No.

Time
Source
Destination
Protocol
Length Info
1 0.000000000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=1 Ack
=1 Win=46 Len=1260
Frame 1: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.049930000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.049930000 s
econds
[Time delta fro
m previous captured
frame: 0.000000000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00000000
0 seconds]
[Time since ref
erence or first fra
me: 0.000000000 sec
onds]
Frame Number: 1
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9

0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf174 (61812)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab6 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 1, Ack: 1, Le
n: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 1261 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi

ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x194
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 74 4
0 00 31 06 3a b6 4a
7c 0c 8a c0 a8 .
..t@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 62 2e 9e
87 4e aa 50 10 .
..P..+.b...N.P.
0030 00 2e 19 44 0
0 00 30 82 03 17 4c
37 01 53 d4 2a .
..D..0...L7.S.*
0040 30 70 01 01 6
9 f6 a0 3d 4c f1 22
80 90 aa 44 94 0
p..i..=L."...D.
0050 26 1e 43 06 8
d 17 23 b0 8c 16 23
0c b9 bb 65 83 &
.C...#...#...e.
0060 66 ce 54 44 2
b 6f 40 bd e0 88 2d
61 5e c5 f4 6a f
.TD+o@...-a^..j

0070 a9 b5 14 47 b
a b2 dd a3 2f 6b ab
54 df 0e dc 57 .
..G..../k.T...W
0080 16 c1 fc e5 7
c b6 eb bc b7 86 cb
b9 22 ff fb 92 .
...|......."...
0090 04 e9 8f f2 f
b 29 51 83 79 62 60
60 c4 9a 00 6f .
....)Q.yb``...o
00a0 2f 4a 0b d8 a
5 46 0d e1 e9 81 71
92 68 01 ac 3d /
J...F....q.h..=
00b0 28 6e f0 af 4
b bf 7b ba 36 af ce
6c d0 64 16 1b (
n..K.{.6..l.d..
00c0 be 80 71 c0 2
7 40 02 07 70 ca 28
29 21 20 ad 24 .
.q.'@..p.()! .$
00d0 2d 10 90 41 8
0 30 50 7e 2c 9e a4
4e 5f 75 d8 50 ..A.0P~,..N_u.P
00e0 42 89 39 19 7
3 54 8a bd 72 c8 26
99 ad b4 3d 20 B
.9.sT..r.&...=
00f0 51 0a f2 4e 9
3 4c 9c ab 6f d1 28
52 a5 da 7e 35 Q
..N.L..o.(R..~5
0100 8b 05 70 a4 6
0 6e 7d b8 6c 17 a2
99 8b 39 5d ea .
.p.`n}.l....9].
0110 cf 37 ab 6b 1
2 38 a6 92 4e 9a 9c
b3 46 b0 a1 40 .
7.k.8..N...F..@
0120 84 84 d9 86 0
e 10 fc 0a 1c 64 a1
87 9c 66 c1 5a .
........d...f.Z
0130 c0 8c 7c 18 f
1 61 a5 24 0f 3a b2
59 f4 ba 1a 64 .
.|..a.$.:.Y...d
0140 f4 9d 65 38 d
f a6 94 de 88 3e f1
96 d1 6a 52 c2 .
.e8.....>...jR.
0150 4b 00 82 6c 4
6 b2 e3 0c d2 f8 5b
de 54 33 74 89 K
..lF.....[.T3t.
0160 d3 77 ef 18 1
c a3 6d 70 8d 8f b6
c9 af 55 8a d2 .
w....mp.....U..
0170 4b 55 af 7a c
4 7b 45 8d 95 fc ba
0c 44 23 2f 3d K
U.z.{E.....D#/=
0180 25 cc 41 03 7

2 38 4d fa 38 39 26
04 18 a8 40 2d %
.A.r8M.89&...@0190 08 ba 3b 4c e
1 30 c0 77 5e 66 ec
93 71 95 33 5e .
.;L.0.w^f..q.3^
01a0 31 27 fe 92 0
6 94 da b2 dc 61 29
e3 3d 37 0f d7 1
'.......a).=7..
01b0 30 f8 7e c9 5
3 a9 aa 01 e5 ee a1
fe 3a 76 7d c0 0
.~.S.......:v}.
01c0 78 a2 73 ba e
1 53 26 db 33 ba 6b
d3 5f 70 cd 38 x
.s..S&.3.k._p.8
01d0 6d 65 1c c5 3
5 3d 3a aa 0b 91 16
16 1c dc e8 85 m
e..5=:.........
01e0 95 8d 1d 39 6
2 10 d1 d4 5a 22 44
5f a0 ae 54 64 .
..9b...Z"D_..Td
01f0 ad 0d 9d 48 6
e 21 0f 17 0c 8c 92
38 ab 1b 55 4b .
..Hn!.....8..UK
0200 a8 2a 38 ed 4
c 4d 24 61 b0 dc f7
ba 8d ae ba 37 .
*8.LM$a.......7
0210 ae 8d f4 db 7
b b5 04 ba 09 4e 7e
6d cf 53 85 a3 .
...{....N~m.S..
0220 7f aa 9b 6c e
8 9c a0 00 e1 08 62
51 d2 87 04 ff .
..l......bQ....
0230 fb 92 04 ea 8
f f3 17 29 51 03 79
7a 60 60 a4 b9 .
......)Q.yz``..
0240 f0 6b 4f 4a 0
b b8 a7 46 0d e1 e9
81 70 12 e8 01 .
kOJ...F....p...
0250 ac 3d 28 0e 9
4 7f 5a 9d fc b8 25
e7 5b 9a c6 de .
=(...Z...%.[...
0260 8a 84 04 81 4
0 20 e2 5c 54 0c 51
60 20 0b 95 1a .
...@ .\T.Q` ...
0270 3c 85 b3 3f 4
8 3a 70 6c 69 68 4e
28 ce 84 21 91 <
..?H:plihN(..!.
0280 20 e0 df 19 1
1 01 0b 12 c4 70 fd
7c d9 ca 1f b6
........p.|....
0290 bc ee 36 cc d
1 c0 bd 7c 7f 03 89

31 65 af 7b 36 .
.6....|...1e.{6
02a0 be ff 3a da f
7 ff 39 b7 eb f3 34
a3 8b 0c 43 87 .
.:...9...4...C.
02b0 11 58 e0 c0 2
0 18 4c 89 4f 77 a7
fd 02 3a c5 4a .
X.. .L.Ow...:.J
02c0 34 41 37 48 6
9 8d 24 4b 05 61 7d
fc 59 1c 55 e7 4
A7Hi.$K.a}.Y.U.
02d0 e3 04 35 1a 7
d 54 ab 3b 17 29 06
36 49 f2 e6 da .
.5.}T.;.).6I...
02e0 a4 a4 78 aa 2
5 c2 85 f1 14 97 47
09 c7 46 c8 a0 .
.x.%.....G..F..
02f0 38 49 cd 0d 7
e 49 bc 1d b8 f1 7e
1d e5 9e 7d 3f 8
I..~I....~...}?
0300 a6 7d 77 fd c
e ed 34 07 3c c6 6e
6e 58 62 27 1d .
}w...4.<.nnXb'.
0310 a8 5a 92 68 d
9 e8 72 1d ed 59 04
be b7 e8 11 c6 .
Z.h..r..Y......
0320 55 29 1c 98 1
b 38 50 57 42 05 8e
e0 22 bc 74 16 U
)...8PWB...".t.
0330 18 1f 93 c9 6
8 cb 60 e2 51 e1 7a
86 e4 fd b3 86 .
...h.`.Q.z.....
0340 1e c8 98 80 4
a 8a 2d 3e 4b 15 cb
66 68 58 34 55 .
...J.->K..fhX4U
0350 aa 85 4f c5 b
b 82 c6 84 87 c1 70
98 54 3c 70 d9 .
.O.......p.T<p.
0360 50 ab 56 c0 0
d 2c 51 ca 9d bd 2e
ce 7e 2c df 57 P
.V..,Q.....~,.W
0370 ee d6 fc e1 9
f ea 04 2c 0b 20 13
c5 90 dd d9 21 .
......,. .....!
0380 11 e0 c9 f7 6
0 1f 98 cb 2b 13 1c
14 c0 9a cd 18 .
...`...+.......
0390 34 46 c1 9d 6
1 2f a6 81 1d 24 60
b2 05 e3 61 6f 4
F..a/...$`...ao
03a0 6f 25 4c c5 6
4 6f ff 79 56 77 fa
fc 12 6b ff ff o

%L.do.yVw...k..
03b0 f5 d1 8e 0d 9
b e8 17 9f c8 d7 2f
12 33 8c 9f a9 .
........./.3...
03c0 ea a3 b8 11 7
e cb 96 56 27 3a f4
bf bf b6 bc 77 .
...~..V':.....w
03d0 04 ff fb 92 0
4 ea 8f f2 ed 29 d4
83 4f 4a 60 62 .
........)..OJ`b
03e0 c5 8a 70 61 e
c 4c 0c 34 b5 5a 0c
bc c9 81 60 0f .
.pa.L.4.Z....`.
03f0 ab 41 96 25 2
8 ee d4 b7 41 0c fa
b0 21 60 d6 22 .
A.%(...A...!`."
0400 bc ae 05 7f a
f 47 33 81 0e 43 e8
0f 3c c9 e5 a8 .
....G3..C..<...
0410 44 6e 2d b8 7
4 9c b0 cf d6 09 d1
a2 09 61 68 16 D
n-.t........ah.
0420 00 2f 1b 0b 7
b 34 d2 a5 50 76 7d
fe 77 98 1d 39 .
/..{4..Pv}.w..9
0430 fd 7a 0e ef f
f ff dd 3f a7 07 33
94 f9 fc 54 a5 .
z.....?..3...T.
0440 3d 22 74 99 9
6 8e 5d 52 0f 71 f7
1e a9 99 bb c3 =
"t...]R.q......
0450 a7 bf 5f fd f
b dc ae 78 6a fc 11
b4 8c 88 89 09 .
._....xj.......
0460 4f 24 02 b5 a
7 e4 bf 14 33 ef bb
61 c4 1d b6 bb O
$......3..a....
0470 86 93 4e 86 d
a 36 17 35 29 6c 40
64 d5 ea db 7c .
.N..6.5)l@d...|
0480 b4 c1 96 d9 b
9 c3 6a 7f a9 cb a6
df 9f c9 0a 11 .
.....j.........
0490 a9 7f 0a 11 7
4 d8 de 27 0b e1 99
d9 50 e9 ff ca .
...t..'....P...
04a0 7b 0a b4 9b d
8 3e 17 ee 1e ef b2
ad 5e 44 bb 46 {
....>......^D.F
04b0 c6 1f 54 fd 9
5 11 37 1d e4 9b 10
31 d8 45 75 af .
.T...7....1.Eu.

04c0 c4 a0 91 4d f
2 9a ed 80 39 06 35
d6 49 35 0e 67 .
..M....9.5.I5.g
04d0 9d 3a 1c b4 5
0 d9 75 78 d7 f8 cd
ef c7 8f 79 b5 .
:..P.ux......y.
04e0 bb bc a2 9f e
1 ab c5 d2 33 94 3c
a3 6b 08 d4 bf .
.......3.<.k...
04f0 9a 11 6a 6c 6
f 39 af c3 1d aa 64
6e 71 27 dd 69 .
.jlo9....dnq'.i
0500 d8 f5 cf 4b a
a 65 89 ae c5 4f 91
7c 9f 2a ca b0 .
..K.e...O.|.*..
0510 28 ff 52 7b 2
c 38 24 8d 65 8b f5
9a 0e 3b 71 35 (
.R{,8$.e....;q5
0520 80 fa
.
.
No. Time
Source
Destination
Protocol
Length Info
2 0.000173000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=1261 Win=39802 Len
=0
Frame 2: 54 bytes o
n wire (432 bits),
54 bytes captured (
432 bits) on interf
ace 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.050103000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.050103000 s
econds
[Time delta fro
m previous captured
frame: 0.000173000
seconds]

[Time delta fro

m previous displaye
d frame: 0.00017300
0 seconds]
[Time since ref
erence or first fra
me: 0.000173000 sec
onds]
Frame Number: 2
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124

-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f16 (20246)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 1261,
Len: 0
Source Port: 49
574 (49574)
Destination Por

t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 1261 (re
lative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39802
[Calculated win
dow size: 39802]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 1]
[The RTT to
ACK the segment wa
s: 0.000173000 seco
nds]

0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 16 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 67 1a 50 10 .
....P..N.+.g.P.
0030 9b 7a 18 d4 0
0 00
.
z....
No. Time
Source
Destination
Protocol
Length Info
3 0.070998000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=1261
Ack=1 Win=46 Len=12
60
Frame 3: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.120928000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.120928000 s
econds
[Time delta fro
m previous captured
frame: 0.070825000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07082500
0 seconds]
[Time since ref
erence or first fra
me: 0.070998000 sec
onds]
Frame Number: 3
Frame Length: 1
314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: Not-

ECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf175 (61813)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab5 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 1261, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 1261 (relative
sequence number)
[Next sequence

number: 2521 (re

lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x434
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 75 4
0 00 31 06 3a b5 4a
7c 0c 8a c0 a8 .
..u@.1.:.J|....
0020 01 0b 00 50 c

1 a6 2b c8 67 1a 9e
87 4e aa 50 10 .
..P..+.g...N.P.
0030 00 2e 43 47 0
0 00 90 30 2b 83 d6
db c6 59 8e 52 .
.CG...0+....Y.R
0040 21 94 18 b9 1
0 af ab 34 39 50 7d
45 a1 e5 d8 27 !
......49P}E...'
0050 94 42 f3 d9 3
a 3f f4 b6 ed 43 53
e1 9a da 21 3f .
B..:?...CS...!?
0060 b0 88 b2 ad 1
8 dc ac 02 38 d2 d5
fe 64 de 57 63 .
.......8...d.Wc
0070 51 3f 7e 33 6
b 4c 98 56 20 bc 2a
88 a1 48 49 51 Q
?~3kL.V .*..HIQ
0080 62 87 f8 73 2
3 5b 57 ff fb 92 04
ec 8f f3 0d 20 b
..s#[W........
0090 57 83 09 32 5
2 61 83 fa e0 61 86
4a 4b 9d 0b 60 W
..2Ra...a.JK..`
00a0 0c 20 6b 89 8
6 2a ab 81 83 0d 79
85 06 f8 d7 7b .
k..*....y....{
00b0 68 ba 4b e9 3
7 c6 8a 1a 89 6f 80
b3 dd 76 14 98 h
.K.7....o...v..
00c0 f1 e9 3b 35 7
8 eb f0 90 21 07 90
2f bb 9a 85 30 .
.;5x...!../...0
00d0 8d 14 78 f2 c
d 83 da 4b c6 1a bc
70 6d db 62 fc .
.x....K...pm.b.
00e0 33 5b 49 3f b
3 22 3e c8 c6 e5 76
38 72 d5 e6 dd 3
[I?.">...v8r...
00f0 63 ed 2f a5 f
f c3 f5 f2 63 55 fe
1d 26 e1 fc 30 c
./.....cU..&..0
0100 a8 bf 17 1d a
3 6d e6 fa 69 5d 0a
6a 06 fc cf f9 .
....m..i].j....
0110 7b d0 66 e6 3
e 20 50 c0 f7 03 a8
42 c3 50 87 da {
.f.> P....B.P..
0120 38 40 00 0f d
7 3d 65 5e 3d c9 a4
44 5a 41 c9 8a 8
@...=e^=..DZA..
0130 ec 15 48 b2 b
7 ae 5c d9 cd 43 f2

c9 09 24 e2 43 .
.H...\..C...$.C
0140 e2 d4 8c c9 d
7 22 9b dc 87 32 b2
9c ae 83 6a d9 .
...."...2....j.
0150 cb db b6 dd 9
c c2 26 92 6d 00 65
3e b3 22 cb 95 .
.....&.m.e>."..
0160 9e b6 e1 4c f
5 e9 a6 7a f6 59 d4
f5 f1 40 b7 a5 .
..L...z.Y...@..
0170 4d 45 c2 2e a
9 9c 31 50 22 df b7
66 29 14 50 b9 M
E....1P"..f).P.
0180 22 52 b0 8e f
1 a8 f1 32 a4 55 37
46 64 68 6f 58 "
R.....2.U7FdhoX
0190 86 a5 83 05 0
2 86 0a 21 93 a0 0c
2a 95 ca d9 44 .
......!...*...D
01a0 55 7b 9c 7e 4
d 88 7b 69 06 e6 c3
dc a3 e3 24 84 U
{.~M.{i......$.
01b0 c1 c7 02 a5 e
3 58 1d a8 3c 3d 8d
57 5d 10 e4 b5 .
....X..<=.W]...
01c0 52 37 96 a6 b
b eb 87 7e 3f fd 15
34 4a 8e a8 83 R
7.....~?..4J...
01d0 59 a4 e5 36 5
4 c3 c5 ce 0b b6 24
b1 50 8d 54 9d Y
..6T.....$.P.T.
01e0 47 e6 31 cc b
4 49 51 8e 06 0c ed
eb 9c 56 56 5b G
.1..IQ......VV[
01f0 1f eb a1 e2 c
a 44 27 4e b1 03 6a
f0 0e 16 f6 de .
....D'N..j.....
0200 a2 a0 e4 73 8
c 3d c4 59 1a e3 68
7d 04 c2 8c ca .
..s.=.Y..h}....
0210 f0 22 f7 2d 3
1 2a a7 54 af 3b ed
55 f3 1f 13 53 .
".-1*.T.;.U...S
0220 9b 8d b8 71 5
0 b4 d8 d7 16 ff fb
92 04 ea 8f f3 .
..qP...........
0230 1f 3c d6 03 0
9 1a e2 59 a8 ba c0
61 03 5c 4b 80 .
<.....Y...a.\K.
0240 99 52 0c bd 6
9 41 73 92 6a 01 97
a5 28 14 38 e2 .

R..iAs.j...(.8.
0250 0f a4 ba 6a b
f d4 65 88 01 c3 18
95 2a 90 14 c0 .
..j..e.....*...
0260 0c 35 34 94 5
a 0b 63 49 49 68 3b
a7 40 07 49 85 .
54.Z.cIIh;.@.I.
0270 51 35 e2 79 6
1 68 f0 f1 65 6c 22
41 37 5b 44 7f Q
5.yah..el"A7[D.
0280 0a 13 cc 1e b
f 4a 9d 58 96 8a 1d
85 1c a6 39 07 .
....J.X......9.
0290 c0 60 81 9c 5
5 50 55 9e 65 17 78
db 75 3a cc cd .
`..UPU.e.x.u:..
02a0 af 45 65 8a c
6 dc 39 6a 52 40 52
c2 07 1d 20 fa .
Ee...9jR@R... .
02b0 d2 ab 50 f7 7
4 a0 c2 49 80 00 86
1c 32 0f 19 30 .
.P.t..I....2..0
02c0 b0 c4 d6 30 2
4 a7 11 74 0b 08 85
5e a4 73 83 a5 .
..0$..t...^.s..
02d0 f3 4f 6d 2d c
6 25 31 da 9a 8c 5a
b1 35 1f 85 3f .
Om-.%1...Z.5..?
02e0 6f a2 e0 a3 6
c aa 93 ad 85 9c 45
ab 46 3b bb 44 o
...l.....E.F;.D
02f0 38 41 50 41 a
8 b4 da 51 2b 19 96
5a 69 dd db ee 8
APA...Q+..Zi...
0300 7e ae 75 7b b
a 90 19 a1 15 31 43
83 29 69 e1 08 ~
.u{.....1C.)i..
0310 9b 29 62 8a c
f 7e dd da 4c 78 0c
a3 c8 19 43 91 .
)b..~..Lx....C.
0320 33 c3 73 20 8
e 4c 88 ca 94 db 29
48 c9 e2 b6 9e 3
.s .L....)H....
0330 63 ca 38 7a 9
4 8f dd 38 37 c3 7c
ac 69 e7 5c ad c
.8z...87.|.i.\.
0340 70 d4 ab 33 3
6 01 8c 42 96 89 78
2d 27 21 42 51 p
..36..B..x-'!BQ
0350 bc 55 b4 9b 6
e a6 9b 7a a4 1b fb
97 29 c7 64 d6 .
U..n..z....).d.

0360 ea d9 df 1e d
9 69 12 0b 1e 28 28
13 0e 95 55 48 .
....i...((...UH
0370 61 d6 11 87 e
4 25 5a 9f 45 ca 11
2d 31 60 0c f8 a
....%Z.E..-1`..
0380 63 30 5c e4 1
a 2f e9 ae 8e 98 10
a2 e3 0a 15 57 c
0\../.........W
0390 ac 1b a9 4f 1
e a7 fb 6c e7 b3 14
b2 5c a4 b6 6e .
..O...l....\..n
03a0 41 91 67 70 e
e 3c 27 39 05 ec 78
ea e4 2e 2a 9a A
.gp.<'9..x...*.
03b0 8f b4 cd 13 b
8 ee 15 15 f0 71 99
73 26 61 c0 dc .
........q.s&a..
03c0 ec 71 2f 8c 6
7 18 f0 6b 66 bf b8
ff fb 92 04 ee .
q/.g..kf.......
03d0 0f f3 37 33 5
2 83 4f 42 e0 5f e6
6a 60 69 85 5c .
.73R.OB._.j`i.\
03e0 0c 50 a9 4a 0
d e1 29 81 87 14 e9
01 97 a5 30 21 .
P.J..).......0!
03f0 54 0b 24 b1 f
9 76 30 51 cd b7 ee
32 29 c9 8a 38 T
.$..v0Q...2)..8
0400 54 50 e3 0d a
4 85 89 4a a6 d1 4d
9b 51 19 de d6 T
P.....J..M.Q...
0410 36 ea 4b f1 4
f 3f 8d ae da 91 2b
14 33 15 29 22 6
.K.O?....+.3.)"
0420 14 f3 cd a5 8
7 ea 9a 58 f7 4c f5
83 fe 69 62 e5 .
......X.L...ib.
0430 a7 ce d2 9d 4
7 89 eb e6 6e ca cc
6d 64 d9 f7 6e .
...G...n..md..n
0440 ee ed 62 9d a
f 7f 7e d7 62 7a 9e
5c 05 07 02 41 .
.b...~.bz.\...A
0450 40 44 5e 2a e
a ce de bb 19 fc c5
de 93 14 1e 12 @
D^*............
0460 62 34 b0 b3 6
b 06 33 61 93 2d 0b
38 30 e6 6f 16 b
4..k.3a.-.80.o.
0470 30 40 70 a1 9

9 d0 a0 e1 87 41 86
46 2d c6 da 9c 0
@p......A.F-...
0480 fc 45 d7 89 c
a ea 53 d4 88 40 90
ba 06 a3 59 45 .
E....S..@....YE
0490 29 73 36 36 0
d 6a 15 c3 f3 82 89
c1 94 b0 83 21 )
s66.j.........!
04a0 04 38 86 65 c
2 3b d5 9c 6a 18 7b
3b 5e 96 ab 93 .
8.e.;..j.{;^...
04b0 f8 aa 4c 58 a
4 a5 16 fd bd eb 33
c8 00 65 88 0d .
.LX......3..e..
04c0 9a e2 87 20 5
9 8d 36 9e a9 f2 f6
45 c0 da 57 09 .
.. Y.6....E..W.
04d0 0b 8a a9 e9 5
4 c7 10 bd 6d 12 cc
c2 91 74 f6 48 .
...T...m....t.H
04e0 a8 c2 f7 1e 1
d 1b 12 d3 dc aa 64
f6 2f 43 6a 2b .
.........d./Cj+
04f0 64 55 69 d3 c
8 5c 71 9a 9e c7 23
0f ba d8 e9 4a d
Ui..\q...#....J
0500 57 a6 97 ad b
9 cc 9b 4b 0f 34 31
11 53 43 d2 9f W
......K.41.SC..
0510 47 52 6d ff 4
3 17 a1 07 09 18 d8
a9 b4 a9 99 b9 G
Rm.C...........
0520 c1 ab
.
.
No. Time
Source
Destination
Protocol
Length Info
4 0.142005000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=2521
Ack=1 Win=46 Len=12
60
Frame 4: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0

(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.191935000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.191935000 s
econds
[Time delta fro
m previous captured
frame: 0.071007000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07100700
0 seconds]
[Time since ref
erence or first fra
me: 0.142005000 sec
onds]
Frame Number: 4
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco

m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf176 (61814)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab4 [validatio
n disabled]
[Good: Fals
e]
[Bad: False

]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 2521, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 2521 (relative
sequence number)
[Next sequence
number: 3781 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set

Window size val

ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x05e
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 76 4
0 00 31 06 3a b4 4a
7c 0c 8a c0 a8 .
..v@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 6c 06 9e
87 4e aa 50 10 .
..P..+.l...N.P.
0030 00 2e 05 e8 0
0 00 8c ab 41 cf 1d
2a 46 0e 09 1a .
.......A..*F...
0040 02 21 58 44 4
5 5b d4 b3 c4 c5 c2
03 4b 47 19 fe .
!XDE[......KG..
0050 7b 1e 28 7a 2
f 23 b6 f5 be b3 89
f2 93 00 ca 3c {
.(z/#.........<
0060 eb b6 b3 6a 0
b 96 61 5f 56 6d 64
c5 a0 ca dd 9d .
..j..a_Vmd.....
0070 62 fa cb d5 9
8 98 fb cd 22 52 6f
34 4d e6 3f ac b
......."Ro4M.?.
0080 0d ff fb 92 0
4 e7 8f f2 ef 28 52
83 58 7a 50 60 .
........(R.XzP`
0090 a5 3a 30 67 0
c 4c 0b b0 a5 4a 0d
e1 29 81 73 14 .
:0g.L...J..).s.
00a0 e8 c1 a7 b1 3
0 3b bf 0f c5 b6 ae
bf a4 cb 00 d3 .
...0;..........
00b0 9c ed 24 33 0
3 8d 33 7c c6 94 ec
b8 b0 d8 0d 87 .
.$3..3|........

00c0 98 83 93 75 d
a 1c 35 54 07 3a a5
70 6c 37 30 31 .
..u..5T.:.pl701
00d0 3b 5f 91 91 4
e b3 1e 58 42 ec 85
cf 19 ac f0 71 ;
_..N..XB......q
00e0 c6 ad 1e 6a 4
4 89 1a f0 5e b7 53
1b 8f bc b5 ac .
..jD...^.S.....
00f0 c4 a6 37 ed 3
6 08 84 c0 87 c6 a6
35 a6 e9 03 bd .
.7.6......5....
0100 a4 54 b5 53 9
2 bb d0 a2 26 24 4e
63 6d 26 b6 8e .
T.S....&$Ncm&..
0110 77 83 c4 24 0
3 cc 66 eb 16 af a0
d0 0a 58 8f 92 w
..$..f......X..
0120 c2 d8 23 50 5
e 12 d8 cb 25 d7 c6
67 b2 a5 59 1b .
.#P^...%..g..Y.
0130 64 a4 d6 90 5
9 c6 6b d2 78 07 b9
6c 41 12 e4 25 d
...Y.k.x..lA..%
0140 69 25 ba 16 4
b 7f 8d 13 2a 89 d4
cc 57 e8 11 e6 i
%..K...*...W...
0150 73 4e b1 59 4
7 34 47 d2 ed ea c2
99 00 0b 8a 98 s
N.YG4G.........
0160 13 3c da 2a 4
6 14 4b 58 82 7c f5
be ae dd 26 50 .
<.*F.KX.|....&P
0170 99 93 d2 72 4
2 17 70 c6 a2 31 07
44 8a 17 94 38 .
..rB.p..1.D...8
0180 83 28 21 62 1
0 8e 05 1c 9f 82 10
25 7b ed 02 95 .
(!b.......%{...
0190 96 ba 55 38 2
e c3 ba d0 65 f3 2d
76 cc 30 23 28 .
.U8....e.-v.0#(
01a0 2d 8e a3 b2 e
9 2b 89 77 31 8d ce
db c4 ae 78 a4 ....+.w1.....x.
01b0 58 62 27 6c d
3 dd 50 8e bb 36 e7
ab bd 3f 5e d8 X
b'l..P..6...?^.
01c0 b4 a9 90 d1 5
1 08 06 38 71 8d 0e
8e 36 bc ef b1 .
...Q..8q...6...
01d0 bf d0 0b 14 1

8 3b 08 e1 a0 7d 89
c3 0a 8d 0b 98 .
....;...}......
01e0 45 42 ab bb 0
6 3c 38 01 aa 48 a3
b3 7d 37 1c a2 E
B...<8..H..}7..
01f0 96 55 8d 4d 5
5 99 80 e9 a7 a3 14
8c 62 9d c3 61 .
U.MU.......b..a
0200 29 e1 83 c6 3
c 6b cb 04 d0 41 d2
f6 23 f7 af 10 )
...<k...A..#...
0210 ed 37 54 ca c
c 70 eb af 9c 65 2c
41 7e ac 55 72 .
7T..p...e,A~.Ur
0220 ba 5d 5f ff f
b 92 04 ea 0f f2 ee
28 d2 83 78 7a .
]_........(..xz
0230 50 5b a4 6a 3
0 65 ef 4a 0c c0 a5
46 0d bd 89 81 P
[.j0e.J...F....
0240 8e 13 a8 81 a
c 31 28 28 5b 3c a7
f3 b7 ad 11 76 .
....1(([<.....v
0250 8e 17 7f df d
9 50 52 41 95 3e 0e
f6 6c 0f 1c 63 .
....PRA.>..l..c
0260 a7 6c 50 91 2
9 d1 e1 2c b9 5d 14
11 90 ae b7 76 .
lP.)..,.].....v
0270 4a 8e 51 68 0
e 15 21 6e 32 18 36
06 97 6e b4 aa J
.Qh..!n2.6..n..
0280 19 86 ee d5 a
9 75 a1 e3 21 fc 09
20 7b 61 f6 a2 .
....u..!.. {a..
0290 c4 9d a6 b9 5
a 47 68 aa 1f 0f 0f
57 19 f5 7a 7b .
...ZGh....W..z{
02a0 bb ee e1 be a
e 2c d6 d9 3a c1 73
01 41 76 77 df .
....,..:.s.Avw.
02b0 77 29 bb 28 0
d 05 31 d5 33 46 66
33 30 f3 4d 27 w
).(..1.3Ff30.M'
02c0 0e 1c 36 49 d
8 71 7d 98 f8 e0 19
a5 67 9e 7e af .
.6I.q}.....g.~.
02d0 65 62 cd 0c b
6 d4 c4 b3 51 1a 1c
76 b6 a4 50 8a e
b......Q..v..P.
02e0 52 20 52 c7 9
7 45 ab af 0c d8 8a

f8 a8 96 d7 77 R
R..E.........w
02f0 9d 9b 7e 22 b
a 05 6b 5a b4 ee ec
96 81 1e 96 8f .
.~"..kZ........
0300 5a 5b 18 91 c
f e3 7b cc ba dd b5
e1 0a c5 2a 2c Z
[....{.......*,
0310 d6 f3 bf b2 d
5 98 32 26 ce c8 08
a9 d0 44 71 d5 .
.....2&.....Dq.
0320 9c 42 03 c9 1
f a4 c1 46 71 d8 55
0e 6a 33 24 74 .
B.....Fq.U.j3$t
0330 ec be b1 98 1
6 c4 01 06 4f c2 2b
63 8d 67 d9 7a .
.......O.+c.g.z
0340 33 78 62 9c 8
7 45 77 30 79 9a 59
13 af 67 87 23 3
xb..Ew0y.Y..g.#
0350 4d e9 df 49 3
4 d8 8a e7 ba b8 7e
cc f2 7a 8a 81 M
..I4.....~..z..
0360 9c 1f 26 1c 2
a 39 42 84 90 c3 4b
ae 60 a1 56 21 .
.&.*9B...K.`.V!
0370 fb bd ba ea 2
2 35 34 54 11 6f 43
cf 12 39 32 a0 .
..."54T.oC..92.
0380 74 11 d6 d1 1
1 05 a6 80 81 2c c1
06 1d 11 7b e7 t
........,....{.
0390 23 53 bf 69 d
6 d3 d3 22 97 da ad
0b 99 1c 04 76 #
S.i...".......v
03a0 17 06 2e 5b a
3 00 63 73 0d 92 80
dd 02 d5 09 35 .
..[..cs.......5
03b0 cb 40 81 33 8
6 29 3e 74 aa 61 f4
18 4d 97 fc a5 .
@.3.)>t.a..M...
03c0 ab 4d d1 bc 2
d ff fb 92 04 e7 8f
f2 fd 29 51 83 .
M..-........)Q.
03d0 78 62 60 5e 4
5 2a 10 6b 0b 4c 0c
28 af 46 0d e1 x
b`^E*.k.L.(.F..
03e0 e9 81 78 91 2
8 01 ac bd 28 62 e4
d4 b0 f5 ac 84 .
.x.(...(b......
03f0 6c a1 11 1a 3
2 d5 e8 0e aa 71 78
9c c7 01 e6 0e l

...2....qx.....
0400 89 c3 4e 74 9
8 5a f6 84 42 04 5f
42 37 81 33 b5 .
.Nt.Z..B._B7.3.
0410 32 de 67 07 b
f 57 9d ba f4 f0 7e
74 d1 d8 c3 8a 2
.g..W....~t....
0420 d4 a6 ce 40 6
4 51 3c b9 98 3a e8
a5 8a d9 d9 21 .
..@dQ<..:.....!
0430 5b c2 b6 2b 0
b 3a 87 06 07 91 01
fa fc f6 bf a6 [
..+.:..........
0440 63 70 94 42 7
3 8b 8a 06 eb 74 ff
95 7b e9 07 01 c
p.Bs....t..{...
0450 9a 29 31 a9 3
9 9c 62 a0 76 21 9e
0b 1d c3 8b 8a .
)1.9.b.v!......
0460 d6 cc 20 18 d
3 99 7e 39 0d 0b b1
68 8d f8 e3 50 .
. ...~9...h...P
0470 a9 05 4e f2 8
b 56 a5 2a cc 94 72
68 42 fa 21 b0 .
.N..V.*..rhB.!.
0480 27 8d d5 3b c
1 14 ca 89 d2 ef 0c
b3 af 47 b4 b0 '
..;.........G..
0490 24 b5 3d ea b
1 a9 d0 3a ec 3a ef
21 e1 b5 d4 27 $
.=....:.:.!...'
04a0 b8 ae e2 e6 0
3 7a cb 31 51 71 6f
bf b6 a3 06 04 .
....z.1Qqo.....
04b0 49 b1 aa 50 7
4 0b 1a 21 20 98 49
60 b9 12 85 0e I
..Pt..! .I`....
04c0 06 07 15 a5 0
e 0e 33 be e9 0f 26
a4 89 50 42 6a .
.....3...&..PBj
04d0 de 8e 39 97 6
8 21 d8 31 8b bd bd
87 29 18 53 d9 .
.9.h!.1....).S.
04e0 04 62 ed 93 2
a 5b 45 9c 07 6e 33
6e 63 2a bf 5a .
b..*[E..n3nc*.Z
04f0 a5 4c f0 ab b
a 2c 66 9f 2c 35 7b
9f 85 f2 02 20 .
L...,f.,5{....
0500 45 a4 00 75 2
c 64 2e 2c 4f 9e 7d
49 6b 08 d6 e7 E
..u,d.,O.}Ik...

0510 ff d7 31 23 b
3 2d 4c 33 91 b0 da
c3 34 1b 30 e0 .
.1#.-L3....4.0.
0520 13 75
.
u
No. Time
Source
Destination
Protocol
Length Info
5 0.142197000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=3781 Win=39690 Len
=0
Frame 5: 54 bytes o
n wire (432 bits),
54 bytes captured (
432 bits) on interf
ace 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.192127000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.192127000 s
econds
[Time delta fro
m previous captured
frame: 0.000192000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00019200
0 seconds]
[Time since ref
erence or first fra
me: 0.142197000 sec
onds]
Frame Number: 5
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype

:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab

le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f17 (20247)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 3781,
Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 3781 (re
lative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .

... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39690
[Calculated win
dow size: 39690]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 4]
[The RTT to
ACK the segment wa
s: 0.000192000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 17 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 70 f2 50 10 .
....P..N.+.p.P.
0030 9b 0a 18 d4 0
0 00
.
.....
No. Time
Source

Destination
Protocol
Length Info
6 0.145997000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
458 http49
574 [PSH, ACK] Seq=
3781 Ack=1 Win=46 L
en=404
Frame 6: 458 bytes
on wire (3664 bits)
, 458 bytes capture
d (3664 bits) on in
terface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.195927000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.195927000 s
econds
[Time delta fro
m previous captured
frame: 0.003800000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00380000
0 seconds]
[Time since ref
erence or first fra
me: 0.145997000 sec
onds]
Frame Number: 6
Frame Length: 4
58 bytes (3664 bits
)
Capture Length:
458 bytes (3664 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),

Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
44
Identification:
0xf177 (61815)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3e0b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 3781, Ack: 1,
Len: 404
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 404]
Sequence number
: 3781 (relative
sequence number)
[Next sequence
number: 4185 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x60f
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 404]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 bc f1 77 4
0 00 31 06 3e 0b 4a
7c 0c 8a c0 a8 .
..w@.1.>.J|....
0020 01 0b 00 50 c
1 a6 2b c8 70 f2 9e
87 4e aa 50 18 .
..P..+.p...N.P.
0030 00 2e 60 f9 0
0 00 2e 5d ce 28 54
30 c2 52 b2 12 .
.`....].(T0.R..
0040 09 b7 7f e1 e
9 a9 64 11 17 8c 3a
71 78 2a 25 8c .
.....d...:qx*%.
0050 dc 52 95 3c e
1 49 c5 05 07 39 75
99 c1 b4 9b 5a .
R.<.I...9u....Z
0060 5d 42 63 63 b
c 66 c5 24 49 56 dc
19 fd 30 f7 2c ]
Bcc.f.$IV...0.,
0070 0c bf 11 b1 9

6 ac c3 cd 71 98 7f
ff fb 92 04 e7 .
.......q.......
0080 8f f2 f8 29 5
0 83 78 62 60 57 04
99 f0 6b 0f 4a .
..)P.xb`W...k.J
0090 0b f0 a3 40 0
d e5 e9 41 91 91 67
81 ac 61 28 72 .
..@...A..g..a(r
00a0 7d 41 15 65 8
d f4 db 5f 49 95 c9
d2 61 8a f8 b3 }
A.e..._I...a...
00b0 01 13 9f c7 9
1 26 80 a0 71 22 21
c0 33 16 b4 12 .
....&..q"!.3...
00c0 82 04 59 f2 c
e 2f ca 15 24 53 75
86 a1 98 5c 4a .
.Y../..$Su...\J
00d0 02 9b ab 38 f
e b5 39 71 c9 d4 04
ac e1 59 48 11 .
..8..9q.....YH.
00e0 92 7c 9f 5c 3
5 c8 e6 b6 de ba 91
82 ed a9 66 8b .
|.\5.........f.
00f0 c6 7a d9 2e a
4 83 e9 3d 33 02 b7
dd 29 99 e7 16 .
z.....=3...)...
0100 b6 0a b3 e9 b
6 bf a4 28 04 56 21
e7 8c 62 d4 9e .
......(.V!..b..
0110 f0 a6 44 a0 1
9 01 69 54 1c 0c 0c
52 35 4e 3a 44 .
.D...iT...R5N:D
0120 ae 35 0c b4 2
7 1d 69 a6 43 d6 a0
cc 06 14 a4 5e .
5..'.i.C......^
0130 e8 61 7a 30 f
4 c0 53 51 40 23 22
a0 4e 45 81 56 .
az0..SQ@#".NE.V
0140 a5 6d 82 f1 b
d a1 b5 42 6b 20 97
cd 35 d2 b3 0e .
m.....Bk ..5...
0150 70 a3 66 f0 a
1 e5 70 e1 7c 3d dd
a9 8c ee ba f2 p
.f...p.|=......
0160 79 24 90 ec f
f f8 b3 5b ff d0 60
00 8c a4 4c 60 y
$.....[..`...L`
0170 2a 33 b2 18 c
c 81 15 31 08 2e f9
6d cb 36 a6 a3 *
3.....1...m.6..
0180 22 a5 a7 88 1
7 e9 cf 5c e9 69 36

d3 99 eb f6 86 "
......\.i6.....
0190 af 7b a0 bd 1
a 5a 03 19 c8 8c 0c
51 10 13 91 00 .
{...Z.....Q....
01a0 7e d6 9d 8b 1
3 2e 12 aa 4c 63 c9
bd 3e a6 56 6d ~
.......Lc..>.Vm
01b0 fb 14 6c e5 f
4 7a b5 3c de d8 40
c1 01 63 a5 31 .
.l..z.<..@..c.1
01c0 a5 8e 4a aa a
a d7 fe 95 8a aa
.
.J.......
No. Time
Source
Destination
Protocol
Length Info
7 0.193888000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=4185
Ack=1 Win=46 Len=12
60
Frame 7: 1314 bytes
on wire (10512 bit
s), 1314 bytes capt
ured (10512 bits) o
n interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.243818000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.243818000 s
econds
[Time delta fro
m previous captured
frame: 0.047891000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04789100
0 seconds]
[Time since ref
erence or first fra
me: 0.193888000 sec
onds]
Frame Number: 7
Frame Length: 1

314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf178 (61816)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 4185, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 4185 (relative
sequence number)

[Next sequence
number: 5445 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd41
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1664]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 78 4
0 00 31 06 3a b2 4a
7c 0c 8a c0 a8 .
..x@.1.:.J|....

0020 01 0b 00 50 c
1 a6 2b c8 72 86 9e
87 4e aa 50 10 .
..P..+.r...N.P.
0030 00 2e d4 1f 0
0 00 14 43 30 a2 53
99 1a 3a f1 b3 .
......C0.S..:..
0040 39 1c 12 30 4
4 f2 10 85 2d 51 f0
8e 86 98 bf 34 9
..0D...-Q.....4
0050 de 8b 38 c3 0
3 10 8b 1c 2b b0 ce
5c 1d e5 e2 62 .
.8.....+..\...b
0060 5c af 43 c4 4
1 5e 7c 18 98 a3 23
17 0a 21 d0 40 \
.C.A^|...#..!.@
0070 66 79 c6 46 1
6 89 7e 0f 2d da c6
6d fc 5e 7d ca f
y.F..~.-..m.^}.
0080 90 35 86 3e a
d 82 20 e0 30 ff fb
92 04 e9 8f f2 .
5.>.. .0.......
0090 f5 28 d0 83 7
8 7a 50 5e 24 ba 10
67 2f 4a 0c 64 .
(..xzP^$..g/J.d
00a0 99 42 0d 65 e
9 41 7d 10 68 01 ac
3d 28 12 32 43 .
B.e.A}.h..=(.2C
00b0 78 66 e4 49 f
f fa 04 13 c3 08 1e
72 06 4c b9 8c x
f.I.......r.L..
00c0 14 62 56 03 0
9 8c 0c 40 1c 6c 53
ea 3a 09 0b c7 .
bV....@.lS.:...
00d0 0e 2d 97 79 0
7 90 e9 00 c4 57 b3
b9 04 be 4d 3d .
-.y.....W....M=
00e0 fa ae db a2 c
4 5c 42 18 a5 54 1f
12 0a 23 91 41 .
....\B..T...#.A
00f0 7a 82 94 14 7
d 01 7b 03 8f d1 71
3e fc ef 9f 69 z
...}.{...q>...i
0100 d1 a3 6e 31 8
c b7 03 37 a5 b3 73
be 00 d1 d4 c5 .
.n1...7..s.....
0110 11 72 d0 86 a
7 58 70 20 0b 4c 52
47 b6 0d 61 01 .
r...Xp .LRG..a.
0120 c3 5c 34 f5 0
1 2e f9 0d 21 64 4d
5f ce ea e6 4e .
\4.....!dM_...N
0130 55 26 f2 27 d

3 da ce 92 fd aa 39
6d 99 de 75 a5 U
&.'......9m..u.
0140 21 83 7f 8c 5
5 b4 a0 f8 3c cf b6
56 24 36 47 ed !
...U...<..V$6G.
0150 6e da d9 5e 3
f a4 8f 59 1f ba 64
dd e0 47 ab f8 n
..^?..Y..d..G..
0160 b2 59 fe ad 2
c 80 e0 58 4d 0e 30
7b 04 6b f7 ef .
Y..,..XM.0{.k..
0170 dd be df fb 7
e 4d 11 45 4b 44 67
58 24 50 85 51 .
...~M.EKDgX$P.Q
0180 32 4c cb 19 d
2 c2 4b 90 4a f3 ac
04 7a 3e 1a 3e 2
L....K.J...z>.>
0190 51 bf ca a8 d
6 33 66 72 38 61 cb
a8 9a f0 c3 24 Q
....3fr8a.....$
01a0 36 81 05 70 3
2 bd d8 0f 0c d0 de
6f 58 f8 a3 a3 6
..p2......oX...
01b0 15 b3 ab df 8
1 65 77 ee bc 00 4c
1c 14 38 5c 30 .
....ew...L..8\0
01c0 d1 e9 11 83 e
4 46 48 3c b8 5a b5
d9 20 ee ff ff .
....FH<.Z.. ...
01d0 ff f9 3a 11 0
0 f5 22 3c b4 e5 ab
22 56 36 46 ad .
.:..."<..."V6F.
01e0 6d 07 cb 8d c
8 80 95 70 bc 7c 6e
01 f1 3d 8b 17 m
......p.|n..=..
01f0 cc 74 82 5b 1
3 e3 d3 a1 d1 08 0c
28 20 1c 94 a6 .
t.[.......( ...
0200 62 71 fc dd c
6 b6 5b 74 f1 db 71
88 17 48 7c f7 b
q....[t..q..H|.
0210 59 7d eb 23 c
3 ed db a6 e4 01 00
b5 64 0f 9f 0b Y
}.#........d...
0220 9a 0b be 11 b
1 0f b3 20 e2 84 04
ff fb 92 04 e8 .
...... ........
0230 8f f2 e2 22 5
0 83 6f 62 50 5f 64
f9 f0 6b 0c 4a .
.."P.obP_d..k.J
0240 0c 04 8b 4a 0
c e1 e9 41 73 10 69

41 9c 31 28 6b .
..J...As.iA.1(k
0250 7c 4c fa 20 4
3 9e 82 f3 97 17 f4
a4 61 b1 81 d0 |
L. C.......a...
0260 78 a9 e4 6e 5
b ee a7 30 81 00 99
1a 30 40 b9 b1 x
..n[..0....0@..
0270 71 41 fa 32 7
5 e2 4c cc 32 0f 9b
2b 3b 22 12 08 q
A.2u.L.2..+;"..
0280 08 9c 10 e7 6
7 cd 73 ea 49 ec 6c
3d 20 5a e2 6c .
...g.s.I.l= Z.l
0290 c4 22 18 c4 3
b 6f ee d1 11 71 6e
4f 7c 3a 76 11 .
"..;o...qnO|:v.
02a0 15 07 c1 f0 8
b 1a f3 e1 88 3e 40
4e 07 03 87 e0 .
........>@N....
02b0 fa fb 69 67 8
9 f5 3b e9 28 db 3f
40 77 02 94 09 .
.ig..;.(.?@w...
02c0 42 38 e2 65 3
7 19 aa 6c 11 82 80
e9 3a dd 59 a1 B
8.e7..l....:.Y.
02d0 15 b7 66 c8 2
2 b2 71 74 cd 18 45
18 af 2f 0a a1 .
.f.".qt..E../..
02e0 bd bf ac 40 9
4 4c 6b 3d f7 c9 ab
74 37 5b 6d fc .
..@.Lk=...t7[m.
02f0 cb 75 38 01 2
6 d6 79 a2 63 c6 18
54 c3 9d 73 e7 .
u8.&.y.c..T..s.
0300 de 4c f5 07 2
2 31 57 20 3c f7 be
d5 29 e6 c5 c5 .
L.."1W <...)...
0310 9b 6a d9 09 b
d 3c 73 08 ca 0d 20
46 49 41 1c a4 .
j...<s... FIA..
0320 54 2e 30 ab 6
2 2e 50 47 6d 46 2b
b1 70 99 f5 3c T
.0.b.PGmF+.p..<
0330 13 8b b5 f1 3
9 14 c5 b4 42 53 0c
a6 ab ca 46 b3 .
...9...BS....F.
0340 f7 96 e2 15 7
b ba 80 14 b4 34 15
31 22 f2 56 b4 .
...{....4.1".V.
0350 80 20 18 02 a
8 e3 f9 67 e7 98 13
48 b1 79 c5 87 .

