| jmcollin92 |
01-08-2004 03:50 PM |
Quote:
Originally posted by yuray
You need the program ethereal
This is GUI for showing file contents.
|
OK I've got it installed on a distant windows box.
I load a file generated on the Linux box and here is an extract of the interesting dialog (only packet at the begining and interesting packet are shown here. I can send the complete file to you if you want ...) :
Code:
Frame 50 (64 bytes on wire, 64 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.350905000
Time delta from previous packet: 0.003661000 seconds
Time since reference or first frame: 91.480258000 seconds
Frame Number: 50
Packet Length: 64 bytes
Capture Length: 64 bytes
Linux cooked capture
Packet type: Sent by us (4)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 217.128.230.16 (217.128.230.16), Dst Addr: 193.252.122.103 (193.252.122.103)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 48
Identification: 0x3f3d (16189)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0xc095 (correct)
Source: 217.128.230.16 (217.128.230.16)
Destination: 193.252.122.103 (193.252.122.103)
Transmission Control Protocol, Src Port: 3153 (3153), Dst Port: http (80), Seq: 0, Ack: 0, Len: 0
Source port: 3153 (3153)
Destination port: http (80)
Sequence number: 0
Header length: 28 bytes
Flags: 0x0002 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0x8272 (correct)
Options: (8 bytes)
Maximum segment size: 1460 bytes
NOP
NOP
SACK permitted
Code:
Frame 56 (64 bytes on wire, 64 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.411793000
Time delta from previous packet: 0.000059000 seconds
Time since reference or first frame: 91.541146000 seconds
Frame Number: 56
Packet Length: 64 bytes
Capture Length: 64 bytes
Linux cooked capture
Packet type: Unicast to us (0)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 193.252.122.103 (193.252.122.103), Dst Addr: 217.128.230.16 (217.128.230.16)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 48
Identification: 0x0000 (0)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: TCP (0x06)
Header checksum: 0x49d3 (correct)
Source: 193.252.122.103 (193.252.122.103)
Destination: 217.128.230.16 (217.128.230.16)
Transmission Control Protocol, Src Port: http (80), Dst Port: 3153 (3153), Seq: 0, Ack: 1, Len: 0
Source port: http (80)
Destination port: 3153 (3153)
Sequence number: 0
Acknowledgement number: 1
Header length: 28 bytes
Flags: 0x0012 (SYN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0xee81 (correct)
Options: (8 bytes)
Maximum segment size: 1460 bytes
NOP
NOP
SACK permitted
SEQ/ACK analysis
This is an ACK to the segment in frame: 50
The RTT to ACK the segment was: 0.060888000 seconds
Code:
Frame 58 (56 bytes on wire, 56 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.412127000
Time delta from previous packet: 0.000290000 seconds
Time since reference or first frame: 91.541480000 seconds
Frame Number: 58
Packet Length: 56 bytes
Capture Length: 56 bytes
Linux cooked capture
Packet type: Sent by us (4)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 217.128.230.16 (217.128.230.16), Dst Addr: 193.252.122.103 (193.252.122.103)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x3f41 (16193)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0xc099 (correct)
Source: 217.128.230.16 (217.128.230.16)
Destination: 193.252.122.103 (193.252.122.103)
Transmission Control Protocol, Src Port: 3153 (3153), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
Source port: 3153 (3153)
Destination port: http (80)
Sequence number: 1
Acknowledgement number: 1
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0x3216 (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 56
The RTT to ACK the segment was: 0.000334000 seconds
Code:
Frame 61 (263 bytes on wire, 263 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.419130000
Time delta from previous packet: 0.001182000 seconds
Time since reference or first frame: 91.548483000 seconds
Frame Number: 61
Packet Length: 263 bytes
Capture Length: 263 bytes
