Frame 1: 135 bytes on wire (1080 bits), 135 bytes captured (1080 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:24.580537000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406844.580537000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 135 bytes (1080 bits) Capture Length: 135 bytes (1080 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp] Ethernet II, Src: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79), Dst: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Destination: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.21, Dst: 15.73.182.62 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 121 Identification: 0xb96e (47470) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: TCP (6) Header Checksum: 0xfacb [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.21 Destination Address: 15.73.182.62 Transmission Control Protocol, Src Port: 58063, Dst Port: 5222, Seq: 1, Ack: 1, Len: 69 Source Port: 58063 Destination Port: 5222 [Stream index: 0] [TCP Segment Len: 69] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 1355629712 [Next Sequence Number: 70 (relative sequence number)] Acknowledgment Number: 1 (relative ack number) Acknowledgment number (raw): 2088334296 1000 .... = Header Length: 32 bytes (8) Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window: 2481 [Calculated window size: 2481] [Window size scaling factor: -1 (unknown)] Checksum: 0x786c [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Timestamps: TSval 27565581, TSecr 1853307966 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 27565581 Timestamp echo reply: 1853307966 [SEQ/ACK analysis] [Bytes in flight: 69] [Bytes sent since last PSH flag: 69] [Timestamps] [Time since first frame in this TCP stream: 0.000000000 seconds] [Time since previous frame in this TCP stream: 0.000000000 seconds] TCP payload (69 bytes) TCP segment data (69 bytes) Frame 2: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:24.696171000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406844.696171000 seconds [Time delta from previous captured frame: 0.115634000 seconds] [Time delta from previous displayed frame: 0.115634000 seconds] [Time since reference or first frame: 0.115634000 seconds] Frame Number: 2 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp] Ethernet II, Src: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc), Dst: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Destination: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 15.73.182.62, Dst: 192.168.0.21 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 52 Identification: 0x9f3f (40767) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 48 Protocol: TCP (6) Header Checksum: 0x2540 [validation disabled] [Header checksum status: Unverified] Source Address: 15.73.182.62 Destination Address: 192.168.0.21 Transmission Control Protocol, Src Port: 5222, Dst Port: 58063, Seq: 1, Ack: 70, Len: 0 Source Port: 5222 Destination Port: 58063 [Stream index: 0] [TCP Segment Len: 0] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 2088334296 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 70 (relative ack number) Acknowledgment number (raw): 1355629781 1000 .... = Header Length: 32 bytes (8) Flags: 0x010 (ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 0... = Push: Not set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······A····] Window: 23 [Calculated window size: 23] [Window size scaling factor: -1 (unknown)] Checksum: 0x3e34 [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Timestamps: TSval 1853368025, TSecr 27565581 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 1853368025 Timestamp echo reply: 27565581 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 1] [The RTT to ACK the segment was: 0.115634000 seconds] [Timestamps] [Time since first frame in this TCP stream: 0.115634000 seconds] [Time since previous frame in this TCP stream: 0.115634000 seconds] Frame 3: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.088405000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.088405000 seconds [Time delta from previous captured frame: 0.392234000 seconds] [Time delta from previous displayed frame: 0.392234000 seconds] [Time since reference or first frame: 0.507868000 seconds] Frame Number: 3 Frame Length: 86 bytes (688 bits) Capture Length: 86 bytes (688 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:dns] Ethernet II, Src: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79), Dst: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Destination: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.21, Dst: 192.168.0.61 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 72 Identification: 0x6a70 (27248) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: UDP (17) Header Checksum: 0x4e92 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.21 Destination Address: 192.168.0.61 User Datagram Protocol, Src Port: 35159, Dst Port: 53 Source Port: 35159 Destination Port: 53 Length: 52 Checksum: 0x30a4 [unverified] [Checksum Status: Unverified] [Stream index: 0] [Timestamps] [Time since first frame: 0.000000000 seconds] [Time since previous frame: 0.000000000 seconds] UDP payload (44 bytes) Domain Name System (query) Transaction ID: 0x0002 Flags: 0x0100 Standard query 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data: Unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries 254.1.168.192.in-addr.arpa: type PTR, class IN Name: 254.1.168.192.in-addr.arpa [Name Length: 26] [Label Count: 6] Type: PTR (domain name PoinTeR) (12) Class: IN (0x0001) Frame 4: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.088446000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.088446000 seconds [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 0.507909000 seconds] Frame Number: 4 Frame Length: 86 bytes (688 bits) Capture Length: 86 bytes (688 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:dns] Ethernet II, Src: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79), Dst: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Destination: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.21, Dst: 192.168.1.254 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 72 Identification: 0xb2b2 (45746) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: UDP (17) Header Checksum: 0x048f [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.21 Destination Address: 192.168.1.254 User Datagram Protocol, Src Port: 50754, Dst Port: 53 Source Port: 50754 Destination Port: 53 Length: 52 Checksum: 0xf1f6 [unverified] [Checksum Status: Unverified] [Stream index: 1] [Timestamps] [Time since first frame: 0.000000000 seconds] [Time since previous frame: 0.000000000 seconds] UDP payload (44 bytes) Domain Name System (query) Transaction ID: 0x0003 Flags: 0x0100 Standard query 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data: Unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries 254.1.168.192.in-addr.arpa: type PTR, class IN Name: 254.1.168.192.in-addr.arpa [Name Length: 26] [Label Count: 6] Type: PTR (domain name PoinTeR) (12) Class: IN (0x0001) Frame 5: 111 bytes on wire (888 bits), 111 bytes captured (888 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.088549000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.088549000 seconds [Time delta from previous captured frame: 0.000103000 seconds] [Time delta from previous displayed frame: 0.000103000 seconds] [Time since reference or first frame: 0.508012000 seconds] Frame Number: 5 Frame Length: 111 bytes (888 bits) Capture Length: 111 bytes (888 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:dns] Ethernet II, Src: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc), Dst: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Destination: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.61, Dst: 192.168.0.21 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 97 Identification: 0x9294 (37524) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: UDP (17) Header Checksum: 0x6655 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.61 Destination Address: 192.168.0.21 User Datagram Protocol, Src Port: 53, Dst Port: 35159 Source Port: 53 Destination Port: 35159 Length: 77 Checksum: 0x8201 [unverified] [Checksum Status: Unverified] [Stream index: 0] [Timestamps] [Time since first frame: 0.000144000 seconds] [Time since previous frame: 0.000144000 seconds] UDP payload (69 bytes) Domain Name System (response) Transaction ID: 0x0002 Flags: 0x8580 Standard query response, No error 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... 1... .... = Recursion available: Server can do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... ...0 .... = Non-authenticated data: Unacceptable .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries 254.1.168.192.in-addr.arpa: type PTR, class IN Name: 254.1.168.192.in-addr.arpa [Name Length: 26] [Label Count: 6] Type: PTR (domain name PoinTeR) (12) Class: IN (0x0001) Answers 254.1.168.192.in-addr.arpa: type PTR, class IN, freebox.lan Name: 254.1.168.192.in-addr.arpa Type: PTR (domain name PoinTeR) (12) Class: IN (0x0001) Time to live: 3600 (1 hour) Data length: 13 Domain Name: freebox.lan [Request In: 3] [Time: 0.000144000 seconds] Frame 6: 111 bytes on wire (888 bits), 111 bytes captured (888 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.088583000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.088583000 seconds [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 0.508046000 seconds] Frame Number: 6 Frame Length: 111 bytes (888 bits) Capture Length: 111 bytes (888 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:dns] Ethernet II, Src: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc), Dst: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Destination: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.254, Dst: 192.168.0.21 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 97 Identification: 0x9295 (37525) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: UDP (17) Header Checksum: 0x6493 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.1.254 Destination Address: 192.168.0.21 User Datagram Protocol, Src Port: 53, Dst Port: 50754 Source Port: 53 Destination Port: 50754 Length: 77 Checksum: 0x83c2 [unverified] [Checksum Status: Unverified] [Stream index: 1] [Timestamps] [Time since first frame: 0.000137000 seconds] [Time since previous frame: 0.000137000 seconds] UDP payload (69 bytes) Domain Name System (response) Transaction ID: 0x0003 Flags: 0x8580 Standard query response, No error 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... 