.....g...H.y..
0360 49 d9 8b 34 2
a f2 6e 79 f6 ee 13
ef 7e 65 a8 10 I
..4*.ny....~e..
0370 d5 41 18 50 e
f eb ee fd 3c 69 bf
b6 45 b9 97 4c .
A.P....<i..E..L
0380 69 b0 40 64 5
c a0 63 31 b5 67 2c
6f b5 0a 9d c5 i
.@d\.c1.g,o....
0390 b1 e4 8d 72 b
2 27 ef 24 d2 e7 15
a3 11 29 42 61 .
..r.'.$.....)Ba
03a0 0b 6c 57 10 6
a a0 21 d1 5f 3c d2
65 4b ef 79 e6 .
lW.j.!._<.eK.y.
03b0 97 df cc ff c
b 22 e7 83 41 98 1f
3c c4 ba 77 87 .
...."..A..<..w.
03c0 df 5c fb 5c 7
d fb df d6 aa 99 ff
ce 0e ff fb 92 .
\.\}...........
03d0 04 eb 0f f3 2
1 2d d7 03 0c 32 60
60 85 ba f0 61 .
...!-...2``...a
03e0 26 4c 0b b0 9
f 64 07 a4 c9 41 5c
10 ec c0 f4 99 &
L...d...A\.....
03f0 28 17 08 7e f
f ed 84 8e 15 d2 46
0c 98 f3 1b e7 (
..~......F.....
0400 c9 ee b2 cc 7
8 1c 9f 8a e8 70 60
5d 12 59 4f 94 .
...x....p`].YO.
0410 76 ef b9 47 3
9 98 16 62 fa b8 7f
11 2f b1 29 78 v
..G9..b..../.)x
0420 cf d9 e3 4b 7
6 89 b6 93 46 97 90
37 67 1b eb fc .
..Kv...F..7g...
0430 7c fd fc b4 7
5 89 1a b6 a7 98 58
d3 c3 63 d4 49 |
...u.....X..c.I
0440 27 0c 54 a7 0
2 8c 0b 45 fb 60 06
d2 85 b8 6c ba '
.T....E.`....l.
0450 0e 0a ea 30 c
4 9f 40 e1 41 cd 2a
05 51 51 51 a5 .
..0..@.A.*.QQQ.
0460 64 2d 79 b6 4
9 88 19 36 e7 f2 42
68 a9 41 13 d2 d
-y.I..6..Bh.A..

0470 68 54 b1 3b 4
c 69 04 c6 0e 32 85
31 ea d9 f4 30 h
T.;Li...2.1...0
0480 97 c8 f8 55 e
c 8c a7 70 d7 df ad
f9 58 47 e6 5b .
..U...p....XG.[
0490 3d 9a 9d de 8
5 55 ed ec ee ab 5d
d5 ac 8a d9 4a =
....U....]....J
04a0 97 dd 90 b7 2
d 93 d1 2d f9 3d 59
cb 65 67 a5 76 .
...-..-.=Y.eg.v
04b0 3e c6 b0 5b 7
4 ab 6d 8a 6b 83 9b
59 21 99 66 73 >
..[t.m.k..Y!.fs
04c0 d2 46 6c e0 4
3 ed 2d f4 52 34 8d
3f f0 ed 26 b8 .
Fl.C.-.R4.?..&.
04d0 92 14 8e 4e e
3 e6 d4 ed 5b 10 2a
61 d3 9d 7e 8e .
..N....[.*a..~.
04e0 54 5d f8 67 f
0 f7 da f5 ff da cb
e6 42 38 58 2a T
].g........B8X*
04f0 65 0e 60 1f 1
7 6c c5 06 c5 e8 1a
62 8b 98 21 4a e
.`..l.....b..!J
0500 9c 54 d0 ab 9
0 28 12 75 13 e8 40
68 df 55 90 39 .
T...(.u..@h.U.9
0510 43 c7 1e 6d e
f 30 55 6f 04 64 c9
35 18 2b f0 88 C
..m.0Uo.d.5.+..
0520 f2 86
.
.
No. Time
Source
Destination
Protocol
Length Info
8 0.194066000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=5445 Win=41265 Len
=0
Frame 8: 54 bytes o
n wire (432 bits),
54 bytes captured (
432 bits) on interf
ace 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.243996000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.243996000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 0.194066000 sec
onds]
Frame Number: 8
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek

C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f18 (20248)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False

]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 5445,
Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 5445 (re
lative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41265
[Calculated win
dow size: 41265]
[Window size sc

aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 7]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 18 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 77 72 50 10 .
....P..N.+.wrP.
0030 a1 31 18 d4 0
0 00
.
1....
No. Time
Source
Destination
Protocol
Length Info
9 0.223622000
Netgear_2e:1a:0
9
Broadcast
HomePlug
AV 60 MAC Manag
ement, Get Bridge I
nformations Confirm
ation
Frame 9: 60 bytes o
n wire (480 bits),
60 bytes captured (
480 bits) on interf
ace 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.273552000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615213.273552000 s
econds
[Time delta fro
m previous captured
frame: 0.029556000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02955600
0 seconds]
[Time since ref
erence or first fra
me: 0.223622000 sec
onds]
Frame Number: 9
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:homeplug-av]
[Coloring Rule
Name: Broadcast]
[Coloring Rule
String: eth[0] & 1]
Ethernet II, Src: N
etgear_2e:1a:09 (20
:0c:c8:2e:1a:09), D
st: Broadcast (ff:f
f:ff:ff:ff:ff)
Destination: Br
oadcast (ff:ff:ff:f
f:ff:ff)
Address: Br
oadcast (ff:ff:ff:f
f:ff:ff)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f
actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Netgear
_2e:1a:09 (20:0c:c8
:2e:1a:09)
Address: Ne
tgear_2e:1a:09 (20:
0c:c8:2e:1a:09)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: Homeplug
AV (0x88e1)
HomePlug AV protoco
l
MAC Management
Header
.... ...1 =
Version: 1.1 (1)
Type: Get B
ridge Informations
Confirmation (0x602
1)
.... ..
01 = LSB: Confirm (
0x01)
.... .0
0. = MSB: STA - Cen
tral Coordinator (0
x00)
Fragmentati
on Info: 0x0000
.... 00
00 = Fragment count
:0
0000 ..
.. = Fragment index
:0
Fragmen
t Sequence number:
0
Get Bridge Info
rmations Confirmati
on
Bridging: T
rue
Bridge Term
inal Equipement Ide
ntifier: 5
Number of s
tations: 4
Bridged Des
tination Address: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1)
Bridged Des
tination Address: A
pple_86:da:3d (04:e
5:36:86:da:3d)
Bridged Des
tination Address: H
onHaiPr_be:71:b9 (8
4:4b:f5:be:71:b9)
Bridged Des
tination Address: H
onHaiPr_c9:0e:4a (0
0:1f:3a:c9:0e:4a)
0000 ff ff ff ff f
f ff 20 0c c8 2e 1a
09 88 e1 01 21 .
..... ........!
0010 60 00 00 01 0
5 04 90 01 3b d0 17
e1 04 e5 36 86 `
.......;.....6.
0020 da 3d 84 4b f
5 be 71 b9 00 1f 3a
c9 0e 4a 00 00 .

=.K..q...:..J..
0030 00 00 00 00 0
0 00 00 00 00 00 00
00
.
...........
No. Time
Source
Destination
Protocol
Length Info
10 0.336007000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=5445
Ack=1 Win=46 Len=12
60
Frame 10: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.385937000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.385937000 s
econds
[Time delta fro
m previous captured
frame: 0.112385000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11238500
0 seconds]
[Time since ref
erence or first fra
me: 0.336007000 sec
onds]
Frame Number: 1
0
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]

[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00

)
Total Length: 1
300
Identification:
0xf179 (61817)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 5445, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 5445 (relative
sequence number)
[Next sequence
number: 6705 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)

000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb3d
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 79 4
0 00 31 06 3a b1 4a
7c 0c 8a c0 a8 .
..y@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 77 72 9e
87 4e aa 50 10 .
..P..+.wr..N.P.
0030 00 2e b3 d7 0
0 00 59 b7 63 c5 d4
67 b5 39 44 41 .
.....Y.c..g.9DA
0040 45 cc 90 19 b
1 0b 0f 29 23 33 ab
4d 26 1e b0 de E
......)#3.M&...

0050 1c 1b 52 1e b
4 39 92 39 14 7b ee
eb 53 37 5a 5d .
.R..9.9.{..S7Z]
0060 5c 8f 3a b5 b
c 96 67 9b 77 fc 8a
f8 db e7 cc 5f \
.:...g.w......_
0070 93 71 d3 7a b
f e1 99 06 ad d7 31
63 49 64 98 e6 .
q.z......1cId..
0080 f5 86 55 ff f
b 92 04 ed 0f f3 24
37 d9 03 0f 1a .
.U.......$7....
0090 e2 5d 25 8b 3
0 3d 86 4c 0c 8d 67
64 0c 24 4d c9 .
]%.0=.L..gd.$M.
00a0 6f 11 ec c1 8
7 99 28 bb a8 9d 6c
96 b7 68 f8 25 o
.....(...l..h.%
00b0 f0 07 85 d4 4
2 72 4d 0f 28 a7 09
c2 7e 54 5d 4e .
...BrM.(...~T]N
00c0 3e cc f8 e7 9
9 fd a2 4d 12 36 25
93 76 64 8e f6 >
......M.6%.vd..
00d0 9b 6f 8a e1 0
e bf 17 d4 0b 66 94
f9 f6 de 75 66 .
o.......f....uf
00e0 52 b3 90 bd 5
6 cb b0 0a 22 91 8e
4e e8 a7 9b 4e R
...V..."..N...N
00f0 87 be ac e5 c
d 7d 36 d7 f5 44 97
ae c8 29 cb 2a .
....}6..D...).*
0100 51 d2 0e d7 3
5 7a c8 23 31 43 56
12 d0 48 25 43 Q
...5z.#1CV..H%C
0110 2a 48 15 39 8
7 d3 85 db 62 cd 1d
3b 04 96 03 ad *
H.9....b..;....
0120 a9 b1 b5 05 8
b ed 9d c9 fb 84 07
27 bb 6d 72 25 .
..........'.mr%
0130 6b 07 ca aa e
3 08 25 1e c5 6d 47
cb 77 27 2c 9d k
.....%..mG.w',.
0140 fb 57 e6 bf c
0 1a bc b4 90 02 26
b7 93 e7 dd ff .
W........&.....
0150 ea ef ee 09 c
d 9c 61 b6 dc e2 ae
3c b3 2d 3b 66 .
.....a....<.-;f
0160 df d2 74 c2 f

f f1 6d 13 fc 8d e9
fe 2f ff a0 70 .
.t...m...../..p
0170 13 54 d8 c7 2
f 44 2c 9e 9d 61 7e
43 65 34 af c9 .
T../D,..a~Ce4..
0180 11 ea 5e e4 0
1 56 dc fd 4e 77 0d
46 a5 35 75 1a .
.^..V..Nw.F.5u.
0190 c6 e6 35 ec 5
5 40 24 3c 4f 21 5b
1d d9 e4 c4 eb .
.5.U@$<O![.....
01a0 19 dd cb b8 3
8 3d 34 99 94 fd b5
99 18 76 79 9d .
...8=4......vy.
01b0 ee 6a 2d 3a 0
d 5d 32 c7 e8 48 b9
96 30 c8 54 92 .
j-:.]2..H..0.T.
01c0 92 2a e4 45 4
4 cb 81 a2 eb 84 0f
05 c4 19 cb 22 .
*.ED.........."
01d0 c6 ca 2a 77 a
1 b5 d4 1c 78 e4 18
e1 4a 13 a5 f9 .
.*w....x...J...
01e0 8c cf 95 0c c
5 a9 67 5d bb 7f 8d
fa 99 5b fc ea .
.....g].....[..
01f0 d6 bf 52 b9 6
4 ab 07 06 88 81 b1
4a b4 1d b5 8e .
.R.d......J....
0200 de 66 37 f9 6
a 64 49 2a 44 02 05
aa 61 61 23 d4 .
f7.jdI*D...aa#.
0210 4a 2d a5 97 9
1 58 f0 cb 46 a0 82
e5 0d 58 1e 43 J
-...X..F....X.C
0220 8f a0 ca 9e 7
d ff fb 92 04 eb 0f
f3 03 33 d8 83 .
...}........3..
0230 0f 1a e2 5d 8
9 cb 20 3d e2 5e 0c
34 83 60 0c 3d .
..].. =.^.4.`.=
0240 29 49 8e 96 6
c 00 fc 19 30 60 73
c8 17 6d 5a 48 )
I..l...0`s..mZH
0250 a1 d0 fb 33 9
5 2d bf 42 88 71 d2
66 18 10 03 44 .
..3.-.B.q.f...D
0260 e1 50 ce 46 0
5 f4 57 b0 49 3e 20
c6 60 89 1f 7e .
P.F..W.I> .`..~
0270 2c 2d f7 e1 d
a 8d c5 14 70 8e 04

12 e9 2f e9 e7 ,
-......p..../..
0280 b4 ab de 6f a
8 61 a3 4e 18 44 b5
ed fc 12 64 5c .
..o.a.N.D....d\
0290 1a 70 68 cc 0
e d1 65 d6 34 d1 07
3c 22 2c 2a 35 .
ph...e.4..<",*5
02a0 8c 44 50 38 4
6 46 58 95 43 c0 c1
9b 29 5e 9f 26 .
DP8FFX.C...)^.&
02b0 cf 54 3a e1 a
e 21 a3 36 67 75 7b
62 88 4f d4 63 .
T:..!.6gu{b.O.c
02c0 c6 51 ce 4a 6
5 30 c5 3e ad 3f bc
cf ea d2 e5 95 .
Q.Je0.>.?......
02d0 b9 74 8f 44 6
b 18 12 12 4e 6a 7d
7f 7f 39 db 9f .
t.Dk...Nj}..9..
02e0 5f 61 bb 43 1
8 cc fd 21 80 ab 16
f3 e0 d1 43 80 _
a.C...!......C.
02f0 b1 61 ee c1 7
a 85 61 97 93 59 65
99 3c 48 82 c1 .
a..z.a..Ye.<H..
0300 20 bb 45 98 9
2 14 bc 20 cc 5f 25
b9 30 b7 93 42
.E.... ._%.0..B
0310 d6 fa c1 6c 5
a 0e 93 ac 56 bf 2a
19 24 3e c9 1c .
..lZ...V.*.$>..
0320 77 33 56 0a 8
4 4c 21 db a2 66 f4
ac 5d da 7b 45 w
3V..L!..f..].{E
0330 8d 15 85 f4 0
4 54 07 9a c0 75 1f
d6 39 89 67 6c .
....T...u..9.gl
0340 f9 85 32 47 0
4 49 d2 7c bf ff eb
3e fa dd aa 9f .
.2G.I.|...>....
0350 de 61 b6 14 9
7 23 10 ac 34 85 bc
54 e1 81 ec 73 .
a...#..4..T...s
0360 cf 2d 6b 13 4
e bf 40 b3 e3 55 b8
be b5 6a 96 da .
-k.N.@..U...j..
0370 8a 6e 08 f6 b
6 d5 24 db 43 00 16
e2 4f aa 9a f6 .
n....$.C...O...
0380 82 5c 62 6a f
1 05 ee a2 5c f8 70
75 88 11 37 b8 .

\bj....\.pu..7.
0390 0a ad d7 34 5
6 67 83 d8 fc bd cb
ca 8f d4 d2 cf .
..4Vg..........
03a0 38 6f ff 64 c
a a7 16 3c 51 85 8c
41 30 2b 0e 00 8
o.d...<Q..A0+..
03b0 dc 2a 26 3a 5
9 b6 cb d5 48 68 f3
87 bd 85 44 95 .
*&:Y...Hh....D.
03c0 50 a5 c9 15 c
c b4 4d ff fb 92 04
e8 0f f2 f1 21 P
.....M........!
03d0 58 03 18 42 5
0 5c 84 eb 10 3d e8
4a 0b e8 8d 5e X
..BP\...=.J...^
03e0 0c 60 c9 41 7
e 97 ec 01 87 99 30
6a d8 75 cc 42 .
`.A~.....0j.u.B
03f0 6b af 2a 6e 0
7 5a e5 42 68 05 b9
29 98 47 cb fa k
.*n.Z.Bh..).G..
0400 f6 98 8c 4b 4
2 5c 14 3e 25 a0 4d
16 f0 35 bc e5 .
..KB\.>%.M..5..
0410 6b 3b ae db e
e b1 80 4a ea 50 e6
8a 2e b7 9a 57 k
;.....J.P.....W
0420 69 7d 26 c7 1
a bc 94 ea a6 5c 47
3b 53 7d c3 5d i
}&......\G;S}.]
0430 a2 b7 9d 81 c
4 27 52 4e d1 a0 30
92 e0 53 cd 01 .
....'RN..0..S..
0440 0f 08 a4 81 d
3 48 a0 22 ba ca 8a
3d ee 45 95 1d .
....H."...=.E..
0450 1e e9 8b 1d d
6 99 f7 2c 99 84 58
56 b7 00 0b 28 .
......,..XV...(
0460 1d 13 16 14 c
b 78 20 c0 d4 89 83
f0 93 df af a2 .
....x .........
0470 66 b6 f1 5f 8
9 22 04 c1 d6 49 a2
43 42 41 35 ab f
.._."...I.CBA5.
0480 54 9d 96 91 6
e a3 bb d7 89 79 83
94 04 60 34 2a T
...n....y...`4*
0490 6d 6f 28 3c d
9 b0 5d 70 60 fb 98
09 09 4f 8a b4 m
o(<..]p`....O..

04a0 05 59 27 ba b
9 a6 87 4a a5 c3 de
d8 c7 a2 e2 ae .
Y'....J........
04b0 53 41 de 06 e
a b9 0b 84 43 cc 85
52 f8 56 0a 62 S
A......C..R.V.b
04c0 ac c9 43 67 8
8 a4 05 e4 d4 66 1c
5b cc b0 7d b3 .
.Cg.....f.[..}.
04d0 5d 67 18 98 4
2 8e a5 aa 42 2b a6
2e 5b 29 62 d7 ]
g..B...B+..[)b.
04e0 fb 9a e8 91 e
e 83 c5 40 20 a9 db
56 6d 81 70 a0 .
......@ ..Vm.p.
04f0 24 58 59 c3 8
b 1d 4b 56 e3 a9 29
b0 b3 8e 0a d6 $
XY...KV..).....
0500 75 6e 0e b5 9
3 98 ad 2a 17 6a 5a
ce 51 0f 2e eb u
n.....*.jZ.Q...
0510 11 72 52 08 e
8 42 d8 aa a2 82 82
2a cd 12 49 4c .
rR..B.....*..IL
0520 a5 f6
.
.
No. Time
Source
Destination
Protocol
Length Info
11 0.342008000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
868 http49
574 [PSH, ACK] Seq=
6705 Ack=1 Win=46 L
en=814
Frame 11: 868 bytes
on wire (6944 bits
), 868 bytes captur
ed (6944 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.391938000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615213.391938000 s
econds
[Time delta fro
m previous captured
frame: 0.006001000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00600100
0 seconds]
[Time since ref
erence or first fra
me: 0.342008000 sec
onds]
Frame Number: 1
1
Frame Length: 8
68 bytes (6944 bits
)
Capture Length:
868 bytes (6944 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
54
Identification:
0xf17a (61818)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c6e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]

[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 6705, Ack: 1,
Len: 814
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 814]
Sequence number
: 6705 (relative
sequence number)
[Next sequence
number: 7519 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa52
7 [validation disab
led]

[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2074]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 56 f1 7a 4
0 00 31 06 3c 6e 4a
7c 0c 8a c0 a8 .
V.z@.1.<nJ|....
0020 01 0b 00 50 c
1 a6 2b c8 7c 5e 9e
87 4e aa 50 18 .
..P..+.|^..N.P.
0030 00 2e a5 27 0
0 00 90 20 56 8b 35
22 ab ba c5 4c .
..'... V.5"...L
0040 e1 8b b3 db a
d 87 71 b5 9c a2 8b
2f b5 65 10 27 .
.....q..../.e.'
0050 9b 77 84 f4 b
b bd c4 33 b6 57 9b
6c 3c 75 e5 56 .
w.....3.W.l<u.V
0060 f6 7f 38 db a
d bb 4e 75 2c 3f 61
f5 ac b0 e7 e3 .
.8...Nu,?a.....
0070 5c 50 fc a8 2
e 3d a5 07 3e 19 41
44 46 ff fb 92 \
P...=..>.ADF...
0080 04 ea 0f f2 e
f 20 d7 03 0f 4a 50
62 a5 5a f0 3d .
.... ...JPb.Z.=
0090 eb 4c 0c 30 8
5 5a 0c 3d 09 41 67
90 ab c0 f7 a1 .
L.0.Z.=.Ag.....
00a0 28 95 2a 75 0
5 95 da 26 8a c5 8c
c2 12 0c 49 14 (
.*u...&......I.
00b0 ec 19 59 cb 9
e ea 26 55 0c 17 a6
30 56 c9 dc a8 .
.Y...&U...0V...
00c0 1a 0f 6c 67 1
0 dd ac 6e 77 3d da
cc a2 92 5b 21 .
.lg...nw=....[!
00d0 01 19 88 ee 4
3 bf cd 89 fa df 3a
4b 6e e1 ed ec .
...C.....:Kn...
00e0 22 c8 a4 f5 b
e 44 0e 3c 6b 03 24

92 34 1d 3a f4 "
....D.<k.$.4.:.
00f0 bf 8e 6b 64 4
0 6b 17 0e 30 ad 31
29 40 55 0a 3a .
.kd@k..0.1)@U.:
0100 d3 ff c7 ce a
b eb 82 54 a9 a8 0d
7d 33 54 28 2a .
......T...}3T(*
0110 a6 0e 30 38 2
e 6a a1 60 84 c1 b9
d7 9d 33 6b 67 .
.08.j.`.....3kg
0120 5d ea b3 96 3
8 55 bd f0 74 c4 ce
18 6a 6e c5 ee ]
...8U..t...jn..
0130 c0 f9 65 bc a
a 02 3a 8a 77 30 55
31 d5 0c 80 d7 .
.e...:.w0U1....
0140 12 20 32 cb 2
a f5 52 3d 71 92 cc
b2 5a fa 7f a7 .
2.*.R=q...Z...
0150 2b 5d 1e 80 f
4 55 65 e8 a0 9e b2
07 45 52 94 cc +
]...Ue.....ER..
0160 52 b5 9d 61 7
9 5e ce bd 1d c4 71
2d 2f 01 aa 00 R
..ay^....q-/...
0170 20 bd 93 f5 3
e ba 81 02 8a dc dc
3c ba e9 2d ee
...>......<..-.
0180 55 cb 98 e1 4
f 67 e4 33 13 78 72
bd 0d 85 81 f2 U
...Og.3.xr.....
0190 6d da 86 a8 5
3 c4 7e ee 0c 67 50
76 d4 5b af 6c m
...S.~..gPv.[.l
01a0 9d 89 ef 6c 7
b a5 8e 64 67 f3 b0
21 1a 2a 30 a5 .
..l{..dg..!.*0.
01b0 bc 81 76 87 4
0 e5 c1 b2 a1 78 a5
87 e9 50 a9 71 .
.v.@....x...P.q
01c0 22 9a 59 09 d
5 62 24 4f 71 40 ed
56 e9 4d d1 d0 "
.Y..b$Oq@.V.M..
01d0 1a c6 07 12 5
f aa 44 04 bc 8b 91
6a 3b 57 4b 06 .
..._.D....j;WK.
01e0 89 ca b6 f3 2
5 1d db 15 f2 a7 8a
f7 e8 f5 ab b1 .
...%...........
01f0 b2 12 f1 90 2
a c2 13 a3 db e3 0a
51 95 09 fe d8 .

...*......Q....
0200 f7 f5 50 dc 8
a bf 76 2b 25 22 e9
18 33 5d cb c5 .
.P...v+%"..3]..
0210 7e a3 b7 bd 6
1 04 a5 c2 17 16 6b
3a 4b 50 3c ff ~
...a.....k:KP<.
0220 fb 92 04 eb 0
f f3 11 2a d6 03 18
32 60 5a e4 6a .
......*...2`Z.j
0230 d0 63 09 4a 0
c 31 0d 58 0c 60 4b
81 96 15 ab 00 .
c.J.1.X.`K.....
0240 fc 2d 30 a3 e
9 57 fb ee 95 3d 49
00 a5 97 21 61 .
-0..W...=I...!a
0250 0d d0 1c e2 8
a e8 b0 1d 50 41 dc
25 61 6f 22 dd .
.......PA.%ao".
0260 0d 91 fc 57 3
6 59 f2 e5 0b 5b 6f
15 1a 6d 01 a8 .
..W6Y...[o..m..
0270 a0 68 41 7d 8
8 cc 31 48 0f ff 0d
d7 02 3a 3d 39 .
hA}..1H.....:=9
0280 a5 30 b8 e2 b
6 ee 66 9d 5a 8a 95
b1 f6 36 96 fb .
0....f.Z....6..
0290 0b ce a2 8b d
1 24 54 8d ec c2 a0
1b 91 ec e4 7e .
....$T........~
02a0 84 f5 0a b0 d
e 50 7d 09 94 a9 54
a9 7f 32 24 6e .
....P}...T..2$n
02b0 93 5c 20 81 1
4 e0 67 8d c5 44 49
65 6a 76 57 0a .
\ ...g..DIejvW.
02c0 de b7 5f 75 6
5 d7 13 26 60 16 00
85 5c 03 82 1f .
._ue..&`...\...
02d0 d5 75 d2 29 2
d a2 e7 f7 fa 8c bf
45 f3 5a 80 c8 .
u.)-......E.Z..
02e0 d2 c5 09 81 c
e b4 4e 81 87 53 7b
dc 05 a5 49 bd .
.....N..S{...I.
02f0 68 11 30 cb 2
9 46 2e fb da 84 bb
2b ee 3d d3 a3 h
.0.)F.....+.=..
0300 ae 1d 32 a8 b
b ef c0 d0 d3 0c cc
29 3a 46 3b 55 .
.2........):F;U

0310 69 09 0c d0 6
4 58 b4 01 e4 df bf
6e 7a 5d 5f 98 i
...dX.....nz]_.
0320 d7 ce ec ba b
6 37 e9 1f 68 62 a9
e1 8e 0b 8c e8 .
....7..hb......
0330 8c 02 26 68 0
b 23 23 f3 32 3e b2
51 6a 75 aa 79 .
.&h.##.2>.Qju.y
0340 37 ad 5b 33 2
5 52 92 49 36 ac d1
60 fa 05 56 1c 7
.[3%R.I6..`..V.
0350 d1 6a 28 8b 0
7 14 a5 0b bb 4a dc
16 7d 2c b4 fb .
j(......J..},..
0360 76 f4 0a 2a
v
..*
No. Time
Source
Destination
Protocol
Length Info
12 0.342165000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=7519 Win=41265 Len
=0
Frame 12: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.392095000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.392095000 s
econds
[Time delta fro
m previous captured
frame: 0.000157000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00015700
0 seconds]

[Time since ref

erence or first fra
me: 0.342165000 sec
onds]
Frame Number: 1
2
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f19 (20249)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 7519,
Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]

[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 7519 (re
lative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41265
[Calculated win
dow size: 41265]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 11]
[The RTT to
ACK the segment wa
s: 0.000157000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64

78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 19 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 7f 8c 50 10 .
....P..N.+...P.
0030 a1 31 18 d4 0
0 00
.
1....
No. Time
Source
Destination
Protocol
Length Info
13 0.475014000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=7519
Ack=1 Win=46 Len=12
60
Frame 13: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.524944000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.524944000 s
econds
[Time delta fro
m previous captured
frame: 0.132849000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13284900
0 seconds]
[Time since ref
erence or first fra
me: 0.475014000 sec
onds]
Frame Number: 1
3
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:

1314 bytes (10512

bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))

0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf17b (61819)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aaf [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 7519, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 7519 (relative
sequence number)
[Next sequence
number: 8779 (re
lative sequence num

ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x572
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 7b 4
0 00 31 06 3a af 4a
7c 0c 8a c0 a8 .
..{@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 7f 8c 9e
87 4e aa 50 10 .

..P..+.....N.P.
0030 00 2e 57 20 0
0 00 4b 55 29 03 12
03 91 05 00 1e .
.W ..KU).......
0040 2e e7 a6 6b 4
3 15 06 fe e4 39 01
44 70 f5 2b a8 .
..kC....9.Dp.+.
0050 a5 32 b9 6c a
1 ed 79 b2 b3 d9 16
38 bd ae a9 50 .
2.l..y....8...P
0060 a7 a5 f1 eb e
a 1a 9c c5 30 21 fe
30 ad ef e4 b9 .
.......0!.0....
0070 f9 66 27 25 8
a e7 73 f8 c1 82 63
c5 83 20 30 8e .
f'%..s...c.. 0.
0080 d1 84 98 e7 b
b 5b d4 e2 4f a1 e3
95 75 2d 60 dd .
....[..O...u-`.
0090 f7 e9 f7 ff f
b 92 04 e8 0f f2 c0
21 d6 03 18 4a .
..........!...J
00a0 50 57 85 0a d
0 3d e8 4a 0c 08 87
54 0c 61 29 41 P
W...=.J...T.a)A
00b0 89 95 aa c1 8
c 35 30 af 7e b5 65
4e ba e2 c9 4c .
....50.~.eN...L
00c0 85 e4 63 9a b
4 19 40 90 ee cc f1
06 17 0b b5 1c .
.c...@.........
00d0 a6 0e dd eb 3
2 88 ed 6c b1 b7 0a
c7 18 76 42 ac .
...2..l.....vB.
00e0 5f 95 16 7c 5
3 67 a8 4e cd e1 1a
7b b4 8a b9 27 _
..|Sg.N...{...'
00f0 dc b1 b5 9e c
7 8c f8 1b f6 89 4f
ac fc 5f e3 ca .
.........O.._..
0100 14 1c a3 58 1
0 54 62 92 8e 98 9d
eb ad 45 84 50 .
..X.Tb......E.P
0110 da 98 69 50 5
a 87 4f 48 3f a6 d2
49 d1 a9 7e 86 .
.iPZ.OH?..I..~.
0120 94 2f a0 bb 4
5 a2 18 c0 e4 a4 da
13 50 a5 5d db .
/..E.......P.].
0130 18 d0 ac dc e
f 66 35 14 b6 fe 94
ba 86 e5 ac a4 .
....f5.........

0140 f8 65 09 85 a
9 8b d3 b5 21 53 02
a6 0d b5 7c 7b .
e......!S....|{
0150 7d aa 6f af 2
c 6a e2 91 35 36 9a
af 9f 89 38 a0 }
.o.,j..56....8.
0160 a2 0e c3 a7 4
a 02 ee 12 2d 2a 3c
a8 a5 5a 99 db .
...J...-*<..Z..
0170 a8 65 c3 3b a
4 b7 f5 ff 47 4b 05
03 01 34 89 82 .
e.;....GK...4..
0180 45 15 29 00 4
1 93 90 5d 9a 63 36
39 e4 60 c6 91 E
.).A..].c69.`..
0190 a7 a5 35 9b b
f 3f 5e 62 d4 cc 9e
ee 53 b1 76 e3 .
.5..?^b....S.v.
01a0 8a 3a 75 27 4
c ab 44 47 de 0a e2
4c e4 90 cf 8e .
:u'L.DG...L....
01b0 d6 b5 9c dd 7
1 e9 da b1 6d d2 34
4c 6e b8 cf 97 .
...q...m.4Ln...
01c0 fd 48 17 0d 8
2 a1 a1 18 65 af 2d
65 96 68 7d 5c .
H......e.-e.h}\
01d0 3e 99 0c f5 0
c ba c4 ff f1 b5 4e
43 24 35 6f 1e >
.........NC$5o.
01e0 51 c2 4b d5 4
c 28 0d 49 0a 06 51
65 68 9b 25 f9 Q
.K.L(.I..Qeh.%.
01f0 84 43 f0 62 5
2 af 29 ec 23 c5 e1
87 2c d4 6e 95 .
C.bR.).#...,.n.
0200 b9 94 0a f7 b
8 76 3c 92 14 51 f0
f0 48 ca cf 21 .
....v<..Q..H..!
0210 9c 91 06 5f e
9 77 bb 64 e9 d2 26
bc 28 3c 94 74 .
.._.w.d..&.(<.t
0220 a4 92 45 2d f
d f6 bf a4 39 19 d6
32 37 72 19 8f .
.E-....9..27r..
0230 ff a5 68 18 8
3 ff fb 92 04 ed 8f
f2 fc 21 d4 83 .
.h..........!..
0240 59 62 50 64 4
4 ca 90 63 0f 4a 0b
7c 87 50 0c 65 Y
bPdD..c.J.|.P.e
0250 e9 41 7f 13 a

a 41 8c 3d 28 8c 90
25 d8 65 6a 6c .
A...A.=(..%.ejl
0260 23 95 b5 02 1
8 aa 8f b4 88 a9 d0
d8 12 f9 53 d6 #
.............S.
0270 5e 5a 6c 20 c
5 bb 10 b3 49 00 4f
63 f1 56 85 15 ^
Zl ....I.Oc.V..
0280 51 cd 04 96 5
c ca 80 44 4c de f8
c9 c3 85 91 4b Q
...\..DL......K
0290 79 f7 66 8d f
0 72 d3 3d 8f 5f c6
bc 6c 3c da 47 y
.f..r.=._..l<.G
02a0 ac 44 19 1c 1
9 15 2a 39 85 68 78
a3 ea d3 c7 31 .
D....*9.hx....1
02b0 ec 62 3b 67 6
b a3 4a 0e ff f4 0a
02 0e 1a 2c 34 .
b;gk.J.......,4
02c0 5a 20 60 a0 7
1 a3 2b d1 79 05 42
a6 59 58 ce 21 Z
`.q.+.y.B.YX.!
02d0 87 70 d8 96 e
3 8c 0c 49 8c ea cd
0d 0d 37 8e 72 .
p.....I.....7.r
02e0 7e 6a 20 ea b
4 ed 1f 4c 65 b9 23
0a 29 36 49 f6 ~
j ....Le.#.)6I.
02f0 17 73 d6 2d d
6 a3 7c 29 62 7e da
fe db f0 7f f3 .
s.-..|)b~......
0300 e3 78 d7 b6 e
4 fa cd 23 8a 9f 6b
4d b2 e7 3f 3f .
x.....#..kM..??
0310 cb 7e ca 16 b
e 99 6d 6d 5b 29 7d
ad fa 18 01 6a .
~....mm[)}....j
0320 2e 14 9e 86 4
c a4 c3 99 95 02 40
2f 9d 33 88 15 .
...L.....@/.3..
0330 64 1e 03 b4 0
c 2c 1a 0a 76 96 61
11 a4 38 6f 3c d
....,..v.a..8o<
0340 39 10 7e 5d 6
9 93 57 20 cb b8 10
42 d4 23 31 20 9
.~]i.W ...B.#1
0350 a7 0b d7 7b b
2 fc ac de 0f 9f 7f
04 ea b6 f2 b9 .
..{............
0360 8f af 12 36 f
1 4f 6d c0 85 0c 84

40 ee 6a b6 ea .
..6.Om....@.j..
0370 2a cf db dc 2
b 24 4b e6 fb 0b a3
ec d4 44 00 11 *
...+$K......D..
0380 07 70 a6 cc 2
6 90 24 5e 18 1f 91
9a 08 11 1c 14 .
p..&.$^........
0390 ce b0 04 b2 3
d 23 4f 5a 4e 0f 6a
fd 46 e7 c5 a5 .
...=#OZN.j.F...
03a0 96 c3 f4 6c c
6 8e 3d 1e 89 3f 4b
2e 6c d1 11 0a .
..l..=..?K.l...
03b0 66 52 72 4d a
d 5f 9c 25 db de 47
fc 91 4d f1 4f f
RrM._.%..G..M.O
03c0 7d e1 bf 15 d
3 2e be f1 5f 3f 89
72 00 10 5c 37 }
......._?.r..\7
03d0 49 c2 f5 be b
3 2c c7 ff fb 92 04
ec 8f f2 be 1e I
....,..........
03e0 d3 83 59 5a 5
0 64 64 4a 70 67 2f
4a 0c 64 9d 4c .
.YZPddJpg/J.d.L
03f0 0d 65 e9 41 7
e 92 a9 c1 9d 3d 28
ed db 63 d0 2b .
e.A~....=(..c.+
0400 f5 fa 9e f5 1
a 81 0b f8 64 4a 89
16 45 cf 35 75 .
.......dJ..E.5u
0410 c5 15 3c 26 5
7 34 32 10 8c 2d 34
ad 72 0f 5d 87 .
.<&W42..-4.r.].
0420 ad cf 18 00 3
4 b2 be be 3c d4 d4
f4 0f a9 dc 91 .
...4...<.......
0430 67 e4 28 a3 b
0 5a f7 6e 70 ed a6
ed 4c bf 0b a4 g
.(..Z.np...L...
0440 06 fd 09 ec 7
d e5 ad cb 3a 4e cd
fe 37 f7 e0 05 .
...}...:N..7...
0450 94 e0 f0 50 e
1 aa a4 ea 3d 75 ad
a2 95 cf 76 ff .
..P....=u....v.
0460 ff d4 84 82 f
c 1a 40 a7 d1 92 95
96 ac c7 b0 29 .
.....@........)
0470 0a 06 06 4a 2
8 44 42 2e 33 1c 3a
4a d6 a1 11 06 .

..J(DB.3.:J....
0480 47 99 64 82 7
4 79 15 24 fe 2e c3
e7 4d 2a 6b 6a G
.d.ty.$....M*kj
0490 6e a4 2a 9c 8
e 72 76 af 65 23 4d
33 e2 6f 02 17 n
.*..rv.e#M3.o..
04a0 50 44 9e 19 f
a fe de 4c cb 4c c5
ae a8 cd af 5d P
D.....L.L.....]
04b0 eb 1b c4 54 9
8 1c 01 7d a9 d1 dd
dc 2c 89 6f 5f .
..T...}....,.o_
04c0 f4 a2 60 41 a
0 81 48 e5 65 62 40
1a 30 4d 97 35 .
.`A..H.eb@.0M.5
04d0 21 21 98 da 7
e 8d fb 3d 54 80 43
3c 99 35 79 d4 !
!..~..=T.C<.5y.
04e0 16 ad 6f 1a 7
d 56 ce 03 7b e2 0f
07 54 7d c7 97 .
.o.}V..{...T}..
04f0 97 42 58 2e 3
d 51 53 38 64 b1 69
34 73 31 f6 34 .
BX.=QS8d.i4s1.4
0500 52 99 88 04 9
a 08 11 89 d0 73 d5
d0 52 92 5d d4 R
........s..R.].
0510 cf b3 73 a4 c
7 e7 27 a8 42 11 ff
ee f5 4a 55 7f .
.s...'.B....JU.
0520 5b 10
[
.
No. Time
Source
Destination
Protocol
Length Info
14 0.490013000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
880 http49
574 [PSH, ACK] Seq=
8779 Ack=1 Win=46 L
en=826
Frame 14: 880 bytes
on wire (7040 bits
), 880 bytes captur
ed (7040 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B

-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.539943000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.539943000 s
econds
[Time delta fro
m previous captured
frame: 0.014999000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01499900
0 seconds]
[Time since ref
erence or first fra
me: 0.490013000 sec
onds]
Frame Number: 1
4
Frame Length: 8
80 bytes (7040 bits
)
Capture Length:
880 bytes (7040 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3

b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
66
Identification:
0xf17c (61820)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c60 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]

Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 8779, Ack: 1,
Len: 826
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 826]
Sequence number
: 8779 (relative
sequence number)
[Next sequence
number: 9605 (re
lative sequence num
ber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val

ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa66
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2086]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 62 f1 7c 4
0 00 31 06 3c 60 4a
7c 0c 8a c0 a8 .
b.|@.1.<`J|....
0020 01 0b 00 50 c
1 a6 2b c8 84 78 9e
87 4e aa 50 18 .
..P..+..x..N.P.
0030 00 2e a6 69 0
0 00 5c e3 9c ba 14
9b 34 8f 08 15 .
..i..\.....4...
0040 14 65 88 e8 d
e 0c 5a 34 4c e3 b0
bb 07 ab b0 ff .
e....Z4L.......
0050 35 b0 40 2e f
e ed c0 ce 7d 6c a1
6e c0 03 92 c9 5
.@.....}l.n....
0060 80 d0 3b 11 1
6 85 cc 27 3f 6f b1
cb 9b b5 5b b0 .
.;....'?o....[.
0070 83 77 da 81 b
e ab 71 fd d0 f3 b6
ce 5e b9 1e 05 .
w....q.....^...
0080 c4 61 f0 fd 2
2 17 9c 9f a5 24 e2
47 5e ff fb 90 .
a.."....$.G^...
0090 04 ec 0f f3 2
0 25 d2 83 39 7a 50
5c e4 aa 70 63 .
... %..9zP\..pc
00a0 4f 4a 0b e8 9
5 4a 0d 69 e9 41 74
15 e9 81 9c c5 O
J...J.i.At.....
00b0 30 86 9f d4 9
8 5e df e5 0f c0 99
b4 c2 55 0b 55 0
....^.......U.U
00c0 35 0b 9e 00 b

a 75 a3 b4 d2 96 43
8e e9 1e 2b 35 5
....u....C...+5
00d0 c7 34 04 e9 7
5 04 4d 68 c6 e3 71
b8 dc 5e a6 16 .
4..u.Mh..q..^..
00e0 df 83 9d 5e c
8 6e 22 d3 8e 23 28
67 c7 67 63 42 .
..^.n"..#(g.gcB
00f0 3c 48 71 dc f
3 78 ae b7 8d 1b 52
fa c7 f6 bc 3a <
Hq..x....R....:
0100 88 c8 34 e0 0
c 58 1f 4b d4 64 4e
51 c0 77 d3 ae .
.4..X.K.dNQ.w..
0110 5c 2f 70 7f b
4 98 7f fe 40 8d 0a
ce 8c c2 5a 2c \
/p.....@.....Z,
0120 eb 2b 6c 05 9
a 48 24 8c 6e 09 df
30 54 2a 4f b2 .
+l..H$.n..0T*O.
0130 77 1e ca 12 1
c 27 46 5c 8b 92 da
38 fc 42 1f 8c w
....'F\...8.B..
0140 4a e3 0a 1e c
6 6f 21 f0 8c 46 11
f6 a2 57 bf 6c J
....o!..F...W.l
0150 92 04 b3 37 e
6 35 6a fa f8 dc 91
2e c1 5a 43 f1 .
..7.5j......ZC.
0160 21 c0 db 24 7
9 59 f8 2e 1b c4 a2
30 7c b0 48 88 !
..$yY.....0|.H.
0170 2c 24 ff d2 3
a 70 08 80 ce 6a ec
cd 58 91 2d f6 ,
$..:p...j..X.-.
0180 6a ea a0 cf e
7 a0 b2 dc bf ec 4e
04 22 24 14 dd j
.........N."$..
0190 e7 d6 c4 33 2
f 9b 94 46 e9 25 f1
85 e6 de 98 43 .
..3/..F.%.....C
01a0 d3 c7 83 69 f
e e4 33 df c0 91 ff
ab 7e 27 8b 57 .
..i..3.....~'.W
01b0 d7 93 c0 7d d
e 4b 98 79 cc f3 4f
34 78 73 f0 5c .
..}.K.y..O4xs.\
01c0 37 92 1a 1f 0
1 28 ca 81 c2 12 5d
80 77 d2 ef d0 7
....(....].w...
01d0 47 56 2a a1 6
5 4d 2c 64 9a 11 0d

5c 38 ad 75 34 G
V*.eM,d...\8.u4
01e0 03 8a 87 34 e
4 75 d4 61 a9 ba ac
46 27 51 cf 8c .
..4.u.a...F'Q..
01f0 6a ce 53 fa 6
e 6e 4d 89 e8 6d 2e
96 d4 76 98 24 j
.S.nnM..m...v.$
0200 2b 80 35 10 a
6 a6 48 ce 2c 4c d6
a6 fd 67 df 6b +
.5...H.,L...g.k
0210 6d ca 86 23 5
5 1e 39 3d 7b 32 9a
db 8d 8c 67 eb m
..#U.9={2....g.
0220 e6 fe d5 ae b
1 3f 07 04 2b 48 50
de 9b fe ff fb .
....?..+HP.....
0230 92 04 eb 8f f
3 1b 25 d3 83 39 62
50 60 04 2a 90 .
.....%..9bP`.*.
0240 63 0f 4a 0b 3
0 91 5a 0c 61 e9 41
70 12 2b 41 8c c
.J.0.Z.a.Ap.+A.
0250 3d 28 dc 8d 7
f ff a7 ff f7 24 3e
b2 0b 95 89 b1 =
(.......$>.....
0260 a3 d0 f0 db b
2 74 c7 58 cb 21 1b
83 a4 bf 0b 02 .
....t.X.!......
0270 1e 4d 50 b2 2
d 2a 63 c8 97 6a 7c
e3 02 f8 37 d0 .
MP.-*c..j|...7.
0280 d5 47 43 c7 f
1 9c d7 61 25 61 16
44 73 73 82 42 .
GC....a%a.Dss.B
0290 68 56 5c 44 d
e b2 ee de e9 db 32
d2 05 1e 3b 8b h
V\D......2...;.
02a0 07 4b a0 e8 e
1 54 4f 83 21 30 59
21 03 ad 3c 7d .
K...TO.!0Y!..<}
02b0 fb d3 b3 5e 3
0 f2 8f fc 9d 9b 37
d1 fb 1c df a4 .
..^0.....7.....
02c0 dd 48 b1 05 a
0 26 11 42 dc 5e c6
29 f8 1f 50 82 .
H...&.B.^.)..P.
02d0 86 8c 62 4b 3
9 86 96 96 20 98 35
fa f6 d2 92 3d .
.bK9... .5....=
02e0 e0 aa 12 e5 4
1 5e c6 16 76 29 e2
33 ba 92 bb 7b .

