 0x08, 0x00, 0x45, 0x00, 0x02, 0x18, 0xb5, 0x78, 0x00, 0x00, 0x2e, 0x11, 0xda, 0xdf, 0x79, 0x0e, 0x9a, 0x5d, 0xc0, 0xa8, 0x26, 0x69, 0x00, 0x35, 0xee, 0xab, 0x02, 0x04, 0x9a, 0xca, 0xa5, 0xaf, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x0d, 0x00, 0x0e, 0x03, 0x77, 0x77, 0x77, 0x06, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x04, 0x68, 0x9a, 0x59, 0x69, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x14, 0x01, 0x62, 0x0c, 0x67, 0x74, 0x6c, 0x64, 0x2d, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x03, 0x6e, 0x65, 0x74, 0x00, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x65, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x63, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x66, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x61, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x6b, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x68, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x64, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x67, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x69, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x6d, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x6c, 0xc0, 0x3e, 0xc0, 0x17, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x04, 0x01, 0x6a, 0xc0, 0x3e, 0xc0, 0x8c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x57, 0x5b, 0x00, 0x04, 0xc0, 0x05, 0x06, 0x1e, 0xc0, 0x3c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x70, 0x36, 0x00, 0x04, 0xc0, 0x21, 0x0e, 0x1e, 0xc0, 0x6c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x72, 0x6d, 0x00, 0x04, 0xc0, 0x1a, 0x5c, 0x1e, 0xc0, 0xbc, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x71, 0xdb, 0x00, 0x04, 0xc0, 0x1f, 0x50, 0x1e, 0xc0, 0x5c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x75, 0x53, 0x00, 0x04, 0xc0, 0x0c, 0x5e, 0x1e, 0xc0, 0x7c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x71, 0xdb, 0x00, 0x04, 0xc0, 0x23, 0x33, 0x1e, 0xc0, 0xcc, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x78, 0x72, 0x00, 0x04, 0xc0, 0x2a, 0x5d, 0x1e, 0xc0, 0xac, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x7a, 0x75, 0x00, 0x04, 0xc0, 0x36, 0x70, 0x1e, 0xc0, 0xdc, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x73, 0x3d, 0x00, 0x04, 0xc0, 0x2b, 0xac, 0x1e, 0xc1, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x72, 0x6d, 0x00, 0x04, 0xc0, 0x30, 0x4f, 0x1e, 0xc0, 0x9c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x7a, 0x75, 0x00, 0x04, 0xc0, 0x34, 0xb2, 0x1e, 0xc0, 0xfc, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x7a, 0x75, 0x00, 0x04, 0xc0, 0x29, 0xa2, 0x1e, 0xc0, 0xec, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x72, 0x6d, 0x00, 0x04, 0xc0, 0x37, 0x53, 0x1e, 0xc0, 0x8c, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x01, 0xa7, 0x1a, 0x00, 0x10, 0x20, 0x01, 0x05, 0x03, 0xa8, 0x3e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x30}; #ifdef __cpluscplus } #endif #endif