1... .... = Recursion available: Server can do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... ...0 .... = Non-authenticated data: Unacceptable .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries 254.1.168.192.in-addr.arpa: type PTR, class IN Name: 254.1.168.192.in-addr.arpa [Name Length: 26] [Label Count: 6] Type: PTR (domain name PoinTeR) (12) Class: IN (0x0001) Answers 254.1.168.192.in-addr.arpa: type PTR, class IN, freebox.lan Name: 254.1.168.192.in-addr.arpa Type: PTR (domain name PoinTeR) (12) Class: IN (0x0001) Time to live: 3600 (1 hour) Data length: 13 Domain Name: freebox.lan [Request In: 4] [Time: 0.000137000 seconds] Frame 7: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.088866000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.088866000 seconds [Time delta from previous captured frame: 0.000283000 seconds] [Time delta from previous displayed frame: 0.000283000 seconds] [Time since reference or first frame: 0.508329000 seconds] Frame Number: 7 Frame Length: 74 bytes (592 bits) Capture Length: 74 bytes (592 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp] Ethernet II, Src: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79), Dst: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Destination: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.21, Dst: 192.168.1.254 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 60 Identification: 0x1b13 (6931) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: TCP (6) Header Checksum: 0x9c45 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.21 Destination Address: 192.168.1.254 Transmission Control Protocol, Src Port: 38411, Dst Port: 445, Seq: 0, Len: 0 Source Port: 38411 Destination Port: 445 [Stream index: 1] [TCP Segment Len: 0] Sequence Number: 0 (relative sequence number) Sequence Number (raw): 3702490451 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 0 Acknowledgment number (raw): 0 1010 .... = Header Length: 40 bytes (10) Flags: 0x002 (SYN) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...0 .... = Acknowledgment: Not set .... .... 0... = Push: Not set .... .... .0.. = Reset: Not set .... .... ..1. = Syn: Set [Expert Info (Chat/Sequence): Connection establish request (SYN): server port 445] [Connection establish request (SYN): server port 445] [Severity level: Chat] [Group: Sequence] .... .... ...0 = Fin: Not set [TCP Flags: ··········S·] Window: 29200 [Calculated window size: 29200] Checksum: 0xb8dc [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale TCP Option - Maximum segment size: 1460 bytes Kind: Maximum Segment Size (2) Length: 4 MSS Value: 1460 TCP Option - SACK permitted Kind: SACK Permitted (4) Length: 2 TCP Option - Timestamps: TSval 27565632, TSecr 0 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 27565632 Timestamp echo reply: 0 TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Window scale: 6 (multiply by 64) Kind: Window Scale (3) Length: 3 Shift count: 6 [Multiplier: 64] [Timestamps] [Time since first frame in this TCP stream: 0.000000000 seconds] [Time since previous frame in this TCP stream: 0.000000000 seconds] Frame 8: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.089102000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.089102000 seconds [Time delta from previous captured frame: 0.000236000 seconds] [Time delta from previous displayed frame: 0.000236000 seconds] [Time since reference or first frame: 0.508565000 seconds] Frame Number: 8 Frame Length: 74 bytes (592 bits) Capture Length: 74 bytes (592 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp] Ethernet II, Src: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc), Dst: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Destination: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.254, Dst: 192.168.0.21 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 60 Identification: 0x0000 (0) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 63 Protocol: TCP (6) Header Checksum: 0xb858 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.1.254 Destination Address: 192.168.0.21 Transmission Control Protocol, Src Port: 445, Dst Port: 38411, Seq: 0, Ack: 1, Len: 0 Source Port: 445 Destination Port: 38411 [Stream index: 1] [TCP Segment Len: 0] Sequence Number: 0 (relative sequence number) Sequence Number (raw): 492076916 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 1 (relative ack number) Acknowledgment number (raw): 3702490452 1010 .... = Header Length: 40 bytes (10) Flags: 0x012 (SYN, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 0... = Push: Not set .... .... .0.. = Reset: Not set .... .... ..1. = Syn: Set [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port 445] [Connection establish acknowledge (SYN+ACK): server port 445] [Severity level: Chat] [Group: Sequence] .... .... ...0 = Fin: Not set [TCP Flags: ·······A··S·] Window: 65160 [Calculated window size: 65160] Checksum: 0xb324 [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale TCP Option - Maximum segment size: 1460 bytes Kind: Maximum Segment Size (2) Length: 4 MSS Value: 1460 TCP Option - SACK permitted Kind: SACK Permitted (4) Length: 2 TCP Option - Timestamps: TSval 1147770875, TSecr 27565632 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 1147770875 Timestamp echo reply: 27565632 TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Window