...A^..v).3...{
02f0 02 9e d9 de b
e 7c 0d f8 3a 93 7f
5a 7f e1 a1 1f .
....|..:..Z....
0300 2c 85 ea 65 5
e ab ee eb 93 fa 28
a1 4f 55 9c b9 ,
..e^.....(.OU..
0310 ad 6d 7a aa a
e 90 50 82 94 78 88
81 b8 65 9f 6a .
mz...P..x...e.j
0320 72 60 80 0a 4
5 44 25 03 71 e4 fc
a2 a4 48 26 ef r
`..ED%.q....H&.
0330 b6 69 25 53 8
f e3 bd 4d 25 cc 02
29 8c 51 2f 9c .
i%S...M%..).Q/.
0340 54 8e ea d1 6
c f7 74 d5 b3 bd 7c
aa a0 6f c1 d4 T
...l.t...|..o..
0350 9b fa d3 fd 4
a 61 16 68 6a 17 8b
3a a6 b3 52 1f .
...Ja.hj..:..R.
0360 38 dc 5e 59 2
8 df ae cb d0 fd 6f
6f 9d ee f1 6a 8
.^Y(.....oo...j
No. Time
Source
Destination
Protocol
Length Info
15 0.490182000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=9605 Win=40743 Len
=0
Frame 15: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.540112000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.540112000 s

econds
[Time delta fro
m previous captured
frame: 0.000169000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00016900
0 seconds]
[Time since ref
erence or first fra
me: 0.490182000 sec
onds]
Frame Number: 1
5
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f1a (20250)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D

st Port: http (80),

Seq: 1, Ack: 9605,
Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 9605 (re
lative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40743
[Calculated win
dow size: 40743]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an

ACK to the segment

in frame: 14]
[The RTT to
ACK the segment wa
s: 0.000169000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 1a 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 87 b2 50 10 .
....P..N.+...P.
0030 9f 27 18 d4 0
0 00
.
'....
No. Time
Source
Destination
Protocol
Length Info
16 0.541016000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=9605
Ack=1 Win=46 Len=12
60
Frame 16: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.590946000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.590946000 s
econds
[Time delta fro
m previous captured
frame: 0.050834000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05083400
0 seconds]
[Time since ref

erence or first fra

me: 0.541016000 sec
onds]
Frame Number: 1
6
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf17d (61821)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aad [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 9605, Ack: 1,
Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:

0]
[TCP Segment Le
n: 1260]
Sequence number
: 9605 (relative
sequence number)
[Next sequence
number: 10865 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb7f
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17

e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 7d 4
0 00 31 06 3a ad 4a
7c 0c 8a c0 a8 .
..}@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 87 b2 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e b7 f9 0
0 00 87 12 dc 69 84
31 54 2a 6a 02 .
........i.1T*j.
0040 6b 2d 19 03 5
f 79 85 92 2a d4 b0
aa a4 b6 2d 5a k
-.._y..*.....-Z
0050 77 0f dc 09 7
4 cd 8e e5 30 d6 62
d1 cc 1e ca a0 w
...t...0.b.....
0060 a4 16 b2 32 4
f 1e 93 98 67 ce 92
53 e1 2f 1e 25 .
..2O...g..S./.%
0070 f5 99 2b ed 5
6 ed f6 2c b7 fd 4f
de 78 21 75 2c .
.+.V..,..O.x!u,
0080 14 72 8d 52 4
9 c8 9d b5 9d 43 e4
27 53 ef 9d 22 .
r.RI....C.'S.."
0090 fd 62 a1 a1 4
7 a9 ff fb 92 04 ee
0f f3 3c 2b d6 .
b..G........<+.
00a0 83 18 7a 60 6
4 44 4a d0 61 ef 4a
0a b8 8d 5e 07 .
.z`dDJ.a.J...^.
00b0 bd e9 41 68 1
1 ab 80 f7 bd 28 e2
22 c9 d7 3a 9d .
.Ah.....(."..:.
00c0 be a7 90 0d 2
0 57 11 45 c9 69 0b
f2 3c a0 cc b9 .
... W.E.i..<...
00d0 55 95 63 72 4
5 8d b5 39 40 1a 36
da fe 70 56 a8 U
.crE..9@.6..pV.
00e0 6c 5c fb 8e 8
c 8a 39 db 23 0a 60
a5 94 24 20 cd l
\....9.#.`..$ .
00f0 24 34 53 c1 3
f a7 c2 59 87 57 d5
6d 5f 2a a1 aa $
4S.?..Y.W.m_*..
0100 7e a6 cc 3d e
a 7f 13 50 77 62 c8
52 e8 f6 dc 59 ~
..=...Pwb.R...Y
0110 4b 57 91 42 9
c 56 fe 99 55 1b ea
a8 8a 95 15 22 K

W.B.V..U......"
0120 95 80 62 3f a
9 41 0b 01 06 a0 6b
ee 0b 30 88 63 .
.b?.A....k..0.c
0130 bc 48 d1 15 4
5 f7 11 f4 98 26 7e
95 d9 b2 c1 cc .
H..E....&~.....
0140 a0 4a 70 c2 8
0 51 b9 d5 e0 d9 6c
a1 cc 89 14 0a .
Jp..Q....l.....
0150 49 2b 8c b5 e
f 25 21 1d 9a e8 99
70 2d 15 1c 27 I
+...%!....p-..'
0160 b1 c8 bc 55 f
c bd 45 9d 9a b6 a4
f8 c6 ef c7 b5 .
..U..E.........
0170 8c 9b 91 1e 7
6 7f b2 bd e3 7c 98
f3 44 a5 94 55 .
...v....|..D..U
0180 87 8d 46 7f 5
8 80 c5 b0 32 00 8a
ee 42 12 55 f4 .
.F.X...2...B.U.
0190 89 37 54 5c 7
4 a9 42 dd 89 ab 04
c5 2c 0d da 1c .
7T\t.B.....,...
01a0 65 94 ec ae b
d 0d 59 88 3a b2 ff
b1 76 cb bd 82 e
.....Y.:...v...
01b0 fa 22 94 b0 8
8 2d d5 39 af c9 ae
c6 24 72 d8 62 .
"...-.9....$r.b
01c0 a5 8c f1 ce d
5 1e 36 a3 34 19 63
39 f3 3c ce ff .
.....6.4.c9.<..
01d0 d3 ec 36 91 e
6 89 4a 0c 5e 3e 01
52 a8 f1 aa fe .
.6...J.^>.R....
01e0 9f 5d 2e 60 1
1 03 c2 32 b4 1f 74
0c 80 0e 34 60 .
].`...2..t...4`
01f0 28 19 7a 32 0
8 37 00 86 61 b6 34
ec 54 58 c5 2d (
.z2.7..a.4.TX.0200 0a 09 21 55 d
4 af ec fc 17 4d d8
8d 52 83 5a c3 .
.!U.....M..R.Z.
0210 0d 91 b9 2f 2
8 e8 04 71 e0 59 77
f8 44 3b e6 b6 .
../(..q.Yw.D;..
0220 24 f6 d8 f5 0
3 83 7f 5a fa b2 fa
2e 4a 6a d6 c3 $
......Z....Jj..

0230 36 ef d8 e6 1
3 74 dc 96 ff fb 92
04 ef 0f f3 3c 6
....t.........<
0240 23 55 83 18 7
a 50 63 44 7a b0 63
0f 4a 0b fc 8f #
U..zPcDz.c.J...
0250 4e 0c e3 09 4
1 74 11 6a 41 8c 61
28 77 53 db fc N
...At.jA.a(wS..
0260 69 bd 01 e2 5
4 95 bb 59 21 c6 89
47 08 60 a6 90 i
...T..Y!..G.`..
0270 c4 bf 45 00 b
8 a3 85 40 84 13 b8
65 81 06 81 9d .
.E....@...e....
0280 42 05 d2 6c 1
1 03 43 d3 6e a5 1d
dc 35 15 e2 4c B
..l..C.n...5..L
0290 c3 8f ad 1b f
b 14 95 0f ce aa 45
ad 34 41 b6 d8 .
.........E.4A..
02a0 23 52 d7 3b 0
8 ec 6f 59 6e 66 07
bd cc 5b 6b 98 #
R.;..oYnf...[k.
02b0 67 01 f6 63 5
7 69 be 93 f5 7d a2
68 d1 a2 32 e5 g
..cWi...}.h..2.
02c0 34 c5 9a d9 6
6 98 17 20 6b d5 9a
64 a7 38 28 28 4
...f.. k..d.8((
02d0 78 4b 71 92 6
0 e0 c9 36 02 29 fc
24 b5 1e ea 76 x
Kq.`..6.).$...v
02e0 2a 19 83 02 6
1 b2 ce c3 cb 6a 06
82 e1 fb 77 e8 *
...a....j....w.
02f0 02 a3 9d 0b 8
9 80 2b 0c 85 a5 89
d4 a3 e6 98 8f .
.....+.........
0300 f0 55 4a aa 3
d 0e 50 b9 d4 cc da
76 ef e5 41 49 .
UJ.=.P....v..AI
0310 8e 53 55 ab 5
e db a1 76 02 bf d9
0f cf 58 d4 fd .
SU.^..v.....X..
0320 ae 49 63 a6 9
9 43 00 1e 00 f3 6c
59 40 59 65 f8 .
Ic..C....lY@Ye.
0330 07 47 5d 53 9
7 68 10 92 8d 8c 31
48 b3 c6 9a cc .
G]S.h....1H....
0340 02 db 86 d9 0

d f5 cd 6a bc 8a b4
ed 02 5f cb 51 .
......j....._.Q
0350 09 f4 6b b0 c
3 86 1e e7 a4 b9 49
b6 30 29 4b 08 .
.k.......I.0)K.
0360 9c 60 d2 29 e
8 d3 d3 6f 0d 5d 9e
c7 2d 36 98 5e .
`.)...o.]..-6.^
0370 f8 86 72 4b f
d 9d fb 58 67 7f ca
23 0e 07 61 cd .
.rK...Xg..#..a.
0380 e5 37 e9 51 0
4 fb 36 e0 89 9a 9f
c1 0e b1 ba 30 .
7.Q..6........0
0390 24 51 2b 09 0
0 85 4c 16 58 c4 84
78 c0 60 8c 4d $
Q+...L.X..x.`.M
03a0 33 8c 30 16 5
0 c0 88 9e aa cd 41
af a3 20 90 10 3
.0.P.....A.. ..
03b0 db 77 48 e9 c
2 c1 aa a5 66 58 42
51 e9 33 91 be .
wH.....fXBQ.3..
03c0 40 a1 72 dd 7
a a0 57 6e 18 a0 62
32 79 65 dc b0 @
.r.z.Wn..b2ye..
03d0 e5 fa 7b 97 3
0 bd b9 4c 92 be ff
fb 92 04 ea 0f .
.{.0..L........
03e0 f3 0d 26 52 8
3 59 ca 50 5c e4 7a
70 67 38 4a 0c .
.&R.Y.P\.zpg8J.
03f0 24 8f 48 0d 6
3 29 41 75 92 29 81
9c 61 28 7f 3b $
.H.c)Au.)..a(.;
0400 f7 7f e7 bf 8
b 48 f1 37 65 0c 00
8c 9e ed 1c 43 .
....H.7e......C
0410 99 4c 01 45 3
7 02 74 42 8d a1 08
81 81 e5 89 50 .
L.E7.tB.......P
0420 7a d9 52 af 5
8 e7 4a d1 a2 10 ae
b6 19 c9 6e e6 z
.R.X.J.......n.
0430 26 ed b1 a9 b
2 51 5b 84 f3 b8 8e
ec 5a 12 0f 48 &
....Q[.....Z..H
0440 7c 20 d8 92 4
4 52 43 84 40 53 d2
0a 70 7b 42 6a |
..DRC.@S..p{Bj
0450 4c 24 a2 50 6
d 97 13 52 46 c9 9b

ca b3 b6 3f 5a L
$.Pm..RF.....?Z
0460 9d 94 cf 42 7
5 d7 72 5d 10 90 26
27 5a 06 0b c2 .
..Bu.r]..&'Z...
0470 0e e0 23 6e 5
4 35 21 24 b0 11 89
b4 a9 84 93 78 .
.#nT5!$.......x
0480 98 a1 d3 35 e
1 ad 61 f2 12 59 ea
48 bd b4 b1 a8 .
..5..a..Y.H....
0490 ac 2a 22 60 0
7 50 28 02 ab 2b 2c
80 b0 74 fa 51 .
*"`.P(..+,..t.Q
04a0 c3 09 69 87 9
8 f3 c1 8d ac 06 ea
59 64 d4 12 ba .
.i........Yd...
04b0 b4 bc a5 ee 5
7 6d 72 df 60 ab 77
72 d4 f7 d4 cb .
...Wmr.`.wr....
04c0 5f fd cb fe d
6 00 91 cd fd 4b 4c
c8 c1 14 30 f4 _
........KL...0.
04d0 1b 01 e2 a1 0
c 18 d5 e4 60 84 28
01 63 08 e0 e9 .
.......`.(.c...
04e0 49 47 05 8d 0
c ed 00 f5 74 d0 6f
4d d6 7e cc fc I
G......t.oM.~..
04f0 a9 ef b8 aa b
9 25 e3 22 67 f7 88
43 72 1a 30 03 .
....%."g..Cr.0.
0500 18 64 80 ba a
4 47 0d 01 3d 0b 61
a0 e2 1f 03 7d .
d...G..=.a....}
0510 07 48 70 a0 8
9 88 b9 52 36 8f a2
b9 89 f9 27 41 .
Hp....R6.....'A
0520 25 6e
%
n
No. Time
Source
Destination
Protocol
Length Info
17 0.639020000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1308 http49
574 [PSH, ACK] Seq=
10865 Ack=1 Win=46
Len=1254

Frame 17: 1308 byte

s on wire (10464 bi
ts), 1308 bytes cap
tured (10464 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.688950000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.688950000 s
econds
[Time delta fro
m previous captured
frame: 0.098004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09800400
0 seconds]
[Time since ref
erence or first fra
me: 0.639020000 sec
onds]
Frame Number: 1
7
Frame Length: 1
308 bytes (10464 bi
ts)
Capture Length:
1308 bytes (10464
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
294
Identification:
0xf17e (61822)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9

Protocol: TCP (
6)
Header checksum
: 0x3ab2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 10865, Ack: 1
, Len: 1254
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1254]
Sequence number
: 10865 (relativ
e sequence number)
[Next sequence
number: 12119 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1

... = Push: Set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc28
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2514]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0e f1 7e 4
0 00 31 06 3a b2 4a
7c 0c 8a c0 a8 .
..~@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 8c 9e 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e c2 8f 0
0 00 96 93 55 9d 7a
bd b4 52 63 84 .
.......U.z..Rc.
0040 24 21 86 86 6
e 06 4e d6 1c 24 60
e4 c5 ba 31 20 $
!..n.N..$`...1
0050 41 c0 70 0b 4
4 d6 44 c3 58 4d 34
fe 57 06 a9 75 A
.p.D.D.XM4.W..u
0060 42 81 4d 3b 3
4 74 ad 85 bc 95 4b
4b 95 40 9d 4d B
.M;4t....KK.@.M
0070 21 59 72 24 4
a b0 3c 66 71 47 97
75 2b 33 75 60 !
Yr$J.<fqG.u+3u`
0080 46 f7 6f 26 1
a bd aa 69 fb bb b7
ca b6 b7 10 a3 F
.o&...i........
0090 ff fb 92 04 e
a 8f f3 0e 24 52 83
59 c2 52 5f a5 .
.......$R.Y.R_.

00a0 3a 50 67 33 4
c 0c 20 9d 48 0c e7
09 41 82 14 e9 :
Pg3L. .H...A...
00b0 41 ac c9 30 b
b a2 29 20 2c 68 80
b0 2a 31 3f 50 A
..0..) ,h..*1?P
00c0 80 58 30 39 5
b a1 2d 61 e9 c4 42
c2 13 2c 31 83 .
X09[.-a..B..,1.
00d0 28 5e 30 28 0
5 00 af 21 67 d6 9a
26 33 40 7e 7a (
^0(...!g..&3@~z
00e0 4f 48 c3 0c 7
6 a1 0f ae 50 f7 13
1a 56 d7 9b a2 O
H..v...P...V...
00f0 8e f4 90 aa 2
0 fb a6 32 87 11 2a
42 dd e0 55 1b .
... ..2..*B..U.
0100 79 75 26 78 2
4 7c f9 a9 1d 5d df
6a 97 6d f2 21 y
u&x$|...].j.m.!
0110 47 43 96 ef f
b 11 18 35 6d 28 f5
3f b6 8a 1f 96 G
C.....5m(.?....
0120 ee 72 89 88 5
4 9a ea 40 63 a1 9b
42 c1 92 cc 40 .
r..T..@c..B...@
0130 20 c1 3c 7b 1
5 0f 27 96 3e 1d 42
7e 88 d0 7d 54
.<{..'.>.B~..}T
0140 5e 82 1e 8b 3
e 35 e7 ab d2 25 85
92 01 5d 24 f9 ^
...>5...%...]$.
0150 7b 88 02 50 9
8 64 9d 91 04 dd eb
c3 61 c2 7e 74 {
..P.d......a.~t
0160 ef d5 a1 cb 9
b c7 3b 17 32 fc b1
ca d6 1f fc fa .
.....;.2.......
0170 be 4e 17 16 3
2 0b f7 7d de 9e 6f
fc 62 df ff e8 .
N..2..}..o.b...
0180 a1 04 a6 70 8
1 d6 36 2c 08 b0 98
a0 70 d8 06 d4 .
..p..6,....p...
0190 12 bc 40 68 4
2 91 62 be e4 5f 8c
81 80 5e 73 95 .
.@hB.b.._...^s.
01a0 99 78 c0 69 1
9 14 a6 09 a6 97 da
96 31 ca a8 ee .
x.i........1...
01b0 fb 2f 59 12 6

4 a7 0e 00 f2 33 80
dc f8 e9 2e 88 .
/Y.d....3......
01c0 4c 75 45 71 c
a 2a 9b 32 87 7a cf
17 87 26 6c 81 L
uEq.*.2.z...&l.
01d0 16 36 6a da b
a 2f bd 6a ba d3 9b
a9 e6 4e ef e4 .
6j../.j.....N..
01e0 68 7e 54 50 1
c 44 04 40 16 05 ad
02 8d bf cd 2d h
~TP.D.@.......01f0 9d 95 13 29 8
2 ca c9 00 36 b9 29
6d 3d 16 51 0c .
..)....6.)m=.Q.
0200 c1 ce b6 d4 4
1 f2 6c 33 21 8e d2
25 a2 e9 7e 87 .
...A.l3!..%..~.
0210 a6 1a df b6 7
c 40 d5 3f f1 fb 30
08 65 0c d5 5b .
...|@.?..0.e..[
0220 ff 47 9f 62 2
a 72 de 28 08 78 b0
00 c2 09 f8 82 .
G.b*r.(.x......
0230 cd 60 ff fb 9
2 04 e8 0f f2 ed 20
52 03 79 c2 50 .
`........ R.y.P
0240 5e a4 3a 50 6
b 38 4a 0c 50 8b 48
0d 67 09 41 81 ^
.:Pk8J.P.H.g.A.
0250 15 e9 41 ac 4
5 30 4f 6c 98 a9 f2
15 2d 0b 1e b7 .
.A.E0Ol....-...
0260 50 74 22 e6 8
3 b4 0d 64 30 03 6c
38 5a c4 4d 32 P
t"....d0.l8Z.M2
0270 02 cb ea 91 1
e 0c 8a ae a0 61 e9
e2 d6 e2 7a bb .
........a....z.
0280 9c a7 0b 8b 9
f 16 e0 cc a0 77 a3
51 74 93 90 52 .
........w.Qt..R
0290 ac d7 3a 52 f
8 a2 4e 6f ab b4 fa
e1 5d fe f3 35 .
.:R..No....]..5
02a0 1e 33 b1 64 f
f 8d f1 05 ce da a1
8e 26 52 c2 c1 .
3.d........&R..
02b0 8f b1 c2 0b a
f 53 b2 9d 9a 98 99
34 03 f1 95 12 .
....S.....4....
02c0 68 48 48 39 8
6 42 82 4a 56 54 e4

94 2b 67 b8 f1 h
HH9.B.JVT..+g..
02d0 48 39 b6 18 f
a 60 a3 fa f9 f1 ac
b7 3f 30 cc 09 H
9...`......?0..
02e0 07 0c 43 89 8
9 a0 83 a5 2d d1 07
5e fa fa e3 77 .
.C.....-..^...w
02f0 f6 74 9a 4b d
a a3 ae a9 b7 eb 53
25 c4 6d 0e 4b .
t.K......S%.m.K
0300 4f c3 f9 e1 7
5 86 66 48 0b bd 09
05 16 2e 42 e3 O
...u.fH......B.
0310 40 86 64 a6 3
5 60 38 b8 a2 d2 07
50 36 2b 61 04 @
.d.5`8....P6+a.
0320 c4 57 55 81 1
3 58 e0 c0 46 46 40
f0 c7 67 a4 aa .
WU..X..FF@..g..
0330 23 1e 9f e8 b
1 a9 22 1c c6 ff df
df 37 72 9e 03 #
.....".....7r..
0340 28 24 1c 70 d
2 62 26 29 0d f8 b2
19 d0 74 a5 f5 (
$.p.b&).....t..
0350 ab 7c 65 00 b
b 84 a4 e5 ed 51 d7
54 db f5 a9 94 .
|e......Q.T....
0360 82 7c b5 ee 9
e c5 e0 2a 6f d2 24
b4 6d 77 39 06 .
|.....*o.$.mw9.
0370 4c 6e 17 26 f
3 67 1e 30 ba e3 6a
79 56 00 48 e0 L
n.&.g.0..jyV.H.
0380 48 a7 39 0c 3
c 60 39 92 28 91 05
a0 c7 19 27 8c H
.9.<`9.(.....'.
0390 26 64 49 fd 0
0 fd d3 da c1 3b 25
30 f5 59 83 57 &
dI......;%0.Y.W
03a0 c1 ec 3d b1 b
4 24 a6 cb 9e 18 61
57 09 cc 44 4d .
.=..$....aW..DM
03b0 7d a6 d8 94 4
0 22 41 57 46 67 49
49 21 57 58 76 }
...@"AWFgII!WXv
03c0 78 89 54 ae a
0 66 59 d5 07 2b 18
3c 92 83 aa 7a x
.T..fY..+.<...z
03d0 1a d0 09 e5 c
2 ff fb 92 04 e7 8f
f2 d4 1b 55 03 .

.............U.
03e0 58 79 c0 5d e
3 fa 90 67 0f 4a 0c
10 7d 58 0c 3d X
y.]...g.J..}X.=
03f0 69 41 6d 8e a
b 01 8c 2d 28 81 fe
3a ca 21 2c e8 i
Am....-(..:.!,.
0400 0f a3 68 40 4
6 61 44 2b e8 a9 51
d8 4e 15 41 de .
.h@FaD+..Q.N.A.
0410 08 a8 4a a4 4
8 1e 2a 7e e1 11 ab
62 0e 9a d1 ae .
.J.H.*~...b....
0420 6a c5 1e c1 1
c 40 e5 c2 f1 19 32
01 33 2e 2f 5e j
....@....2.3./^
0430 b6 ac da ca 9
8 e9 d7 ed 4b 12 88
04 48 2a e8 cc .
.......K...H*..
0440 ea 28 5c db a
c 3b 1e e8 c5 b9 03
e5 96 13 9a b4 .
(\..;..........
0450 ed f3 d3 da b
d 86 d6 d5 dd 22 ac
0d 14 21 58 ca .
........"...!X.
0460 c4 ce 08 41 0
d 0c 34 8a 09 70 53
fd 19 a3 22 03 .
..A..4..pS...".
0470 bc d7 e1 e7 0
5 92 cf 32 6e e5 5b
29 f9 4f dd 87 .
......2n.[).O..
0480 59 bb b2 4a 0
6 c8 a3 80 d9 d8 b4
22 b5 9a 19 b7 Y
..J......."....
0490 ba 2f 65 ce e
9 f6 3f 61 1c b8 d5
04 c8 da 3e 4d .
/e...?a......>M
04a0 59 6c ab 64 5
6 ec 04 b0 d1 8a 9b
da 54 e9 2f 2d Y
l.dV.......T./04b0 e0 24 30 a9 2
5 29 15 0c 43 f0 ca
c2 63 83 52 9a .
$0.%)..C...c.R.
04c0 00 e0 17 0f d
8 18 6a 1c 57 32 9c
12 c2 3c f5 e8 .
.....j.W2...<..
04d0 b3 7a 10 ff 5
6 b7 b4 28 72 d4 ae
09 90 5d 87 5b .
z..V..(r....].[
04e0 f7 46 54 df d
7 76 5c 6a b9 a6 e9
43 3f 3b af 76 .
FT..v\j...C?;.v

04f0 3f 5a 08 85 7
f 6a 40 b8 63 a7 47
96 fe c4 8b bb ?
Z...j@.c.G.....
0500 c6 da 82 64 6
d 1f 26 19 9a 2d 95
72 52 b2 39 6a .
..dm.&..-.rR.9j
0510 91 b6 58 f5 6
7 7f ff f5 6b f5 3e
aa
.
.X.g...k.>.
No. Time
Source
Destination
Protocol
Length Info
18 0.639201000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=12119 Win=40115 Le
n=0
Frame 18: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.689131000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.689131000 s
econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 0.639201000 sec
onds]
Frame Number: 1
8
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke

d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De

fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f1b (20251)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 12119
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 12119 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010

(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40115
[Calculated win
dow size: 40115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 17]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 1b 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 91 84 50 10 .
....P..N.+...P.
0030 9c b3 18 d4 0
0 00

.
.....
No. Time
Source
Destination
Protocol
Length Info
19 0.754027000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=12119
Ack=1 Win=46 Len=1
260
Frame 19: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.803957000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.803957000 s
econds
[Time delta fro
m previous captured
frame: 0.114826000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11482600
0 seconds]
[Time since ref
erence or first fra
me: 0.754027000 sec
onds]
Frame Number: 1
9
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule

String: http || tcp

.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300

Identification:
0xf17f (61823)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aab [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 12119, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 12119 (relativ
e sequence number)
[Next sequence
number: 13379 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set

...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x133
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 7f 4
0 00 31 06 3a ab 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 91 84 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 13 3e 0
0 00 12 02 23 5a 56
a4 a8 c0 f8 61 .
..>....#ZV....a
0040 07 58 19 a6 4
a 49 7e 34 00 82 8a
92 d8 09 6d 2d .
X..JI~4......m0050 12 b4 3c d1 4
a 9a 0a d6 c4 01 fa
4a 15 29 52 0e .

.<.J......J.)R.
0060 38 8a a1 ce 2
4 42 32 53 1f 42 4e
0a 00 2e d0 7e 8
...$B2S.BN....~
0070 33 43 70 88 e
5 03 4e 6e 14 87 96
74 fa 99 52 d6 3
Cp...Nn...t..R.
0080 71 9b 8b b2 f
4 e1 49 e7 de e6 f0
84 86 41 e3 88 q
.....I......A..
0090 08 ff fb 92 0
4 ec 0f f2 f2 15 d5
03 2f 61 c0 5c .
.........../a.\
00a0 a3 fa a0 61 e
b 4a 0b 7c 7d 46 0d
e1 69 41 97 10 .
..a.J.|}F..iA..
00b0 a8 c1 ac e1 2
8 14 58 ab f2 85 c9
b8 fe aa fe b5 .
...(.X.........
00c0 2c 0a 63 36 c
2 4d a2 63 1e 84 0c
a8 c6 59 47 43 ,
.c6.M.c.....YGC
00d0 06 a8 08 1c a
8 cd 38 8a 31 a6 a2
b1 e5 f2 22 22 .
.....8.1.....""
00e0 6d a6 cb 13 4
6 5b 2d 82 2a bd b3
8f bb 94 dc 9d m
...F[-.*.......
00f0 36 88 fc b4 6
a ae 9b 30 43 89 32
5c 89 74 95 ed 6
...j..0C.2\.t..
0100 b1 27 c2 02 c
2 c6 13 56 6d cd cd
38 d9 c5 e5 15 .
'.....Vm..8....
0110 a1 ec 30 bf 9
7 7f 1f ad 9f 95 39
f5 07 08 89 7f .
.0.......9.....
0120 fd bb a8 88 5
a b4 78 18 08 7e 54
9a da a0 6f cc .
...Z.x..~T...o.
0130 cd c5 b9 27 9
4 8a 92 45 73 4d b3
b9 3f 05 ce 66 .
..'...EsM..?..f
0140 83 09 73 41 6
6 ac c2 63 c0 96 f7
2d 5b 40 42 22 .
.sAf..c...-[@B"
0150 45 d9 4c 05 1
9 87 2d 63 96 a9 a5
9a fc b2 96 5e E
.L...-c.......^
0160 bb 96 2c c1 3
0 1f 8c fb 9d 8c f1
ee ae e1 bf b5 .
.,.0...........

0170 b0 cb ea 2c a
7 3d 60 fb f5 91 00
18 98 e8 fa 20 .
..,.=`........
0180 2a 94 cf c2 4
c 2c bc d1 46 93 1d
98 a8 13 82 af *
...L,..F.......
0190 d6 2c 2a 58 e
d 48 c2 13 3f 0b c2
90 80 4c 16 2d .
,*X.H..?....L.01a0 21 9c c1 41 d
7 a4 ce 2f ea 9d 02
08 97 17 68 74 !
..A.../......ht
01b0 af 62 92 ac 3
5 95 6a 4a b5 72 ca
a5 16 3f 32 d7 .
b..5.jJ.r...?2.
01c0 15 c4 53 b4 7
d a9 ba b2 50 38 aa
19 16 02 06 03 .
.S.}...P8......
01d0 b0 b9 e0 97 f
f e8 54 89 0a 76 10
39 e9 fb d0 db .
.....T..v.9....
01e0 05 21 35 87 5
2 36 f0 0d 04 42 13
89 76 27 03 3f .
!5.R6...B..v'.?
01f0 37 e1 ca fa 4
0 83 9b 03 ea f3 c2
33 3a 57 ea d7 7
...@......3:W..
0200 c3 c1 93 2b 0
c d1 c2 38 80 05 00
da 68 81 05 24 .
..+...8....h..$
0210 52 22 87 cb 8
3 3c 6a 58 49 11 ec
0e 4c 76 2c cd R
"...<jXI...Lv,.
0220 32 c1 b1 93 d
6 9b df 32 4a cb 5a
fa 98 96 a6 a5 2
......2J.Z.....
0230 1e 36 c9 ff f
b 92 04 ec 8f f3 2c
23 d0 03 4f 7a .
6........,#..Oz
0240 50 62 e4 8a 0
0 6b 38 4a 4a d8 93
46 0d 63 09 41 P
b...k8JJ..F.c.A
0250 73 90 68 01 b
c 61 28 a4 a3 ab ff
41 6e 4b 03 07 s
.h..a(....AnK..
0260 00 28 22 2b 1
1 0c 19 40 b8 60 1b
90 bd 5a 50 a4 .
("+...@.`...ZP.
0270 84 84 b6 a5 9
4 b7 1f aa b2 e8 72
23 59 29 20 e9 .
.........r#Y) .
0280 1e a5 b1 f1 9

e a9 bd 35 36 31 a0
cb 32 59 52 87 .
......561..2YR.
0290 28 98 0f 0b a
9 02 e1 11 2a a4 4c
15 cf 0d c3 55 (
.......*.L....U
02a0 25 24 c0 57 1
d 89 2c be 64 91 93
d6 9b de a3 89 %
$.W..,.d.......
02b0 50 d3 ea 40 b
5 4d 4b 31 7e c9 cf
ff a1 00 09 30 P
..@.MK1~......0
02c0 2c 60 87 a7 0
0 10 21 82 2e 03 5f
6b ed 7d 68 14 ,
`....!..._k.}h.
02d0 01 7f 2a 09 7
c 4d d8 93 65 03 c4
21 87 2e 05 b5 .
.*.|M..e..!....
02e0 04 f6 20 76 d
3 6d 0c e1 50 74 ae
cd 0e 07 51 10 .
. v.m..Pt....Q.
02f0 f1 34 75 26 4
d 8e 16 74 56 47 0b
0b 27 40 39 10 .
4u&M..tVG..'@9.
0300 52 27 50 29 1
b 8e ea dd 67 4c b7
73 33 4b b5 2f R
'P)....gL.s3K./
0310 51 57 64 cc 0
d 9e 93 8b 51 aa 8b
4a 14 84 50 40 Q
Wd.....Q..J..P@
0320 79 d1 43 93 0
f 51 0e 4e 8b 3f 76
d1 08 89 ac 7e y
.C..Q.N.?v....~
0330 65 97 b3 38 b
4 71 9d a3 9b ff 03
c3 ca c1 0c 45 e
..8.q.........E
0340 25 8e 41 b1 5
0 14 86 31 82 4b b8
31 37 f3 2e 06 %
.A.P..1.K.17...
0350 ba 12 fd 5e c
f 94 eb f6 77 fb 5d
25 5e 52 d9 17 .
..^....w.]%^R..
0360 52 6c ea 24 9
1 dc a9 12 99 87 6b
df 7b bd 77 bc R
l.$......k.{.w.
0370 fc 52 fe d8 9
a 86 00 80 c3 af 9b
c2 35 67 ac bd .
R..........5g..
0380 cb 61 45 53 9
c 5a 66 22 d5 6b 4c
58 7a 12 e2 10 .
aES.Zf".kLXz...
0390 5a 2e 96 50 f
4 e1 07 41 a1 87 fb

3b 7b 3b 1a 5d Z
..P...A...;{;.]
03a0 56 71 9c 95 3
8 3c 21 b8 c1 48 74
e5 2e e6 2c 71 V
q..8<!..Ht...,q
03b0 79 3e 07 57 f
b 1d 76 ec 28 7b a9
46 fb 39 bb e3 y
>.W..v.({.F.9..
03c0 14 a5 18 ad a
3 44 62 10 70 06 a7
ef 29 42 c3 f7 .
....Db.p...)B..
03d0 87 c0 64 6b 2
8 ff fb 92 04 ed 8f
f3 0d 2e d1 83 .
.dk(...........
03e0 39 92 60 61 2
5 ca 10 6f 10 4c 0b
b0 b9 48 0d e2 9
.`a%..o.L...H..
03f0 09 81 88 95 e
8 c1 ac 3d 30 4c f9
4a c0 83 57 53 .
......=0L.J..WS
0400 fe b7 d6 1e 6
7 4b 91 04 61 87 05
01 a8 35 45 44 .
...gK..a....5ED
0410 15 85 80 43 0
b 68 eb 7a 2c 6f 8e
f4 7a 93 b6 1f .
..C.h.z,o..z...
0420 ee 65 dc 97 a
b d9 90 c8 8c 0a 86
d7 ed 8e 41 84 .
e............A.
0430 07 85 06 12 0
a 44 17 06 d8 23 34
40 82 db 91 02 .
....D...#4@....
0440 06 d7 94 17 8
6 c3 2f af 3a 87 b9
c2 eb 26 a3 e1 .
...../.:....&..
0450 39 a5 8b c8 2
1 50 61 e8 6e b0 b1
72 00 4e b7 b9 9
...!Pa.n..r.N..
0460 2c 90 cb fd 0
9 2e 60 09 0a 57 62
e2 6b ad d6 76 ,
.....`..Wb.k..v
0470 5f 1d 5e 3f 0
8 83 a2 d2 f7 b3 85
50 e3 3d 64 a3 _
.^?.......P.=d.
0480 3f be aa 31 2
4 a6 15 92 9b 61 1d
8c a0 a6 ca 5e ?
..1$....a.....^
0490 b5 98 6f 65 d
9 ac 2d 22 77 ec 85
d0 4d b3 65 f8 .
.oe..-"w...M.e.
04a0 3a 99 94 9d b
c 73 25 91 a9 04 20
f2 ca fe ba 58 :

....s%... ....X
04b0 93 23 d8 69 4
6 ed 19 bf 33 d4 d7
b7 63 f8 e3 fe .
#.iF...3...c...
04c0 bf ff ff ea 8
b 97 d4 64 ec 41 bd
76 67 23 71 e6 .
......d.A.vg#q.
04d0 ea 73 70 50 f
0 aa da c3 da 08 24
c2 dd d3 55 f7 .
spP......$...U.
04e0 e1 70 e8 c4 1
4 94 0f 87 42 19 41
76 28 a8 bc 69 .
p......B.Av(..i
04f0 29 70 eb 0b 9
3 65 20 ae c4 70 b1
04 c1 f2 51 ae )
p...e ..p....Q.
0500 af 17 19 1a 1
0 21 07 b4 af 06 74
75 59 87 61 66 .
....!....tuY.af
0510 7b 6a ac fb 7
d f5 ae d9 6e 79 6f
fc 5f ff fb e6 {
j..}...nyo._...
0520 d5 21
.
!
No. Time
Source
Destination
Protocol
Length Info
20 0.788028000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
886 http49
574 [PSH, ACK] Seq=
13379 Ack=1 Win=46
Len=832
Frame 20: 886 bytes
on wire (7088 bits
), 886 bytes captur
ed (7088 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.837958000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.837958000 s

econds
[Time delta fro
m previous captured
frame: 0.034001000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03400100
0 seconds]
[Time since ref
erence or first fra
me: 0.788028000 sec
onds]
Frame Number: 2
0
Frame Length: 8
86 bytes (7088 bits
)
Capture Length:
886 bytes (7088 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
72
Identification:
0xf180 (61824)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c56 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro

l Protocol, Src Por

t: http (80), Dst P
ort: 49574 (49574),
Seq: 13379, Ack: 1
, Len: 832
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 832]
Sequence number
: 13379 (relativ
e sequence number)
[Next sequence
number: 14211 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x8a7
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks

um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2092]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 68 f1 80 4
0 00 31 06 3c 56 4a
7c 0c 8a c0 a8 .
h..@.1.<VJ|....
0020 01 0b 00 50 c
1 a6 2b c8 96 70 9e
87 4e aa 50 18 .
..P..+..p..N.P.
0030 00 2e 8a 75 0
0 00 6a 38 af f1 e2
b2 45 e5 47 0e .
..u..j8....E.G.
0040 3d f5 a3 53 6
c 9e 15 44 d2 3d 99
3a 85 d0 a0 33 =
..Sl..D.=.:...3
0050 34 73 42 f4 4
b 8c 62 c7 08 95 51
a2 c4 f1 9b 56 4
sB.K.b...Q....V
0060 89 6d fb b0 6
2 79 ce c7 96 35 bc
be 5e f7 a4 b2 .
m..by...5..^...
0070 65 df 3f ec c
f db c6 bd 56 bd 65
36 4b 5e d1 62 e
.?.....V.e6K^.b
0080 27 96 48 b0 7
8 dc 1e a6 a5 b6 b3
ff fb 92 04 eb '
.H.x...........
0090 0f f3 04 25 5
7 03 0f 62 50 62 e5
9a f0 61 e9 4c .
..%W..bPb...a.L
00a0 0b e8 a1 64 0
c 31 89 49 72 91 ac
c1 86 21 29 7a .
..d.1.Ir....!)z
00b0 49 66 57 96 a
d 24 af 35 45 12 86
91 19 4b ea 7a I
fW..$.5E....K.z
00c0 48 8c d3 a5 1
1 44 a4 55 57 df 54
fa 0b 05 f5 30 H
....D.UW.T....0
00d0 29 e8 e3 65 1
9 d3 67 15 bb 07 4c
d0 f9 a5 75 ff )
..e..g...L...u.
00e0 5a 25 bf dd 8
5 27 8c 52 89 3b 1a
de 5f 2d aa 69 Z
%...'.R.;.._-.i
00f0 2c 94 65 e3 b

b d3 3f 8f 1a e7 56
bd 65 14 e6 b5 ,
.e...?...V.e...
0100 ed 16 d4 bc f
5 7a ed b9 5b fa da
22 a1 6d ac 0c .
....z..[..".m..
0110 10 49 f4 54 4
f 4c 5e 90 58 85 a9
88 88 1e 22 2a .
I.TOL^.X....."*
0120 a7 6c 66 64 4
f 36 0f 0e 1c 27 25
50 c2 ee 42 23 .
lfdO6...'%P..B#
0130 66 91 19 2d 1
3 c7 58 72 14 97 60
de b9 e8 51 24 f
..-..Xr..`...Q$
0140 c6 dc 82 de 3
5 e5 51 86 28 bb f1
4f 6d fe fb 24 .
...5.Q.(..Om..$
0150 7f ba f4 f0 e
f 5b 2e bd f5 d9 db
36 77 b6 bb ee .
....[.....6w...
0160 2f b1 e0 b8 2
0 05 33 32 1b 7e 87
20 3a 1a bd a9 /
... .32.~. :...
0170 a1 c2 88 d1 a
d 2d 42 86 67 0b b5
db 58 b2 f8 72 .
....-B.g...X..r
0180 31 18 97 43 8
3 c6 46 91 92 a8 79
7c 32 17 1d a4 1
..C..F...y|2...
0190 47 48 99 30 5
d 84 2b c1 72 43 70
76 a1 69 46 0d G
H.0].+.rCpv.iF.
01a0 d4 04 49 47 2
0 c3 80 00 08 0e f8
86 af 3a 2a b0 .
.IG ........:*.
01b0 60 f9 82 36 d
2 d6 75 a3 99 b7 2c
23 56 c1 0e 74 `
..6..u...,#V..t
01c0 c8 7e c7 83 8
8 4a 2e e8 89 3f 56
82 ec 65 15 ef .
~...J...?V..e..
01d0 2f ff 8b bf b
b e7 fd b3 4d 02 33
ca d9 d2 d7 41 /
.......M.3....A
01e0 13 4d 80 e9 d
d 28 85 38 64 c8 50
4f 16 51 22 64 .
M...(.8d.PO.Q"d
01f0 68 fa 8a c1 a
3 48 8b 99 32 0e 3b
aa bb 82 33 ef h
....H..2.;...3.
0200 59 3b 94 a5 e
1 a3 2f d1 72 95 3a

5c c4 44 33 de Y
;..../.r.:\.D3.
0210 cb bb b6 cc 1
d 66 c6 39 af 9b aa
9b 77 51 0e 7d .
....f.9....wQ.}
0220 33 fa 73 61 4
b 0e a0 88 36 1d 68
86 ed ff fb 92 3
.saK...6.h.....
0230 04 ea 0f f2 e
3 36 d9 03 09 32 e0
62 27 fb 10 61 .
....6...2.b'..a
0240 86 5c 0b a8 d
9 62 07 a4 cb 81 8d
1b 2c 01 84 8d .
\...b......,...
0250 71 2b 40 33 2
6 59 f6 98 5d 51 ab
90 27 6a b0 69 q
+@3&Y..]Q..'j.i
0260 dd 78 85 8b 0
4 c2 9d 2a 38 fa 8d
07 0c dd 85 f3 .
x.....*8.......
0270 86 4a c5 a7 1
9 a1 f2 a5 c5 f5 27
a5 48 b1 9b ad .
J........'.H...
0280 51 ba f3 4d e
8 d2 95 c3 4d 77 93
8c 99 41 26 b1 Q
..M....Mw...A&.
0290 10 55 74 e4 3
d cd af 03 92 11 19
5e 6d 2a 59 ba .
Ut.=......^m*Y.
02a0 88 67 a4 5f a
6 58 29 ce 1c 30 0c
7d 62 03 a8 21 .
g._.X)..0.}b..!
02b0 63 e3 12 d3 d
0 f5 c3 1f 75 f2 2e
d1 68 59 f3 ea c
.......u...hY..
02c0 56 32 e6 a9 4
4 13 73 24 e1 35 1d
f5 7f 02 6d 51 V
2..D.s$.5....mQ
02d0 5a f0 9f 31 b
8 e9 b2 47 0a c4 cb
c5 58 f6 5a 49 Z
..1...G....X.ZI
02e0 1c cc 22 58 4
7 7f 20 58 13 86 ef
60 ea db b0 32 .
."XG. X...`...2
02f0 9c fc fe 4a a
7 d5 b6 29 b7 06 04
47 98 1d 7a 5e .
..J...)...G..z^
0300 27 68 c5 5a 1
0 15 79 8d cd 5b 6c
ae 57 75 2d 5e '
h.Z..y..[l.Wu-^
0310 76 47 aa 46 6
e 28 63 5a f4 34 9c
a8 55 2d 81 e3 v

G.Fn(cZ.4..U-..
0320 4c 36 0d 0e 4
e 8f 93 15 14 41 53
80 15 eb 5f 69 L
6..N....AS..._i
0330 08 c1 6b ad d
9 e8 de 65 35 17 d8
f5 85 85 7a fc .
.k....e5.....z.
0340 83 82 eb 6e 9
0 3c c6 e8 86 3c 9d
1f 59 0c 9f 37 .
..n.<...<..Y..7
0350 a9 8f df f3 c
6 35 56 b3 36 ef 7b
df 67 89 06 02 .
....5V.6.{.g...
0360 cd 17 38 0d b
c c1 a1 c1 21 f3 6e
11 38 55 c5 56 .
.8.....!.n.8U.V
0370 6a db 57 9a f
a 15
j
.W...
No. Time
Source
Destination
Protocol
Length Info
21 0.788201000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=14211 Win=40320 Le
n=0
Frame 21: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.838131000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.838131000 s
econds
[Time delta fro
m previous captured
frame: 0.000173000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017300

0 seconds]
[Time since ref
erence or first fra
me: 0.788201000 sec
onds]
Frame Number: 2
1
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1

24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f1c (20252)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 14211
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:

0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 14211 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40320
[Calculated win
dow size: 40320]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 20]
[The RTT to
ACK the segment wa
s: 0.000173000 seco
nds]
0000 90 01 3b d0 1

7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 1c 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 99 b0 50 10 .
....P..N.+...P.
0030 9d 80 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
22 0.846807000
pc13.home
livebox.home
DNS
86 Standard que
ry 0xaf5a PTR 138.
12.124.74.in-addr.a
rpa
Frame 22: 86 bytes
on wire (688 bits),
86 bytes captured
(688 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.896737000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.896737000 s
econds
[Time delta fro
m previous captured
frame: 0.058606000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05860600
0 seconds]
[Time since ref
erence or first fra
me: 0.846807000 sec
onds]
Frame Number: 2
2
Frame Length: 8
6 bytes (688 bits)
Capture Length:
86 bytes (688 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =

Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
2
Identification:
0x4f1d (20253)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4977
9 (49779), Dst Port
: domain (53)
Source Port: 49
779 (49779)
Destination Por
t: domain (53)
Length: 52
Checksum: 0x83a
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(query)
[Response In: 4
5]
Transaction ID:
0xaf5a
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response

: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
138.12.124.
74.in-addr.arpa: ty
pe PTR, class IN
Name: 1
38.12.124.74.in-add
r.arpa
[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 48 4f 1d 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
HO.............
0020 01 01 c2 73 0
0 35 00 34 83 a2 af
5a 01 00 00 01 .
..s.5.4...Z....
0030 00 00 00 00 0
0 00 03 31 33 38 02
31 32 03 31 32 .
......138.12.12
0040 34 02 37 34 0
7 69 6e 2d 61 64 64
72 04 61 72 70 4
.74.in-addr.arp
0050 61 00 00 0c 0
0 01
a
.....
No.