Linux cooked capture
Packet type: Sent by us (4)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 217.128.230.16 (217.128.230.16), Dst Addr: 193.252.122.103 (193.252.122.103)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 247
Identification: 0x3f45 (16197)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0xbfc6 (correct)
Source: 217.128.230.16 (217.128.230.16)
Destination: 193.252.122.103 (193.252.122.103)
Transmission Control Protocol, Src Port: 3153 (3153), Dst Port: http (80), Seq: 1, Ack: 1, Len: 207
Source port: 3153 (3153)
Destination port: http (80)
Sequence number: 1
Next sequence number: 208
Acknowledgement number: 1
Header length: 20 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0x9c19 (correct)
Hypertext Transfer Protocol
GET / HTTP/1.1\r\n
Request Method: GET
Accept: */*\r\n
Accept-Language: fr\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Wanadoo 5.6)\r\n
Host: www.wanadoo.fr\r\n
Connection: Keep-Alive\r\n
\r\n
Code:
Frame 69 (1508 bytes on wire, 1508 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.587231000
Time delta from previous packet: 0.063996000 seconds
Time since reference or first frame: 91.716584000 seconds
Frame Number: 69
Packet Length: 1508 bytes
Capture Length: 1508 bytes
Linux cooked capture
Packet type: Unicast to us (0)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 193.252.122.103 (193.252.122.103), Dst Addr: 217.128.230.16 (217.128.230.16)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1492
Identification: 0xdc03 (56323)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: TCP (0x06)
Header checksum: 0x682b (correct)
Source: 193.252.122.103 (193.252.122.103)
Destination: 217.128.230.16 (217.128.230.16)
Transmission Control Protocol, Src Port: http (80), Dst Port: 3153 (3153), Seq: 1, Ack: 208, Len: 1452
Source port: http (80)
Destination port: 3153 (3153)
Sequence number: 1
Next sequence number: 1453
Acknowledgement number: 208
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6432
Checksum: 0x18f7 (correct)
Hypertext Transfer Protocol
HTTP/1.1 200 OK\r\n
Response Code: 200
Date: Thu, 08 Jan 2004 09:22:11 GMT\r\n
Server: Apache\r\n
Set-Cookie: webauth=02003ffd24c70000038400000000e1ac7cc4bddebcef505ac29f82921fe9d980e610anonyme;domain=.wanadoo.fr;path=/\r\n
Keep-Alive: timeout=2, max=20\r\n
Connection: Keep-Alive\r\n
Content-Type: text/html\r\n
Content-Encoding: gzip\r\n
Content-Length: 8470\r\n
\r\n
Data (1131 bytes)
0000 1f 8b 08 00 00 00 00 00 00 03 ec 3d ed 52 db ca ...........=.R..
0010 92 bf 43 d5 7d 87 b9 3a 75 00 5f b0 8d 0d 38 01 ..C.}..:u._...8.
...
0450 a9 16 8f 5c 9c cd 62 c6 7d 46 c2 e2 6f 2a b8 81 ...\..b.}F..o*..
0460 a6 63 67 f1 a9 27 bd 95 48 bb 11 .cg..'..H..
Code:
Frame 76 (1508 bytes on wire, 1508 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.699201000
Time delta from previous packet: 0.031994000 seconds
Time since reference or first frame: 91.828554000 seconds
Frame Number: 76
Packet Length: 1508 bytes
Capture Length: 1508 bytes
Linux cooked capture
Packet type: Unicast to us (0)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 193.252.122.103 (193.252.122.103), Dst Addr: 217.128.230.16 (217.128.230.16)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1492
Identification: 0xdc06 (56326)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: TCP (0x06)
Header checksum: 0x6828 (correct)
Source: 193.252.122.103 (193.252.122.103)
Destination: 217.128.230.16 (217.128.230.16)
Transmission Control Protocol, Src Port: http (80), Dst Port: 3153 (3153), Seq: 2921, Ack: 208, Len: 1452
Source port: http (80)
Destination port: 3153 (3153)
Sequence number: 2921
Next sequence number: 4373
Acknowledgement number: 208
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6432
Checksum: 0x93f1 (correct)
SEQ/ACK analysis
TCP Analysis Flags
A segment before this frame was lost
Hypertext Transfer Protocol
Data (1452 bytes)
0000 71 c8 0c 31 e8 d7 de a3 49 b1 8d ba ff 2d 7d c3 q..1....I....-}.
...
05a0 e1 67 c4 b1 5c 57 4f 4d ad b3 53 a2 .g..\WOM..S.