scale: 7 (multiply by 128) Kind: Window Scale (3) Length: 3 Shift count: 7 [Multiplier: 128] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 7] [The RTT to ACK the segment was: 0.000236000 seconds] [Timestamps] [Time since first frame in this TCP stream: 0.000236000 seconds] [Time since previous frame in this TCP stream: 0.000236000 seconds] Frame 9: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.089215000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.089215000 seconds [Time delta from previous captured frame: 0.000113000 seconds] [Time delta from previous displayed frame: 0.000113000 seconds] [Time since reference or first frame: 0.508678000 seconds] Frame Number: 9 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp] Ethernet II, Src: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79), Dst: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Destination: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.21, Dst: 192.168.1.254 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 52 Identification: 0x1b14 (6932) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: TCP (6) Header Checksum: 0x9c4c [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.21 Destination Address: 192.168.1.254 Transmission Control Protocol, Src Port: 38411, Dst Port: 445, Seq: 1, Ack: 1, Len: 0 Source Port: 38411 Destination Port: 445 [Stream index: 1] [TCP Segment Len: 0] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 3702490452 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 1 (relative ack number) Acknowledgment number (raw): 492076917 1000 .... = Header Length: 32 bytes (8) Flags: 0x010 (ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 0... = Push: Not set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······A····] Window: 457 [Calculated window size: 29248] [Window size scaling factor: 64] Checksum: 0xdeb0 [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Timestamps: TSval 27565632, TSecr 1147770875 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 27565632 Timestamp echo reply: 1147770875 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 8] [The RTT to ACK the segment was: 0.000113000 seconds] [iRTT: 0.000349000 seconds] [Timestamps] [Time since first frame in this TCP stream: 0.000349000 seconds] [Time since previous frame in this TCP stream: 0.000113000 seconds] Frame 10: 183 bytes on wire (1464 bits), 183 bytes captured (1464 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.089386000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.089386000 seconds [Time delta from previous captured frame: 0.000171000 seconds] [Time delta from previous displayed frame: 0.000171000 seconds] [Time since reference or first frame: 0.508849000 seconds] Frame Number: 10 Frame Length: 183 bytes (1464 bits) Capture Length: 183 bytes (1464 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:nbss:smb] Ethernet II, Src: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79), Dst: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Destination: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.21, Dst: 192.168.1.254 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 169 Identification: 0x1b15 (6933) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 64 Protocol: TCP (6) Header Checksum: 0x9bd6 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.21 Destination Address: 192.168.1.254 Transmission Control Protocol, Src Port: 38411, Dst Port: 445, Seq: 1, Ack: 1, Len: 117 Source Port: 38411 Destination Port: 445 [Stream index: 1] [TCP Segment Len: 117] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 3702490452 [Next Sequence Number: 118 (relative sequence number)] Acknowledgment Number: 1 (relative ack number) Acknowledgment number (raw): 492076917 1000 .... = Header Length: 32 bytes (8) Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window: 457 [Calculated window size: 29248] [Window size scaling factor: 64] Checksum: 0xcada [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Timestamps: TSval 27565632, TSecr 1147770875 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 27565632 Timestamp echo reply: 1147770875 [SEQ/ACK analysis] [iRTT: 0.000349000 seconds] [Bytes in flight: 117] [Bytes sent since last PSH flag: 117] [Timestamps] [Time since first frame in this TCP stream: 0.000520000 seconds] [Time since previous frame in this TCP stream: 0.000171000 seconds] TCP payload (117 bytes) NetBIOS Session Service Message Type: Session message (0x00) Length: 113 SMB (Server Message Block Protocol) SMB Header Server Component: SMB SMB Command: Negotiate Protocol (0x72) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x18, Canonicalized Pathnames, Case Sensitivity 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0xc841, Unicode Strings, Error Code Type, Extended Security Negotiation, Long Names Used, Long Names Allowed 1... .... .... .... = Unicode Strings: Strings are Unicode .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .0.. .... .... = Reparse Path: The request does not use a @GMT reparse path .... .... .1.. .... = Long Names Used: Path names in request are long file names .... .... ...0 .... = Security Signatures Required: Security signatures are not required .... .... .... 