Time

Source
Destination
Protocol
Length Info
23 0.908032000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=14211
Ack=1 Win=46 Len=1
260
Frame 23: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.957962000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.957962000 s
econds
[Time delta fro
m previous captured
frame: 0.061225000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06122500
0 seconds]
[Time since ref
erence or first fra
me: 0.908032000 sec
onds]
Frame Number: 2
3
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf181 (61825)
Flags: 0x02 (Do
n't Fragment)

0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aa9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 14211, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 14211 (relativ
e sequence number)
[Next sequence
number: 15471 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .

... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x7df
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 81 4
0 00 31 06 3a a9 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 99 b0 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 7d fa 0
0 00 78 5b 55 62 76
46 a8 bf 12 7e .
.}...x[UbvF...~
0040 79 e9 a2 30 4
3 c1 31 91 a9 89 ce
68 91 db 05 31 y
..0C.1....h...1
0050 b2 46 ea 32 d
e 68 95 b2 ed 34 fe
04 aa 53 8a f2 .
F.2.h...4...S..
0060 5e 0b 8c 7f 9
b b7 8a bb 6a 46 6a
4a e0 e3 05 81 ^

.......jFjJ....
0070 93 7b d6 62 e
7 34 9a 90 59 1f 9d
76 cf c1 40 d9 .
{.b.4..Y..v..@.
0080 e4 61 80 aa c
1 41 df 3a 6f c7 39
7f ff ed d5 ff .
a...A.:o.9.....
0090 fb 92 04 e9 8
f f2 f3 37 d7 83 09
5a e0 60 07 0a .
......7...Z.`..
00a0 e0 61 88 5c 0
b 0c 97 5c 0c 3d 29
41 8a 18 eb 41 .
a.\...\.=)A...A
00b0 86 19 70 e7 d
c 6d 6f f8 c2 57 d4
a4 89 24 c1 67 .
.p..mo..W...$.g
00c0 48 6a ff 42 e
6 e3 dd 10 54 69 f3
24 57 1b 38 13 H
j.B....Ti.$W.8.
00d0 0e 09 4d 73 7
7 ea 3f 85 34 05 f0
27 5a 7d b0 3d .
.Msw.?.4..'Z}.=
00e0 aa 5f cd f0 b
b 21 d1 b5 48 d4 95
c2 2e 29 03 7b .
_...!..H....).{
00f0 d6 62 e6 0c 4
9 a9 8a db 39 df be
73 8f ef fd 73 .
b..I...9..s...s
0100 ab eb 3f 19 d
d b5 ac eb 72 64 14
5a 8f 12 95 51 .
.?.....rd.Z...Q
0110 1c 0b 08 ad f
6 8b 53 ff d4 72 11
80 d1 2e 43 b5 .
.....S..r....C.
0120 06 17 8f ce 0
8 c1 09 18 8b 2d ae
15 2d 92 eb d8 .
........-..-...
0130 b7 2c 31 69 f
c 57 d3 c8 f7 c7 15
e8 ae 90 be 31 .
,1i.W.........1
0140 fb 6b a5 27 3
3 34 1f 0d ef 5c b2
1b b5 66 14 2c .
k.'34...\...f.,
0150 77 d7 5d e6 9
3 20 22 36 25 24 a7
18 2c a6 d0 2a w
.].. "6%$..,..*
0160 1a 96 0f 09 1
d d6 b7 6e 72 0e 28
83 f0 22 82 28 .
......nr.(..".(
0170 49 5c b6 72 f
7 43 f2 99 63 a4 d1
14 88 66 36 8d I
\.r.C..c....f6.

0180 1d e5 a0 fe 2
8 e5 3b 8f 23 a2 06
18 9f a8 5f 02 .
...(.;.#....._.
0190 f2 85 3e b5 2
e 52 a7 0e e3 04 b4
54 e4 9a da 66 .
.>..R.....T...f
01a0 64 eb 52 8c c
c 8c 6b 75 22 71 27
73 a6 2b 6a 9a d
.R...ku"q's.+j.
01b0 cd 4a a5 ed 4
1 55 b3 e9 26 8a cd
19 41 97 eb 5b .
J..AU..&...A..[
01c0 49 0a d0 2f 5
6 95 78 8c 2e 45 89
68 7c 92 b0 b4 I
../V.x..E.h|...
01d0 4d a4 4e c0 8
a ad ad 32 59 dd 72
18 dc 2a f4 fd M
.N....2Y.r..*..
01e0 96 7e a8 25 d
a dc b1 f4 ec ab d9
0f e3 6d b3 2c .
~.%.........m.,
01f0 d9 16 85 0f b
4 62 7b 6d d5 f8 38
46 da d6 63 41 .
....b{m..8F..cA
0200 88 e7 f7 85 d
3 1d 3c 7d 2c 5f 78
8a fe 90 b5 04 .
.....<},_x.....
0210 30 25 a3 4d 8
0 66 39 5d 12 70 74
04 e3 d9 20 91 0
%.M.f9].pt... .
0220 fa 01 db ed d
b f6 c6 65 dd eb f4
a7 e3 eb 3a 93 .
......e......:.
0230 37 ff fb 92 0
4 eb 8f f2 ef 23 d6
03 0f 7a 52 61 7
........#...zRa
0240 06 9a c0 61 8
f 5c 0a 58 85 58 07
bd 89 41 67 9b .
..a.\.X.X...Ag.
0250 6a c1 86 35 7
0 e7 71 44 8f e4 62
e0 a7 a9 92 27 j
..5p.qD..b....'
0260 08 a1 59 a9 3
a 05 e4 f1 8c 07 38
ab 0b e5 77 67 .
.Y.:.....8...wg
0270 98 28 67 02 7
2 04 66 43 f3 b1 5d
50 8a 3e da b2 .
(g.r.fC..]P.>..
0280 ee e9 a4 ed 2
a dc 7e c2 dd 61 83
bc c7 8d 98 d0 .
...*.~..a......
0290 62 33 ee d6 8

5 77 b3 47 a3 46 71
88 b1 f5 0b 59 b
3...w.G.Fq....Y
02a0 83 e0 94 34 d
8 06 63 95 d1 0f 07
40 4e 3d 92 4e .
..4..c....@N=.N
02b0 76 2c f5 f6 8
6 5b b4 5b 2c b7 6d
08 ff 3b 5f fb v
,...[.[,.m..;_.
02c0 70 56 db 42 5
6 75 84 48 71 c1 ca
a0 9a 51 c7 b3 p
V.BVu.Hq....Q..
02d0 79 5b 67 b9 9
c 2a 59 f2 d9 88 ac
83 b7 b0 9b 8a y
[g..*Y.........
02e0 d9 ad 62 c3 e
1 96 bd c7 03 8d ce
0d da d1 d1 b7 .
.b.............
02f0 15 b0 b8 13 6
a 63 fd fc c5 f0 13
79 ce 2c cb ff .
...jc.....y.,..
0300 c3 85 02 2c 0
a 03 4c 50 e2 69 61
a4 9a 21 65 a4 .
..,..LP.ia..!e.
0310 86 18 79 a6 2
1 e3 7b 9f d3 39 1d
02 05 9a 82 e3 .
.y.!.{..9......
0320 c6 95 97 64 8
6 b1 29 5c d8 35 0f
ca e4 75 c8 44 .
..d..)\.5...u.D
0330 d2 26 96 53 0
d 93 59 4b 0d 9e ad
81 cb 08 15 fd .
&.S..YK........
0340 45 71 7a 36 6
e 94 9d ff 15 07 d0
89 cc f9 f9 ac E
qz6n...........
0350 53 c4 6d dc 5
c 7b 59 98 1d a0 8c
8b ec 1c 38 99 S
.m.\{Y.......8.
0360 b1 53 45 80 a
1 84 b0 fb 49 38 03
0b 30 ad ba dd .
SE.....I8..0...
0370 da 99 cf 4a 7
1 4b ea 65 69 76 81
e9 06 00 40 a8 .
..JqK.eiv....@.
0380 05 b8 3c 62 8
f 26 3d 3c 6e 6f 4e
ad 9a b2 fc 96 .
.<b.&=<noN.....
0390 5c 1d 66 97 9
5 5e fa d0 ec 4f 4a
22 c5 2b 5d ec \
.f..^...OJ".+].
03a0 75 1a a4 57 b
7 8a f4 b3 85 ba 84

aa 86 31 ad ff u
..W.........1..
03b0 57 fe e6 12 a
7 3b ba ca 9a 73 5f
8e 35 ee da fd W
....;...s_.5...
03c0 fc 85 59 d6 4
1 55 86 5a 12 4a e1
6d 7f ee 47 f1 .
.Y.AU.Z.J.m..G.
03d0 af e4 b2 ff f
b 92 04 f4 8f f3 66
25 d4 03 18 7a .
.........f%...z
03e0 52 69 44 da 8
0 61 ef 4a 4b 5c 91
54 0c 61 e9 41 R
iD..a.JK\.T.a.A
03f0 63 12 2a 41 8
6 31 28 fb be de f7
cb 18 10 ec 64 c
.*A.1(........d
0400 e3 80 48 d1 7
3 08 29 32 fc 37 71
c2 83 c1 b6 94 .
.H.s.)2.7q.....
0410 0b ab 11 5a 2
1 13 04 2c a7 12 75
03 21 bc 1a 14 .
..Z!..,..u.!...
0420 09 96 3e f8 b
1 f9 eb 3b c1 a8 f3
0b 75 09 0d 18 .
.>....;....u...
0430 a5 cb ff 79 e
a e6 13 51 6f d6 54
d3 9a fc 79 3f .
..y...Qo.T...y?
0440 76 99 af 50 0
8 93 5c 0d 05 44 e1
05 07 42 22 c7 v
..P..\..D...B".
0450 8d be d0 ac 8
b 24 5e f1 4f 32 29
ea 7f 12 b5 9c .
....$^.O2).....
0460 ac 00 43 c4 6
3 30 86 2b 83 77 4a
92 6f 4d c5 ee .
.C.c0.+.wJ.oM..
0470 d0 af 77 eb b
6 2c 96 07 6f f2 ce
4d 1a 9a 9c b0 .
.w..,..o..M....
0480 fc 88 93 37 5
6 92 79 12 ae 70 8b
47 84 9f 50 23 .
..7V.y..p.G..P#
0490 bf 2e 42 23 0
b 5f ae bc 98 64 5c
a0 b7 5e f1 2b .
.B#._...d\..^.+
04a0 17 db 6c 98 8
5 8f fd f1 5f 13 62
cc 70 78 1f 24 .
.l....._.b.px.$
04b0 f4 96 4d ca 5
2 65 29 a9 95 b8 7f
30 e4 1c a6 0f .

.M.Re)....0....
04c0 89 18 1c 80 d
a 03 57 20 dc 3a 5e
1c 99 91 ee 4a .
.....W .:^....J
04d0 13 2d 0a bc 5
a 99 be ba bb 2c 28
55 70 50 82 32 .
-..Z....,(UpP.2
04e0 fe 0b 63 b4 e
a 99 d4 d0 20 14 f7
81 3c 71 5e 1b .
.c..... ...<q^.
04f0 50 b5 9b ae a
3 c0 91 e2 95 cb df
b6 38 45 cc fb P
...........8E..
0500 79 a9 29 ff b
c 95 f1 07 8a 20 b8
0d 69 63 c3 af y
.)...... ..ic..
0510 42 98 c7 99 3
8 c6 33 6a 13 cd 55
72 10 c8 bf 08 B
...8.3j..Ur....
0520 aa 06
.
.
No. Time
Source
Destination
Protocol
Length Info
24 0.937034000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
891 http49
574 [PSH, ACK] Seq=
15471 Ack=1 Win=46
Len=837
Frame 24: 891 bytes
on wire (7128 bits
), 891 bytes captur
ed (7128 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.986964000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.986964000 s
econds
[Time delta fro
m previous captured
frame: 0.029002000

seconds]
[Time delta fro
m previous displaye
d frame: 0.02900200
0 seconds]
[Time since ref
erence or first fra
me: 0.937034000 sec
onds]
Frame Number: 2
4
Frame Length: 8
91 bytes (7128 bits
)
Capture Length:
891 bytes (7128 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
77
Identification:
0xf182 (61826)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c4f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 15471, Ack: 1

, Len: 837
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 837]
Sequence number
: 15471 (relativ
e sequence number)
[Next sequence
number: 16308 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xffe
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys

is]
[Bytes in f
light: 2097]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 6d f1 82 4
0 00 31 06 3c 4f 4a
7c 0c 8a c0 a8 .
m..@.1.<OJ|....
0020 01 0b 00 50 c
1 a6 2b c8 9e 9c 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e ff e2 0
0 00 b0 35 81 dc 9f
8e c3 24 00 2b .
......5.....$.+
0040 8c 03 47 6e b
a 80 39 37 ea d3 b4
d5 39 9c d5 49 .
.Gn..97....9..I
0050 b6 d6 9a de 5
9 41 4d 0f ba 9b 14
80 86 0d e3 c5 .
...YAM.........
0060 87 14 01 a1 9
0 eb 2b 84 3c 58 51
47 23 d9 3a 88 .
.....+.<XQG#.:.
0070 d2 04 ba c8 e
2 22 a7 65 94 cd 2b
ea ba d6 9d 6a .
....".e..+....j
0080 73 e9 a6 ca 3
c fc c9 c9 5a ff fb
92 04 ee 8f f3 s
...<...Z.......
0090 1f 25 54 03 1
8 c2 52 60 24 9a 80
61 38 4a 0b fc .
%T...R`$..a8J..
00a0 a7 50 0c 61 e
9 81 79 14 a9 c1 87
bd 30 52 1f 43 .
P.a..y.....0R.C
00b0 cb 31 cb 55 e
f 73 d6 e8 14 36 1e
41 78 53 78 dd .
1.U.s...6.AxSx.
00c0 2c 28 03 fd 1
3 78 c1 6d 5e a8 dc
be b0 1a 9f 3b ,
(...x.m^......;
00d0 09 a8 ff fc 9
0 be 6b 19 f9 79 c8
f6 31 e2 d1 8d .
.....k..y..1...
00e0 91 58 7d 69 7
1 39 04 70 84 77 dc
21 62 f6 2e 2d .
X}iq9.p.w.!b..00f0 8c d2 da 84 d
6 dd 6f d7 97 f1 7d
65 fb c0 9a 8b .
.....o...}e....
0100 24 17 68 b1 b

0 7c 20 76 59 69 5a
52 1f 41 b2 cc $
.h..| vYiZR.A..
0110 30 ea 1e 97 3
d 35 fa 1e 44 46 5e
8b 1c 1e c3 62 0
...=5..DF^....b
0120 44 a7 1f a8 b
4 08 38 44 a7 46 2d
1b 9a 69 2d ff D
.....8D.F-..i-.
0130 e1 81 01 1d 6
c 7b aa ea fe 5f 49
6e f5 e6 fa fc .
...l{..._In....
0140 3d 3c 2d 40 4
8 cd 0f 1d 2d 09 ed
17 38 66 12 91 =
<-@H...-...8f..
0150 02 3a 09 ca a
7 eb 52 42 7c 41 55
0a 3a 4e 9a 8b .
:....RB|AU.:N..
0160 a6 fe 93 d6 a
6 7a 9d cf 3d e9 9f
94 0a bd 0d 65 .
....z..=......e
0170 d5 0f d6 d7 4
4 78 27 23 ce f3 9c
30 ac f9 d0 34 .
...Dx'#...0...4
0180 d5 d3 11 75 5
a 67 75 08 af dc 91
44 12 d1 f0 fb .
..uZgu....D....
0190 64 54 ef 63 b
2 9e ef b6 87 34 94
83 a7 34 35 29 d
T.c.....4...45)
01a0 92 22 cf 27 5
6 81 4c 23 42 81 d0
75 a2 f7 3e 58 .
".'V.L#B..u..>X
01b0 1d 8c 8b 38 a
b 3e 7d 35 14 4d e8
b5 27 ad 46 a8 .
..8.>}5.M..'.F.
01c0 e9 b9 e7 5a 6
a 37 79 40 6d f2 44
76 b1 72 ba d6 .
..Zj7y@m.Dv.r..
01d0 4e 53 14 16 2
e 0d 08 00 59 ce 10
65 17 17 d2 47 N
S......Y..e...G
01e0 0a 60 fb 34 7
9 3c dd 64 92 7f bb
7a a1 08 8a 7b .
`.4y<.d...z...{
01f0 3d 5c 83 19 4
5 2c 57 98 08 86 8d
64 fb d1 8b f0 =
\..E,W....d....
0200 18 e2 26 92 4
5 c1 01 34 18 2d 48
13 82 a9 48 f2 .
.&.E..4.-H...H.
0210 c6 79 49 a0 9
8 d4 12 57 45 d1 19

44 4d 34 89 25 .
yI....WE..DM4.%
0220 23 fb 32 7d 6
f e8 9f 38 28 c7 8f
ff fb 92 04 ec #
.2}o..8(.......
0230 0f f3 1f 31 5
3 83 18 8a 60 60 64
8a 60 65 8f 4a .
..1S...``d.`e.J
0240 0b 74 bf 4e 0
c 62 49 81 74 17 69
81 87 c5 30 5b .
t.N.bI.t.i...0[
0250 c5 fe 9a 90 9
a 62 92 98 65 b0 6b
a0 98 58 05 1a .
....b..e.k..X..
0260 fa 2a 00 46 1
4 02 46 ab 49 b6 1c
8b ab 38 e8 77 .
*.F..F.I....8.w
0270 10 dc d7 0b c
7 24 ce ad 18 2a 15
51 cf f7 31 9d .
....$...*.Q..1.
0280 0b 4e 24 d2 3
0 3c 2e 05 26 a4 43
89 02 60 2a 94 .
N$.0<..&.C..`*.
0290 90 71 f4 a5 a
0 e3 e0 78 3e d4 48
22 66 9a c9 24 .
q.....x>.H"f..$
02a0 91 fd 91 5b 2
f 4d 7c e9 e5 52 e6
c9 ae f7 6b a3 .
..[/M|..R....k.
02b0 52 9a 83 90 8
5 c4 09 08 1e c6 4e
30 39 5b 26 70 R
.........N09[&p
02c0 d8 18 cd 41 c
c 2f b6 af 6e 42 50
0a b4 d3 53 d5 .
..A./..nBP...S.
02d0 77 c9 84 bf c
9 25 b5 05 98 b1 49
68 1a 12 dc a7 w
....%....Ih....
02e0 8c d9 13 c8 1
2 61 3a 55 2d 1c 0d
d0 c1 38 74 77 .
....a:U-....8tw
02f0 88 e0 05 62 4
4 09 25 24 2b 72 d4
d5 42 b0 59 53 .
..bD.%$+r..B.YS
0300 cd 48 99 55 4
a 41 32 b2 fa 1d 24
1d d2 ad ae 8d .
H.UJA2...$.....
0310 47 d5 0c ec e
c ae ea 56 28 19 c3
65 02 36 14 a4 G
......V(..e.6..
0320 43 40 70 d0 d
3 55 4b b6 8c ee 28
fa ae a7 a8 b1 C

@p..UK...(.....
0330 57 0d ab 73 6
b 06 a2 14 7f 31 d6
73 10 b3 41 1a W
..sk....1.s..A.
0340 10 91 ec bf 0
e cb 47 48 28 85 d2
74 aa 52 0d 71 .
.....GH(..t.R.q
0350 08 64 98 ef 0
e 80 01 e4 82 11 2a
88 b9 e4 d1 93 .
d........*.....
0360 44 4d 27 b1 3
c 5d 41 24 16 49 23
d0 e9 20 9d 2d D
M'.<]A$.I#.. .0370 b4 66 67 d5 3
8 34 c8 bf d7 2b 4d
.
fg.84...+M
No. Time
Source
Destination
Protocol
Length Info
25 0.937189000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=16308 Win=39795 Le
n=0
Frame 25: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.987119000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.987119000 s
econds
[Time delta fro
m previous captured
frame: 0.000155000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00015500
0 seconds]
[Time since ref
erence or first fra
me: 0.937189000 sec

onds]
Frame Number: 2
5
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes

Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f1e (20254)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 16308
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number

: 1 (relative se
quence number)
Acknowledgment
number: 16308 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39795
[Calculated win
dow size: 39795]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 24]
[The RTT to
ACK the segment wa
s: 0.000155000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 1e 4

0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 a1 e1 50 10 .
....P..N.+...P.
0030 9b 73 18 d4 0
0 00
.
s....
No. Time
Source
Destination
Protocol
Length Info
26 0.937501000
pc13.home
par03s14-inf31.1e100.net TLSv1
.2 95 Applicat
ion Data
Frame 26: 95 bytes
on wire (760 bits),
95 bytes captured
(760 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.987431000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.987431000 s
econds
[Time delta fro
m previous captured
frame: 0.000312000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00031200
0 seconds]
[Time since ref
erence or first fra
me: 0.937501000 sec
onds]
Frame Number: 2
6
Frame Length: 9
5 bytes (760 bits)
Capture Length:
95 bytes (760 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f

rame: eth:ethertype
:ip:tcp:ssl]
[Coloring Rule
Name: TCP]
[Coloring Rule
String: tcp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: par03s14-in
-f31.1e100.net (173
.194.41.63)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 8
1
Identification:
0x4f1f (20255)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: pa
r03s14-in-f31.1e100
.net (173.194.41.63
)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51639 (51639), D
st Port: https (443
), Seq: 1, Ack: 1,
Len: 41
Source Port: 51
639 (51639)
Destination Por
t: https (443)
[Stream index:
1]
[TCP Segment Le
n: 41]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 42 (rela
tive sequence numbe
r)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 16635
[Calculated win
dow size: 16635]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x98f
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 41]
Secure Sockets Laye
r
TLSv1.2 Record
Layer: Application
Data Protocol: spdy
Content Typ
e: Application Data
(23)
Version: TL
S 1.2 (0x0303)
Length: 36
Encrypted A
pplication Data: 00
00000000000002e0178
69bbdfbcea66d4b3fe8
77eb01a8...
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 51 4f 1f 4
0 00 80 06 00 00 c0

a8 01 0b ad c2 .
QO.@...........
0020 29 3f c9 b7 0
1 bb 0a 53 43 09 be
85 68 96 50 18 )
?.....SC...h.P.
0030 40 fb 98 f8 0
0 00 17 03 03 00 24
00 00 00 00 00 @
.........$.....
0040 00 00 02 e0 1
7 86 9b bd fb ce a6
6d 4b 3f e8 77 .
..........mK?.w
0050 eb 01 a8 c4 f
0 5d ac 74 dd c9 ae
a4 0c 0f 0a
.
....].t.......
No. Time
Source
Destination
Protocol
Length Info
27 0.937635000
pc13.home
ham02s12-inf24.1e100.net TLSv1
.2 95 Applicat
ion Data
Frame 27: 95 bytes
on wire (760 bits),
95 bytes captured
(760 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
3.987565000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615213.987565000 s
econds
[Time delta fro
m previous captured
frame: 0.000134000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00013400
0 seconds]
[Time since ref
erence or first fra
me: 0.937635000 sec
onds]
Frame Number: 2
7
Frame Length: 9
5 bytes (760 bits)
Capture Length:

95 bytes (760 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:ssl]
[Coloring Rule
Name: TCP]
[Coloring Rule
String: tcp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: ham02s12-in
-f24.1e100.net (173
.194.113.184)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De

fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
1
Identification:
0x4f20 (20256)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: ha
m02s12-in-f24.1e100
.net (173.194.113.1
84)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51501 (51501), D
st Port: https (443
), Seq: 1, Ack: 1,
Len: 41
Source Port: 51
501 (51501)
Destination Por
t: https (443)
[Stream index:
2]
[TCP Segment Le
n: 41]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 42 (rela
tive sequence numbe
r)]
Acknowledgment
number: 1 (relat
ive ack number)

Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 16648
[Calculated win
dow size: 16648]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe17
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 41]
Secure Sockets Laye
r
TLSv1.2 Record
Layer: Application
Data Protocol: spdy
Content Typ
e: Application Data
(23)
Version: TL
S 1.2 (0x0303)
Length: 36
Encrypted A
pplication Data: 00
0000000000004c43c1c
12232e92000affc96dc
d865955d...

0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 51 4f 20 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
QO @...........
0020 71 b8 c9 2d 0
1 bb c8 47 4e a3 37
c0 00 05 50 18 q
..-...GN.7...P.
0030 41 08 e1 71 0
0 00 17 03 03 00 24
00 00 00 00 00 A
..q......$.....
0040 00 00 4c 43 c
1 c1 22 32 e9 20 00
af fc 96 dc d8 .
.LC.."2. ......
0050 65 95 5d df 7
f c3 e7 2d 2e fa b0
6f 5a 4d cf
e
.]....-...oZM.
No. Time
Source
Destination
Protocol
Length Info
28 0.953172000
pc13.home
livebox.home
DNS
85 Standard que
ry 0xc7e2 PTR 11.1
.168.192.in-addr.ar
pa
Frame 28: 85 bytes
on wire (680 bits),
85 bytes captured
(680 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.003102000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.003102000 s
econds
[Time delta fro
m previous captured
frame: 0.015537000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01553700
0 seconds]

[Time since ref

erence or first fra
me: 0.953172000 sec
onds]
Frame Number: 2
8
Frame Length: 8
5 bytes (680 bits)
Capture Length:
85 bytes (680 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
1
Identification:
0x4f21 (20257)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4977
9 (49779), Dst Port
: domain (53)
Source Port: 49
779 (49779)
Destination Por
t: domain (53)
Length: 51
Checksum: 0x83a
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]

Domain Name System

(query)
[Response In: 2
9]
Transaction ID:
0xc7e2
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
11.1.168.19
2.in-addr.arpa: typ
e PTR, class IN
Name: 1
1.1.168.192.in-addr
.arpa
[Name L
ength: 25]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 47 4f 21 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
GO!............
0020 01 01 c2 73 0
0 35 00 33 83 a1 c7
e2 01 00 00 01 .
..s.5.3........
0030 00 00 00 00 0
0 00 02 31 31 01 31
03 31 36 38 03 .
......11.1.168.

0040 31 39 32 07 6
9 6e 2d 61 64 64 72
04 61 72 70 61 1
92.in-addr.arpa
0050 00 00 0c 00 0
1
.
....
No. Time
Source
Destination
Protocol
Length Info
29 0.958029000
livebox.home
pc13.home
DNS
108 Standard que
ry response 0xc7e2
PTR pc13.home
Frame 29: 108 bytes
on wire (864 bits)
, 108 bytes capture
d (864 bits) on int
erface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.007959000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.007959000 s
econds
[Time delta fro
m previous captured
frame: 0.004857000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00485700
0 seconds]
[Time since ref
erence or first fra
me: 0.958029000 sec
onds]
Frame Number: 2
9
Frame Length: 1
08 bytes (864 bits)
Capture Length:
108 bytes (864 bit
s)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]

Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 9
4
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb732 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49779 (49779)
Source Port: do
main (53)
Destination Por
t: 49779 (49779)
Length: 74
Checksum: 0x500
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(response)
[Request In: 28
]
[Time: 0.004857
000 seconds]
Transaction ID:
0xc7e2
Flags: 0x8580 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .1.. .
... .... = Authorit
ative: Server is an

authority for doma

in
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs:
0
Additional RRs:
0
Queries
11.1.168.19
2.in-addr.arpa: typ
e PTR, class IN
Name: 1
1.1.168.192.in-addr
.arpa
[Name L
ength: 25]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Answers
11.1.168.19
2.in-addr.arpa: typ
e PTR, class IN, pc
13.home
Name: 1
1.1.168.192.in-addr
.arpa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 0
Data le

ngth: 11
Domain
Name: pc13.home
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 5e 00 00 4
0 00 40 11 b7 32 c0
a8 01 01 c0 a8 .
^..@.@..2......
0020 01 0b 00 35 c
2 73 00 4a 50 03 c7
e2 85 80 00 01 .
..5.s.JP.......
0030 00 01 00 00 0
0 00 02 31 31 01 31
03 31 36 38 03 .
......11.1.168.
0040 31 39 32 07 6
9 6e 2d 61 64 64 72
04 61 72 70 61 1
92.in-addr.arpa
0050 00 00 0c 00 0
1 c0 0c 00 0c 00 01
00 00 00 00 00 .
...............
0060 0b 04 70 63 3
1 33 04 68 6f 6d 65
00
.
.pc13.home.
No. Time
Source
Destination
Protocol
Length Info
30 0.963028000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=16308
Ack=1 Win=46 Len=1
260
Frame 30: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.012958000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.012958000 s
econds

[Time delta fro

m previous captured
frame: 0.004999000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00499900
0 seconds]
[Time since ref
erence or first fra
me: 0.963028000 sec
onds]
Frame Number: 3
0
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co

m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf183 (61827)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aa7 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 16308, Ack: 1
, Len: 1260
Source Port: ht
tp (80)

Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 16308 (relativ
e sequence number)
[Next sequence
number: 17568 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x355
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 83 4
0 00 31 06 3a a7 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 a1 e1 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 35 59 0
0 00 81 30 2a 02 31
81 45 40 1c 11 .
.5Y...0*.1.E@..
0040 a6 28 35 87 5
1 ed 2f 31 3c 36 d0
bb 1c 65 f4 58 .
(5.Q./1<6...e.X
0050 4b aa a0 db 4
1 b5 8d 79 4a af 80
b0 b7 42 93 ef K
...A..yJ....B..
0060 ec 76 9a 6c 4
2 00 47 26 c5 32 69
10 e8 c7 09 ab .
v.lB.G&.2i.....
0070 95 82 60 0d b
7 34 26 5a 31 1d 4d
12 a3 bd 42 e5 .
.`..4&Z1.M...B.
0080 3f 46 74 ac b
5 6f d0 53 ff fb 92
04 ec 8f f2 fa ?
Ft..o.S........
0090 2f 53 03 39 9
2 60 5d 65 da 50 65
f3 4c 0c d4 bd /
S.9.`]e.Pe.L...
00a0 4a 0d 66 69 8
1 8d 97 a9 01 9c 49
30 d5 af ce 25 J
.fi......I0...%
00b0 1c da 9f e8 f
4 34 c1 96 4d 99 8d
e3 d2 b8 dc a4 .
....4..M.......
00c0 8a 98 19 a4 3
2 d4 30 86 b8 84 d7
7c 3a a2 f8 4d .
...2.0....|:..M
00d0 61 2f 54 ee 1
b f4 a8 d7 49 42 51
b7 93 f4 35 32 a
/T.....IBQ...52
00e0 dc a7 0c 80 0
3 0d 2b 90 f2 2c 98
80 e2 71 3c 4d .
.....+..,...q<M
00f0 92 e1 08 00 2
d 6c 5d 68 c8 d6 eb
12 02 fa b8 9e .
...-l]h........
0100 4b 6b 46 53 2
f 22 85 4a 7d 07 49
92 cc c5 80 e0 K
kFS/".J}.I.....

0110 b1 78 7e 8c 9
6 86 48 a5 0b 12 8c
23 49 c6 48 61 .
x~...H....#I.Ha
0120 45 ca 1e 75 6
6 10 91 26 62 93 8e
b6 12 b4 56 7e E
..uf..&b.....V~
0130 f3 dd 30 89 e
f 3d 9d c4 64 8e 54
d4 5a c7 53 05 .
.0..=..d.T.Z.S.
0140 ee 97 c4 6a 9
2 81 9d b5 38 56 a8
52 26 44 57 36 .
..j....8V.R&DW6
0150 2b 06 b8 14 8
c 5e ce 0c 96 5f 61
14 26 39 98 b8 +
....^..._a.&9..
0160 8f d0 a2 56 4
d 6f 45 d6 a9 c6 a5
73 f7 d2 be 81 .
..VMoE....s....
0170 6f ff e9 6c c
a 5c 16 10 b8 4c bc
e1 10 c3 7d 28 o
..l.\...L....}(
0180 a5 64 00 25 e
c a0 25 85 8a 0b d2
e0 ee d1 a1 03 .
d.%..%.........
0190 35 1f a7 ea d
5 d3 13 72 aa 2f 18
2d 2b 68 96 b0 5
......r./.-+h..
01a0 da 31 ca 74 7
6 32 0c 17 64 99 bb
90 20 2d 08 9e .
1.tv2..d... -..
01b0 6a 63 9d 9b b
0 dc 39 cc c7 28 b7
69 64 fb ad 2a j
c....9..(.id..*
01c0 2e b5 39 86 a
a cd 9d 59 cb d1 59
f6 db a1 53 05 .
.9....Y..Y...S.
01d0 70 ba 4c 68 0
3 26 34 d9 cd 10 18
b0 b5 47 40 95 p
.Lh.&4......G@.
01e0 5f 8b 15 19 3
5 ec af 25 03 dd cd
cb 99 02 6c d8 _
...5..%......l.
01f0 d5 24 a9 2c 6
3 0f 76 e4 85 45 54
80 a2 d3 ab 28 .
$.,c.v..ET....(
0200 4c 70 f6 b7 c
2 e7 4b 0c 90 1e 05
d0 3a d9 ad 51 L
p....K.....:..Q
0210 40 b4 ba 80 8
a 14 b5 1e 0f 32 2d
8e 84 91 5b 35 @
........2-...[5
0220 15 3a d6 8d 6

c b4 b4 16 53 a5 ff
fb 92 04 e8 0f .
:..l...S.......
0230 f2 d9 2f 53 0
3 58 92 60 60 65 8a
30 65 f3 4c 0b .
./S.X.``e.0e.L.
0240 b0 c9 4a 0d 6
2 8b 81 6b 18 e9 01
97 d1 70 a8 b6 .
.J.b..k.....p..
0250 af 42 c2 1a 0
0 e6 60 11 6c 52 e4
d9 0f 30 d1 97 .
B....`.lR...0..
0260 54 a5 75 a7 e
b 9a 42 88 94 d4 10
f0 b9 f2 8d 4f T
.u...B........O
0270 25 33 1e c2 9
a cc f2 78 dc 6c f4
f1 e4 b4 ca 25 %
3.....x.l.....%
0280 16 9d 66 41 9
7 9e a4 e5 00 c9 23
06 4a 1b 02 33 .
.fA......#.J..3
0290 05 b3 97 74 4
5 22 d2 eb 11 c3 89
3c b8 1a 6a 2b .
..tE".....<..j+
02a0 65 93 07 d1 4
5 91 a3 48 eb b7 5d
ed 2f b2 4d 59 e
...E..H..]./.MY
02b0 5a 8d 08 a5 d
b fd 29 2a af 86 00
e2 06 c4 0c b8 Z
.....)*........
02c0 48 7e 1c 82 1
4 c4 a9 05 12 d5 9a
11 29 a0 53 36 H
~..........).S6
02d0 5d c9 04 71 0
e 0f 75 8b 7e ed b8
34 d2 e8 1e a9 ]
..q..u.~..4....
02e0 74 da 0c a2 5
b 21 64 62 5a a9 76
92 38 5d dd 20 t
...[!dbZ.v.8].
02f0 4a 92 00 11 2
0 1b 71 a9 82 29 89
f9 b2 c0 7e 05 J
... .q..)....~.
0300 13 77 8d 43 7
4 13 69 16 41 48 d6
9a 4f 59 75 f5 .
w.Ct.i.AH..OYu.
0310 fe 5c 76 69 c
3 6c 75 4e af fa 90
e2 1c f8 0a 52 .
\vi.luN.......R
0320 bd d0 1c 77 8
0 60 82 89 0c 61 80
a8 cd 1a 77 40 .
..w.`...a....w@
0330 90 24 ad bf 9
2 4c be 56 07 01 37

2a 8b d6 76 db .
$...L.V..7*..v.
0340 ad a9 e8 be d
4 93 7b 52 86 75 99
8b 2a dd 6c 61 .
.....{R.u..*.la
0350 84 a9 96 11 4
1 9d 1e 40 10 40 5f
48 a0 8a 62 b6 .
...A..@.@_H..b.
0360 ec 29 8a 2f 9
b 2c 5a 07 b4 1d 96
47 3a 8c 6b 75 .
)./.,Z....G:.ku
0370 6b 35 f5 de b
9 51 6d 51 71 2b 9e
a5 2a 61 ac 16 k
5...QmQq+..*a..
0380 2a 9a 28 d0 0
c bc 84 49 d7 86 48
4a b1 e3 be 0f *
.(....I..HJ....
0390 25 98 0e 24 d
9 a8 62 76 dc 29 06
bf 39 95 3f 6f %
..$..bv.)..9.?o
03a0 2e d7 18 3c b
f 08 f5 b1 76 28 04
09 95 99 8a 31 .
..<....v(.....1
03b0 bd 12 68 10 f
1 62 c7 8c 08 aa 6b
74 c8 71 f3 88 .
.h..b....kt.q..
03c0 24 46 3a d3 7
5 15 19 07 7a 48 21
5d ff fb 92 04 $
F:.u...zH!]....
03d0 ed 0f f2 fd 3
2 52 03 58 a2 e0 64
c6 4a 20 6b 14 .
...2R.X..d.J k.
03e0 5c 0c 7c c7 4
8 0d 62 6b 81 87 98
e8 81 9c 4d 70 \
.|.H.bk......Mp
03f0 3e 83 d4 9c c
1 94 64 35 bd 0e e4
19 e7 d4 7e 84 >
.....d5......~.
0400 40 6e 82 f5 f
0 b4 82 e9 0f 6f 8e
2d ec eb a5 45 @
n.......o.-...E
0410 58 e6 68 57 9
a 6c ee 4e 11 3c 78
69 b7 f3 df 23 X
.hW.l.N.<xi...#
0420 26 fd a9 fa e
d 82 95 d4 34 b4 f6
8f b0 77 3e c5 &
.......4....w>.
0430 29 47 be fb d
c 2d e2 9b 6c de 6f
7c 44 31 38 f0 )
G...-..l.o|D18.
0440 06 63 96 00 c
f 35 be fa 0f 7c 03
35 d1 fe 23 ff .

c...5...|.5..#.
0450 78 09 fe 7f c
7 68 03 ff cf e0 87
c5 67 25 ab 16 x
....h......g%..
0460 54 e3 28 4d 3
8 21 76 2e f0 80 1a
ea 43 7f 6c 09 T
.(M8!v.....C.l.
0470 44 fb 43 62 b
2 ca 0b b8 55 dd 97
27 5a 91 4e ba D
.Cb....U..'Z.N.
0480 0c 37 27 c7 1
9 c0 d9 79 3e 12 d9
61 a6 8f 1d 00 .
7'....y>..a....
0490 75 36 ac 0a 2
e c7 4b 6d 41 5c 56
71 ac 28 7e 0b u
6....KmA\Vq.(~.
04a0 f9 ff 2f bd b
a 6b 9f 4c a4 fb 8f
0c a4 9c fa b2 .
./..k.L........
04b0 7c d8 cc 52 c
6 5d bf ff f4 94 60
7b 07 c9 62 1c |
..R.]....`{..b.
04c0 6d 44 fc d2 2
7 85 fc 7c 48 bc af
7a d9 d5 69 56 m
D..'..|H..z..iV
04d0 c6 08 4a cb b
a ac 6e c2 a3 60 7f
62 17 09 89 0b .
.J...n..`.b....
04e0 ac 0b 89 c4 6
6 c9 16 91 23 83 79
28 a4 62 70 ce .
...f...#.y(.bp.
04f0 bc aa e4 7c a
5 a8 e9 25 b0 37 e7
49 43 23 5e 15 .
..|...%.7.IC#^.
0500 5f b8 d8 08 b
8 7c 51 22 01 4b 73
66 cc 8f 8a 59 _
....|Q".Ksf...Y
0510 5b 40 a5 8f 6
8 72 5f f5 55 69 2c
a2 03 48 36 56 [
@..hr_.Ui,..H6V
0520 6a 1b
j
.
No. Time
Source
Destination
Protocol
Length Info
31 0.964022000
par03s14-in-f31
.1e100.net pc13.hom
e
TCP
60 https
51639 [ACK] Seq=1 A

ck=42 Win=344 Len=0

Frame 31: 60 bytes
on wire (480 bits),
60 bytes captured
(480 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.013952000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.013952000 s
econds
[Time delta fro
m previous captured
frame: 0.000994000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00099400
0 seconds]
[Time since ref
erence or first fra
me: 0.964022000 sec
onds]
Frame Number: 3
1
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Padding: 000000
000000
Internet Protocol V
ersion 4, Src: par0
3s14-in-f31.1e100.n
et (173.194.41.63),
Dst: pc13.home (19
2.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x6028 (24616)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 5
5
Protocol: TCP (
6)
Header checksum
: 0x8af3 [validatio
n disabled]
[Good: Fals

e]
[Bad: False
]
Source: par03s1
4-in-f31.1e100.net
(173.194.41.63)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: https (443), Dst
Port: 51639 (51639
), Seq: 1, Ack: 42,
Len: 0
Source Port: ht
tps (443)
Destination Por
t: 51639 (51639)
[Stream index:
1]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 42 (rela
tive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 344
[Calculated win

dow size: 344]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd5b
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 26]
[The RTT to
ACK the segment wa
s: 0.026521000 seco
nds]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 28 60 28 0
0 00 37 06 8a f3 ad
c2 29 3f c0 a8 .
(`(..7.....)?..
0020 01 0b 01 bb c
9 b7 be 85 68 96 0a
53 43 32 50 10 .
.......h..SC2P.
0030 01 58 d5 b3 0
0 00 00 00 00 00 00
00
.
X..........
No. Time
Source
Destination
Protocol
Length Info
32 0.964075000
par03s14-in-f31
.1e100.net pc13.hom
e
TLSv1
.2 95 Applicat
ion Data
Frame 32: 95 bytes
on wire (760 bits),
95 bytes captured
(760 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.014005000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615214.014005000 s
econds
[Time delta fro
m previous captured
frame: 0.000053000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00005300
0 seconds]
[Time since ref
erence or first fra
me: 0.964075000 sec
onds]
Frame Number: 3
2
Frame Length: 9
5 bytes (760 bits)
Capture Length:
95 bytes (760 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:ssl]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: par0

3s14-in-f31.1e100.n
et (173.194.41.63),
Dst: pc13.home (19
2.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
1
Identification:
0x6029 (24617)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 5
5
Protocol: TCP (
6)
Header checksum
: 0x8ac9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: par03s1
4-in-f31.1e100.net
(173.194.41.63)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: https (443), Dst
Port: 51639 (51639
), Seq: 1, Ack: 42,
Len: 41
Source Port: ht
tps (443)

Destination Por
t: 51639 (51639)
[Stream index:
1]
[TCP Segment Le
n: 41]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 42 (rela
tive sequence numbe
r)]
Acknowledgment
number: 42 (rela
tive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 344
[Calculated win
dow size: 344]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xdf5
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 41]