Code:
Frame 79 (68 bytes on wire, 68 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.699667000
Time delta from previous packet: 0.000008000 seconds
Time since reference or first frame: 91.829020000 seconds
Frame Number: 79
Packet Length: 68 bytes
Capture Length: 68 bytes
Linux cooked capture
Packet type: Sent by us (4)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 217.128.230.16 (217.128.230.16), Dst Addr: 193.252.122.103 (193.252.122.103)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x3f4a (16202)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0xc084 (correct)
Source: 217.128.230.16 (217.128.230.16)
Destination: 193.252.122.103 (193.252.122.103)
Transmission Control Protocol, Src Port: 3153 (3153), Dst Port: http (80), Seq: 208, Ack: 2913, Len: 0
Source port: 3153 (3153)
Destination port: http (80)
Sequence number: 208
Acknowledgement number: 2913
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 64083
Checksum: 0xded6 (correct)
Options: (12 bytes)
NOP
NOP
SACK:
left edge = 3156462676
right edge = 3156464136
SEQ/ACK analysis
TCP Analysis Flags
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 78
Code:
Frame 85 (64 bytes on wire, 64 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.763159000
Time delta from previous packet: 0.015484000 seconds
Time since reference or first frame: 91.892512000 seconds
Frame Number: 85
Packet Length: 64 bytes
Capture Length: 64 bytes
Linux cooked capture
Packet type: Unicast to us (0)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 193.252.122.103 (193.252.122.103), Dst Addr: 217.128.230.16 (217.128.230.16)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 48
Identification: 0xdc08 (56328)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: TCP (0x06)
Header checksum: 0x6dca (correct)
Source: 193.252.122.103 (193.252.122.103)
Destination: 217.128.230.16 (217.128.230.16)
Transmission Control Protocol, Src Port: http (80), Dst Port: 3153 (3153), Seq: 2913, Ack: 208, Len: 8
Source port: http (80)
Destination port: 3153 (3153)
Sequence number: 2913
Next sequence number: 2921
Acknowledgement number: 208
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6432
Checksum: 0x7b30 (correct)
SEQ/ACK analysis
TCP Analysis Flags
This frame is a (suspected) retransmission
Hypertext Transfer Protocol
Data (8 bytes)
0000 2e 81 91 2e 17 1a ba c4 ........
Code:
Frame 86 (56 bytes on wire, 56 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.763312000
Time delta from previous packet: 0.000153000 seconds
Time since reference or first frame: 91.892665000 seconds
Frame Number: 86
Packet Length: 56 bytes
Capture Length: 56 bytes
Linux cooked capture
Packet type: Sent by us (4)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 217.128.230.16 (217.128.230.16), Dst Addr: 193.252.122.103 (193.252.122.103)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x3f4d (16205)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 127
Protocol: TCP (0x06)
Header checksum: 0xc08d (correct)
Source: 217.128.230.16 (217.128.230.16)
Destination: 193.252.122.103 (193.252.122.103)
Transmission Control Protocol, Src Port: 3153 (3153), Dst Port: http (80), Seq: 208, Ack: 4381, Len: 0
Source port: 3153 (3153)
Destination port: http (80)
Sequence number: 208
Acknowledgement number: 4381
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0x202b (correct)
SEQ/ACK analysis
This is an ACK to the segment in frame: 77
The RTT to ACK the segment was: 0.064084000 seconds
Code:
Frame 87 (1508 bytes on wire, 1508 bytes captured)
Arrival Time: Jan 8, 2004 10:24:11.779210000
Time delta from previous packet: 0.015898000 seconds
Time since reference or first frame: 91.908563000 seconds
Frame Number: 87
Packet Length: 1508 bytes
Capture Length: 1508 bytes
Linux cooked capture
Packet type: Unicast to us (0)
Link-layer address type: 512
Link-layer address length: 0
Source: <MISSING>
Protocol: IP (0x0800)
Internet Protocol, Src Addr: 193.252.122.103 (193.252.122.103), Dst Addr: 217.128.230.16 (217.128.230.16)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1492
Identification: 0xdc09 (56329)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: TCP (0x06)
Header checksum: 0x6825 (correct)
Source: 193.252.122.103 (193.252.122.103)
Destination: 217.128.230.16 (217.128.230.16)
Transmission Control Protocol, Src Port: http (80), Dst Port: 3153 (3153), Seq: 4381, Ack: 208, Len: 1452
Source port: http (80)
Destination port: 3153 (3153)
Sequence number: 4381
Next sequence number: 5833
Acknowledgement number: 208
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 6432
Checksum: 0x0f72 (correct)
Hypertext Transfer Protocol
Data (1452 bytes)
0000 9a 67 ea ea b1 3c 50 17 78 99 09 65 a2 c0 f4 16 .g...<P.x..e....
...
05a0 e6 a1 8f 03 61 11 83 8a 0e 01 73 1d ....a.....s.
I've put in bold where there is something interesting (I think ...).
This is trace from ppp0 interface only. I don't have the traces from eth0 interface.
Sorry for the long, long listing....
I can send the tcpdump file to you if you want .
Many many thank's for your help. |