0... = Compressed: Compression is not requested .... .... .... .0.. = Security Signatures: Security signatures are not supported .... .... .... ..0. = Extended Attributes: Extended attributes are not supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 0 Process ID: 0 User ID: 0 Multiplex ID: 0 Negotiate Protocol Request (0x72) Word Count (WCT): 0 Byte Count (BCC): 78 Requested Dialects Dialect: NT LM 0.12 Buffer Format: Dialect (2) Name: NT LM 0.12 Dialect: SMB 2.002 Buffer Format: Dialect (2) Name: SMB 2.002 Dialect: SMB 2.100 Buffer Format: Dialect (2) Name: SMB 2.100 Dialect: SMB 3.0.0 Buffer Format: Dialect (2) Name: SMB 3.0.0 Dialect: SMB 3.0.2 Buffer Format: Dialect (2) Name: SMB 3.0.2 Dialect: SMB 3.1.1 Buffer Format: Dialect (2) Name: SMB 3.1.1 Dialect: SMB 2.??? Buffer Format: Dialect (2) Name: SMB 2.??? Frame 11: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.089591000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.089591000 seconds [Time delta from previous captured frame: 0.000205000 seconds] [Time delta from previous displayed frame: 0.000205000 seconds] [Time since reference or first frame: 0.509054000 seconds] Frame Number: 11 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp] Ethernet II, Src: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc), Dst: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Destination: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) Address: Dell_e9:b0:bc (d0:67:e5:e9:b0:bc) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.254, Dst: 192.168.0.21 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 52 Identification: 0x5f0f (24335) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 63 Protocol: TCP (6) Header Checksum: 0x5951 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.1.254 Destination Address: 192.168.0.21 Transmission Control Protocol, Src Port: 445, Dst Port: 38411, Seq: 1, Ack: 118, Len: 0 Source Port: 445 Destination Port: 38411 [Stream index: 1] [TCP Segment Len: 0] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 492076917 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 118 (relative ack number) Acknowledgment number (raw): 3702490569 1000 .... = Header Length: 32 bytes (8) Flags: 0x010 (ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 0... = Push: Not set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······A····] Window: 509 [Calculated window size: 65152] [Window size scaling factor: 128] Checksum: 0xde06 [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Timestamps: TSval 1147770876, TSecr 27565632 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 1147770876 Timestamp echo reply: 27565632 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 10] [The RTT to ACK the segment was: 0.000205000 seconds] [iRTT: 0.000349000 seconds] [Timestamps] [Time since first frame in this TCP stream: 0.000725000 seconds] [Time since previous frame in this TCP stream: 0.000205000 seconds] Frame 12: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 27, 2021 19:27:25.922583000 CEST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1627406845.922583000 seconds [Time delta from previous captured frame: 0.832992000 seconds] [Time delta from previous displayed frame: 0.832992000 seconds] [Time since reference or first frame: 1.342046000 seconds] Frame Number: 12 Frame Length: 78 bytes (624 bits) Capture Length: 78 bytes (624 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:igmp:igmp] Ethernet II, Src: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79), Dst: IPv4mcast_16 (01:00:5e:00:00:16) Destination: IPv4mcast_16 (01:00:5e:00:00:16) Address: IPv4mcast_16 (01:00:5e:00:00:16) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast) Source: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) Address: HewlettP_f7:ea:79 (70:5a:0f:f7:ea:79) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.0.21, Dst: 224.0.0.22 0100 .... = Version: 4 .... 0110 = Header Length: 24 bytes (6) Differentiated Services Field: 0xc0 (DSCP: CS6, ECN: Not-ECT) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (48) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 64 Identification: 0x0000 (0) Flags: 0x40, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 1 Protocol: IGMP (2) Header Checksum: 0x4324 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.0.21 Destination Address: 224.0.0.22 Options: (4 bytes), Router Alert IP Option - Router Alert (4 bytes): Router shall examine packet (0) Type: 148 1... .... = Copy on fragmentation: Yes .00. .... = Class: Control (0) ...1 0100 = Number: Router Alert (20) Length: 4 Router Alert: Router shall examine packet (0) Internet Group Management Protocol [IGMP Version: 3] Type: Membership Report (0x22) Reserved: 00 Checksum: 0x42cb [correct] [Checksum Status: Good] Reserved: 0000 Num Group Records: 4 Group Record : 239.255.255.250 Mode Is Exclude Record Type: Mode Is Exclude (2) Aux Data Len: 0 Num Src: 0 Multicast Address: 239.255.255.250 Group Record : 224.0.0.252 Mode Is Exclude Record Type: Mode Is Exclude (2) Aux Data Len: 0 Num Src: 0 Multicast Address: 224.0.0.252 Group Record : 224.0.0.251 Mode Is Exclude Record Type: Mode Is Exclude (2) Aux Data Len: 0 Num Src: 0 Multicast Address: 224.0.0.251 Group Record : 224.0.1.60 Mode Is Exclude Record Type: Mode Is Exclude (2) Aux Data Len: 0 Num Src: 0 Multicast Address: 224.0.1.60