Secure Sockets Laye

r
TLSv1.2 Record
Layer: Application
Data Protocol: spdy
Content Typ
e: Application Data
(23)
Version: TL
S 1.2 (0x0303)
Length: 36
Encrypted A
pplication Data: 00
00000000000002f3656
a51ed50760a11762912
0f75c801...
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 51 60 29 0
0 00 37 06 8a c9 ad
c2 29 3f c0 a8 .
Q`)..7.....)?..
0020 01 0b 01 bb c
9 b7 be 85 68 96 0a
53 43 32 50 18 .
.......h..SC2P.
0030 01 58 df 5c 0
0 00 17 03 03 00 24
00 00 00 00 00 .
X.\......$.....
0040 00 00 02 f3 6
5 6a 51 ed 50 76 0a
11 76 29 12 0f .
...ejQ.Pv..v)..
0050 75 c8 01 4d 0
8 40 5f 8e 9e 72 df
97 eb 28 d3
u
..M.@_..r...(.
No. Time
Source
Destination
Protocol
Length Info
33 0.984720000
ham02s12-in-f24
.1e100.net pc13.hom
e
TLSv1
.2 95 Applicat
ion Data
Frame 33: 95 bytes
on wire (760 bits),
95 bytes captured
(760 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.034650000 Romance
Standard Time

[Time shift for

this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.034650000 s
econds
[Time delta fro
m previous captured
frame: 0.020645000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02064500
0 seconds]
[Time since ref
erence or first fra
me: 0.984720000 sec
onds]
Frame Number: 3
3
Frame Length: 9
5 bytes (760 bits)
Capture Length:
95 bytes (760 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:ssl]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080

0)
Internet Protocol V
ersion 4, Src: ham0
2s12-in-f24.1e100.n
et (173.194.113.184
), Dst: pc13.home (
192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
1
Identification:
0x5155 (20821)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 5
1
Protocol: TCP (
6)
Header checksum
: 0x5524 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: ham02s1
2-in-f24.1e100.net
(173.194.113.184)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: https (443), Dst
Port: 51501 (51501
), Seq: 1, Ack: 42,
Len: 41

Source Port: ht
tps (443)
Destination Por
t: 51501 (51501)
[Stream index:
2]
[TCP Segment Le
n: 41]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 42 (rela
tive sequence numbe
r)]
Acknowledgment
number: 42 (rela
tive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 1373
[Calculated win
dow size: 1373]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc5b
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[This is an
ACK to the segment
in frame: 27]
[The RTT to
ACK the segment wa
s: 0.047085000 seco
nds]
[Bytes in f
light: 41]
Secure Sockets Laye
r
TLSv1.2 Record
Layer: Application
Data Protocol: spdy
Content Typ
e: Application Data
(23)
Version: TL
S 1.2 (0x0303)
Length: 36
Encrypted A
pplication Data: 00
0000000000017fd005a
4881e3d6a6d0f7651de
135ecbc0...
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 51 51 55 0
0 00 33 06 55 24 ad
c2 71 b8 c0 a8 .
QQU..3.U$..q...
0020 01 0b 01 bb c
9 2d 37 c0 00 05 c8
47 4e cc 50 18 .
....-7....GN.P.
0030 05 5d c5 b3 0
0 00 17 03 03 00 24
00 00 00 00 00 .
]........$.....
0040 00 01 7f d0 0
5 a4 88 1e 3d 6a 6d
0f 76 51 de 13 .
.......=jm.vQ..
0050 5e cb c0 64 2
c 33 7d dd 92 2d bf
60 9a 5c ea
^
..d,3}..-.`.\.
No. Time
Source
Destination
Protocol
Length Info
34 1.085039000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
876 http49
574 [PSH, ACK] Seq=
17568 Ack=1 Win=46
Len=822
Frame 34: 876 bytes
on wire (7008 bits
), 876 bytes captur

ed (7008 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.134969000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.134969000 s
econds
[Time delta fro
m previous captured
frame: 0.100319000
seconds]
[Time delta fro
m previous displaye
d frame: 0.10031900
0 seconds]
[Time since ref
erence or first fra
me: 1.085039000 sec
onds]
Frame Number: 3
4
Frame Length: 8
76 bytes (7008 bits
)
Capture Length:
876 bytes (7008 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)

Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
62
Identification:
0xf184 (61828)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c5c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74

-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 17568, Ack: 1
, Len: 822
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 822]
Sequence number
: 17568 (relativ
e sequence number)
[Next sequence
number: 18390 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46

[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x5fb
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2082]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5e f1 84 4
0 00 31 06 3c 5c 4a
7c 0c 8a c0 a8 .
^..@.1.<\J|....
0020 01 0b 00 50 c
1 a6 2b c8 a6 cd 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 5f bc 0
0 00 2c 80 e4 ca f0
1d 81 6e a8 2e .
._...,......n..
0040 a7 19 dc 4e d
c 5a 8d 32 95 75 01
fe 72 df 11 3c .
..N.Z.2.u..r..<
0050 be 61 16 22 0
5 0e a2 20 59 8a 55
82 19 1f b3 41 .
a."... Y.U....A
0060 62 6a bd d0 d
7 38 b4 c5 b2 9c 88
fe d1 95 76 7f b
j...8........v.
0070 16 4d d5 ba 3
6 37 fd 73 5a e7 e2
ff 3f 1f 10 fc .
M..67.sZ...?...
0080 ff 00 ff fb 9
2 04 e6 8f f2 e7 2e
d4 03 38 92 60 .
............8.`
0090 5c a4 7a a0 3
d ef 4a 4b d4 b1 5c
0c 3d 89 81 7c \
.z.=.JK..\.=..|
00a0 16 2b c0 f7 a
5 30 99 26 13 36 a9
e1 6b ad fe af .
+...0.&.6..k...
00b0 fe 81 15 16 0
1 6f 09 b2 56 4b 56
1b 55 c7 81 58 .
....o..VKV.U..X
00c0 4b 88 4f 3f 1
c 87 f2 29 70 ae 18

a6 b4 3b bc d1 K
.O?...)p....;..
00d0 d2 71 e1 0a 4
9 31 bd 29 52 24 b9
98 94 65 86 16 .
q..I1.)R$...e..
00e0 5f 49 1e e7 e
c 78 b4 93 19 56 52
1c 09 dd da 3e _
I...x...VR....>
00f0 b1 ba c9 ba 5
b ea b0 43 42 c1 d7
0c 14 3e f7 9f .
...[..CB....>..
0100 05 5c 1b 72 5
5 61 30 28 0c a8 95
dd f8 a7 fb fd .
\.rUa0(........
0110 bf aa 52 f6 3
f cb a4 49 80 2b 37
79 1c 10 ec a2 .
.R.?..I.+7y....
0120 8a 63 38 08 c
e c4 60 ca 32 5b 50
db 13 38 34 de .
c8...`.2[P..84.
0130 2c e5 1f 24 4
c 60 3a 21 c8 82 c2
67 8f 03 48 9f ,
..$L`:!...g..H.
0140 c4 58 72 43 e
6 c4 6a 15 09 ba 6b
11 5b d0 fd 36 .
XrC..j...k.[..6
0150 ee 0b 37 89 a
a 53 75 ac 95 0b 2a
1a 63 16 e6 52 .
.7..Su...*.c..R
0160 41 cb ed b9 c
9 4d 93 1a de da df
cf fb 3f eb fd A
....M.......?..
0170 ec 43 45 28 2
a c3 21 62 9b 31 f8
75 e3 7e e7 4c .
CE(*.!b.1.u.~.L
0180 34 12 60 46 9
c 87 82 89 3b 2a 1b
cf 7b c2 de 34 4
.`F....;*..{..4
0190 ee 3d 52 af 8
3 60 ea 52 2a 53 23
51 3c 5b ec e3 .
=R..`.R*S#Q<[..
01a0 1d 9e 25 21 5
1 10 b7 4d 49 58 6c
fa 6d cd 61 7a .
.%!Q..MIXl.m.az
01b0 ff f7 5d 49 2
d d8 94 04 09 bd aa
5d e6 2d d7 2a .
.]I-......].-.*
01c0 88 19 ea a3 b
5 7b f9 7f 57 ff fa
55 5a 7d 5d 67 .
....{..W..UZ}]g
01d0 f9 70 a5 38 f
9 53 da 3a dd df 41
64 41 a4 12 c8 .

p.8.S.:..AdA...
01e0 82 1a 8c 23 e
a 6f 6c 90 a5 da bd
56 15 1e 41 57 .
..#.ol....V..AW
01f0 52 c4 44 6d 0
0 a5 04 41 a2 2e 53
1e d6 75 1e 0e R
.Dm...A..S..u..
0200 b8 ee b6 ff a
b 7b 66 a6 c4 17 ba
8f e4 73 c7 c4 .
....{f......s..
0210 37 03 22 71 4
2 a7 cd 32 65 3d 44
83 6d e7 a8 bd 7
."qB..2e=D.m...
0220 6e 4c 05 73 f
f fb 92 04 e9 8f f3
04 2d d7 03 0f n
L.s........-...
0230 7a 60 60 44 b
a f0 3d 8f 4a 0b fc
8f 5c 0c 3d e9 z
``D..=.J...\.=.
0240 41 6c 12 2b 8
1 87 bd 28 15 eb 23
b2 59 7a 0c 10 A
l.+...(..#.Yz..
0250 df 1e a0 d0 1
e 04 d4 83 38 b2 30
9d 27 9a 40 d6 .
.......8.0.'.@.
0260 52 11 33 10 e
a a6 2c 6e aa e0 66
69 9c 35 00 a7 R
.3...,n..fi.5..
0270 a9 72 40 42 4
a 44 0f 0a 12 fd 32
63 6b 37 ce aa .
r@BJD....2ck7..
0280 51 3b df c7 b
b 25 6b 0a 0d 69 1f
54 73 60 8c e8 Q
;...%k..i.Ts`..
0290 32 b1 40 2b c
d 07 2e 4b c3 b5 15
73 68 be 84 0f 2
.@+...K...sh...
02a0 cc dd c5 bd 6
4 76 3c b6 5d 0e 2a
e3 66 51 31 ae .
...dv<.].*.fQ1.
02b0 45 22 cc 50 9
7 49 a4 41 44 9c 75
18 42 e3 4a 47 E
".P.I.AD.u.B.JG
02c0 15 81 b3 0b 0
8 3b a1 80 43 db a9
51 ec 9f 83 a4 .
....;..C..Q....
02d0 02 40 86 45 0
e c5 53 7e 42 c6 08
b2 b1 87 9b 26 .
@.E..S~B......&
02e0 63 76 65 f9 d
7 81 32 55 28 7f 2f
ad c9 4c 13 85 c
ve...2U(./..L..

02f0 6e 5d 83 2c c
c 76 6a 9b 2b 5f 67
42 30 5a f0 68 n
].,.vj.+_gB0Z.h
0300 91 73 20 36 8
0 0c 40 31 cc ea 67
20 23 b4 85 66 .
s 6..@1..g #..f
0310 5a a8 8c 82 b
1 27 51 aa 10 11 83
37 46 6e a3 95 Z
....'Q....7Fn..
0320 61 96 99 8a c
2 e4 9d 9d c2 a5 69
da f2 68 c2 70 a
.........i..h.p
0330 37 82 e5 2a 6
1 ac 16 42 22 7f 05
cc 43 fe ac f7 7
..*a..B"...C...
0340 db 86 0c 23 1
e de 16 20 ae e9 bb
e5 e4 5a 6a 14 .
..#... .....Zj.
0350 2b 46 f1 58 0
e 9e 26 58 f0 2a 0e
ad e8 10 91 2a +
F.X..&X.*.....*
0360 d2 2c 21 5c 8
9 cf 06 9d c2 ae f4
55
.
,!\.......U
No. Time
Source
Destination
Protocol
Length Info
35 1.085221000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=18390 Win=39275 Le
n=0
Frame 35: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.135151000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.135151000 s
econds

[Time delta fro

m previous captured
frame: 0.000182000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018200
0 seconds]
[Time since ref
erence or first fra
me: 1.085221000 sec
onds]
Frame Number: 3
5
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co

rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f23 (20259)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 18390
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)

[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 18390 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39275
[Calculated win
dow size: 39275]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 34]
[The RTT to
ACK the segment wa
s: 0.000182000 seco
nds]

0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 23 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O#@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 aa 03 50 10 .
....P..N.+...P.
0030 99 6b 18 d4 0
0 00
.
k....
No. Time
Source
Destination
Protocol
Length Info
36 1.088028000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18390
Ack=1 Win=46 Len=1
260
Frame 36: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.137958000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.137958000 s
econds
[Time delta fro
m previous captured
frame: 0.002807000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00280700
0 seconds]
[Time since ref
erence or first fra
me: 1.088028000 sec
onds]
Frame Number: 3
6
Frame Length: 1
314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)

.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf185 (61829)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aa5 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 18390, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 18390 (relativ
e sequence number)
[Next sequence
number: 19650 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)

Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xeef
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 85 4
0 00 31 06 3a a5 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 aa 03 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e ee f4 0
0 00 8c a0 11 62 96
b8 ce 0c 3a c2 .

........b....:.
0040 4c 98 68 b2 b
7 30 b0 b9 09 a8 9b
4d f2 4b 0f 2d L
.h..0.....M.K.0050 5b 04 93 5d 1
4 af 35 38 12 86 96
62 ac 57 39 60 [
..]..58...b.W9`
0060 08 f1 a0 26 1
8 a1 50 30 5a 6d 26
0a 80 86 0e 9a .
..&..P0Zm&.....
0070 04 a3 8f c2 e
e 4a 75 0d 22 dc fe
1d f9 b6 bd 57 .
....Ju."......W
0080 bb ba d6 71 9
b fa d3 7d ad f2 ad
73 bf 74 db 0e .
..q...}...s.t..
0090 ff fb 92 04 e
a 8f f2 ea 23 56 83
0f 7a 50 5b 24 .
.......#V..zP[$
00a0 2a d0 3d ef 4
a 0c 14 8f 52 0d 63
09 41 84 91 aa *
.=.J...R.c.A...
00b0 81 8c 3d 28 a
c 73 4c 92 00 8e 40
ad 1f 44 55 3a .
.=(.sL...@..DU:
00c0 49 aa 61 34 7
8 89 02 42 78 94 15
b1 a8 13 88 a1 I
.a4x..Bx.......
00d0 ca b9 43 89 8
c f0 21 ad 65 06 97
b5 e8 12 ac a6 .
.C...!.e.......
00e0 e6 f3 ce 70 4
8 73 40 86 52 24 fb
e2 9d c5 b4 fd .
..pHs@.R$......
00f0 01 ae 73 c5 d
b 5b 4e 25 c3 b0 b7
8f 4d fa 9f cf .
.s..[N%....M...
0100 77 8e db 5b f
b 43 f0 ac dd 8c fc
66 f6 b5 35 9c w
..[.C.....f..5.
0110 e7 74 ce 22 d
4 3c 13 6a 08 8d 24
38 6e 0f 23 44 .
t.".<.j..$8n.#D
0120 ef 55 2d a0 e
8 84 51 14 14 63 8a
9d d0 80 e3 2f .
U-...Q..c...../
0130 92 65 ba 81 5
3 a3 89 29 20 79 18
95 ab 89 1e 40 .
e..S..) y.....@
0140 5e 1a 89 cb 2
b c7 51 29 3b 8d 2a
bc 5a 09 80 4a ^
...+.Q);.*.Z..J

0150 0a 18 9f eb f
9 47 91 2d 60 91 33
4d cb ea 42 ab .
....G.-`.3M..B.
0160 42 ee 55 6d a
d 5c cb 38 35 c9 bd
f9 dc 6e 9b b9 B
.Um.\.85....n..
0170 f7 27 3b cd e
7 86 7f f9 7d d1 74
06 d4 e4 c6 1f .
';.....}.t.....
0180 76 fa 2b 72 0
4 6c 5e a5 dc 1a 00
b2 93 e5 7c 32 v
.+r.l^.......|2
0190 47 e4 45 d1 a
1 26 41 a7 c1 14 9f
0f 74 10 9a 13 G
.E..&A.....t...
01a0 d7 f4 b2 9a 3
a 89 f4 c1 04 34 01
78 3c 02 5e 34 .
...:....4.x<.^4
01b0 86 b0 6f 64 0
8 32 c2 03 5a 89 b2
8a ea 26 49 e7 .
.od.2..Z....&I.
01c0 52 49 9d 21 a
7 9d d4 4c 2d 4e 60
5a b5 e7 ed 58 R
I.!...L-N`Z...X
01d0 95 01 b1 84 8
d a9 c1 f6 a7 a1 23
fe ae 94 2a 6b .
.........#...*k
01e0 88 64 24 05 2
b 4d 88 d3 90 40 99
b4 69 76 c0 00 .
d$.+M...@..iv..
01f0 89 93 08 81 4
c 59 0e e1 9a 87 c7
01 91 69 a4 89 .
...LY.......i..
0200 f9 1a bd dc e
7 d5 cc a2 c9 8c 30
48 8c a9 9a 9d .
.........0H....
0210 ef 7b fe 45 2
4 a7 43 fe 3a 72 0a
d0 a9 98 d6 55 .
{.E$.C.:r.....U
0220 e4 3f bf b5 2
5 6e 98 ff f5 87 de
cd e4 47 b5 18 .
?..%n.......G..
0230 6c 36 ff fb 9
2 04 ec 0f f3 1d 25
d4 03 58 c2 50 l
6........%..X.P
0240 64 c5 9a 80 6
3 0f 4c 0c 14 9b 50
0d 63 09 41 6c d
...c.L...P.c.Al
0250 92 6a 41 87 c
1 28 5c 7b 09 c6 31
ec 3f 27 ff a9 .
jA..(\{..1.?'..
0260 64 16 a8 08 3

3 12 08 a2 46 c2 71
b4 86 fd a2 10 d
...3...F.q.....
0270 25 7f 15 40 9
e 6b 6d 30 9d 75 80
be 80 ac 5a 34 %
..@.km0.u....Z4
0280 aa ed 1d 89 1
b 39 c2 70 38 ed e0
6b 8b d1 96 ce .
....9.p8..k....
0290 9f 03 91 86 1
9 ee 0a f7 18 f1 ab
24 f7 65 f5 f1 .
..........$.e..
02a0 b2 90 d5 2f 1
9 0b d5 f7 6c 66 d2
e4 f3 a5 4a a5 .
../....lf....J.
02b0 2d 15 34 40 8
9 32 c1 58 8d ec a1
b9 dd 4d 01 20 .4@.2.X.....M.
02c0 cb bc 16 9c 0
d 61 88 78 3e 48 e2
42 26 0a 4f 15 .
....a.x>H.B&.O.
02d0 9c a8 a6 d9 1
d 45 c1 28 03 26 b8
20 b7 9b 3b cb .
....E.(.&. ..;.
02e0 5e 7e db 1e 5
a d0 fd 18 0a 91 c7
4a 16 1f a3 3c ^
~..Z......J...<
02f0 3b c6 e0 50 0
1 c1 1c 98 b9 bc 41
e4 f0 cc af f5 ;
..P......A.....
0300 df c4 49 97 5
8 9f 32 97 48 ef 77
46 5d e3 5e 7c .
.I.X.2.H.wF].^|
0310 66 92 15 00 9
a 5b 12 55 cd 11 6c
a5 14 b4 03 68 f
....[.U..l....h
0320 83 4c 4a 20 7
f c5 ce 07 82 b7 c1
b3 20 e0 0f 3d .
LJ ........ ..=
0330 23 18 bb 0f 2
2 8d 96 e2 e5 20 85
40 4b d4 f2 b4 #
...".... .@K...
0340 92 00 32 19 1
3 9e dd 26 c6 98 c6
2e aa b1 15 29 .
.2....&.......)
0350 c8 08 e0 20 0
1 79 1c d9 61 72 55
d9 09 85 78 2f .
.. .y..arU...x/
0360 23 d6 2d 52 7
a ad a1 ab 21 4a fa
8e 31 b1 af 18 #
.-Rz...!J..1...
0370 31 64 dc 24 0
3 3a 39 e2 a1 35 2b

b6 c8 a2 aa 83 1
d.$.:9..5+.....
0380 87 07 80 41 1
6 6c db 0c 3d c1 0c
a8 b8 29 4d 96 .
..A.l..=....)M.
0390 08 73 4c 18 5
1 4b 89 72 14 b5 95
13 3a 2a 17 44 .
sL.QK.r....:*.D
03a0 6c 91 30 dc b
2 57 8c 3c b3 65 f8
06 6e 20 54 f4 l
.0..W.<.e..n T.
03b0 41 46 d4 2e 5
a 3d 44 00 a3 3f 1d
88 5e 50 7d 69 A
F..Z=D..?..^P}i
03c0 5e f2 b1 8e 1
7 67 1f 17 f2 9b 0d
dc 72 67 32 c2 ^
....g......rg2.
03d0 b6 25 d2 68 f
f fb 90 04 e8 8f f2
e6 1f d3 83 58 .
%.h...........X
03e0 c2 50 5d a4 6
a 70 63 0f 4a 0b f8
91 4c 0c e1 e9 .
P].jpc.J...L...
03f0 41 84 91 e9 8
1 8c 3d 28 ad ae 68
4e ab 13 59 fd A
.....=(..hN..Y.
0400 d4 ce a0 84 f
a 25 6f 01 a8 6d 80
6b b5 36 a8 c8 .
....%o..m.k.6..
0410 0a a8 5f c4 2
4 59 ec 40 a4 8e e1
7e da e0 c8 25 .
._.$Y.@...~...%
0420 63 03 8d d6 7
f ac c6 9d 97 f6 e1
41 e1 82 ab a0 c
..........A....
0430 65 13 6f a7 4
a 00 b1 54 cf b0 e4
8f 50 7c d5 7e e
.o.J..T....P|.~
0440 fd 8f c3 76 2
2 71 8a 6c 37 a8 ac
e6 58 56 3a 17 .
..v"q.l7...XV:.
0450 2c e0 98 04 3
4 5a 2e b0 01 e9 f9
90 a3 e7 ba db ,
...4Z..........
0460 30 a1 2b b0 1
4 f1 d1 59 ae b9 80
93 28 12 5c 02 0
.+....Y....(.\.
0470 49 6e 8b 78 3
2 a6 d8 bc c1 95 74
51 43 31 02 70 I
n.x2.....tQC1.p
0480 57 8b 8e 9a b
c cb c2 ba e4 d9 09
86 68 31 44 c8 W

...........h1D.
0490 49 72 b0 bc 0
a 62 45 b4 fe ea ca
a4 a9 0a 54 13 I
r...bE.......T.
04a0 94 b3 b4 d8 4
4 7c 0e d3 b1 10 4e
71 5d 8c b7 70 .
...D|....Nq]..p
04b0 c8 a7 c7 71 c
4 44 d4 72 fb e7 fe
eb 39 35 b3 51 .
..q.D.r....95.Q
04c0 05 e4 53 80 4
9 3e 02 3a 43 2a a0
b2 61 a4 8f 02 .
.S.I>.:C*..a...
04d0 99 4f 16 20 a
f 90 e0 a1 09 be 02
04 14 00 4e 2a .
O. ..........N*
04e0 68 a7 e4 f1 d
7 66 c3 7e fc d3 03
b3 90 04 89 e0 h
....f.~........
04f0 87 e9 c6 c6 9
b 29 58 54 33 26 65
18 a8 f7 5f 8d .
....)XT3&e..._.
0500 5c a7 c7 98 e
a ac 99 ee e6 5b a9
0f d8 9b fc 2c \
........[.....,
0510 77 2f d5 4d 2
3 82 d3 06 4d 95 6d
5f 7f c2 7f bf w
/.M#...M.m_....
0520 fd 55
.
U
No. Time
Source
Destination
Protocol
Length Info
37 1.213044000
par03s14-in-f31
.1e100.net pc13.hom
e
TLSv1
.2 95 [TCP Ret
ransmission] Applic
ation Data
Frame 37: 95 bytes
on wire (760 bits),
95 bytes captured
(760 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.262974000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.262974000 s
econds
[Time delta fro
m previous captured
frame: 0.125016000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12501600
0 seconds]
[Time since ref
erence or first fra
me: 1.213044000 sec
onds]
Frame Number: 3
7
Frame Length: 9
5 bytes (760 bits)
Capture Length:
95 bytes (760 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:ssl]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: par0
3s14-in-f31.1e100.n
et (173.194.41.63),
Dst: pc13.home (19
2.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
1
Identification:
0x602a (24618)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 5
5
Protocol: TCP (
6)
Header checksum
: 0x8ac8 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: par03s1
4-in-f31.1e100.net
(173.194.41.63)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: https (443), Dst
Port: 51639 (51639
), Seq: 1, Ack: 42,

Len: 41
Source Port: ht
tps (443)
Destination Por
t: 51639 (51639)
[Stream index:
1]
[TCP Segment Le
n: 41]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 42 (rela
tive sequence numbe
r)]
Acknowledgment
number: 42 (rela
tive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 344
[Calculated win
dow size: 344]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xdf5
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys

is]
[Bytes in f
light: 41]
[TCP Analys
is Flags]
[Expert
Info (Note/Sequenc
e): This frame is a
(suspected) retran
smission]
[Th
is frame is a (susp
ected) retransmissi
on]
[Se
verity level: Note]
[Gr
oup: Sequence]
[The RT
O for this segment
was: 0.248969000 se
conds]
[RTO ba
sed on delta from f
rame: 32]
Secure Sockets Laye
r
TLSv1.2 Record
Layer: Application
Data Protocol: spdy
Content Typ
e: Application Data
(23)
Version: TL
S 1.2 (0x0303)
Length: 36
Encrypted A
pplication Data: 00
00000000000002f3656
a51ed50760a11762912
0f75c801...
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 51 60 2a 0
0 00 37 06 8a c8 ad
c2 29 3f c0 a8 .
Q`*..7.....)?..
0020 01 0b 01 bb c
9 b7 be 85 68 96 0a
53 43 32 50 18 .
.......h..SC2P.
0030 01 58 df 5c 0
0 00 17 03 03 00 24
00 00 00 00 00 .
X.\......$.....
0040 00 00 02 f3 6
5 6a 51 ed 50 76 0a
11 76 29 12 0f .
...ejQ.Pv..v)..
0050 75 c8 01 4d 0
8 40 5f 8e 9e 72 df
97 eb 28 d3
u
..M.@_..r...(.
No. Time
Source

Destination
Protocol
Length Info
38 1.213117000
pc13.home
par03s14-inf31.1e100.net TCP
66 51639
https [ACK] Seq=42
Ack=42 Win=16625 Le
n=0 SLE=1 SRE=42
Frame 38: 66 bytes
on wire (528 bits),
66 bytes captured
(528 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.263047000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.263047000 s
econds
[Time delta fro
m previous captured
frame: 0.000073000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00007300
0 seconds]
[Time since ref
erence or first fra
me: 1.213117000 sec
onds]
Frame Number: 3
8
Frame Length: 6
6 bytes (528 bits)
Capture Length:
66 bytes (528 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: TCP]
[Coloring Rule
String: tcp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)

Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: par03s14-in
-f31.1e100.net (173
.194.41.63)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 5
2
Identification:
0x4f24 (20260)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t

..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: pa
r03s14-in-f31.1e100
.net (173.194.41.63
)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51639 (51639), D
st Port: https (443
), Seq: 42, Ack: 42
, Len: 0
Source Port: 51
639 (51639)
Destination Por
t: https (443)
[Stream index:
1]
[TCP Segment Le
n: 0]
Sequence number
: 42 (relative s
equence number)
Acknowledgment
number: 42 (rela
tive ack number)
Header Length:
32 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 16625
[Calculated win
dow size: 16625]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x98d
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
Options: (12 by
tes), No-Operation
(NOP), No-Operation
(NOP), SACK
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...
0 0001 = Number: No
-Operation (NOP) (1
)
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...
0 0001 = Number: No
-Operation (NOP) (1
)
SACK: 1-42
Kind: S
ACK (5)
Length:
10
left ed
ge = 1 (relative)
right e
dge = 42 (relative)
[TCP SA
CK Count: 1]
[SEQ/ACK analys
is]

[This is an
ACK to the segment
in frame: 32]
[The RTT to
ACK the segment wa
s: 0.249042000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 34 4f 24 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
4O$@...........
0020 29 3f c9 b7 0
1 bb 0a 53 43 32 be
85 68 bf 80 10 )
?.....SC2..h...
0030 40 f1 98 db 0
0 00 01 01 05 0a be
85 68 96 be 85 @
...........h...
0040 68 bf
h
.
No. Time
Source
Destination
Protocol
Length Info
39 1.230046000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=19650
Ack=1 Win=46 Len=1
260
Frame 39: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.279976000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.279976000 s
econds
[Time delta fro
m previous captured
frame: 0.016929000
seconds]

[Time delta fro

m previous displaye
d frame: 0.01692900
0 seconds]
[Time since ref
erence or first fra
me: 1.230046000 sec
onds]
Frame Number: 3
9
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf186 (61830)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aa4 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 19650, Ack: 1
, Len: 1260

Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 19650 (relativ
e sequence number)
[Next sequence
number: 20910 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x987
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 86 4
0 00 31 06 3a a4 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 ae ef 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 98 7d 0
0 00 6b 8c 30 4b 13
05 93 f2 13 c2 .
..}..k.0K......
0040 a0 10 a3 06 3
7 14 e0 0a c5 96 92
22 07 25 20 76 .
...7......".% v
0050 d7 31 78 66 8
7 45 40 23 16 74 18
fc e3 0e 87 28 .
1xf.E@#.t.....(
0060 80 5e 92 08 e
7 6b a9 da 8c 55 81
c1 a9 52 d9 bc .
^...k...U...R..
0070 f5 c8 2d c8 a
a c8 3e 62 ff 3f 54
ee d3 cb 9f e1 .
.-...>b.?T.....
0080 d5 47 7e ce 5
a c7 f1 ff b1 ff fb
92 04 e9 0f f2 .
G~.Z...........
0090 f1 21 53 03 5
8 c2 50 5e 24 1a 60
63 18 4a 0b dc .
!S.X.P^$.`c.J..
00a0 c9 4a 0c e1 6
b 81 8c 12 29 01 9c
61 29 c2 a3 1d .
J..k...)..a)...
00b0 14 4c 49 b3 3
b 5e 8f eb 6b 02 44
03 99 19 30 ce .
LI.;^..k.D...0.
00c0 4c f4 38 ce 2
d c5 12 75 00 05 e7
63 a4 2c 73 92 L
.8.-..u...c.,s.
00d0 58 6a e1 c2 4
8 9b e8 76 8c 0c 92
35 12 ab a9 63 X
j..H..v...5...c
00e0 95 24 b0 69 1
4 a8 2b 96 f5 29 55
15 00 71 d8 13 .
$.i..+..)U..q..
00f0 1b a4 a7 93 5
b 85 4a 60 ef b1 df
fd 53 c3 4f ef .
...[.J`....S.O.
0100 7f 0c d8 fd b
c 72 d6 7d c7 fe c3

83 44 2a 4c 5d .
....r.}....D*L]
0110 d5 1b af 17 f
a 55 2a 1b 18 a1 26
c9 d8 95 e3 6b .
....U*...&....k
0120 5c c0 80 06 0
5 64 08 8c 49 0a 8c
90 9c b7 93 9c \
....d..I.......
0130 a3 e9 20 f2 d
3 82 32 e6 53 de 2b
41 63 73 ca b6 .
. ...2.S.+Acs..
0140 5f 1f 32 8d 7
7 82 91 26 bb 01 6d
99 9a 83 09 85 _
.2.w..&..m.....
0150 4e a7 d9 ec f
d d8 1f e1 dd 5b 93
ff fe 9b 1c 7a N
........[.....z
0160 de 75 9b 1b 3
a ce e7 72 b1 ec 16
0f 01 56 f0 e1 .
u..:..r.....V..
0170 cb 0f c5 07 2
c b3 ed df 53 34 03
16 22 aa 0a b8 .
...,...S4.."...
0180 12 2c dc 9b 0
c 6d 06 01 80 09 02
20 8b ae 3a e7 .
,...m..... ..:.
0190 cd c3 2b eb 6
2 26 94 e8 a9 69 53
4e 1d 8f 4b 33 .
.+.b&...iSN..K3
01a0 b4 c5 60 6a 1
3 13 e0 61 8b 8f 0d
68 bf 4d dd 73 .
.`j...a...h.M.s
01b0 07 15 98 53 b
6 3b fb 85 ea 67 29
ba 3f fd ea 3f .
..S.;...g).?..?
01c0 04 5d ce b4 1
7 01 5f b9 dc ac 75
82 c1 e0 65 6f .
]...._...u...eo
01d0 0e 1c 9c 35 5
2 aa 4d a9 40 08 e0
30 e2 a6 40 e2 .
..5R.M.@..0..@.
01e0 7d 9a 68 83 0
3 1d 54 25 8c 03 00
08 8b e4 96 7b }
.h...T%.......{
01f0 85 56 0e 72 a
a 84 32 98 08 e9 52
62 c2 b0 af f1 .
V.r..2...Rb....
0200 d5 2f 80 e0 4
3 2e 1b b0 8a 41 23
95 95 a7 a8 a9 .
/..C....A#.....
0210 76 0b 6e b9 6
d 4e 49 f5 03 ee 17
c9 4d 26 3f 76 v

.n.mNI.....M&?v
0220 cc 65 eb ef 7
2 82 53 62 c5 7f c3
ff fb 92 04 e8 .
e..r.Sb........
0230 8f f2 f0 24 5
2 83 38 ca 50 5d 44
7a 40 67 18 4a .
..$R.8.P]Dz@g.J
0240 0c 6c 87 48 0
d 67 09 41 7d 90 e8
c1 ac 61 28 2e .
l.H.g.A}....a(.
0250 73 f7 f7 fe e
9 d4 8e e5 32 36 36
bf fd 45 e1 15 s
.......266..E..
0260 30 8f 83 59 b
0 aa 07 23 81 98 30
04 95 20 2d 70 0
..Y...#..0.. -p
0270 14 1c a9 06 d
8 aa 92 e9 29 88 72
29 0c 46 ac 89 .
.......).r).F..
0280 b0 35 04 cf e
2 cb e1 b8 38 0b 87
48 45 01 a5 20 .
5......8..HE..
0290 5b f6 b2 50 1
8 98 6c 06 d4 3b 27
bb 2f dc 2f 18 [
..P..l..;'././.
02a0 cd 8f fd ce d
2 bc 7c ee aa ae 1c
2b fe 15 b9 ce .
.....|....+....
02b0 dd fb ff 77 1
8 19 95 07 78 e4 2f
6f ff a1 1e 42 .
..w....x./o...B
02c0 c2 9d e1 09 5
0 4c 98 15 54 10 b4
26 f2 52 54 b9 .
...PL..T..&.RT.
02d0 77 12 b0 84 4
5 41 43 28 66 05 ed
a7 30 49 8c 0e w
...EAC(f...0I..
02e0 11 1a 92 d9 a
d 2c 82 1f d8 c8 51
fa 63 0e e5 78 .
....,....Q.c..x
02f0 87 72 63 a5 0
8 1a 5d 26 15 a6 e5
4d 76 06 af 73 .
rc...]&...Mv..s
0300 ed 4e f3 f1 9
6 c1 50 46 f3 e5 67
16 73 7c b9 98 .
N....PF..g.s|..
0310 c9 15 9e 13 2
1 fa 76 58 7b d7 fd
49 5a 0e 40 62 .
...!.vX{..IZ.@b
0320 c3 82 a3 91 8
1 31 26 c0 a1 53 7a
05 14 00 54 f2 .
....1&..Sz...T.

0330 97 0e b1 71 0
e 0c 25 0e 82 4e cb
4c 61 94 10 12 .
..q..%..N.La...
0340 1e 99 c2 b4 e
3 c4 e4 c3 23 9d c8
03 43 b8 87 72 .
.......#...C..r
0350 62 e6 12 b5 2
b 94 7a f3 76 a6 a1
91 53 d2 76 6b b
...+.z.v...S.vk
0360 f9 f8 d9 ad 2
8 e7 fc a9 fd b1 9f
2b 67 cd 77 7a .
...(......+g.wz
0370 ef dd 61 63 5
a 7b 2c 67 ad 2f 48
e0 f3 9e 68 df .
.acZ{,g./H...h.
0380 98 04 84 31 2
3 80 a0 a4 a2 32 8a
1c 17 a8 8a 42 .
..1#....2.....B
0390 ac c8 5e a2 8
1 b8 b7 10 56 50 01
90 44 60 bb c8 .
.^.....VP..D`..
03a0 59 5e 59 3b 2
f 8c b0 f7 40 29 74
41 b7 27 8a 2e Y
^Y;/...@)tA.'..
03b0 8f 0a 5c 5b 7
4 ac 4e f9 f8 94 e4
ae 55 ee ef 69 .
.\[t.N.....U..i
03c0 f7 fd b9 9e 5
4 92 ca bc b9 07 c8
35 97 ff fb 92 .
...T......5....
03d0 04 e8 8f f3 0
b 25 51 83 58 ca 50
60 64 ba 20 67 .
....%Q.X.P`d. g
03e0 18 4a 0b b4 8
5 46 0c e7 29 41 75
92 a8 81 ac 65 .
J...F..)Au....e
03f0 28 4f 8c 26 6
6 30 83 b7 76 ff df
fc 48 84 0f 3a (
O.&f0..v...H..:
0400 3b 63 cd 9a 6
1 11 72 54 46 24 72
f2 06 80 56 21 ;
c..a.rTF$r...V!
0410 5b 8a c4 25 4
0 38 f5 30 0f b5 94
80 a2 d0 19 49 [
..%@8.0.......I
0420 41 79 92 02 e
d 2c ec fc 12 d7 dd
83 0a 27 69 fa A
y...,.......'i.
0430 27 41 28 55 d
4 68 38 e9 f0 9b f9
be d1 49 5c d6 '
A(U.h8......I\.
0440 31 1c ab f7 7

d a9 9e 52 49 cc 71
d4 0d 21 a8 95 1
...}..RI.q..!..
0450 85 85 83 3c 7
a 6b a5 3a da ce 84
49 59 47 e9 84 .
..<zk.:...IYG..
0460 e5 86 ba 48 b
8 1d 56 82 9e e1 10
a0 f9 48 a3 83 .
..H..V......H..
0470 11 46 3a 21 9
2 4b 3a 16 d6 1b 05
1c ea 8e 82 8f .
F:!.K:.........
0480 ad b6 10 e4 d
5 05 03 15 16 68 68
23 11 17 82 f3 .
........hh#....
0490 42 86 ba 48 2
6 4d 09 81 ad 39 98
c2 2a c3 57 71 B
..H&M...9..*.Wq
04a0 a6 ee 37 6e 5
6 82 e0 ea 93 b5 2d
ca 6a 61 bb 99 .
.7nV.....-.ja..
04b0 34 a0 05 00 5
3 ca e9 f8 48 ba 2c
84 3d 9a 40 8d 4
...S...H.,.=.@.
04c0 9b 00 81 01 1
9 5e 22 a1 dd d4 f2
27 a1 2a 8a f6 .
....^"....'.*..
04d0 2a 03 7a 5c a
1 30 c6 cb 2d 19 4b
72 e8 b7 f1 57 *
.z\.0..-.Kr...W
04e0 cb 97 ef 2e 0
0 31 92 64 50 22 70
6e e2 48 7f 50 .
....1.dP"pn.H.P
04f0 98 c1 a1 99 1
5 33 d9 84 26 95 f6
af 56 9b 3c 6b .
....3..&...V.<k
0500 d6 d4 dc 82 e
4 b6 a6 72 9a 98 6e
e6 4d 28 e2 a0 .
......r..n.M(..
0510 5d cf 59 3f 6
8 49 57 0e 41 82 80
5f b0 e2 c2 24 ]
.Y?hIW.A.._...$
0520 e3 dc
.
.
No. Time
Source
Destination
Protocol
Length Info
40 1.230221000
pc13.home
cust-74-12412-138.dllstx01.cor

exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=20910 Win=42525 Le
n=0
Frame 40: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.280151000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.280151000 s
econds
[Time delta fro
m previous captured
frame: 0.000175000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 1.230221000 sec
onds]
Frame Number: 4
0
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa

gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f25 (20261)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set

Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 20910
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 20910 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 42525
[Calculated win
dow size: 42525]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 39]
[The RTT to
ACK the segment wa
s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 25 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O%@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 b3 db 50 10 .
....P..N.+...P.
0030 a6 1d 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
41 1.232999000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
881 http49
574 [PSH, ACK] Seq=
20910 Ack=1 Win=46
Len=827
Frame 41: 881 bytes
on wire (7048 bits
), 881 bytes captur
ed (7048 bits) on i

nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.282929000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.282929000 s
econds
[Time delta fro
m previous captured
frame: 0.002778000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00277800
0 seconds]
[Time since ref
erence or first fra
me: 1.232999000 sec
onds]
Frame Number: 4
1
Frame Length: 8
81 bytes (7048 bits
)
Capture Length:
881 bytes (7048 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
67
Identification:
0xf187 (61831)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c54 [validatio
n disabled]

[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 20910, Ack: 1
, Len: 827
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 827]
Sequence number
: 20910 (relativ
e sequence number)
[Next sequence
number: 21737 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .

.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa83
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 827]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 63 f1 87 4
0 00 31 06 3c 54 4a
7c 0c 8a c0 a8 .
c..@.1.<TJ|....
0020 01 0b 00 50 c
1 a6 2b c8 b3 db 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e a8 30 0
0 00 91 e0 00 21 69
82 65 1a 60 18 .
..0.....!i.e.`.
0040 80 f4 4f 01 b
2 12 e4 1e 6d a4 18
05 b4 d1 80 54 .
.O.....m......T
0050 05 5f 4c 51 d
f 97 15 0a 0e 10 08
ec 80 91 a1 dc .
_LQ............
0060 01 00 7b 2e b
a 5b f5 ea 9e ca 13
3d 66 86 87 1a .
.{..[.....=f...
0070 97 3b 9f 27 e
b d0 d5 54 f3 d6 66
2f 52 5c 15 69 .
;.'...T..f/R\.i
0080 b5 07 5c ff f
b 92 04 e9 0f f2 fa
1f d0 83 59 c2 .
.\...........Y.
0090 52 5e 43 fa 0
0 6b 38 4a 0b c8 87
42 0c e7 09 41 R
^C..k8J...B...A
00a0 74 10 e8 01 a
c 61 28 d3 2f ac 2c
f1 31 c4 ff f9 t
....a(./.,.1...
00b0 a4 f1 10 26 1

5 38 c8 44 62 20 4c
20 fc 96 c2 dd .
..&.8.Db L ....
00c0 59 60 98 41 d
6 05 90 22 aa 34 6b
88 ec 14 26 e8 Y
`.A...".4k...&.
00d0 03 05 75 47 0
3 45 54 ba 98 91 5f
9f 18 30 78 00 .
.uG.ET..._..0x.
00e0 63 70 29 28 4
3 38 06 01 34 61 f4
f7 94 3a 12 29 c
p)(C8..4a...:.)
00f0 a9 d9 76 33 3
2 5c 6a 56 ee 7c 97
d7 a1 a5 5d f3 .
.v32\jV.|....].
0100 dc a9 8d 25 4
c 82 e6 c7 08 8d 2c
81 b4 44 e9 58 .
..%L.....,..D.X
0110 31 f6 7f b7 f
4 2a 14 aa 30 b4 45
50 e1 8c c2 0a 1
....*..0.EP....
0120 1f 62 04 45 a
f 35 d8 c2 ca 47 79
c3 8e 88 bf 98 .
b.E.5...Gy.....
0130 97 6b 89 69 1
c 51 56 a7 1e 98 80
1a 29 82 0c 99 .
k.i.QV.....)...
0140 95 bd 2b c4 4
b 50 30 4b ae 4a 12
87 40 18 45 a9 .
.+.KP0K.J..@.E.
0150 ba 83 e1 40 c
8 6f 48 86 8b 11 50
30 3d 0b 78 4d .
..@.oH...P0=.xM
0160 88 66 aa 48 e
1 35 32 a5 77 6c fb
df ad 75 31 fd .
f.H.52.wl...u1.
0170 e6 6d 4a 15 2
8 5c 30 a0 4f 38 9e
26 81 43 c3 b9 .
mJ.(\0.O8.&.C..
0180 09 9e c4 5b 3
2 5f 8b d9 9b a0 76
35 2b a2 95 a4 .
..[2_....v5+...
0190 f4 77 13 b5 8
f c7 a2 10 03 75 2c
9c 81 a5 c1 6d .
w.......u,....m
01a0 cc 5d a5 b2 4
f b9 4b 24 aa 87 b2
6b 7d 6c 56 26 .
]..O.K$...k}lV&
01b0 a4 7a 81 f9 c
9 9b 15 2e e5 05 bc
53 d3 b9 cd 54 .
z.........S...T
01c0 c7 3a c3 ac 2
e 6d 2e 35 59 e3 62

77 48 ae cf d1 .
:...m.5Y.bwH...
01d0 a5 5a 20 14 8
9 09 74 3a 8b 5e 34
dd 20 16 18 33 .
Z ...t:.^4. ..3
01e0 0e 73 49 80 8
6 22 d4 6a 43 7d db
7e cd c4 e4 58 .
sI..".jC}.~...X
01f0 6c 51 cd 5b b
d 56 24 08 4b b3 ca
10 a0 04 51 72 l
Q.[.V$.K.....Qr
0200 c7 88 06 08 e
c 8e 3f d9 0a 14 03
43 b0 6e c8 22 .
.....?....C.n."
0210 31 02 94 2f 0
2 88 88 f0 9b bd c6
5d a6 f7 14 59 1
../.......]...Y
0220 9b d9 06 00 c
f ff fb 92 04 eb 8f
f3 14 20 51 03 .
............ Q.
0230 59 c2 50 64 a
4 1a 10 67 38 4a 0b
c4 bb 46 0c e5 Y
.Pd...g8J...F..
0240 a9 81 76 10 a
8 c1 9c 61 28 94 0c
5c 08 52 82 80 .
.v....a(..\.R..
0250 85 f2 eb 44 c
3 34 e2 2f 73 6e c9
e0 27 82 58 ec .
..D.4./sn..'.X.
0260 0c d3 4c 9f 2
1 05 21 6f 51 a7 0e
f9 37 04 dc 6c .
.L.!.!oQ...7..l
0270 56 41 6e 73 3
8 54 70 55 87 e2 1b
3a 8a 10 a0 2c V
Ans8TpU...:...,
0280 a2 8c 30 40 1
4 11 cf d0 f7 17 64
6c 0f 01 70 8f .
.0@......dl..p.
0290 0e 01 a1 84 0
a 53 18 89 f0 63 be
ef a1 6f 15 76 .
....S...c...o.v
02a0 92 2e 38 b3 e
c 02 3c b0 27 c3 f8
ed fe 0e cc 84 .
.8...<.'.......
02b0 73 82 30 10 7
0 54 81 98 aa 05 d3
93 76 57 25 05 s
.0.pT......vW%.
02c0 0a 0a 32 e1 c
e 1a 7b 0b 0a 77 cc
4b 0e db 97 93 .
.2...{..w.K....
02d0 6b 6c ac 26 1
1 be 96 56 54 1a 03
c1 00 8e 25 aa k

l.&...VT.....%.
02e0 40 e0 83 6e 8
4 52 52 c5 a8 8b 8e
03 82 7b 31 5d @
..n.RR......{1]
02f0 af a9 8a 3e 6
9 55 53 d2 ba 73 dc
ab ac 8b 68 4b .
..>iUS..s....hK
0300 0d 9e 92 5d e
b d4 7e cf 76 ff fc
63 bf 89 3e 7e .
..]..~.v..c..>~
0310 c9 6d d0 0c d
3 9c 16 38 ca 65 c9
b8 f9 e0 8a 51 .
m.....8.e.....Q
0320 26 17 41 9b 6
4 73 b2 c1 2d 0c a4
6a 8c 84 39 2b &
.A.ds..-..j..9+
0330 7d 93 11 e0 2
7 3e 2c 32 40 44 73
43 27 a1 60 60 }
...'>,2@DsC'.``
0340 e6 93 0a 23 3
8 6a d0 91 78 b3 22
67 3c 9d 59 e4 .
..#8j..x."g<.Y.
0350 9a 4f 63 2d 4
9 9f 8b f4 11 5e 76
fb 7f 37 47 91 .
Oc-I....^v..7G.
0360 7c 59 d3 54 c
0 f1 7d 7e f2 ea 7b
d2 ff ff ff fe |
Y.T..}~..{.....
0370 2a
*
No. Time
Source
Destination
Protocol
Length Info
42 1.245114000
pc13.home
ham02s12-inf24.1e100.net TCP
54 51501
https [ACK] Seq=42
Ack=42 Win=16638 Le
n=0
Frame 42: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.295044000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.295044000 s
econds
[Time delta fro
m previous captured
frame: 0.012115000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01211500
0 seconds]
[Time since ref
erence or first fra
me: 1.245114000 sec
onds]
Frame Number: 4
2
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: TCP]
[Coloring Rule
String: tcp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: ham02s12-in
-f24.1e100.net (173
.194.113.184)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f26 (20262)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: ha
m02s12-in-f24.1e100
.net (173.194.113.1
84)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]

Transmission Contro
l Protocol, Src Por
t: 51501 (51501), D
st Port: https (443
), Seq: 42, Ack: 42
, Len: 0
Source Port: 51
501 (51501)
Destination Por
t: https (443)
[Stream index:
2]
[TCP Segment Le
n: 0]
Sequence number
: 42 (relative s
equence number)
Acknowledgment
number: 42 (rela
tive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 16638
[Calculated win
dow size: 16638]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe14
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0

[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 33]
[The RTT to
ACK the segment wa
s: 0.260394000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 26 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
(O&@...........
0020 71 b8 c9 2d 0
1 bb c8 47 4e cc 37
c0 00 2e 50 10 q
..-...GN.7...P.
0030 40 fe e1 48 0
0 00
@
..H..
No. Time
Source
Destination
Protocol
Length Info
43 1.369049000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=21737
Ack=1 Win=46 Len=1
260
Frame 43: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.418979000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.418979000 s
econds
[Time delta fro
m previous captured
frame: 0.123935000
seconds]
[Time delta fro
m previous displaye

d frame: 0.12393500
0 seconds]
[Time since ref
erence or first fra
me: 1.369049000 sec
onds]
Frame Number: 4
3
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co

m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf188 (61832)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aa2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 21737, Ack: 1
, Len: 1260
Source Port: ht
tp (80)

Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 21737 (relativ
e sequence number)
[Next sequence
number: 22997 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x00f
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2087]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 88 4
0 00 31 06 3a a2 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 b7 16 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 00 f9 0
0 00 21 ba 16 37 44
80 73 da 53 05 .
.....!..7D.s.S.
0040 7c 5f 67 d2 1
e 66 e0 18 cc 08 0f
09 69 51 38 19 |
_g..f......iQ8.
0050 45 00 aa 66 5
0 d3 26 d0 3c 54 b9
9e 54 f4 18 55 E
..fP.&.<T..T..U
0060 69 a8 44 3a 8
2 88 00 4d 51 58 c2
32 0a b8 a9 52 i
.D:...MQX.2...R
0070 ec 8e 88 83 6
8 e2 63 0a ea 94 c1
a4 22 ae c8 8e .
...h.c....."...
0080 8c 88 44 de 4
9 45 c5 07 0f 1c aa
db ff fb 92 04 .
.D.IE..........
0090 e9 0f f2 eb 3
0 56 03 0f 42 60 5c
65 ea c0 61 e8 .
...0V..B`\e..a.
00a0 4c 4b d4 bb 5
c 0c bd 09 89 8b 17
2b 81 86 25 31 L
K..\......+..%1
00b0 13 24 e1 3f a
7 a0 cb be a2 53 aa
07 6a 03 84 c5 .
$.?.....S..j...
00c0 6b 44 e2 b3 f
7 ea 02 56 65 04 d9
5e 26 89 64 83 k
D.....Ve..^&.d.
00d0 4b b3 8d 26 f
4 0d 22 9a 19 11 a0
a8 5c 97 38 d1 K
..&..".....\.8.
00e0 72 89 c2 ac 1
d d4 4a 22 40 c8 57
7c d8 bf 59 98 r
.....J"@.W|..Y.
00f0 c8 e5 3e 90 a
9 6d a8 74 b5 48 67
fd db b1 79 27 .
.>..m.t.Hg...y'
0100 e0 88 c8 ec 1
6 32 22 ff 0f 05 69
e5 e7 ff d0 c0 .
....2"...i.....

0110 cd 8b 60 23 8
2 9d 1d 0c 1d 7b 0a
7a 5a 25 03 49 .
.`#.....{.zZ%.I
0120 23 e4 76 b6 c
a 4b 21 5b 23 73 b6
38 bc a3 cd 2d #
.v..K![#s.8...0130 29 b6 aa 25 b
3 39 aa a5 c6 e8 a2
76 9d ec d2 7f )
..%.9.....v....
0140 fc 69 7d f5 6
5 d5 22 d0 ff 61 a3
f6 2b 32 91 df .
i}.e."..a..+2..
0150 31 94 99 3b 6
d fe 37 c7 9b 87 78
3d b2 35 f7 ba 1
..;m.7...x=.5..
0160 7c 58 4c 20 6
d 47 12 20 08 b8 3e
a6 51 fe ef 2e |
XL mG. ..>.Q...
0170 b7 bd 28 ea 0
2 4b 77 7f 21 99 14
b2 ac 0b 16 92 .
.(..Kw.!.......
0180 e6 60 e2 17 0
4 cf 32 92 28 c0 93
25 ee e4 66 07 .
`....2.(..%..f.
0190 a9 71 c7 6a 7
a 68 51 54 94 49 8d
68 ec 20 1e d6 .
q.jzhQT.I.h. ..
01a0 5c 84 22 91 f
8 c6 17 19 37 bc de
34 73 5d 25 0c \
.".....7..4s]%.
01b0 89 25 e2 ba b
9 4b b1 c8 68 fb c7
fc c5 ea ed 13 .
%...K..h.......
01c0 4a a6 aa db d
c 3d ca 54 fd 0f f8
a8 32 a8 f2 f5 J
....=.T....2...
01d0 6e e9 90 90 f
5 d2 99 3a 8a 1d 4d
c7 71 10 31 4b n
......:..M.q.1K
01e0 56 c5 7b d3 4
4 e9 08 52 52 50 9c
34 f1 55 72 71 V
.{.D..RRP.4.Urq
01f0 39 ad 2d ca a
9 6d 5d 37 df 90 64
3e 3f c9 2f 74 9
.-..m]7..d>?./t
0200 8e 4c 2e 42 a
9 7e 7e 76 43 7d b1
ff a5 57 bd ee .
L.B.~~vC}...W..
0210 b6 6a b7 7e 5
e 17 42 89 f3 3b a9
b6 f8 d3 24 36 .
j.~^.B..;....$6
0220 07 44 b3 a0 7

2 dd 4b a9 d2 1a 47
97 b1 bb ff fb .
D..r.K...G.....
0230 92 04 ea 0f f
2 f4 39 58 03 09 2a
e0 56 26 6b 10 .
.....9X..*.V&k.
0240 61 26 5c 4c 7
9 05 62 0c 24 cb 81
94 a3 ec 41 83 a
&\Ly.b.$.....A.
0250 21 70 37 6e d
e 16 d7 f8 95 8e eb
d9 33 f4 ad 01 !
p7n........3...
0260 b8 83 3c 3e c
b 8a 1c ac 51 f0 33
f4 98 45 44 9f .
.<>....Q.3..ED.
0270 d2 c3 48 c2 6
7 d5 07 3b 9b dd 27
f5 7d 38 19 ac .
.H.g..;..'.}8..
0280 5f 2f 72 d5 7
b e3 66 63 de 26 37
ee 7f 25 34 b7 _
/r.{.fc.&7..%4.
0290 dd a9 b7 2f 2
f 89 ce 8f c6 8a 4b
f8 26 a8 c1 0b .
..//.....K.&...
02a0 1a 76 61 8a 8
d 8c 38 ff 33 a0 68
10 74 b7 5f 2c .
va...8.3.h.t._,
02b0 ee 4d b1 1a 6
a f3 df 6e de 9d ff
96 0d 9d fe ef .
M..j..n........
02c0 fd 3e 29 87 4
e 3a 36 82 87 28 8c
a7 08 0b 29 d5 .
>).N:6..(....).
02d0 84 54 47 d5 a
4 78 d7 62 ef 3b 55
ad 1d 66 2b 59 .
TG..x.b.;U..f+Y
02e0 e4 79 7b 16 e
1 63 30 bb 98 60 82
a6 90 28 54 54 .
y{..c0..`...(TT
02f0 32 94 e8 3f 3
2 6d 41 31 89 29 0f
37 cc d4 bd ab 2
..?2mA1.).7....
0300 b9 55 9a 5c 7
3 1a 08 49 a0 4a ca
83 c6 54 25 b2 .
U.\s..I.J...T%.
0310 94 ed 6b 46 8
8 8f 76 6f f8 c2 08
7e c1 25 e1 f8 .
.kF..vo...~.%..
0320 01 58 6d 0a 3
6 a0 e5 dd eb 26 fd
b3 eb 6e 99 a9 .
Xm.6....&...n..
0330 01 a9 ca 7c 2
7 8e ee 80 16 43 74

df 2b 22 ec e9 .
..|'....Ct.+"..
0340 b1 24 39 b1 2
e 55 b6 9d 65 a9 37
77 9a ac de 51 .
$9..U..e.7w...Q
0350 58 e7 be 67 2
4 a8 89 fe 4d 78 ef
a6 1f f2 59 ff X
..g$...Mx....Y.
0360 fb 91 df c7 d
f 16 ef af 52 8e 7f
a7 7e 60 70 ba .
.......R...~`p.
0370 8a a5 9a 59 6
3 f5 62 95 83 84 03
6a 43 09 8b ba .
..Yc.b....jC...
0380 0c 32 72 bc d
e a3 48 44 b3 1c a7
e3 b9 e3 25 a5 .
2r...HD......%.
0390 19 fe ca a9 0
d ce 77 d8 6b 6e 53
6e 68 bd bf f3 .
.....w.knSnh...
03a0 9b 77 5c b0 6
b 1c 76 66 67 c2 d9
fc e6 2d ee 3c .
w\.k.vfg....-.<
03b0 6c 69 93 de d
1 ca d4 79 fd e1 95
5b 1f bc a3 f3 l
i.....y...[....
03c0 c9 df 7a 02 b
2 0b 35 78 26 2e f8
de de 10 ad 64 .
.z...5x&......d
03d0 ff fb 92 04 e
a 0f f3 0f 30 d8 81
e9 32 62 63 45 .
.......0...2bcE
03e0 fb 10 3c c9 4
c 4b 0c df 60 0c 24
6b 81 77 a3 ec .
.<.LK..`.$k.w..
03f0 00 c3 19 70 2
f 49 f0 a4 98 a9 d2
fd 19 be 15 d1 .
..p/I..........
0400 c4 24 b1 16 7
b 7d 8d 30 86 32 4d
3a ec a1 48 47 .
$..{}.0.2M:..HG
0410 73 8c b1 3d b
2 8e 12 28 bc cf aa
1c 5b 96 28 21 s
..=...(....[.(!
0420 b0 d0 07 16 0
6 8f 74 41 c3 49 81
ea 61 28 e2 b7 .
.....tA.I..a(..
0430 54 b2 96 b2 7
c 94 37 c9 1c 51 33
f4 39 ea 7c ea T
...|.7..Q3.9.|.
0440 8d 8d 1d 2e 1
d 15 0e aa f0 1a 0d
4a 8d ad 56 91 .

..........J..V.
0450 79 87 af d0 e
9 41 0b b9 5c 91 0c
42 78 0e 82 65 y
....A..\..Bx..e
0460 f4 ad 29 64 0
8 a0 4d c2 c9 21 3e
4a c7 6a 71 75 .
.)d..M..!>J.jqu
0470 15 c4 08 03 a
a aa c4 cf 33 0e 1f
1e 46 c6 6b aa .
.......3...F.k.
0480 4a 36 93 b7 0
6 b2 8a 09 a8 64 d1
7e 41 f3 1f 6d J
6.......d.~A..m
0490 54 e6 c6 d6 f
3 07 5e 95 d7 2c ef
f6 65 fc d7 9e T
.....^..,..e...
04a0 e5 2a fb b1 e
0 d8 72 5c 4c b1 34
e0 22 18 7c f5 .
*....r\L.4.".|.
04b0 43 40 8c 2a b
f ce 7f 5a e8 bb 24
81 a0 85 a7 94 C
@.*...Z..$.....
04c0 2e a3 37 35 2
b 9c 63 93 c0 f2 48
4f 99 5f 1e 9c .
.75+.c...HO._..
04d0 59 e0 ed b1 1
1 75 63 0d 31 1e 8d
18 9d 74 aa 73 Y
....uc.1....t.s
04e0 74 52 8c 97 5
7 45 ce a8 f0 13 5e
af 66 3e 2f c7 t
R..WE....^.f>/.
04f0 c1 f1 3d f0 a
b 39 3e ee 6b 66 73
73 e9 bc 4b 36 .
.=..9>.kfss..K6
0500 7b 38 42 bf a
7 b3 7f 6a 51 8c a5
04 b3 ef ff 77 {
8B....jQ......w
0510 3f f5 aa 66 2
5 7c 5c e3 0d a0 87
e9 4d b7 59 15 ?
..f%|\.....M.Y.
0520 82 88
.
.
No. Time
Source
Destination
Protocol
Length Info
44 1.369229000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h

ttp [ACK] Seq=1 Ack

=22997 Win=42003 Le
n=0
Frame 44: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.419159000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.419159000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 1.369229000 sec
onds]
Frame Number: 4
4
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f27 (20263)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 22997
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 22997 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 42003
[Calculated win
dow size: 42003]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 43]
[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 27 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O'@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 bc 02 50 10 .
....P..N.+...P.
0030 a4 13 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
45 1.385049000
livebox.home
pc13.home
DNS
143 Standard que
ry response 0xaf5a
PTR cust-74-124-12
-138.dllstx01.corex
change.com
Frame 45: 143 bytes
on wire (1144 bits
), 143 bytes captur
ed (1144 bits) on i
nterface 0
Interface id: 0

(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.434979000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.434979000 s
econds
[Time delta fro
m previous captured
frame: 0.015820000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01582000
0 seconds]
[Time since ref
erence or first fra
me: 1.385049000 sec
onds]
Frame Number: 4
5
Frame Length: 1
43 bytes (1144 bits
)
Capture Length:
143 bytes (1144 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3

b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
29
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb70f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)

Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49779 (49779)
Source Port: do
main (53)
Destination Por
t: 49779 (49779)
Length: 109
Checksum: 0x0bf
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(response)
[Request In: 22
]
[Time: 0.538242
000 seconds]
Transaction ID:
0xaf5a
Flags: 0x8180 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .0.. .
... .... = Authorit
ative: Server is no
t an authority for
domain
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica

ted by the server

.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs:
0
Additional RRs:
0
Queries
138.12.124.
74.in-addr.arpa: ty
pe PTR, class IN
Name: 1
38.12.124.74.in-add
r.arpa
[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Answers
138.12.124.
74.in-addr.arpa: ty
pe PTR, class IN, c
ust-74-124-12-138.d
llstx01.corexchange
.com
Name: 1
38.12.124.74.in-add
r.arpa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 86400
Data le
ngth: 45
Domain
Name: cust-74-124-1
2-138.dllstx01.core
xchange.com
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 81 00 00 4
0 00 40 11 b7 0f c0
a8 01 01 c0 a8 .
...@.@.........
0020 01 0b 00 35 c
2 73 00 6d 0b fc af
5a 81 80 00 01 .
..5.s.m...Z....
0030 00 01 00 00 0
0 00 03 31 33 38 02
31 32 03 31 32 .

......138.12.12
0040 34 02 37 34 0
7 69 6e 2d 61 64 64
72 04 61 72 70 4
.74.in-addr.arp
0050 61 00 00 0c 0
0 01 c0 0c 00 0c 00
01 00 01 51 80 a
.............Q.
0060 00 2d 12 63 7
5 73 74 2d 37 34 2d
31 32 34 2d 31 .
-.cust-74-124-1
0070 32 2d 31 33 3
8 08 64 6c 6c 73 74
78 30 31 0b 63 2
-138.dllstx01.c
0080 6f 72 65 78 6
3 68 61 6e 67 65 03
63 6f 6d 00
o
rexchange.com.
No. Time
Source
Destination
Protocol
Length Info
46 1.421977000
pc13.home
livebox.home
DNS
84 Standard que
ry 0x69b5 PTR 1.1.
168.192.in-addr.arp
a
Frame 46: 84 bytes
on wire (672 bits),
84 bytes captured
(672 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.471907000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.471907000 s
econds
[Time delta fro
m previous captured
frame: 0.036928000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03692800
0 seconds]
[Time since ref
erence or first fra
me: 1.421977000 sec
onds]

Frame Number: 4
6
Frame Length: 8
4 bytes (672 bits)
Capture Length:
84 bytes (672 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
0
Identification:
0x4f29 (20265)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4977
9 (49779), Dst Port
: domain (53)
Source Port: 49
779 (49779)
Destination Por
t: domain (53)
Length: 50
Checksum: 0x83a
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(query)
[Response In: 4
7]

Transaction ID:
0x69b5
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
1.1.168.192
.in-addr.arpa: type
PTR, class IN
Name: 1
.1.168.192.in-addr.
arpa
[Name L
ength: 24]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 46 4f 29 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
FO)............
0020 01 01 c2 73 0
0 35 00 32 83 a0 69
b5 01 00 00 01 .
..s.5.2..i.....
0030 00 00 00 00 0
0 00 01 31 01 31 03
31 36 38 03 31 .
......1.1.168.1
0040 39 32 07 69 6
e 2d 61 64 64 72 04
61 72 70 61 00 9
2.in-addr.arpa.

0050 00 0c 00 01
.
...
No. Time
Source
Destination
Protocol
Length Info
47 1.434055000
livebox.home
pc13.home
DNS
110 Standard que
ry response 0x69b5
PTR livebox.home
Frame 47: 110 bytes
on wire (880 bits)
, 110 bytes capture
d (880 bits) on int
erface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.483985000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.483985000 s
econds
[Time delta fro
m previous captured
frame: 0.012078000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01207800
0 seconds]
[Time since ref
erence or first fra
me: 1.434055000 sec
onds]
Frame Number: 4
7
Frame Length: 1
10 bytes (880 bits)
Capture Length:
110 bytes (880 bit
s)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]

Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 9
6
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb730 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49779 (49779)
Source Port: do
main (53)
Destination Por
t: 49779 (49779)
Length: 76
Checksum: 0x5fe
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(response)
[Request In: 46
]
[Time: 0.012078
000 seconds]
Transaction ID:
0x69b5
Flags: 0x8580 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .1.. .
... .... = Authorit
ative: Server is an

authority for doma

in
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs:
0
Additional RRs:
0
Queries
1.1.168.192
.in-addr.arpa: type
PTR, class IN
Name: 1
.1.168.192.in-addr.
arpa
[Name L
ength: 24]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Answers
1.1.168.192
.in-addr.arpa: type
PTR, class IN, liv
ebox.home
Name: 1
.1.168.192.in-addr.
arpa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 0
Data le

ngth: 14
Domain
Name: livebox.home
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 60 00 00 4
0 00 40 11 b7 30 c0
a8 01 01 c0 a8 .
`..@.@..0......
0020 01 0b 00 35 c
2 73 00 4c 5f e3 69
b5 85 80 00 01 .
..5.s.L_.i.....
0030 00 01 00 00 0
0 00 01 31 01 31 03
31 36 38 03 31 .
......1.1.168.1
0040 39 32 07 69 6
e 2d 61 64 64 72 04
61 72 70 61 00 9
2.in-addr.arpa.
0050 00 0c 00 01 c
0 0c 00 0c 00 01 00
00 00 00 00 0e .
...............
0060 07 6c 69 76 6
5 62 6f 78 04 68 6f
6d 65 00
.
livebox.home.
No. Time
Source
Destination
Protocol
Length Info
48 1.440048000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=22997
Ack=1 Win=46 Len=1
260
Frame 48: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.489978000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.489978000 s
econds

[Time delta fro

m previous captured
frame: 0.005993000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00599300
0 seconds]
[Time since ref
erence or first fra
me: 1.440048000 sec
onds]
Frame Number: 4
8
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf189 (61833)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aa1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por

t: http (80), Dst P

ort: 49574 (49574),
Seq: 22997, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 22997 (relativ
e sequence number)
[Next sequence
number: 24257 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe41
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]

Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 89 4
0 00 31 06 3a a1 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 bc 02 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e e4 19 0
0 00 6a 4a 45 ff 9b
a0 86 aa 53 1a .
.....jJE.....S.
0040 9c 02 17 7a 9
1 1a 82 56 4a 2d e7
b0 83 04 67 61 .
..z...VJ-....ga
0050 ba d0 79 db 6
e c5 dd 1a c7 ae b1
1c 28 51 2c 13 .
.y.n.......(Q,.
0060 ae fe 58 b8 a
8 d9 ce 64 be d3 4b
3e 10 41 b5 ed .
.X....d..K>.A..
0070 26 fe eb a6 e
8 f8 df d7 98 5e 14
05 11 82 ad 7b &
........^.....{
0080 01 58 00 58 3
a 72 ff fb 92 04 eb
0f f2 b6 3b d7 .
X.X:r........;.
0090 83 09 32 e0 6
1 27 3a f0 3d 28 5c
0c 78 e7 5c 0c .
.2.a':.=(\.x.\.
00a0 24 cb 81 91 a
2 6b c0 f4 a5 70 07
ac b2 9b 40 2f $
....k...p....@/
00b0 fa ca b1 e4 2
b 82 a1 0a 27 a7 3b
12 9b 6b 84 b8 .
...+...'.;..k..
00c0 4a 66 90 46 d
9 24 40 9a ac 92 0f
b8 b8 10 70 16 J
f.F.$@.......p.
00d0 76 77 a5 2c 2
4 92 cc 0d 76 26 1e
c5 b1 13 13 06 v
w.,$...v&......
00e0 00 80 e0 f5 b
9 8e 86 b0 d3 12 87
2e 41 37 6c a4 .
...........A7l.
00f0 c8 70 4c 8a f
2 ee e5 33 3a 1a 3a

b8 71 88 37 92 .
pL....3:.:.q.7.
0100 58 51 15 cf 2
1 18 6d f1 23 d7 ef
82 87 d4 b9 6a X
Q..!.m.#......j
0110 e2 db cc 2f 1
5 84 45 60 b2 a1 0d
19 5b a8 ad 5f .
../..E`....[.._
0120 a4 a1 2a 39 c
2 f2 86 b9 d0 8b 56
8a 12 b8 74 c4 .
.*9......V...t.
0130 66 5a 6e 24 c
4 fb d5 ec 61 2f e3
75 fc cc 97 0c f
Zn$....a/.u....
0140 58 71 5c cb 8
7 de 59 8b 11 fc be
ea ca 89 d7 7a X
q\...Y........z
0150 b8 78 ee 6a f
7 7c 75 33 2e 71 8a
03 2b 40 a0 51 .
x.j.|u3.q..+@.Q
0160 a0 52 64 8f c
2 89 23 20 82 c7 c7
ca 86 0f 3d 49 .
Rd...# ......=I
0170 6a fd 07 e9 8
8 39 05 e9 c2 9b 37
20 f6 e3 f1 4e j
....9....7 ...N
0180 5a 0c 7f cd c
4 61 49 35 15 4e 57
2c 1d 1a b9 48 Z
....aI5.NW,...H
0190 da ad 34 65 3
a b8 bb 7d 20 9b 58
b3 8b cb 84 cf .
.4e:..} .X.....
01a0 49 88 be 0f b
8 d1 ae a9 da f5 55
2f 87 75 9b 17 I
.........U/.u..
01b0 c2 f5 52 ae f
f 8a a3 f0 eb bf 44
da 99 df 13 0d .
.R.......D.....
01c0 29 b8 59 ff 2
e be e7 e1 ce bf 87
9c 50 d9 66 6b )
.Y.........P.fk
01d0 bb e8 70 08 4
0 af 1d c1 30 03 d0
f9 72 95 49 02 .
.p.@...0...r.I.
01e0 24 f3 48 2e 7
f 70 ba a6 e3 29 98
4e e4 88 17 93 $
.H..p...).N....
01f0 3b b1 1e cf 4
c 15 8c 0f c4 95 90
86 22 13 65 05 ;
...L.......".e.
0200 58 55 c4 45 8
a b7 5c e2 25 88 6e
5a a7 96 91 c7 X

U.E..\.%.nZ....
0210 52 53 25 8b 6
b 79 a6 a7 54 3b 19
24 ce 93 36 97 R
S%.ky..T;.$..6.
0220 18 bc 91 78 9
0 35 58 9c ff fb 92
04 ea 0f f2 ea .
..x.5X.........
0230 39 d7 03 06 3
2 e0 61 e8 9a e0 3c
c8 5c 0b e8 df 9
...2.a...<.\...
0240 5c 0c 24 cb 8
1 7e a3 eb c0 f3 2d
70 32 a0 56 d0 \
.$..~....-p2.V.
0250 ac 5c b6 05 5
b 2b 63 ae d6 f1 c7
05 24 52 24 5b .
\..[+c.....$R$[
0260 eb ab 19 8c 8
d c6 68 3c f3 70 b9
53 77 b3 62 ee .
.....h<.p.Sw.b.
0270 48 84 75 1d d
c 06 bf a6 0a e4 0f
c6 56 42 53 0b H
.u.........VBS.
0280 07 bb 89 85 c
1 69 c3 5c cd 26 9c
63 6e 83 b2 c4 .
....i.\.&.cn...
0290 04 ba 78 09 d
c 26 11 a8 7a d9 31
6b 70 84 c5 ac .
.x..&..z.1kp...
02a0 5c c0 e3 ed b
7 2e d4 6b 22 2a d7
ca f7 f2 f2 6d \
......k"*.....m
02b0 5f 0d 26 ba f
3 83 19 22 a4 01 bf
a6 00 6e ce 09 _
.&....".....n..
02c0 20 d8 a9 29 5
d ca f5 32 9d ca 8c
d1 7a 86 41 b3
..)]..2....z.A.
02d0 6b ec d3 c5 6
e 13 78 91 ef 96 21
33 90 8a 44 c9 k
...n.x...!3..D.
02e0 26 fa 72 9a b
7 ae d1 9d 17 a8 d4
e6 63 b5 7c 2a &
.r.........c.|*
02f0 18 ff ff fb e
7 bf 48 a8 39 5f cf
c9 bf 9f 54 67 .
.....H.9_....Tg
0300 6d 33 45 0f 1
c 0f 18 15 65 4d 28
e7 5e f6 a8 c2 m
3E.....eM(.^...
0310 d2 6c 5b fe f
a 94 8b e3 9c 54 20
c5 28 be 61 bb .
l[......T .(.a.

0320 0a 48 8b 19 e
b eb 39 06 c5 6b f9
c6 17 88 2d e6 .
H....9..k....-.
0330 5f 29 63 22 d
9 08 a4 4c b2 df 4a
53 1d 9f 72 71 _
)c"...L..JS..rq
0340 f1 10 11 25 1
2 7f a5 b2 68 fb c0
b5 50 11 1c bf .
..%....h...P...
0350 2d cb c6 5b 6
7 e9 f6 17 fe 75 d2
13 ad 83 9f 5f ..[g....u....._
0360 90 fb fd 5c d
4 fe ea 24 92 4f 7b
c2 6d 6c 59 20 .
..\...$.O{.mlY
0370 37 94 76 ef c
2 6a a0 53 24 31 31
45 c7 f5 bf 2c 7
.v..j.S$11E...,
0380 9a 82 e7 6a a
4 47 27 56 87 9c 5e
61 75 59 fa aa .
..j.G'V..^auY..
0390 0b b2 a4 0b 4
4 7b d8 c1 13 a7 f1
57 d3 ec 8c e2 .
...D{.....W....
03a0 fb 20 43 27 5
3 03 11 87 fb d7 77
ab 68 47 ef 38 .
C'S.....w.hG.8
03b0 4a 35 df b6 2
1 f0 dc f4 ec ed ef
6f 0e 46 7b e1 J
5..!......o.F{.
03c0 9a df 69 df 7
b 18 d3 9f fd 55 ff
fb 92 04 ea 0f .
.i.{....U......
03d0 f3 17 3d 56 8
1 e9 42 e0 62 e8 fa
e0 3d 28 5c 0b .
.=V..B.b...=(\.
03e0 30 dd 5c 0c 2
4 cb 81 80 a0 2b 80
f4 99 70 f3 c0 0
.\.$....+...p..
03f0 eb 32 c3 0e 8
1 92 7d 27 28 67 6d
9a f0 62 6a 56 .
2....}'(gm..bjV
0400 34 59 a5 a9 0
f f6 b5 da 92 66 23
96 ad bd 46 dd 4
Y.......f#...F.
0410 6c db 3e b1 c
0 9e ae 87 54 5b 5c
48 8a 67 da 69 l
.>.....T[\H.g.i
0420 86 9b cc cb b
2 10 5b 1b 02 e2 c1
31 bd dd ae e3 .
.....[....1....
0430 0f d8 d0 3e f

1 0a cb bb 9e 46 09
bc 5f c8 2b 86 .
..>.....F.._.+.
0440 d1 2c 6f b7 0
5 27 0c d7 32 72 4c
df ff 15 d5 dc .
,o..'..2rL.....
0450 46 3e 90 5d f
5 9e 68 a4 cb 95 ea
5c 82 18 10 a0 F
>.]..h....\....
0460 68 83 c8 30 1
2 93 f6 dc f0 f3 3a
21 3a d5 1b 7c h
..0......:!:..|
0470 d8 62 12 93 1
a d4 90 73 cd 46 05
17 cc f2 79 03 .
b.....s.F....y.
0480 bf 75 69 0b a
0 6b 9d b5 23 f1 95
bf fc 68 10 82 .
ui..k..#....h..
0490 eb c4 39 5b a
e f0 cf 15 bf fd cd
5e 67 6a ab 6e .
.9[.......^gj.n
04a0 cd 3f 6b 5f b
6 e7 be f9 ff fe f1
1a c9 2b 5e e0 .
?k_.........+^.
04b0 ed e4 88 73 1
a 65 97 2b c0 25 8a
c4 20 7a d2 90 .
..s.e.+.%.. z..
04c0 ea de d6 e2 7
2 3a 55 99 53 6d c6
0c 43 24 c4 c7 .
...r:U.Sm..C$..
04d0 a4 c6 99 6a 3
0 18 27 cc 9a 5a 41
6f dd 0f 1a 76 .
..j0.'..ZAo...v
04e0 b9 3f 92 5a 1
2 8f df a8 a4 f8 75
34 54 42 e0 de .
?.Z......u4TB..
04f0 fd 47 8f 7c 8
d fd 5c 0b f7 68 fb
51 db e7 66 8b .
G.|..\..h.Q..f.
0500 ee ad 07 82 8
d 58 49 8e 0b 99 1e
80 a3 c8 40 2c .
....XI.......@,
0510 f9 ba ea 86 5
6 00 70 24 2a 63 c5
96 97 44 66 65 .
...V.p$*c...Dfe
0520 92 fc
.
.
No. Time
Source
Destination
Protocol
Length Info

49 1.517992000
pc13.home
livebox.home
DNS
86 Standard que
ry 0xc783 PTR 63.4
1.194.173.in-addr.a
rpa
Frame 49: 86 bytes
on wire (688 bits),
86 bytes captured
(688 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.567922000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.567922000 s
econds
[Time delta fro
m previous captured
frame: 0.077944000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07794400
0 seconds]
[Time since ref
erence or first fra
me: 1.517992000 sec
onds]
Frame Number: 4
9
Frame Length: 8
6 bytes (688 bits)
Capture Length:
86 bytes (688 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
2
Identification:
0x4f2b (20267)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4977
9 (49779), Dst Port
: domain (53)
Source Port: 49
779 (49779)
Destination Por
t: domain (53)
Length: 52
Checksum: 0x83a
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(query)
[Response In: 5
2]
Transaction ID:
0xc783
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1

Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
63.41.194.1
73.in-addr.arpa: ty
pe PTR, class IN
Name: 6
3.41.194.173.in-add
r.arpa
[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 48 4f 2b 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
HO+............
0020 01 01 c2 73 0
0 35 00 34 83 a2 c7
83 01 00 00 01 .
..s.5.4........
0030 00 00 00 00 0
0 00 02 36 33 02 34
31 03 31 39 34 .
......63.41.194
0040 03 31 37 33 0
7 69 6e 2d 61 64 64
72 04 61 72 70 .
173.in-addr.arp
0050 61 00 00 0c 0
0 01
a
.....
No. Time
Source
Destination
Protocol
Length Info
50 1.518054000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
881 http49
574 [PSH, ACK] Seq=
24257 Ack=1 Win=46
Len=827
Frame 50: 881 bytes
on wire (7048 bits
), 881 bytes captur
ed (7048 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8

8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.567984000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.567984000 s
econds
[Time delta fro
m previous captured
frame: 0.000062000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00006200
0 seconds]
[Time since ref
erence or first fra
me: 1.518054000 sec
onds]
Frame Number: 5
0
Frame Length: 8
81 bytes (7048 bits
)
Capture Length:
881 bytes (7048 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco

m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
67
Identification:
0xf18a (61834)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c51 [validatio
n disabled]
[Good: Fals
e]
[Bad: False

]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 24257, Ack: 1
, Len: 827
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 827]
Sequence number
: 24257 (relativ
e sequence number)
[Next sequence
number: 25084 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set

Window size val

ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa7a
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2087]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 63 f1 8a 4
0 00 31 06 3c 51 4a
7c 0c 8a c0 a8 .
c..@.1.<QJ|....
0020 01 0b 00 50 c
1 a6 2b c8 c0 ee 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e a7 a2 0
0 00 0a 8b b1 e9 02
17 d1 33 48 fb .
............3H.
0040 2b 26 cd b2 4
2 9e 9a c1 dc 32 7e
e7 9e 77 f3 81 +
&..B....2~..w..
0050 bd 69 69 3e 3
1 87 a2 6d 5d ff dc
91 b2 51 9a fb .
ii>1..m]....Q..
0060 f4 ba a7 87 d
8 0a ad db e8 6f 66
e5 a6 c8 c7 fd .
........of.....
0070 91 ae f0 f3 4
c ef 3b b9 ff f7 9e
8e e1 40 49 e5 .
...L.;......@I.
0080 ff fb 92 04 e
9 0f f3 12 42 56 83
0c 32 e0 5e c8 .
.......BV..2.^.
0090 9a e0 61 88 5
c 0b 69 13 5a 07 a4
cb 81 70 1d eb .
.a.\.i.Z....p..
00a0 80 f4 99 70 d
b 40 4c f9 b2 ab 53
2f 66 43 52 b4 .
..p.@L...S/fCR.
00b0 3f 01 0e 9e 5
7 8b 64 f1 72 e2 8b
68 58 d6 96 d3 ?
...W.d.r..hX...

00c0 39 d5 6a 44 f
5 96 cd b1 09 80 bf
c7 01 60 96 fa 9
.jD.........`..
00d0 29 44 5e b3 1
5 e9 de aa 93 9d 91
2a 14 86 72 ee )
D^........*..r.
00e0 b2 4e 6e 52 5
e d6 92 4d 8e 66 2d
32 49 ef fb e9 .
NnR^..M.f-2I...
00f0 2f ba 5b ee 3
f 69 77 d3 31 0a b5
b4 90 67 d7 fe /
.[.?iw.1....g..
0100 55 95 57 dd 5
8 fd 0b 0e 81 5e 87
85 bb 72 1a a7 U
.W.X....^...r..
0110 1a e0 71 4c 7
2 63 a2 04 aa d8 85
49 25 5a c9 33 .
.qLrc.....I%Z.3
0120 62 98 1b 95 9
5 51 66 bf 4c 5f fa
5c 1d 1f a9 6b b
....Qf.L_.\...k
0130 c8 36 19 ca c
2 fc 65 cb cc cc 0e
36 81 ea 18 82 .
6....e....6....
0140 a8 45 0c b9 8
8 b3 1e c7 f2 48 73
2f 4b 0e d7 63 .
E.......Hs/K..c
0150 ee e2 b7 f1 b
b f7 1f 10 7e b1 33
86 9a 26 28 b0 .
.......~.3..&(.
0160 79 40 40 f9 4
8 b4 75 83 59 a2 a9
1a a9 15 50 10 y
@@.H.u.Y.....P.
0170 55 62 7c d4 5
e cd 05 88 f3 61 a6
c6 6c 86 06 ea U
b|.^....a..l...
0180 d5 20 94 be 5
9 fa 67 d0 0a 7e a5
c6 90 6c 35 a2 .
..Y.g..~...l5.
0190 f2 bb e1 f1 b
c ca c1 0a 85 ca 0d
36 b9 38 79 e3 .
..........6.8y.
01a0 de dd 8f cc 0
8 16 9e 95 fa 42 2a
a3 31 14 77 26 .
........B*.1.w&
01b0 8d 39 a1 b8 8
1 f2 3b 60 ef e9 61
38 bf e9 3f 6f .
9....;`..a8..?o
01c0 28 fb 9e d2 5
7 4d 06 5a ba 70 4d
83 54 0b 40 95 (
...WM.Z.pM.T.@.
01d0 18 e2 ad 5d 2

3 3d 61 dd bb 4a e8
f8 f6 cb 0e b3 .
..]#=a..J......
01e0 ba e2 4c 7e e
4 86 3e c4 7c b5 14
b5 dd e1 df 1b .
.L~..>.|.......
01f0 fe 87 b5 53 a
1 90 ce 91 52 c7 73
f2 b9 22 eb e7 .
..S....R.s.."..
0200 8d f3 26 45 3
c 25 73 59 df 9b be
67 73 be 63 c7 .
.&E<%sY...gs.c.
0210 6d 6e c5 d9 2
c f6 d3 8b d7 7f f1
ff 37 0a d2 0e m
n..,.......7...
0220 16 04 ff fb 9
2 04 eb 8f f3 1d 42
d6 03 0b 32 e0 .
.........B...2.
0230 60 a8 9a d0 3
d 26 5c 0b a0 df 58
0c 25 0b 81 71 `
...=&\...X.%..q
0240 22 ab 41 84 a
1 70 57 9a 7b ed 00
a9 c4 63 04 82 "
.A..pW.{....c..
0250 41 d6 a6 fc 2
f a9 3c ae 92 db 75
7f e1 b7 51 8a A
.../.<...u...Q.
0260 b4 f6 db 0c c
b 3b fe 92 56 d0 91
90 b1 1f 9f 05 .
....;..V.......
0270 6e 7e 73 0e 2
a 79 f4 3b eb 3c 66
2b 92 66 d0 8f n
~s.*y.;.<f+.f..
0280 7a f3 58 c6 a
5 e1 2e 93 81 3d 3c
97 9d aa 2e 8d z
.X......=<.....
0290 52 37 fe b4 9
3 ff f6 66 68 2e f3
b9 51 19 99 df R
7.....fh...Q...
02a0 fe ca 50 04 2
0 71 67 0f b4 aa 85
09 91 2c dd dd .
.P. qg......,..
02b0 ff f5 45 15 3
b 12 0a cd 70 81 00
d3 1f 19 b9 4e .
.E.;...p......N
02c0 78 26 77 8a 7
2 fe 36 6f b7 e9 e6
6a 6a c0 60 cc x
&w.r.6o...jj.`.
02d0 e1 61 e4 2a 7
8 da c9 b6 77 5f 4b
4f d9 3e b0 08 .
a.*x...w_KO.>..
02e0 95 d2 2f ba 7
f b2 e8 ac a2 bf b2

cd aa f9 5f 3d .
./..........._=
02f0 53 74 08 67 a
b dc 74 35 ff c6 4f
1a 71 1e db 76 S
t.g..t5..O.q..v
0300 85 34 3f ff 7
f 9e cc 74 1c 90 b1
87 37 04 6b b1 .
4?....t....7.k.
0310 4f 2e a4 12 6
c 84 d9 4a 2d a8 c6
58 f0 62 ab 95 O
...l..J-..X.b..
0320 4e 25 5b 9f c
9 b7 48 fd 3d 94 a7
10 b0 52 33 85 N
%[...H.=....R3.
0330 b4 4b 0c 85 c
8 85 2c a3 e2 91 ae
76 c6 04 94 78 .
K....,....v...x
0340 33 b3 aa 9c 3
a 41 37 33 bc 40 e5
ec a1 c2 19 04 3
...:A73.@......
0350 8d 51 b1 ac 7
6 29 0c ea 6d 47 1d
14 8d 31 43 e8 .
Q..v)..mG...1C.
0360 fb 7a e5 26 8
d c7 13 96 b8 e8 bb
4e 68 de 9f fd .
z.&.......Nh...
0370 75
u
No. Time
Source
Destination
Protocol
Length Info
51 1.518206000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=25084 Win=41895 Le
n=0
Frame 51: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.568136000 Romance
Standard Time
[Time shift for

this packet: 0.000

000000 seconds]
Epoch Time: 141
5615214.568136000 s
econds
[Time delta fro
m previous captured
frame: 0.000152000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00015200
0 seconds]
[Time since ref
erence or first fra
me: 1.518206000 sec
onds]
Frame Number: 5
1
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f2c (20268)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 25084
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 25084 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41895
[Calculated win
dow size: 41895]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:

0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 50]
[The RTT to
ACK the segment wa
s: 0.000152000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 2c 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O,@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 c4 29 50 10 .
....P..N.+..)P.
0030 a3 a7 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
52 1.550816000
livebox.home
pc13.home
DNS
125 Standard que
ry response 0xc783
PTR par03s14-in-f3
1.1e100.net
Frame 52: 125 bytes
on wire (1000 bits
), 125 bytes captur
ed (1000 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.600746000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.600746000 s
econds
[Time delta fro
m previous captured
frame: 0.032610000
seconds]
[Time delta fro
m previous displaye

d frame: 0.03261000
0 seconds]
[Time since ref
erence or first fra
me: 1.550816000 sec
onds]
Frame Number: 5
2
Frame Length: 1
25 bytes (1000 bits
)
Capture Length:
125 bytes (1000 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4

Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
11
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb721 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49779 (49779)
Source Port: do
main (53)
Destination Por
t: 49779 (49779)
Length: 91
Checksum: 0x707
e [validation disab
led]
[Good Check
sum: False]

[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(response)
[Request In: 49
]
[Time: 0.032824
000 seconds]
Transaction ID:
0xc783
Flags: 0x8180 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .0.. .
... .... = Authorit
ative: Server is no
t an authority for
domain
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs:
0
Additional RRs:
0
Queries
63.41.194.1
73.in-addr.arpa: ty
pe PTR, class IN
Name: 6
3.41.194.173.in-add
r.arpa

[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Answers
63.41.194.1
73.in-addr.arpa: ty
pe PTR, class IN, p
ar03s14-in-f31.1e10
0.net
Name: 6
3.41.194.173.in-add
r.arpa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 13835
Data le
ngth: 27
Domain
Name: par03s14-in-f
31.1e100.net
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 6f 00 00 4
0 00 40 11 b7 21 c0
a8 01 01 c0 a8 .
o..@.@..!......
0020 01 0b 00 35 c
2 73 00 5b 70 7e c7
83 81 80 00 01 .
..5.s.[p~......
0030 00 01 00 00 0
0 00 02 36 33 02 34
31 03 31 39 34 .
......63.41.194
0040 03 31 37 33 0
7 69 6e 2d 61 64 64
72 04 61 72 70 .
173.in-addr.arp
0050 61 00 00 0c 0
0 01 c0 0c 00 0c 00
01 00 00 36 0b a
.............6.
0060 00 1b 0f 70 6
1 72 30 33 73 31 34
2d 69 6e 2d 66 .
..par03s14-in-f
0070 33 31 05 31 6
5 31 30 30 03 6e 65
74 00
3
1.1e100.net.
No. Time
Source
Destination
Protocol
Length Info

53 1.580060000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=25084
Ack=1 Win=46 Len=1
260
Frame 53: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.629990000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.629990000 s
econds
[Time delta fro
m previous captured
frame: 0.029244000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02924400
0 seconds]
[Time since ref
erence or first fra
me: 1.580060000 sec
onds]
Frame Number: 5
3
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64

:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf18b (61835)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =

Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a9f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 25084, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 25084 (relativ
e sequence number)
[Next sequence
number: 26344 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .

... = ECN-Echo: Not

set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x41e
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 8b 4
0 00 31 06 3a 9f 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 c4 29 9e
87 4e aa 50 10 .
..P..+..)..N.P.
0030 00 2e 41 e2 0
0 00 80 55 5c 20 43
b3 68 64 46 86 .
.A....U\ C.hdF.
0040 e3 18 ca 3e 5
c 82 15 03 65 8d cd
47 3b 97 3f 13 .
..>\...e..G;.?.
0050 c0 e0 1f 43 7
c 90 4e bb 36 8e 21
59 43 62 55 0e .
..C|.N.6.!YCbU.
0060 18 3d 8c 17 0
8 14 58 a5 42 b0 c2
90 49 91 29 0b .
=....X.B...I.).
0070 39 96 cc ef 9
1 e1 23 b3 96 c8 83
16 7c a7 56 41 9

.....#.....|.VA
0080 c9 43 9b 42 a
2 57 37 18 e3 ff fb
92 04 eb 8f f3 .
C.B.W7.........
0090 02 43 d6 01 e
f 32 e0 64 e8 2a c0
61 e6 5c 0b f9 .
C...2.d.*.a.\..
00a0 13 58 0c 24 c
b 81 7a 23 6b 40 f4
95 70 0a e6 12 .
X.$..z#k@..p...
00b0 a5 0a 63 05 1
d a3 5a 24 9d 07 f0
35 ce 30 6f 0b .
.c...Z$...5.0o.
00c0 7c 06 f5 c2 f
2 09 c4 dc 74 b2 9f
7a 3b 09 f7 ed |
.......t..z;...
00d0 df b2 39 3c 4
3 f8 76 46 93 7e c3
38 6e f2 45 38 .
.9<C.vF.~.8n.E8
00e0 fd aa 4c 10 8
b 23 18 70 2e 69 e6
23 58 be da 2f .
.L..#.p.i.#X../
00f0 3d c4 71 df 4
a 22 99 7a 5f 89 ed
66 19 2c 3a 9d =
.q.J".z_..f.,:.
0100 38 3a 3a 4a b
e 47 d6 d1 a2 7a fa
24 46 32 a2 71 8
::J.G...z.$F2.q
0110 1b d6 c5 ba a
3 6e a7 5a 75 0d 01
68 57 01 ee 09 .
....n.Zu..hW...
0120 d1 c0 ba 6a 7
2 a5 6b 29 5d c7 73
a2 63 7b a1 c7 .
..jr.k)].s.c{..
0130 b6 d8 d1 25 1
c 53 ac 8c b7 3a 37
1f 95 68 8a 68 .
..%.S...:7..h.h
0140 f0 f9 99 ca 4
c b7 00 b6 14 f6 73
50 16 4d e4 34 .
...L.....sP.M.4
0150 78 fa fa a7 f
7 f7 2b fb c9 2e 1d
27 ff f3 4a ae x
.....+....'..J.
0160 52 2f 9d b5 b
e e5 cf 7f b9 af cb
d4 69 a0 64 93 R
/..........i.d.
0170 52 5e 19 a5 1
8 32 b1 bf c9 72 c1
25 f3 58 b6 2d R
^...2...r.%.X.0180 d2 d0 bb 15 7
3 a2 71 f2 c7 43 47
a5 ee 21 1e c6 .
...s.q..CG..!..

0190 ec e9 54 37 d
c a3 eb 6f 93 cc 4a
1b 32 4d 28 b6 .
.T7...o..J.2M(.
01a0 82 40 17 ed 8
5 46 3d b3 f9 bc cc
0d b8 8b 66 8d .
@...F=.......f.
01b0 99 6e d1 4b f
a b6 f8 fe 5e 3f 9d
6e 70 ec 41 b9 .
n.K....^?.np.A.
01c0 8d fc 1b 4b 3
7 07 fe 77 ef f1 fd
63 2c ca 96 3a .
..K7..w...c,..:
01d0 84 c7 1c c2 3
c 33 9c 1e cb cb cd
97 db 0e c2 b2 .
...<3..........
01e0 7b 69 47 77 1
c db 2c 52 4b 5e 84
c9 d9 9a f3 a0 {
iGw..,RK^......
01f0 28 aa e7 fc 9
2 eb ee bd 9b e5 74
18 32 87 ba 50 (
.........t.2..P
0200 f3 c7 0d 39 8
4 4b 2a a1 14 f5 66
b4 4a b4 e9 27 .
..9.K*...f.J..'
0210 dd e9 21 e9 3
4 be 59 79 1e 45 da
5f 1f c5 44 dd .
.!.4.Yy.E._..D.
0220 55 25 cb d7 3
3 d6 9a 0d a7 d4 6b
ff fb 92 04 e8 U
%..3.....k.....
0230 8f f2 e5 44 d
6 03 08 2a e0 61 08
9a c0 3d 88 5c .
..D...*.a...=.\
0240 0b 45 0f 58 0
7 b0 cb 81 6e 9c 6b
01 86 19 71 bd .
E.X....n.k...q.
0250 3b 77 7f fd 4
e 8a 30 a1 0f a0 d0
0b e3 81 c1 14 ;
w..N.0.........
0260 3e c7 e6 8a e
2 39 3d f5 e5 ba 38
cf 2c 2c 95 d7 >
....9=...8.,,..
0270 b1 53 b3 33 3
2 10 20 8e e7 fc 20
1c 2e 59 f9 eb .
S.32. ... ..Y..
0280 aa 06 0c a7 9
8 83 8e 3d c4 f6 1f
4c d3 25 8e 9e .
......=...L.%..
0290 9a 12 ad 24 d
4 ef a2 a6 cd b0 25
e0 98 11 06 17 .
..$......%.....
02a0 64 d8 f0 74 5

1 64 5c a6 40 22 cf
8d ac b2 74 18 d
..tQd\.@"....t.
02b0 37 ff fe a7 8
1 60 21 b2 73 2a d2
05 26 33 b7 11 7
....`!.s*..&3..
02c0 77 91 c1 75 9
5 ae 52 a2 1f 9c c7
72 91 85 23 78 w
..u..R....r..#x
02d0 39 62 8e f6 0
2 1c e6 b4 c0 d8 f1
6d 85 d9 a3 19 9
b.........m....
02e0 d2 b1 d4 0d 3
8 83 0b 7a 46 9a 1d
ae 79 c4 20 d9 .
...8..zF...y. .
02f0 72 75 19 9e e
f 5a 1d 2d b7 ef df
6e e8 ff 11 77 r
u...Z.-...n...w
0300 8d 8d da ef 4
c 43 c2 ac b0 7f dc
fd 24 86 1f 03 .
...LC......$...
0310 5a 2d 80 8a 3
7 ff cf 55 48 a1 62
0b b7 11 6c 27 Z
-..7..UH.b...l'
0320 48 5c 36 21 3
4 43 c3 0b 71 c5 49
43 d1 c5 4e 5b H
\6!4C..q.IC..N[
0330 5f a7 4f ad c
3 23 73 23 04 8b 0f
d9 3a 12 58 44 _
.O..#s#....:.XD
0340 b1 13 1c e5 4
3 bb 22 cd 0e 7a 6f
c4 21 36 ee 4f .
...C."..zo.!6.O
0350 a1 99 ee fb 4
7 ad b7 ff fd db e7
f8 7b bc 67 43 .
...G.......{.gC
0360 25 76 1c 84 4
1 f2 6e 2e b5 54 2f
10 29 d5 81 c6 %
v..A.n..T/.)...
0370 3d ba 5e b7 e
f aa 8e 27 73 4b 0e
3b 8a d1 de 17 =
.^....'sK.;....
0380 8e 34 e5 9e a
c 22 18 1e a9 91 59
57 0c 48 87 c8 .
4..."....YW.H..
0390 d0 d1 12 13 2
9 6b 4b 8a 46 fe c9
0a 71 ca 55 7b .
...)kK.F...q.U{
03a0 84 ab 1b 9b 2
9 dd 49 29 e5 2b b1
f2 ab 76 12 5f .
...).I).+...v._
03b0 7d 20 54 1c a
e e8 15 c2 83 ce e4

e4 e5 b5 c2 f3 }
T.............
03c0 bb 61 e7 57 1
9 dd b7 7e cf f7 e5
cb ff ff fb 92 .
a.W...~........
03d0 04 ed 8f f3 1
3 44 56 03 0c 42 e0
5f 25 aa c0 3d .
....DV..B._%..=
03e0 88 4c 0c 88 d
f 5e 0c 3c cb 89 78
1a 2c 00 f6 19 .
L...^.<..x.,...
03f0 70 d9 fa 77 b
f d8 e6 f1 fd 88 48
56 11 c2 a4 e2 p
..w......HV....
0400 59 5c 6b 5c 4
f 26 98 0e 8a 07 5d
80 78 a5 44 22 Y
\k\O&....].x.D"
0410 43 41 d2 e7 8
5 10 64 8b 66 15 5f
27 20 fa 71 ca C
A....d.f._' .q.
0420 42 bd a3 42 1
6 e2 41 d8 c8 c5 1f
b5 a5 1b 48 57 B
..B..A.......HW
0430 cf b2 35 57 6
b 9c 8a 5a c8 ee 65
95 32 36 38 d4 .
.5Wk..Z..e.268.
0440 a3 87 0b 99 2
6 f2 66 a2 81 67 93
53 d8 9d 68 a9 .
...&.f..g.S..h.
0450 aa d2 9f 6b 3
f a5 78 31 8d d1 77
9d 8d c1 38 bb .
..k?.x1..w...8.
0460 7b 2b c2 20 1
e 1a 68 b1 82 ea e9
54 f1 4e 73 14 {
+. ..h....T.Ns.
0470 a5 8f 32 56 c
6 97 89 5a 43 42 0c
62 29 d6 42 6e .
.2V...ZCB.b).Bn
0480 3a 2b e7 0f 4
d 96 ec 8f a4 43 f5
73 29 17 b9 7e :
+..M....C.s)..~
0490 b4 9e c5 b6 b
b a6 50 92 4e 97 9d
47 39 17 04 62 .
.....P.N..G9..b
04a0 5c 2a 6c a2 4
7 3c 20 e5 24 c7 3c
db 4a 13 df 5c \
*l.G< .$.<.J..\
04b0 72 52 02 c5 3
4 02 21 85 8e 29 d0
a8 61 18 89 51 r
R..4.!..)..a..Q
04c0 26 2c 7d d6 c
6 79 c6 a6 d2 c4 47
91 cd 8b 42 da &

,}..y....G...B.
04d0 68 e8 ed 59 c
d 87 6a 0f af 48 be
76 b1 18 9f d2 h
..Y..j..H.v....
04e0 b7 c3 54 bf a
8 b5 c3 46 f6 9b d9
82 a7 5f e7 fb .
.T....F....._..
04f0 33 3a ed 2e e
f 7b 9f 33 c3 37 b5
73 62 41 e2 8b 3
:...{.3.7.sbA..
0500 b9 87 d0 f0 8
a 48 ce 4f 33 5b 75
a8 cb 69 d8 99 .
....H.O3[u..i..
0510 3a 6c 2a 04 6
5 28 49 8b 8a db 8b
2b e6 84 72 b2 :
l*.e(I....+..r.
0520 43 6b
C
k
No. Time
Source
Destination
Protocol
Length Info
54 1.582047000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=26344
Ack=1 Win=46 Len=1
260
Frame 54: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.631977000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.631977000 s
econds
[Time delta fro
m previous captured
frame: 0.001987000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00198700

0 seconds]
[Time since ref
erence or first fra
me: 1.582047000 sec
onds]
Frame Number: 5
4
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),

Dst: pc13.home (192

.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf18c (61836)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a9e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 26344, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por

t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 26344 (relativ
e sequence number)
[Next sequence
number: 27604 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x39e
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 8c 4
0 00 31 06 3a 9e 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 c9 15 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 39 e3 0
0 00 9a 82 16 52 ce
ac 58 5e 3b 66 .
.9......R..X^;f
0040 82 8e f4 e3 0
c ea 3f 67 37 0e af
55 1e b2 72 b1 .
.....?g7..U..r.
0050 a2 49 45 bf 9
6 c6 e9 a9 43 4f 32
4d 07 8a b1 db .
IE.....CO2M....
0060 33 58 ea ec a
5 54 a5 e8 5e 19 b6
a7 0e 5d 6c fb 3
X...T..^....]l.
0070 8a 9f c9 52 7
9 55 20 f8 ee 2d bb
bf f2 75 49 51 .
..RyU ..-...uIQ
0080 6a af 70 ff f
b 92 04 ea 8f f3 00
22 58 83 0c 4a j
.p........"X..J
0090 52 5b c7 3b 1
0 31 23 5c 0b 71 0d
64 07 a0 6b 81 R
[.;.1#\.q.d..k.
00a0 7d 1e ec 40 c
4 99 70 d8 06 e1 31
38 1b d4 77 5d }
..@..p...18..w]
00b0 3f 8f d9 e5 d
c 4e 98 f7 21 65 68
41 58 b0 bc 65 ?
....N..!ehAX..e
00c0 71 14 be 32 c
4 08 bb 97 c3 d6 64
19 8d a4 d9 29 q
..2......d....)
00d0 31 40 71 8d e
b ac 22 cc 8a 1e 10
cd 0a 16 4c f4 1
@q...".......L.
00e0 a6 d3 44 f5 1
8 e8 27 0b 20 0c 5c
71 11 c0 ea 8a .
.D...'. .\q....
00f0 0b 44 64 dc 6
9 27 71 40 ed 46 84
c7 ee 55 ea af .
Dd.i'q@.F...U..
0100 ee 74 25 00 5
2 0f 14 44 46 9c 42
66 41 03 be d3 .
t%.R..DF.BfA...
0110 76 a4 28 97 7

d 38 a9 28 ab 3b 5b
15 58 28 d2 1e v
.(.}8.(.;[.X(..
0120 bc 47 a5 d0 9
4 1b 92 26 89 7c fd
ce 2e 4b 47 1b .
G.....&.|...KG.
0130 7e 4d d1 a7 4
9 c5 43 5f e8 fd 9f
11 9b 96 05 78 ~
M..I.C_.......x
0140 fa ed 7b fd a
8 b9 de af ca 7a 8d
d4 ab b1 4f 8b .
.{......z....O.
0150 78 cf 77 5c 7
5 c8 6e 2f 4e e8 90
f6 6a ea 92 cd x
.w\u.n/N...j...
0160 0b 28 b9 7f f
c df 92 70 cc 04 64
a5 0c 20 64 19 .
(.....p..d.. d.
0170 0b ba bd 57 a
3 4b 2e d1 a2 12 54
24 51 2e 71 1d .
..W.K....T$Q.q.
0180 aa 81 49 27 d
7 25 1e 92 ee 07 86
e4 d3 51 a7 f4 .
.I'.%.......Q..
0190 e6 56 8e ce 5
5 7c 93 e9 81 82 58
2a 1e 73 72 66 .
V..U|....X*.srf
01a0 7c 15 89 34 8
1 5e 5b 3e b2 5f da
af 37 be 7c b6 |
..4.^[>._..7.|.
01b0 f2 d9 f0 a3 9
e 17 65 36 7f 9f be
17 ea ea 1b e7 .
.....e6........
01c0 47 9f 26 2c 3
c 3c b1 53 ce 3d b5
89 ba e7 7a 74 G
.&,<<.S.=....zt
01d0 d5 7d 06 12 4
c 11 0a 12 45 17 54
a5 cf 78 e0 0b .
}..L...E.T..x..
01e0 d3 67 4c dd e
8 ce 93 25 69 7c 28
ee 86 99 7c ff .
gL....%i|(...|.
01f0 5d 68 bb cf 1
1 25 30 5f 0b e5 c7
ef e4 d9 8c 86 ]
h...%0_........
0200 da 97 6d 71 8
8 5e 27 5d b3 d5 3a
95 aa 78 5b 4e .
.mq.^']..:..x[N
0210 4a dd f2 12 c
c ed 3b 6d ad 5a ea
6f f9 d9 e7 f2 J
.....;m.Z.o....
0220 a9 92 70 ff 3
4 ff fb 92 04 ee 0f

f2 f4 25 58 81 .
.p.4........%X.
0230 e9 32 52 5b 6
6 7b 10 3d 23 5c 0c
78 e9 5c 0c 24 .
2R[f{.=#\.x.\.$
0240 cb 89 a6 22 e
b 40 f4 99 70 47 d3
4f 14 7e 9e 94 .
..".@..pG.O.~..
0250 f1 45 b8 eb 6
3 ff d8 82 98 96 e4
be 6c 70 75 2d .
E..c.......lpu0260 86 bb bd 1e 8
8 c3 e5 e3 96 fa c9
a0 6e c9 db 23 .
...........n..#
0270 3e b5 a5 fa f
5 52 96 47 eb 28 44
0f 96 17 c2 e9 >
....R.G.(D.....
0280 49 06 f2 e6 9
b 19 89 55 41 ad ae
18 2b 72 ab ce I
......UA...+r..
0290 59 54 ea 56 e
3 c6 95 33 2b 2c 34
bf 9d f9 bb 7b Y
T.V...3+,4....{
02a0 77 eb 9a 36 0
9 b8 c8 34 2e 74 63
0b c2 82 3c 1d w
..6...4.tc...<.
02b0 7a c1 10 6d a
8 bd 27 3a a3 04 93
4a d2 df a0 35 z
..m..':...J...5
02c0 b1 c1 51 c8 c
4 3f d8 30 a9 74 04
af 46 20 11 9d .
.Q..?.0.t..F ..
02d0 d5 cc 9d 89 4
7 3d 77 17 0e c5 a2
52 50 dc a6 c9 .
...G=w....RP...
02e0 01 a9 c7 c7 e
e 54 26 a2 79 1a 89
f4 b1 48 47 de .
....T&.y....HG.
02f0 41 bd 07 47 8
a 0c 07 08 0f 15 03
85 d0 90 ea d8 A
..G............
0300 44 13 87 e8 6
1 39 d4 1f 51 dd a8
d1 4a 15 bb 67 D
...a9..Q...J..g
0310 bb 4b 00 f7 0
c d0 29 89 38 29 18
91 4b 49 b6 b3 .
K....).8)..KI..
0320 f8 48 a8 8d 4
1 4b d1 88 04 67 67
36 51 c4 a4 4d .
H..AK...gg6Q..M
0330 a6 54 b9 b4 e
4 4a 25 06 e5 b8 81
a9 e6 bb 13 21 .

T...J%........!
0340 b6 6b a8 10 8
a 10 96 15 80 cf 24
b2 23 8b 8d 9a .
k........$.#...
0350 89 71 d5 94 b
9 b6 90 c8 17 df bf
c2 5f 9b ae 4b .
q.........._..K
0360 78 60 ce 11 6
2 5d 10 38 6b 34 a9
76 45 23 57 62 x
`..b].8k4.vE#Wb
0370 18 57 2a 42 b
f f1 28 09 90 cc cc
b9 57 22 28 8c .
W*B..(.....W"(.
0380 4f 09 eb 52 d
4 7d 5a cb 25 ba da
33 b0 ec 8f bb O
..R.}Z.%..3....
0390 c8 47 8d c1 5
5 dc f9 15 6c 1a fe
00 db 5e e9 30 .
G..U...l....^.0
03a0 53 79 ad a7 3
9 89 d4 34 ed bf 86
21 ea a1 da 97 S
y..9..4...!....
03b0 de fd 5e 9d b
3 2c e5 64 dc 32 d7
b8 ce ce f9 57 .
.^..,.d.2.....W
03c0 ef e6 fc ff e
7 6f 38 ff fb 92 04
e9 0f f3 0c 3a .
....o8........:
03d0 56 03 0c 32 e
2 61 c6 8a c0 61 86
5c 0b 2c 91 58 V
..2.a...a.\.,.X
03e0 0c 25 29 41 6
4 a0 6b 00 f4 8d 70
df fa 4f 0f 54 .
%)Ad.k...p..O.T
03f0 1a 73 7b 7e 8
9 69 28 5b d2 23 11
19 8d d5 80 e5 .
s{~.i([.#......
0400 af ec 66 5e c
5 79 84 12 29 e1 fb
a9 78 8a b5 9a .
.f^.y..)...x...
0410 ab df 78 be 5
7 57 bb c2 85 15 82
a7 ce be 2a 3a .
.x.WW........*:
0420 e8 99 d0 69 5
7 2d 9e 13 a2 b4 3c
0c 77 61 36 5e .
..iW-....<.wa6^
0430 8b d0 da b6 d
2 4c a1 f5 27 d5 9f
c7 ac 44 a6 3e .
....L..'....D.>
0440 20 7a 75 12 4
7 63 ae e7 99 fe 1d
22 23 ae bf 68
zu.Gc....."#..h

0450 1d 64 73 f5 e
9 f4 43 20 09 8f 38
c1 14 82 1d f2 .
ds...C ..8.....
0460 6b 34 56 8e d
8 2a 3f 3d 54 7c 62
15 1b 1c b4 cd k
4V..*?=T|b.....
0470 59 ba 97 0c 1
d ee 4a 2b 85 09 b9
4e 46 da b8 d2 Y
.....J+...NF...
0480 c6 89 95 8b 2
8 80 80 7c 45 ca 2c
03 1d 48 3c 4e .
...(..|E.,..H<N
0490 5b a0 0a ec 2
e 22 54 45 22 bb aa
9c a2 d3 98 e2 [
...."TE".......
04a0 4e fc ac 83 5
2 75 47 6e 45 b3 92
47 66 d1 4b d7 N
...RuGnE..Gf.K.
04b0 52 f5 28 ed 8
9 aa 74 18 70 b1 13
19 73 01 44 d3 R
.(...t.p...s.D.
04c0 9a 2c 81 d0 8
f 41 c5 e4 59 01 e8
ec 7c 73 68 56 .
,...A..Y...|shV
04d0 1e d9 12 85 8
9 e1 d1 ac 56 da 66
f5 05 07 6b 13 .
.......V.f...k.
04e0 4b 1a 8f df 1
f 25 c8 0f 44 26 47
70 77 12 6d c6 K
....%..D&Gpw.m.
04f0 a4 9a 64 e8 8
a ed 16 a9 af f7 ca
46 c3 9f 57 5f .
.d........F..W_
0500 76 3c e5 91 e
f dd 96 1a 58 26 1a
02 12 7b ec 74 v
<......X&...{.t
0510 58 ed 61 8e 7
2 85 7d 41 c1 3a 90
d1 40 91 03 62 X
.a.r.}A.:..@..b
0520 1d 17
.
.
No. Time
Source
Destination
Protocol
Length Info
55 1.582161000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack

=27604 Win=41580 Le
n=0
Frame 55: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.632091000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.632091000 s
econds
[Time delta fro
m previous captured
frame: 0.000114000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00011400
0 seconds]
[Time since ref
erence or first fra
me: 1.582161000 sec
onds]
Frame Number: 5
5
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f2e (20270)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1

28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 27604
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 27604 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t

.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41580
[Calculated win
dow size: 41580]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 54]
[The RTT to
ACK the segment wa
s: 0.000114000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 2e 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 ce 01 50 10 .
....P..N.+...P.
0030 a2 6c 18 d4 0
0 00
.
l....
No. Time
Source
Destination
Protocol
Length Info
56 1.611981000
pc13.home
livebox.home
DNS
88 Standard que
ry 0xc0fd PTR 184.
113.194.173.in-addr
.arpa
Frame 56: 88 bytes
on wire (704 bits),
88 bytes captured
(704 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B

-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.661911000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.661911000 s
econds
[Time delta fro
m previous captured
frame: 0.029820000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02982000
0 seconds]
[Time since ref
erence or first fra
me: 1.611981000 sec
onds]
Frame Number: 5
6
Frame Length: 8
8 bytes (704 bits)
Capture Length:
88 bytes (704 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08

:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
4
Identification:
0x4f2f (20271)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:

Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4977
9 (49779), Dst Port
: domain (53)
Source Port: 49
779 (49779)
Destination Por
t: domain (53)
Length: 54
Checksum: 0x83a
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(query)
[Response In: 5
7]
Transaction ID:
0xc0fd
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
184.113.194
.173.in-addr.arpa:
type PTR, class IN
Name: 1
84.113.194.173.in-a
ddr.arpa
[Name L
ength: 28]
[Label
Count: 6]
Type: P

TR (domain name Poi

nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 4a 4f 2f 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
JO/............
0020 01 01 c2 73 0
0 35 00 36 83 a4 c0
fd 01 00 00 01 .
..s.5.6........
0030 00 00 00 00 0
0 00 03 31 38 34 03
31 31 33 03 31 .
......184.113.1
0040 39 34 03 31 3
7 33 07 69 6e 2d 61
64 64 72 04 61 9
4.173.in-addr.a
0050 72 70 61 00 0
0 0c 00 01
r
pa.....
No. Time
Source
Destination
Protocol
Length Info
57 1.664062000
livebox.home
pc13.home
DNS
127 Standard que
ry response 0xc0fd
PTR ham02s12-in-f2
4.1e100.net
Frame 57: 127 bytes
on wire (1016 bits
), 127 bytes captur
ed (1016 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.713992000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.713992000 s
econds
[Time delta fro
m previous captured
frame: 0.052081000
seconds]

[Time delta fro

m previous displaye
d frame: 0.05208100
0 seconds]
[Time since ref
erence or first fra
me: 1.664062000 sec
onds]
Frame Number: 5
7
Frame Length: 1
27 bytes (1016 bits
)
Capture Length:
127 bytes (1016 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home

(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
13
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb71f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49779 (49779)
Source Port: do
main (53)
Destination Por
t: 49779 (49779)
Length: 93
Checksum: 0x419
f [validation disab
led]

[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
0]
Domain Name System
(response)
[Request In: 56
]
[Time: 0.052081
000 seconds]
Transaction ID:
0xc0fd
Flags: 0x8180 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .0.. .
... .... = Authorit
ative: Server is no
t an authority for
domain
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs:
0
Additional RRs:
0
Queries
184.113.194
.173.in-addr.arpa:
type PTR, class IN
Name: 1

84.113.194.173.in-a
ddr.arpa
[Name L
ength: 28]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Answers
184.113.194
.173.in-addr.arpa:
type PTR, class IN,
ham02s12-in-f24.1e
100.net
Name: 1
84.113.194.173.in-a
ddr.arpa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 26647
Data le
ngth: 27
Domain
Name: ham02s12-in-f
24.1e100.net
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 71 00 00 4
0 00 40 11 b7 1f c0
a8 01 01 c0 a8 .
q..@.@.........
0020 01 0b 00 35 c
2 73 00 5d 41 9f c0
fd 81 80 00 01 .
..5.s.]A.......
0030 00 01 00 00 0
0 00 03 31 38 34 03
31 31 33 03 31 .
......184.113.1
0040 39 34 03 31 3
7 33 07 69 6e 2d 61
64 64 72 04 61 9
4.173.in-addr.a
0050 72 70 61 00 0
0 0c 00 01 c0 0c 00
0c 00 01 00 00 r
pa.............
0060 68 17 00 1b 0
f 68 61 6d 30 32 73
31 32 2d 69 6e h
....ham02s12-in
0070 2d 66 32 34 0
5 31 65 31 30 30 03
6e 65 74 00
f24.1e100.net.
No. Time
Source
Destination

Protocol
Length Info
58 1.667052000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1294 http49
574 [PSH, ACK] Seq=
27604 Ack=1 Win=46
Len=1240
Frame 58: 1294 byte
s on wire (10352 bi
ts), 1294 bytes cap
tured (10352 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.716982000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.716982000 s
econds
[Time delta fro
m previous captured
frame: 0.002990000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00299000
0 seconds]
[Time since ref
erence or first fra
me: 1.667052000 sec
onds]
Frame Number: 5
8
Frame Length: 1
294 bytes (10352 bi
ts)
Capture Length:
1294 bytes (10352
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),

Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
280
Identification:
0xf18d (61837)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ab1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 27604, Ack: 1
, Len: 1240
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1240]
Sequence number
: 27604 (relativ
e sequence number)
[Next sequence
number: 28844 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x694
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1240]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 00 f1 8d 4
0 00 31 06 3a b1 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 ce 01 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 69 42 0
0 00 f1 f4 69 79 36
07 8f 30 e6 e4 .
.iB....iy6..0..
0040 78 a4 5f 55 5
a f1 a5 f3 7c 46 7b
f9 20 96 6c ca x
._UZ...|F{. .l.
0050 f8 fb 94 b4 d
4 0c 61 92 88 e5 dc
f6 d4 ca 4a d0 .
.....a.......J.
0060 7e 44 c7 d5 4
7 c4 96 79 59 09 0b
8e 9a 52 d3 db ~
D..G..yY....R..
0070 cf 73 8a 7f 1

b f7 cf ae 6d 13 58
5c f1 ff fb 92 .
s......m.X\....
0080 04 ed 0f f3 2
c 47 d5 03 2c 32 e0
61 a8 fa b0 61 .
...,G..,2.a...a
0090 88 5c 0b f5 2
1 54 0c 30 ab 81 7f
1b 6a 81 86 19 .
\..!T.0....j...
00a0 70 56 01 44 2
0 88 93 0b a9 6f df
5e 85 e5 ad 5c p
V.D ....o.^...\
00b0 3a ae 4a ba 4
2 64 20 bb 69 72 f1
37 68 7e fd 4a :
.J.Bd .ir.7h~.J
00c0 9c 1e 13 64 4
5 52 74 a8 d9 20 cc
16 bc 47 e7 bd .
..dERt.. ...G..
00d0 87 21 6a e3 b
b b6 29 1b 73 13 87
94 29 4a 34 b4 .
!j...).s...)J4.
00e0 39 c6 0f 41 e
7 41 11 85 01 80 ed
28 f3 89 8c 8a 9
..A.A.....(....
00f0 b8 59 2e 06 a
1 f6 3c 70 b1 1e cf
77 2a 68 96 d4 .
Y....<p...w*h..
0100 5f d3 27 2d 9
7 41 72 d2 a6 27 c6
7b a0 dc 32 5b _
.'-.Ar..'.{..2[
0110 03 64 e2 a6 8
9 3e d2 d0 96 10 15
65 c8 e1 46 0f .
d...>.....e..F.
0120 05 29 89 83 0
1 55 08 a7 54 3f 64
8d 11 57 68 0f .
)...U..T?d..Wh.
0130 6d 59 13 29 7
8 ba 8e a4 29 e2 67
b7 38 c0 57 90 m
Y.)x...).g.8.W.
0140 36 f6 b3 cc e
c 46 78 e5 a9 56 87
de 8f 23 8d 46 6
....Fx..V...#.F
0150 cf cc ef 79 b
5 b0 5e 17 4c d5 1a
ed ff 3b 73 fc .
..y..^.L....;s.
0160 e4 96 13 04 0
4 0c 6d 8a 32 f1 89
3a db 88 f5 bf .
.....m.2..:....
0170 ab 74 2b 11 6
a 01 44 b7 08 dc 79
fd 76 20 c8 39 .
t+.j.D...y.v .9
0180 84 23 e8 90 c
b 41 c1 54 d2 af 0b

91 cd ce 0e 6b .
#...A.T.......k
0190 a3 c0 4e 8d 6
d 64 10 08 e9 bc b9
6c 03 95 44 b1 .
.N.md.....l..D.
01a0 9e 3e 06 1f 6
7 64 07 43 c5 00 55
bd cf 5b 15 a8 .
>..gd.C..U..[..
01b0 61 05 75 ae 2
6 ad 85 c7 25 db 44
3c 44 cb cd c5 a
.u.&...%.D<D...
01c0 6b ae 77 58 e
0 92 53 58 a6 b2 2b
e8 89 3f fa 15 k
.wX..SX..+..?..
01d0 7a 4a 90 16 a
8 2e 30 0a 94 b5 58
c9 5a f0 b4 ea z
J....0...X.Z...
01e0 46 c0 c0 ac 6
9 b2 e9 95 72 52 d9
4b 9d 55 fb 7a F
...i...rR.K.U.z
01f0 a6 5d 6d b8 e
c 73 52 cd d5 e7 13
fd 5b 70 38 a8 .
]m..sR.....[p8.
0200 f9 da aa e1 f
7 53 a8 d0 08 26 22
73 12 66 1e b9 .
....S...&"s.f..
0210 8c 4b b9 56 e
f 53 96 b7 4b 54 96
49 93 e3 90 ff .
K.V.S..KT.I....
0220 fb 92 04 e8 8
f f3 0d 34 54 83 0f
32 e0 5e 08 fa .
......4T..2.^..
0230 a0 61 85 5c 0
c 30 dd 52 0c bc cb
81 80 9b ea 41 .
a.\.0.R.......A
0240 96 21 70 d1 7
7 06 a4 37 77 6c 5d
0e d3 44 02 f4 .
!p.w..7wl]..D..
0250 16 58 c8 a5 7
2 a2 ec 2a 01 70 61
f1 12 22 89 9e .
X..r..*.pa.."..
0260 14 83 53 e4 b
4 c8 ad c8 51 b6 25
42 bc 41 60 a3 .
.S.....Q.%B.A`.
0270 d5 4a c1 90 6
c 2e 87 8b 29 a6 df
62 6e 7b 71 b2 .
J..l...)..bn{q.
0280 b4 2a 23 01 6
6 8c 98 e1 6d 46 4d
34 be cb af e3 .
*#.f...mFM4....
0290 41 b1 60 5c 5
4 f0 a1 32 a7 83 0a
71 46 91 3a b9 A

.`\T..2...qF.:.
02a0 da bb 1d b9 5
5 a2 08 af 82 10 49
79 05 40 6c dc .
...U.....Iy.@l.
02b0 5f 12 27 1d 0
4 41 82 e1 2b ba a1
1d cd 02 d8 85 _
.'..A..+.......
02c0 36 e6 3b a8 3
0 65 3c fc b0 e2 09
12 a3 ba c9 7d 6
.;.0e<........}
02d0 0d 0c da 3d d
4 2e e5 7e 71 93 86
09 a9 ab 35 22 .
..=...~q.....5"
02e0 05 ae 11 f3 1
9 24 0a db a6 d8 47
7e f7 b9 66 5b .
....$....G~..f[
02f0 5e 16 a7 cb a
6 86 ef ef d3 22 f4
ec d9 df 3e 66 ^
........"....>f
0300 e6 7e 5c 5c 2
c 0b 68 3c 95 56 55
3d 56 50 18 e4 .
~\\,.h<.VU=VP..
0310 d8 1e b8 34 8
9 0a da a9 93 21 82
d8 8d 35 a5 b5 .
..4.....!...5..
0320 74 ce 07 f2 9
e d7 4a 41 82 c6 d3
2c 7c ae 0a 08 t
.....JA...,|...
0330 1d d4 a3 94 a
4 dc f8 db d7 29 bd
1e 2c c7 10 64 .
........)..,..d
0340 56 98 bc 06 6
3 d4 df 51 d0 2a 32
5c 67 74 8d df V
...c..Q.*2\gt..
0350 23 55 a6 a0 7
d 0d 13 4e fb 7f 51
3f 49 bf 2f 3d #
U..}..N..Q?I./=
0360 f5 d1 57 fe 3
b ba e7 1a b9 0e 16
2e 8f 4a 14 02 .
.W.;........J..
0370 42 c0 0c 54 c
7 45 04 90 02 11 67
49 05 46 ac 8b B
..T.E....gI.F..
0380 c0 08 cd 21 3
e 87 a5 a8 ee c1 0b
0b 2d a6 b1 73 .
..!>.......-..s
0390 b2 57 16 c2 1
7 cd 74 78 04 5d 98
9b 11 23 a7 e3 .
W....tx.]...#..
03a0 5f 55 b5 f5 d
f ea 68 76 60 7d 4b
ac ac ee 5f 2d _
U....hv`}K..._-

03b0 6e 7b 3a 63 6
b f2 7a 6f 78 64 47
09 a4 38 31 4a n
{:ck.zoxdG..81J
03c0 3c ff fb 92 0
4 e6 8f f2 cd 37 54
83 2f 2a e0 57 <
........7T./*.W
03d0 85 6a a0 61 2
8 4c 0c b5 03 4e 0c
bc cb 81 8b a2 .
j.a(L...N......
03e0 6a 01 87 a1 7
0 2e f3 f1 65 90 32
62 27 be f7 21 j
...p...e.2b'..!
03f0 14 5e aa 95 5
5 68 02 7a 78 c8 20
05 d5 4c e6 d9 .
^..Uh.zx. ..L..
0400 9d af a3 d1 d
a aa 2b a5 92 d3 c6
3c d2 10 c7 52 .
.....+....<...R
0410 62 44 b6 d2 b
2 90 c5 f3 dd 1c 0a
71 42 7b 52 64 b
D.........qB{Rd
0420 74 ad 9a 7a b
a ec 0d 5b dd a3 e7
80 7e d2 b3 67 t
..z...[....~..g
0430 b9 fb 9f da 6
3 83 a6 d5 fc 9a cb
60 70 44 f2 da .
...c......`pD..
0440 09 18 60 80 c
a c1 dc e1 51 23 cd
e7 df 5b e3 3d .
.`.....Q#...[.=
0450 ae a5 09 a2 3
2 0e 03 46 9d 13 39
80 a6 00 60 ec .
...2..F..9...`.
0460 f5 a5 b6 93 4
6 78 af 2e c6 e3 06
2d 9a 97 0d f1 .
...Fx.....-....
0470 1b ba b6 95 b
4 12 02 d1 24 7d 29
87 93 ba 3e 7a .
.......$})...>z
0480 f7 da db 85 a
d 5a f8 9e 2d eb 57
6a 16 5f a9 a4 .
....Z..-.Wj._..
0490 a6 35 03 70 3
7 4d db 5f 56 c6 6d
6d 5f 3b f5 ff .
5.p7M._V.mm_;..
04a0 d2 7e 0d bd 8
d 2d 61 aa 4d 26 4e
28 71 7f 3b ed .
~...-a.M&N(q.;.
04b0 7f d6 b4 53 b
8 b1 78 38 15 c0 15
00 48 07 4d 61 .
..S..x8....H.Ma
04c0 5b a9 a8 c5 6

b 2e c6 fb b5 ae b0
5e 25 b8 9b 96 [
...k......^%...
04d0 b3 4b 40 00 a
a 50 a3 e1 48 36 3e
82 fb 4b 1c 96 .
K@..P..H6>..K..
04e0 e3 b9 a3 e2 d
a 79 95 96 82 05 9a
1c 64 15 52 0f .
....y......d.R.
04f0 d6 65 a5 52 c
5 1e db 8d 31 50 44
91 53 cf 43 c1 .
e.R....1PD.S.C.
0500 cd 8a b5 c2 c
f 3d 4b 08 c0 4f dd
b6 f7 26
.
....=K..O...&
No. Time
Source
Destination
Protocol
Length Info
59 1.782070000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=28844
Ack=1 Win=46 Len=1
260
Frame 59: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.832000000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.832000000 s
econds
[Time delta fro
m previous captured
frame: 0.115018000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11501800
0 seconds]
[Time since ref
erence or first fra
me: 1.782070000 sec
onds]
Frame Number: 5

9
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf18e (61838)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a9c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 28844, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number

: 28844 (relativ
e sequence number)
[Next sequence
number: 30104 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd12
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2500]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 8e 4
0 00 31 06 3a 9c 4a

7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 d2 d9 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e d1 2a 0
0 00 4a 90 28 f3 40
0c 1b 40 c7 83 .
..*..J.(.@..@..
0040 16 68 0a 0e 8
f 8c c9 f9 48 8d b5
5b 3b 6d 14 b0 .
h......H..[;m..
0050 23 39 43 c5 1
f 37 40 71 66 9d c2
fc 07 57 97 5a #
9C..7@qf....W.Z
0060 96 c4 8f 8d d
a 9e ba d4 e7 3d a9
7a 84 da b2 d6 .
........=.z....
0070 89 0d 9f 5e 0
8 99 ca f5 71 68 b1
a1 38 5d 51 50 .
..^....qh..8]QP
0080 89 83 35 86 8
d ac 3c 27 93 2c 49
ff fb 92 04 e8 .
.5...<'.,I.....
0090 8f f3 0a 2c d
3 83 4c 62 60 5e 85
6a 80 61 8c 4c .
..,..Lb`^.j.a.L
00a0 0c 04 c1 4e 0
c bd e9 81 6f 95 aa
01 96 2d 30 63 .
..N....o....-0c
00b0 47 3d b5 35 d
2 4c 8d ea da cf 5b
0d 6b c6 26 22 G
=.5.L....[.k.&"
00c0 c9 06 2e 59 5
4 af 7e 52 92 23 4e
cd 9a d9 e6 c4 .
..YT.~R.#N.....
00d0 58 13 be cd 3
9 8d 09 e3 8b 33 1a
33 2b 81 d3 e5 X
...9....3.3+...
00e0 b6 a3 9c 16 b
3 ea ab 62 c3 ce 11
67 d2 03 52 47 .
......b...g..RG
00f0 0e f9 13 9c 7
8 98 f8 cd 10 0a 0f
0c 8b 9a b7 4e .
...x..........N
0100 7d 86 90 b1 8
c be 6b 74 e5 39 de
3e 0f 92 af aa }
.....kt.9.>....
0110 de fb ef 7f 8
f 53 30 bb bf 3b a9
01 26 35 78 45 .
....S0..;..&5xE
0120 13 3b 08 8a 6
8 34 12 6c 31 ab 2d
7a 8d 3e 4c 96 .

;..h4.l1.-z.>L.
0130 41 5d 22 eb b
3 75 a8 09 28 80 b1
94 4c 0f 01 85 A
]"..u..(...L...
0140 8b 95 f1 ac 7
1 bb 77 89 76 d2 4d
23 35 e7 8e 72 .
...q.w.v.M#5..r
0150 b0 d3 d6 95 3
c 5d ce ab 02 89 19
5e 77 81 47 ff .
...<].....^w.G.
0160 9b ac cf b9 f
5 eb e7 6f 08 b9 a5
cc 10 9d 63 c4 .
......o......c.
0170 2c 81 2c 28 7
3 d3 da af 93 d0 ca
4b fc 66 0a 03 ,
.,(s......K.f..
0180 49 8b 25 fb 8
9 24 7b d9 54 11 d3
3c d1 eb 09 c7 I
.%..${.T..<....
0190 2f 71 96 13 8
2 02 b1 d4 46 d4 ac
89 22 23 6d 95 /
q......F..."#m.
01a0 c8 cb 4e de 1
c cf 15 91 37 6f 54
d7 cb 8e 9f 67 .
.N.....7oT....g
01b0 79 cb 3c 34 b
c f3 3d 8d 5a ef 5b
c5 b3 f5 5d c9 y
.<4..=.Z.[...].
01c0 4b ff 9f 06 1
d 31 9b eb e7 3e 59
92 84 12 b4 78 K
....1...>Y....x
01d0 d7 a0 d3 c2 3
2 c7 0d a0 ab f7 6a
41 29 8b cb 2c .
...2.....jA)..,
01e0 37 49 05 92 0
1 3e 5b 13 77 69 ee
24 54 aa f5 8a 7
I...>[.wi.$T...
01f0 ed 9e 9a 70 a
2 e0 a4 a4 cc bd 9d
9e cf ea 75 a1 .
..p..........u.
0200 f6 73 6e 57 3
c 93 c1 8f 0e 19 23
b8 e6 10 00 4e .
snW<.....#....N
0210 0e 06 04 98 3
5 65 00 dc 86 03 43
38 60 e4 9d 7a .
...5e....C8`..z
0220 26 a6 b7 23 b
0 bb d2 b7 f2 10 cf
c6 3f ff fb 90 &
..#........?...
0230 04 e9 8f f3 0
5 24 53 03 4f 62 50
60 28 5a 70 65 .
....$S.ObP`(Zpe

0240 e8 5c 0b e4 c
f 4c 0d 30 cb 81 84
98 a9 c1 97 bd .
\...L.0........
0250 30 cf e9 17 d
9 9f f0 17 90 cf e4
bf 4a b6 96 b8 0
...........J...
0260 c4 00 24 a2 2
4 62 90 fc a9 82 bb
2c a2 1c da c6 .
.$.$b.....,....
0270 a8 cd 99 e9 5
7 5a 6c 1b 4f 35 16
65 7c 1c c7 4a .
...WZl.O5.e|..J
0280 aa d0 fb 33 9
8 9b 2c 82 cd 2a 6f
3e 72 fe c4 6c .
..3..,..*o>r..l
0290 31 5c 57 9d 0
0 49 d7 ac 55 a6 b4
c3 cf d6 99 ff 1
\W..I..U.......
02a0 ae b5 69 dd d
3 d5 f9 30 fc e7 cb
33 43 42 55 80 .
.i....0...3CBU.
02b0 68 78 f4 a1 5
e 22 66 ce e9 26 1a
55 5c 0c 50 27 h
x..^"f..&.U\.P'
02c0 96 e2 04 00 2
0 66 50 f4 51 c3 29
bb 2c 8d 31 7b .
... fP.Q.).,.1{
02d0 15 20 7b c2 5
6 bc 79 13 03 b1 1d
1c dd 3e 9b 92 .
{.V.y......>..
02e0 a6 ba b8 bf 5
a 57 3c ee 91 4c c6
71 ee 2a 87 30 .
...ZW<..L.q.*.0
02f0 a9 40 c4 38 9
3 b0 e3 e2 42 91 c2
23 6c e7 cb ea .
@.8....B..#l...
0300 e2 04 74 31 a
b 43 0a 32 e7 b7 41
5b 2e f6 18 64 .
.t1.C.2..A[...d
0310 86 66 d6 37 2
1 ff 7f d0 bb 59 50
e5 41 13 21 4a .
f.7!....YP.A.!J
0320 2f 26 34 c2 f
8 8d cb 55 46 58 4e
4e b0 d5 9d cf /
&4....UFXNN....
0330 96 25 fa 62 1
6 0d c8 17 28 4a 58
4a 13 ed 3c 24 .
%.b....(JXJ..<$
0340 4c d2 bb cd 5
9 31 4a 7d 35 de 89
32 02 54 28 b3 L
...Y1J}5..2.T(.
0350 06 81 f6 4a c

d 99 49 95 15 e9 cc
c4 37 9c 94 37 .
..J..I.....7..7
0360 7d ea 55 5e a
1 ff de c7 40 af 48
aa 5e 2c fb d4 }
.U^....@.H.^,..
0370 12 6b ad b5 9
4 f4 55 4f 55 15 36
d4 1c 44 8a f1 .
k....UOU.6..D..
0380 5a 97 cc 92 4
a e5 e8 60 90 c4 52
04 a7 96 40 ba Z
...J..`..R...@.
0390 72 f5 94 7e 1
7 35 10 96 dd 63 d2
69 b3 3d fb 89 r
..~.5...c.i.=..
03a0 36 72 da be 0
3 6b 96 a8 ab 83 03
de 4d d2 3b cc 6
r...k......M.;.
03b0 42 ac e8 d6 b
9 fd a9 5d db 17 d6
e3 cf 49 01 03 B
......].....I..
03c0 c0 a3 c6 a4 5
c 34 95 bd 8a 40 62
c6 29 95 ff fb .
...\4...@b.)...
03d0 92 04 e7 8f f
2 ed 44 d3 03 2f 1a
e0 5c e6 1a 70 .
.....D../..\..p
03e0 65 ec 4c 0b c
c ef 4e 0c bc ab 81
79 18 e9 c1 97 e
.L...N....y....
03f0 a5 70 1a 36 1
8 a9 c5 62 ee 8c 76
9f a1 68 ad a1 .
p.6...b..v..h..
0400 1f 43 c1 17 e
c 2a 23 01 7f 22 6d
d2 18 46 47 92 .
C...*#.."m..FG.
0410 d3 0c 09 5e d
5 26 17 63 5d a9 71
78 65 c8 da 86 .
..^.&.c].qxe...
0420 1f 71 62 a1 5
1 f9 d6 c9 0e 7f 17
70 4a 36 a8 85 .
qb.Q......pJ6..
0430 91 c8 51 38 1
1 2c e0 e8 20 c4 1d
19 47 23 0b a6 .
.Q8.,.. ...G#..
0440 38 5b c6 cf 7
5 3f 33 f3 5c f5 23
b6 f6 ff bd 7f 8
[..u?3.\.#.....
0450 d7 e0 a9 ac 7
e 70 93 61 cc 53 bd
68 7e 55 98 d9 .
...~p.a.S.h~U..
0460 38 19 23 0e 0
a 92 44 28 18 b5 78

dd 53 c8 84 6a 8
.#...D(..x.S..j
0470 72 c6 59 73 f
6 ca 24 50 f3 24 97
34 79 15 3b 38 r
.Ys..$P.$.4y.;8
0480 b7 2d 79 14 c
6 13 1e 14 9c 36 3f
58 dc 71 25 18 .
-y......6?X.q%.
0490 35 77 65 d5 b
0 21 fd 6b 75 16 69
d1 ad 7e 45 5a 5
we..!.ku.i..~EZ
04a0 eb 9a fc 9d 2
8 10 06 43 a4 de 17
bc 98 cb 59 17 .
...(..C......Y.
04b0 17 c7 3e f3 0
2 f5 bb e6 29 72 5f
70 0d 0b 31 f0 .
.>.....)r_p..1.
04c0 0a 9b 0e b2 7
6 1a f3 bc 1f 6e 4d
6e d7 29 89 30 .
...v....nMn.).0
04d0 a1 8b 04 ef 3
a b1 bc b0 0e 17 b0
8a 17 38 27 dd .
...:........8'.
04e0 e1 97 56 76 e
8 d8 dc 18 95 c7 8f
ac ca c8 c1 0a .
.Vv............
04f0 a8 b9 75 12 e
a bb c0 b6 e1 e2 6f
34 5a 6f 50 3a .
.u.......o4ZoP:
0500 8e 0f 08 0a 0
a 0d 7b 45 4e a4 8c
be d3 90 bb 4b .
.....{EN......K
0510 3a 1c 41 19 d
c 51 87 13 b8 c5 90
71 c5 48 ca 07 :
.A..Q.....q.H..
0520 81 5f
.
_
No. Time
Source
Destination
Protocol
Length Info
60 1.782255000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=30104 Win=45675 Le
n=0
Frame 60: 54 bytes
on wire (432 bits),
54 bytes captured

(432 bits) on inter

face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.832185000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.832185000 s
econds
[Time delta fro
m previous captured
frame: 0.000185000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018500
0 seconds]
[Time since ref
erence or first fra
me: 1.782255000 sec
onds]
Frame Number: 6
0
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f31 (20273)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]

[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 30104
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 30104 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 45675

[Calculated win
dow size: 45675]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 59]
[The RTT to
ACK the segment wa
s: 0.000185000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 31 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O1@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 d7 c5 50 10 .
....P..N.+...P.
0030 b2 6b 18 d4 0
0 00
.
k....
No. Time
Source
Destination
Protocol
Length Info
61 1.852070000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=30104
Ack=1 Win=46 Len=1
260
Frame 61: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5

4.902000000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.902000000 s
econds
[Time delta fro
m previous captured
frame: 0.069815000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06981500
0 seconds]
[Time since ref
erence or first fra
me: 1.852070000 sec
onds]
Frame Number: 6
1
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf18f (61839)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a9b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc

13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 30104, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 30104 (relativ
e sequence number)
[Next sequence
number: 31364 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u

nknown)]
Checksum: 0x458
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 8f 4
0 00 31 06 3a 9b 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 d7 c5 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 45 89 0
0 00 48 fc 60 99 80
d0 9b 08 94 6c .
.E...H.`......l
0040 4a 1d d1 81 b
3 51 00 6a 34 2a c2
80 86 1f 8c 9a J
....Q.j4*......
0050 60 5e 6a 3f 9
6 98 b3 5b 15 32 06
e9 44 32 bd 67 `
^j?...[.2..D2.g
0060 36 16 2e 8b 9
c eb e4 48 18 08 13
59 c6 00 6c 52 6
......H...Y..lR
0070 de a7 1c c4 6
7 e8 f1 77 3c bb 4a
6b 10 0e 75 a4 .
...g..w<.Jk..u.
0080 7f f2 09 cb f
f fb 92 04 ea 8f f3
0e 25 53 03 38 .
...........%S.8
0090 7a 50 5f 47 b
a 70 65 e8 5c 0b a0
87 50 0c e1 89 z
P_G.pe.\...P...
00a0 41 73 13 6a 0
1 97 bd 28 be 97 41
fe 00 78 6a 0b A
s.j...(..A..xj.
00b0 88 b0 9e cd 6
a f3 7c 2b 24 29 44
5e 23 2e 13 d8 .
...j.|+$)D^#...
00c0 a5 4f 25 6a f
6 0d 6a 6e 6e ba 22
8e 0b 4b 74 62 .
O%j..jnn."..Ktb
00d0 80 fc 77 aa 5
e 99 a5 29 2e e9 f1

7d e9 c2 f8 8b .
.w.^..)...}....
00e0 49 b7 3d 33 e
d af 4c c1 fe 4d 01
45 98 68 4e d5 I
.=3..L..M.E.hN.
00f0 02 68 1a 53 3
8 49 a5 df 06 5c 4d
cd 28 d2 04 27 .
h.S8I...\M.(..'
0100 cd c3 ef e3 1
f 3e f3 7f d5 fa 66
52 78 2a a6 3a .
....>....fRx*.:
0110 9d 2f fd a8 a
a 9d a6 dc 3b 17 72
c1 99 5a 03 ac .
/......;.r..Z..
0120 4e 54 c3 77 3
b 35 92 40 90 d3 51
8c c8 5d 9b 2c N
T.w;5.@..Q..].,
0130 83 91 e1 e6 7
e 0b 71 60 6e b8 77
af 0b a3 fa 7c .
...~.q`n.w....|
0140 db 4e fe 7b d
7 87 73 27 fd 34 7d
6f c4 5d 67 2b .
N.{..s'.4}o.]g+
0150 a3 cf 77 2b 4
3 b8 42 1f bd 72 00
92 27 ed f2 d2 .
.w+C.B..r..'...
0160 55 ff e7 5b d
a e8 ca 78 e6 00 36
b8 8d 4a f4 55 U
..[...x..6..J.U
0170 84 64 7d af 2
a 88 21 cc 76 28 5b
de 31 35 86 10 .
d}.*.!.v([.15..
0180 9f 32 ad 52 a
c 4f 22 5d ed b9 41
e0 39 56 b0 57 .
2.R.O"]..A.9V.W
0190 7b 94 bb 59 3
b 69 96 a3 07 97 64
a4 56 8a 36 ca {
..Y;i....d.V.6.
01a0 ca a7 70 2a 3
9 4c c1 08 f3 5f af
79 d5 51 d7 9d .
.p*9L..._.y.Q..
01b0 b6 46 79 75 2
3 48 72 67 4d 8f 76
ba bc 86 44 ae .
Fyu#HrgM.v...D.
01c0 57 d9 5e 7a 1
1 f7 e4 77 49 b4 b3
6a 98 4c 33 75 W
.^z...wI..j.L3u
01d0 bb 3f 04 69 6
d 14 e8 80 0a 4e d1
65 82 b2 5f 16 .
?.im....N.e.._.
01e0 19 92 94 78 2
4 6c bf cd 4b 8f 1b
a8 87 72 32 cd .

..x$l..K....r2.
01f0 f5 c4 35 9b 8
d 34 6b 3f 8f dc 47
24 63 9c cb 9c .
.5..4k?..G$c...
0200 fa 53 27 dd 4
c fc bf d3 74 bf 5c
fa 72 7f 91 12 .
S'.L...t.\.r...
0210 ca 86 5c d2 1
e f9 53 b3 54 eb a6
cf f1 b4 47 bf .
.\...S.T.....G.
0220 65 2d 45 a4 d
d d2 ff fb 92 04 ec
0f f2 dc 1f d5 e
-E.............
0230 03 2c 62 50 6
0 c4 da b0 3d 8f 4a
0c 5d 0d 5c 0c .
,bP`...=.J.].\.
0240 24 6b 89 9a a
c eb 80 f4 89 b9 0e
eb f1 bb b3 31 $
k.............1
0250 5d a4 6f aa b
0 9a 01 76 0f 02 28
bb 9c ab 60 a0 ]
.o....v..(...`.
0260 c0 84 23 00 4
2 6b e2 72 93 d9 82
7d 05 2c b0 5a .
.#.Bk.r...}.,.Z
0270 46 65 2c a2 e
6 6f e6 eb 19 98 fa
45 35 12 29 40 F
e,..o.....E5.)@
0280 57 d8 59 18 3
9 e1 89 e9 65 f7 7f
ed 1f 97 1b 55 W
.Y.9...e......U
0290 0f d0 07 51 9
0 42 c7 b7 a2 7d 94
9b 7a d9 c3 4a .
..Q.B...}..z..J
02a0 69 7d 5d 2f 4
6 c7 82 48 1f f9 f7
27 e9 53 d1 e6 i
}]/F..H...'.S..
02b0 f1 29 28 65 1
7 87 46 6c 0a 75 ac
a5 dc d3 9c a6 .
)(e..Fl.u......
02c0 75 4b 23 58 f
8 60 fb ab 20 2c 6b
2f 11 ef 5b 3c u
K#X.`.. ,k/..[<
02d0 94 b4 dc a6 7
a 9b 4a 1c db 27 22
a4 72 03 1f 37 .
...z.J..'".r..7
02e0 82 fe 10 98 5
1 75 22 a7 1a c9 aa
74 aa a9 68 cc .
...Qu"....t..h.
02f0 dc 39 c3 f5 9
b 1a 97 ea 47 63 33
15 0a b0 69 82 .
9......Gc3...i.

0300 a1 25 01 8b 3
d f2 d9 61 c7 4b 09
5d 22 ee 25 18 .
%..=..a.K.]".%.
0310 3d d2 40 d2 d
1 aa 52 ad 80 d5 a0
11 fc 83 19 13 =
.@...R.........
0320 55 b4 c0 56 0
f a1 a2 50 6b b8 b8
49 0c 4b 13 c1 U
..V...Pk..I.K..
0330 1f 95 1f 68 6
9 84 a3 78 13 06 65
a2 5b e6 97 a3 .
..hi..x..e.[...
0340 9c 74 dd 74 6
2 17 d6 f4 62 f6 dc
5d bd 6a aa a4 .
t.tb...b..].j..
0350 a9 52 c1 c6 1
e 37 0d 34 78 0a 1a
0a 11 3c 54 94 .
R...7.4x....<T.
0360 1a 96 89 1e 5
8 d6 02 79 d0 69 e1
a5 2d c1 b2 39 .
...X..y.i..-..9
0370 57 af 0d f9 2
2 20 aa 77 56 d1 94
9e 64 80 09 06 W
..." .wV...d...
0380 4e e5 65 0b 8
5 1c 16 40 15 e1 24
7c d8 2a 99 1b N
.e....@..$|.*..
0390 8d 19 06 3f 8
c e6 97 86 98 69 65
94 ad 36 59 02 .
..?.....ie..6Y.
03a0 05 62 27 be 2
1 87 d1 7b 7a cb 38
74 b8 b1 1c c5 .
b'.!..{z.8t....
03b0 b5 2d ed 60 4
6 7e 9f 7d 9b 5e f0
23 ee 8e 7f ef .
-.`F~.}.^.#....
03c0 ce b8 68 26 2
a e1 62 f2 ff fb 92
04 e8 0f f2 e1 .
.h&*.b.........
03d0 51 58 01 e8 1
a f2 5e 63 5a f0 3c
c9 38 4c 68 f3 Q
X....^cZ.<.8Lh.
03e0 5a 0c 30 6b 8
1 83 95 6b 41 84 a1
30 17 09 33 a6 Z
.0k...kA..0..3.
03f0 96 19 bd d9 d
5 91 ba ca 7f a3 f5
c4 42 c9 10 ca .
...........B...
0400 5f 64 80 e2 9
8 92 84 b2 1d 27 02
79 11 40 53 38 _
d.......'.y.@S8
0410 2c 41 b8 72 5

6 ed 66 3d 52 4a a5
4e e5 6e 3c 09 ,
A.rV.f=RJ.N.n<.
0420 04 23 8f 6c 7
b 48 d3 d7 f6 61 87
d7 1b fc ba f2 .
#.l{H...a......
0430 11 dc 4b 5c 7
9 7a 19 f3 f1 c3 7b
b5 17 65 a7 6d .
.K\yz....{..e.m
0440 76 61 3e 55 6
f 0c 20 7b dc 00 57
6e a6 51 35 17 v
a>Uo. {..Wn.Q5.
0450 ea ed 4f f4 3
5 d4 01 99 eb 26 45
72 1c 0c 69 80 .
.O.5....&Er..i.
0460 c1 88 42 40 2
9 1e 42 ed cd 81 52
26 26 1d ca e9 .
.B@).B...R&&...
0470 c9 64 55 63 4
8 f0 8c 5b 90 a4 3c
f4 3c 6a 4f 10 .
dUcH..[..<.<jO.
0480 85 89 4c 3c 1
a 92 5b 42 61 3f 2e
e3 d9 79 67 55 .
.L<..[Ba?...ygU
0490 d8 29 af fb a
f 1f 55 1e 6b ec de
53 51 6e e4 b3 .
)....U.k..SQn..
04a0 96 44 48 08 b
3 41 0b 08 30 f1 b1
6b dd 14 56 9e .
DH..A..0..k..V.
04b0 3f 8b b4 91 d
8 84 50 9a e0 82 81
8d 28 63 2b 59 ?
.....P.....(c+Y
04c0 8b b9 3c 30 5
6 58 55 07 2a b9 fb
10 bb c7 56 1c .
.<0VXU.*.....V.
04d0 f0 97 07 72 b
9 cd fb b9 44 d1 e2
8c ac b0 fa 0e .
..r....D.......
04e0 1a 41 06 ac 6
9 96 a5 d5 12 eb 86
6d be fa 74 14 .
A..i......m..t.
04f0 6f 1e 63 3b 6
b 43 5b fb 73 f3 ba
e6 b3 27 90 24 o
.c;kC[.s....'.$
0500 52 d4 82 ce 6
0 ab 80 db 77 b5 4e
ac ab af d1 57 R
...`...w.N....W
0510 26 0c a9 98 2
6 72 c0 03 94 05 d4
b4 d1 00 02 b0 &
...&r..........
0520 a5 81

.
.
No. Time
Source
Destination
Protocol
Length Info
62 1.924692000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=31364
Ack=1 Win=46 Len=1
260
Frame 62: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.974622000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.974622000 s
econds
[Time delta fro
m previous captured
frame: 0.072622000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07262200
0 seconds]
[Time since ref
erence or first fra
me: 1.924692000 sec
onds]
Frame Number: 6
2
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule

String: http || tcp

.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300

Identification:
0xf190 (61840)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a9a [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 31364, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 31364 (relativ
e sequence number)
[Next sequence
number: 32624 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set

...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x6de
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 90 4
0 00 31 06 3a 9a 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 dc b1 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 6d e5 0
0 00 85 ec c4 5d 35
8f e0 c4 59 70 .
.m......]5...Yp
0040 f1 9b 5e 2e 9
1 a8 43 53 24 05 10
5d 31 17 d3 3e .
.^...CS$..]1..>
0050 2b a9 5f 37 0
b 68 ab b4 76 b8 b1
b1 1b 28 b8 74 +

._7.h..v....(.t
0060 8d a7 8c f5 8
8 f9 5d 76 69 1f 6f
3a d4 16 2c 6b .
.....]vi.o:..,k
0070 77 8b bd 69 f
b cd 31 c2 e1 67 90
53 02 cf ff fb w
..i..1..g.S....
0080 92 04 e7 8f f
3 01 27 d4 03 4f 62
50 59 04 ea 90 .
.....'..ObPY...
0090 65 ec 4a 0b c
0 9f 4e 0d 3d 89 41
73 14 6a 01 97 e
.J...N.=.As.j..
00a0 b1 28 22 89 4
4 de d1 5d b1 7d c5
d0 c4 c3 40 9b .
(".D..].}....@.
00b0 83 b4 f4 54 0
e 1d ba 85 91 56 55
53 25 e0 dc 9d .
..T.....VUS%...
00c0 6d 90 79 28 2
3 d0 1b 4d 2a c8 c2
f1 a9 70 c9 63 m
.y(#..M*....p.c
00d0 7c 75 6c 59 4
f 56 f4 22 ec 43 d9
eb 45 a3 d5 73 |
ulYOV.".C..E..s
00e0 1b 31 74 5f d
5 34 c4 ca da c4 89
0e b1 54 cc 59 .
1t_.4.......T.Y
00f0 56 66 98 5c d
e 2d 37 e9 4a ea f7
a7 cd 7e 6f b8 V
f.\.-7.J....~o.
0100 ce 60 c8 b9 b
2 52 e2 46 af 56 20
ab 96 5d 20 5a .
`...R.F.V ..] Z
0110 4c e4 8f f7 c
a 0c 0a b2 21 15 7f
08 13 18 50 9a L
.......!.....P.
0120 09 bd 16 9e 0
6 dd ee f5 57 b8 29
85 22 ad 8a 1a .
.......W.)."...
0130 52 56 05 c2 b
4 fd 47 35 41 95 41
5c 2a 85 73 27 R
V....G5A.A\*.s'
0140 5b 89 28 1c 1
6 f5 c7 4e 14 f7 e0
80 72 7c c4 4c [
.(....N....r|.L
0150 f5 1b 65 b6 2
f 6f ee fb c2 b6 66
76 6b 91 dc cc .
.e./o....fvk...
0160 4f 2a 79 41 6
4 a0 87 b2 4a 84 6d
30 4d 36 aa 37 O
*yAd...J.m0M6.7

0170 d1 25 01 7e a
a 31 00 cb 0c cb 15
8d 95 cb 5f f6 .
%.~.1........_.
0180 1e 96 10 bb 3
d 4c 5a b2 a7 a0 98
8e e4 42 fc b1 .
...=LZ......B..
0190 e1 64 d2 85 a
2 fb c2 e3 92 9a a1
da 03 b7 54 d2 .
d............T.
01a0 98 ea 91 d2 4
1 fe d2 23 c7 b7 93
99 18 ae 53 58 .
...A..#......SX
01b0 e7 1b ee 82 b
1 77 77 e4 0f 3b 49
bc d6 75 fa 76 .
....ww..;I..u.v
01c0 4d 76 24 24 2
f 43 07 7b a8 fd bf
e8 81 4a a6 c6 M
v$$/C.{.....J..
01d0 68 08 50 96 d
8 ca 08 03 02 65 23
02 01 23 47 e9 h
.P......e#..#G.
01e0 8b b5 49 2b 2
3 17 66 d0 f1 74 fd
a9 3a ba 66 57 .
.I+#.f..t..:.fW
01f0 c1 63 d9 e8 a
c 3f a4 b7 92 84 de
3e eb 3c 38 b0 .
c...?.....>.<8.
0200 9e c0 28 ad b
d db 78 ae ec de c7
bd 45 c6 f5 69 .
.(...x.....E..i
0210 62 6e d8 c6 3
1 f2 ea df 58 ce 7f
dd b3 f3 e0 6d b
n..1...X......m
0220 ff fb 92 04 e
c 8f f3 22 28 53 83
4f 7a 50 61 c5 .
......"(S.OzPa.
0230 8a 70 65 ef 4
c 0b 90 b1 4e 0c bd
89 81 8a 17 e9 .
pe.L...N.......
0240 c1 9c 31 30 c
d 25 6c 42 5d 5b 5f
29 d0 b0 a3 a7 .
.10.%lB][_)....
0250 4c f5 81 41 0
0 e1 cc 0c 90 20 54
74 a0 70 e0 c1 L
..A..... Tt.p..
0260 0e 96 94 20 7
e 05 94 45 7a b9 cd
54 cc 32 0e 55 .
.. ~..Ez..T.2.U
0270 f6 06 d7 a7 c
a 75 b8 62 1f da 97
b5 1e 05 e9 46 .
....u.b.......F
0280 aa b3 fb d6 c

c 34 cb 9d a5 78 fa
6d 59 86 78 36 .
....4...x.mY.x6
0290 7d 06 06 f5 6
5 e7 d5 d4 6a db 18
b5 66 00 b5 85 }
...e...j...f...
02a0 c2 22 35 18 2
8 90 f9 57 8a 80 e8
cf ff 86 f5 b9 .
"5.(..W........
02b0 05 81 e6 1f 4
0 1a 21 43 20 4a c4
e7 55 41 e0 40 .
...@.!C J..UA.@
02c0 40 a5 ec 47 9
a 99 c4 70 4d 6c a7
6e 29 b3 b8 cc @
..G...pMl.n)...
02d0 8c b3 c4 4b 2
b 10 c8 47 c1 d8 a0
53 de 80 1c 10 .
..K+..G...S....
02e0 0d 20 8a 64 2
c 2c 6d 40 5e b4 99
63 c9 a1 a4 c4 .
.d,,m@^..c....
02f0 ca c5 0b 06 e
f 22 ab 98 e8 a5 f6
ab b5 5e f2 af .
....".......^..
0300 76 7f fa df 9
d 38 0e 32 f8 70 5b
fa 55 d1 d2 d4 v
....8.2.p[.U...
0310 04 30 83 3a 3
7 96 28 29 09 02 41
8e 8e 9c a9 64 .
0.:7.()..A....d
0320 24 54 e6 a9 6
d 97 3c b1 78 e5 0a
12 a8 2e b1 a7 $
T..m.<.x.......
0330 2a 1e b3 66 0
6 6e f1 aa 21 84 6e
2a 5c af 90 e7 *
..f.n..!.n*\...
0340 53 40 75 59 5
8 62 49 5d b1 63 c6
b5 95 54 8b 79 S
@uYXbI].c...T.y
0350 99 5e ea 06 7
3 aa cf 78 17 85 8f
bc 79 38 a8 68 .
^..s..x....y8.h
0360 c3 4b 28 b0 7
6 32 98 59 ee 6d 49
f1 4b 3c 82 60 .
K(.v2.Y.mI.K<.`
0370 14 e6 ff 87 d
7 00 13 53 14 9a 14
c2 02 1e 48 c2 .
......S......H.
0380 a8 99 c5 3c 8
7 38 b5 5d 8a ca f9
d4 a8 b4 22 bb .
..<.8.]......".
0390 76 94 14 c3 2
5 42 7f 96 70 62 42

55 2c 26 1d 62 v
...%B..pbBU,&.b
03a0 d7 4f 52 ef 1
a a1 57 71 6e cc e1
2e a1 38 b6 c0 .
OR...Wqn....8..
03b0 7b 6f 9a 6d 9
a b9 f6 ce b7 96 07
c1 77 0c 9e d4 {
o.m........w...
03c0 e7 b1 ff fb 9
2 04 e9 0f f2 e7 2f
54 03 4f 7a 60 .
........./T.Oz`
03d0 62 44 fa 70 6
9 ef 4a 0b f8 c5 4e
0d 3d 29 81 7f b
D.pi.J...N.=)..
03e0 13 e9 c1 9c 3
d 28 f1 40 e6 8b 3c
ab 38 00 ca 4a .
...=(.@..<.8..J
03f0 f1 dc 70 f0 a
8 8a 88 88 da b6 08
63 1b 24 bd d1 .
.p........c.$..
0400 c6 e0 5c 18 a
2 c8 01 6a a5 26 2e
8c 2a 38 93 a5 .
.\....j.&..*8..
0410 0d f1 fa 70 0
9 99 9a a9 89 22 ac
3a 05 85 01 4b .
..p.....".:...K
0420 43 4f 52 48 1
9 50 ac de 6c f7 74
db d6 56 18 0f C
ORH.P..l.t..V..
0430 61 c4 cd 23 b
5 b5 e6 d6 8f 9d f9
60 b5 b7 eb ff a
..#.......`....
0440 6a 78 ad b1 c
d 75 b2 4f a2 8f f5
16 00 05 91 1d j
x...u.O........
0450 13 27 69 01 8
c 1e 65 5d 89 02 11
97 24 20 d3 5b .
'i...e]....$ .[
0460 47 62 18 d6 3
4 8f 75 41 b4 77 80
ad 6c 99 e6 2c G
b..4.uA.w..l..,
0470 08 ac ca 91 c
4 8e 34 cd d1 07 73
25 d2 59 06 84 .
.....4...s%.Y..
0480 45 dc 07 05 6
e 90 b8 3c d0 93 9f
2a 88 c4 56 54 E
...n..<...*..VT
0490 dd 18 2d 36 e
3 ed 67 d4 2d 78 6d
cd 15 7f 39 f8 .
.-6..g.-xm...9.
04a0 27 97 59 7b 7
9 b5 d7 d7 b7 45 5b
32 c2 9f 2f ff '

.Y{y....E[2../.
04b0 51 d0 65 93 f
5 91 78 48 98 06 a0
c3 9a a2 ae 52 Q
.e...xH.......R
04c0 c1 5a 96 86 7
5 11 b0 63 aa 32 ae
20 ce d5 a5 10 .
Z..u..c.2. ....
04d0 a3 3c 18 59 9
5 2c 2d ce 47 69 03
76 5c a4 c0 c7 .
<.Y.,-.Gi.v\...
04e0 59 42 e9 46 1
7 fa 91 ba 66 65 47
6b 89 16 25 77 Y
B.F....feGk..%w
04f0 19 ed 19 1f 4
6 be 68 f2 0c b8 a7
cc 2d e2 5b 45 .
...F.h.....-.[E
0500 ff 77 bd 31 e
b f5 bf a8 2e 13 8e
b2 29 a3 b7 fe .
w.1........)...
0510 ba 49 42 48 c
6 f7 09 a0 2a 64 81
03 09 2b 79 88 .
IBH....*d...+y.
0520 08 4c
.
L
No. Time
Source
Destination
Protocol
Length Info
63 1.924873000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=32624 Win=45360 Le
n=0
Frame 63: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.974803000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.974803000 s

econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 1.924873000 sec
onds]
Frame Number: 6
3
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f32 (20274)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D

st Port: http (80),

Seq: 1, Ack: 32624
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 32624 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 45360
[Calculated win
dow size: 45360]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an

ACK to the segment

in frame: 62]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 32 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O2@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 e1 9d 50 10 .
....P..N.+...P.
0030 b1 30 18 d4 0
0 00
.
0....
No. Time
Source
Destination
Protocol
Length Info
64 1.929069000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
453 http49
574 [PSH, ACK] Seq=
32624 Ack=1 Win=46
Len=399
Frame 64: 453 bytes
on wire (3624 bits
), 453 bytes captur
ed (3624 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
4.978999000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615214.978999000 s
econds
[Time delta fro
m previous captured
frame: 0.004196000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00419600
0 seconds]
[Time since ref

erence or first fra

me: 1.929069000 sec
onds]
Frame Number: 6
4
Frame Length: 4
53 bytes (3624 bits
)
Capture Length:
453 bytes (3624 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
39
Identification:
0xf191 (61841)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3df6 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 32624, Ack: 1
, Len: 399
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:

0]
[TCP Segment Le
n: 399]
Sequence number
: 32624 (relativ
e sequence number)
[Next sequence
number: 33023 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x3d9
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 399]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17

e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 b7 f1 91 4
0 00 31 06 3d f6 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b c8 e1 9d 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 3d 94 0
0 00 09 0b 89 29 f7
2a 08 df 32 9b .
.=......).*..2.
0040 d5 67 aa 02 2
4 23 b1 b5 29 2c 57
24 4a 8c e7 3d .
g..$#..),W$J..=
0050 15 06 5b 0b c
c 8b a0 de 54 3d ac
27 d7 9d ce 32 .
.[.....T=.'...2
0060 b6 2e 9f ee 7
6 18 38 72 89 46 49
35 12 d9 79 67 .
...v.8r.FI5..yg
0070 39 7c bf cf 4
c 56 6f 8d ff fb 92
04 e8 8f f2 c5 9
|..LVo.........
0080 27 53 83 2f 7
a 50 5f 85 8a 70 65
ef 4c 0c a4 c7 '
S./zP_..pe.L...
0090 4c 0d 3d 2b 8
9 81 17 a9 c1 97 bd
30 e7 18 94 4a L
.=+.......0...J
00a0 4a 05 1e 26 1
a e9 0f 5f 47 d0 93
89 a0 73 e9 98 J
..&..._G....s..
00b0 e2 ad 60 b9 a
8 05 8f a2 f8 e8 c3
b0 93 58 e3 26 .
.`..........X.&
00c0 00 24 43 42 d
e 96 e4 ad 0e 61 7c
af 52 cc cd 04 .
$CB.....a|.R...
00d0 11 c4 cc 59 2
0 25 90 96 4b 8c 02
c4 96 7b ac c4 .
..Y %..K....{..
00e0 bc 8c 79 52 4
5 d3 1e e3 2b 75 16
75 4c 4a c3 a3 .
.yRE...+u.uLJ..
00f0 cc c1 71 91 f
6 7d e1 7d fa 44 ad
7f d7 c4 5f 0e .
.q..}.}.D...._.
0100 2c 01 78 2c 2
a e6 45 d3 6a 0b ff
a1 34 08 58 18 ,
.x,*.E.j...4.X.
0110 5d a6 05 78 c
1 83 02 41 81 18 50
c8 05 11 13 31 ]

..x...A..P....1
0120 af 02 72 4a 2
2 11 11 0b ee dd 42
20 4e 6e 51 60 .
.rJ".....B NnQ`
0130 29 19 34 e2 a
2 30 15 4b 6f e3 38
4c 64 7e e0 d1 )
.4..0.Ko.8Ld~..
0140 c4 0b 0c 48 2
3 3a 59 34 0e 2b 43
c2 a4 03 91 58 .
..H#:Y4.+C....X
0150 fb 61 cf 87 5
4 47 0e 55 5a b8 fd
d6 c5 3f b4 71 .
a..TG.UZ....?.q
0160 c8 4b df 14 7
2 f6 fe a4 26 0c 1c
36 f5 cc 09 71 .
K..r...&..6...q
0170 a1 e3 a1 d5 f
b c4 91 85 b3 1c 8a
3a b1 3f 23 6c .
..........:.?#l
0180 72 40 09 d7 3
6 07 23 59 99 be 03
01 b8 0f d2 fa r
@..6.#Y........
0190 8e 39 15 d2 b
f 9c 2e 2a 58 9f 54
40 b1 b0 6d 31 .
9.....*X.T@..m1
01a0 91 7c 3c 4e 9
e 4b 94 17 52 64 8b
1d 8a 8a cf cb .
|<N.K..Rd......
01b0 3c fc 62 a1 a
9 cb d5 f8 e6 d4 b2
a9 33 22 04 36 <
.b.........3".6
01c0 e5 11 76 8f a
e
.
.v..
No. Time
Source
Destination
Protocol
Length Info
65 2.125081000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=33023
Ack=1 Win=46 Len=1
260
Frame 65: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B

-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.175011000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.175011000 s
econds
[Time delta fro
m previous captured
frame: 0.196012000
seconds]
[Time delta fro
m previous displaye
d frame: 0.19601200
0 seconds]
[Time since ref
erence or first fra
me: 2.125081000 sec
onds]
Frame Number: 6
5
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3

b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf192 (61842)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a98 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]

Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 33023, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 33023 (relativ
e sequence number)
[Next sequence
number: 34283 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val

ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x661
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1659]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 92 4
0 00 31 06 3a 98 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 e3 2c 9e
87 4e aa 50 10 .
..P..+..,..N.P.
0030 00 2e 66 15 0
0 00 52 81 83 c6 1a
19 b1 0a 64 41 .
.f...R.......dA
0040 39 a1 05 4b 0
7 d3 50 c1 18 13 25
96 28 e4 28 b7 9
..K..P...%.(.(.
0050 ad 17 16 00 3
8 ba 6e 3d 21 b5 4b
2a 95 74 43 11 .
...8.n=!.K*.tC.
0060 0e 23 e9 95 1
8 f6 31 98 2c 09 4d
63 0f f6 d5 15 .
#....1.,.Mc....
0070 eb c3 ef 52 c
5 5f 50 66 8e 4d da
73 63 dc 4f ed .
..R._Pf.M.sc.O.
0080 b9 20 e3 54 a
d 37 de a1 6e 0a 80
ff fb 92 04 e8 .
.T.7..n.......
0090 8f f3 07 2b 5
3 83 4f 7a 60 61 e5
8a 70 69 ef 4c .
..+S.Oz`a..pi.L
00a0 0b 78 bd 50 0
d 3d 69 81 75 17 69
c1 a7 a5 30 50 .
x.P.=i.u.i...0P
00b0 c0 a3 81 b7 a
4 5d 6c 39 f5 a3 ad
06 01 8f 1a fa .
....]l9........
00c0 84 c4 62 82 3

5 43 1f b2 eb b1 11
3e 54 3e 4f 96 .
.b.5C.....>T>O.
00d0 d0 11 95 4b 2
b c0 73 3c d7 a0 9e
79 5d e9 16 7b .
..K+.s<...y]..{
00e0 0b c1 c8 18 a
2 bc f4 ad 61 9c 59
0a 48 bb 8f 22 .
.......a.Y.H.."
00f0 2f af a0 b2 7
9 1a f4 79 3c 16 eb
59 54 7d c5 7e /
...y..y<..YT}.~
0100 cf 87 9f 0c d
0 77 6f 7a ea b5 84
b3 35 be fe b3 .
....woz....5...
0110 4b fb 7d 62 7
f 3c f0 fb 06 05 d7
ab a2 94 78 1d K
.}b.<........x.
0120 20 05 01 ef 2
2 85 19 5c 8d 26 a8
09 8e 00 a0 9e
..."..\.&......
0130 12 29 f9 1b 4
9 66 13 0c 7a 60 98
fb a5 a2 79 e2 .
)..If..z`....y.
0140 b1 3c 1f 38 9
4 13 d5 31 77 43 58
75 0c ee 4e 1b .
<.8...1wCXu..N.
0150 57 8d 86 5b 4
2 41 72 32 cd a5 3d
e0 a8 77 f6 ad W
..[BAr2..=..w..
0160 72 72 5c 39 4
b 13 32 e5 d4 6b df
e6 2e 7c 3a 1d r
r\9K.2..k...|:.
0170 49 85 80 86 5
0 b3 65 ca 07 a8 b6
c5 a7 a0 32 c1 I
...P.e.......2.
0180 08 c7 2b 48 8
a 18 d3 26 6b 69 a2
28 63 3e 9d a1 .
.+H...&ki.(c>..
0190 a6 6a e4 c5 a
0 ce 26 d1 3b 4a d5
65 d3 95 66 a0 .
j....&.;J.e..f.
01a0 f8 09 b3 43 d
6 18 3c b6 9f 95 44
61 07 9f a3 14 .
..C..<...Da....
01b0 c4 34 72 08 9
1 b9 5c 6d 9d f4 b0
51 79 52 6a 6b .
4r...\m...QyRjk
01c0 9b 0a ff b7 f
5 be 2f ef 7a b3 33
35 97 e4 54 51 .
...../.z.35..TQ
01d0 77 4a 12 70 5
3 aa de ba ea 5d 8f

11 9c c4 71 d5 w
J.pS....]....q.
01e0 0c 05 33 8b 9
5 58 91 33 f2 05 4e
99 af ed dc e7 .
.3..X.3..N.....
01f0 14 4e 3a cd 2
9 ca 0b 47 2f 80 de
e8 3e 67 77 24 .
N:.)..G/...>gw$
0200 eb 7a 0c 84 2
b 7d f9 89 9a 74 00
d8 26 a0 e3 41 .
z..+}...t..&..A
0210 e5 f2 49 3e 4
d e9 6a 4c 95 73 25
c7 87 f7 5b 75 .
.I>M.jL.s%...[u
0220 9b 74 3c a7 5
7 4c 66 92 d5 db 25
8c 55 ff fb 92 .
t<.WLf...%.U...
0230 04 e9 8f f3 0
6 27 53 83 4f 7a 50
62 c5 ea 60 65 .
....'S.OzPb..`e
0240 ef 4c 0b d4 9
f 4e 0c e1 e9 41 70
96 29 c1 9c 31 .
L...N...Ap.)..1
0250 30 f1 fe fb a
c e3 22 94 b2 f5 27
5c 53 92 87 04 0
....."...'\S...
0260 4f 01 90 8d 4
8 02 ee 15 41 09 00
bc 4a 00 c1 81 O
...H...A...J...
0270 b9 25 8c 72 8
8 c0 fb 62 47 b0 97
1b 2b c6 ca b0 .
%.r...bG...+...
0280 f1 91 c1 e1 e
c b2 5f 72 2e 77 80
da fc c1 08 d4 .
....._r.w......
0290 ac 90 db 17 e
b 17 de 2e 73 a8 13
32 7e d4 e7 33 .
.......s..2~..3
02a0 b6 fa cb aa c
0 64 c4 f9 f7 bd 25
d8 00 f1 e2 24 .
....d....%....$
02b0 0e 0a da b6 5
1 df a7 67 b9 6d e0
88 01 92 e0 0e .
...Q..g.m......
02c0 26 22 4a 58 5
1 22 2f 59 11 40 20
90 b7 45 40 61 &
"JXQ"/Y.@ ..E@a
02d0 1f 41 b1 b3 2
d 4c 31 91 9b 9c 40
22 b9 5d 65 33 .
A..-L1...@".]e3
02e0 1e 42 10 2e 8
c c7 ec 6d 09 a1 b9
1d 7c 3c b9 89 .

B.....m....|<..
02f0 12 12 1f 51 d
8 22 93 d7 e0 88 78
f2 d3 f6 7a 93 .
..Q."....x...z.
0300 6c 26 fd bd d
7 7e 6a c3 d3 36 cf
cc 96 78 06 a0 l
&...~j..6...x..
0310 c1 60 fa 0b b
d e7 ec 59 53 be cd
6d 24 55 51 8e .
`.....YS..m$UQ.
0320 90 0d 12 c3 0
c 08 f4 eb 53 47 0c
b4 a2 66 76 40 .
.......SG...fv@
0330 62 10 30 e6 6
1 92 42 f8 f5 8c a3
5b 43 6c ad 4a b
.0.a.B....[Cl.J
0340 aa dc 1a 4f 8
1 bd 3b 2d b0 f4 9f
d6 48 fd 8b c2 .
..O..;-....H...
0350 89 21 24 55 f
9 20 3e 83 1f 10 71
3a dc 0a bf a6 .
!$U. >...q:....
0360 5b 21 1a 2c 1
9 40 45 e9 13 19 20
4d a7 24 cb ea [
!.,.@E... M.$..
0370 14 6f d5 e9 a
a 6a 29 c8 62 ad 13
38 06 1b 16 c4 .
o...j).b..8....
0380 24 d0 46 ad b
f 11 06 50 a6 1b 2a
7f 1a 29 01 70 $
.F....P..*..).p
0390 77 27 e5 36 e
5 4f 02 6a c3 14 d3
36 e0 b5 7d 34 w
'.6.O.j...6..}4
03a0 86 0d 13 28 a
f 6e 03 a0 7c b1 b5
e6 4e 6e 6f 40 .
..(.n..|...Nno@
03b0 5c b3 4b 3a d
9 f4 79 66 20 3e 4a
eb ae 3a cb 0b \
.K:..yf >J..:..
03c0 19 ef 9a ed f
e 87 b3 93 9d f5 c6
af 33 f7 af ff .
...........3...
03d0 fb 92 04 e9 0
f f3 08 31 53 03 58
5a 60 5b 64 da .
......1S.XZ`[d.
03e0 70 69 ef 4a 0
c 40 b3 4c 0d 3d 89
81 65 91 29 c1 p
i.J.@.L.=..e.).
03f0 a7 bd 28 4f c
7 9c 78 9d 3d be 94
24 92 84 33 d3 .
.(O..x.=..$..3.

0400 8d 31 f7 d4 c
3 0a 4f 84 56 02 07
20 60 c8 54 36 .
1....O.V.. `.T6
0410 54 d3 13 30 7
8 1c 7f 61 87 26 2f
c4 ef 28 33 2b T
..0x..a.&/..(3+
0420 91 3e f4 50 4
d 24 c9 50 8b 6a 0b
a5 cb a9 34 6b .
>.PM$.P.j....4k
0430 bb b8 57 50 e
1 15 92 0e 35 75 31
9c 36 47 c2 2e .
.WP....5u1.6G..
0440 6d 3e 56 e2 3
4 f3 5d aa ee a2 78
db ad ad fe bd m
>V.4.]...x.....
0450 69 e7 c9 43 e
0 d0 b3 98 35 0e 83
e4 31 ae ff 5c i
..C....5...1..\
0460 85 a4 90 24 1
a 82 87 8c da 80 32
ec 2c 39 20 4e .
..$......2.,9 N
0470 ac 14 af 7a 5
f 0a 24 fa bd 8d 8e
45 62 48 9b ba .
..z_.$....EbH..
0480 89 56 65 84 0
2 ad 10 5f 5e b7 c2
51 be 1e 97 18 .
Ve...._^..Q....
0490 79 a5 69 61 0
0 94 0f 12 07 84 82
f1 81 f9 c8 c2 y
.ia............
04a0 3e 23 f8 c3 2
9 ca 6a 2e 05 f2 0c
76 e2 92 77 e2 >
#..).j....v..w.
04b0 9e df 48 de c
c f9 9b 5d af 36 ba
d2 4c 23 80 6e .
.H....].6..L#.n
04c0 07 0e bc d1 f
e 22 9a 08 4b 0c 13
ba 3b f4 d9 6f .
...."..K...;..o
04d0 57 a0 db cc 6
c 9f 85 98 db 41 5a
33 12 18 a9 43 W
...l....AZ3...C
04e0 c4 78 e9 3f 5
2 f0 94 68 78 49 16
23 c3 81 58 4f .
x.?R..hxI.#..XO
04f0 96 25 78 a8 5
0 36 a8 ed 0e 78 97
71 ac 76 ed 42 .
%x.P6...x.q.v.B
0500 a5 20 c7 a3 8
b fe fe 3c 91 3d e3
90 04 45 41 c0 .
.....<.=...EA.
0510 98 1e 40 3e f

7 9c 3e 63 7b bf 45
7a 46 42 46 01 .
.@>..>c{.EzFBF.
0520 0a 58
.
X
No. Time
Source
Destination
Protocol
Length Info
66 2.125268000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=34283 Win=45360 Le
n=0
Frame 66: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.175198000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.175198000 s
econds
[Time delta fro
m previous captured
frame: 0.000187000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018700
0 seconds]
[Time since ref
erence or first fra
me: 2.125268000 sec
onds]
Frame Number: 6
6
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype

:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab

le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f33 (20275)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 34283
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 34283 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .

... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 45360
[Calculated win
dow size: 45360]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 65]
[The RTT to
ACK the segment wa
s: 0.000187000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 33 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O3@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 e8 18 50 10 .
....P..N.+...P.
0030 b1 30 18 d4 0
0 00
.
0....
No. Time
Source

Destination
Protocol
Length Info
67 2.132077000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=34283
Ack=1 Win=46 Len=1
260
Frame 67: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.182007000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.182007000 s
econds
[Time delta fro
m previous captured
frame: 0.006809000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00680900
0 seconds]
[Time since ref
erence or first fra
me: 2.132077000 sec
onds]
Frame Number: 6
7
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9

0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf193 (61843)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a97 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 34283, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 34283 (relativ
e sequence number)
[Next sequence
number: 35543 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi

ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb44
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 93 4
0 00 31 06 3a 97 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 e8 18 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e b4 4f 0
0 00 9d 08 98 23 4d
e3 8c 18 83 77 .
..O.....#M....w
0040 0d c4 b0 94 7
4 3e 31 25 46 53 00
31 28 9c 0c 2c .
...t>1%FS.1(..,
0050 74 9c 79 3c 1
2 8e 44 51 e1 e7 09
c5 d8 a2 2a 33 t
.y<..DQ......*3
0060 cb 89 4b 4f 4
7 af 56 30 5c aa 8b
a1 65 e7 5e a4 .
.KOG.V0\...e.^.

0070 b4 cd e8 92 c
c b8 ba 71 a6 7a dd
67 7e 27 85 09 .
......q.z.g~'..
0080 1e 78 14 16 b
0 ff fb 92 04 ec 0f
f3 0c 31 53 03 .
x...........1S.
0090 58 62 60 65 2
5 6a 50 6b 0f 4c 0b
3c c7 52 0c bd X
b`e%jPk.L.<.R..
00a0 0b 89 84 93 e
a 01 97 bd 28 4a 44
ad cf 72 5f a5 .
.......(JD..r_.
00b0 5e 2b 7f ff f
f 55 81 d0 c5 c9 90
b4 50 e9 1c 8e ^
+...U......P...
00c0 47 d6 d9 7d 3
c d9 36 da f8 bc 3e
4e b7 33 b1 8c G
..}<.6...>N.3..
00d0 35 02 79 1b 1
9 8a 09 6f 4a 13 a5
c9 92 b8 8c e8 5
.y....oJ.......
00e0 12 2e 3a 84 6
2 38 58 16 e4 a7 26
6c 22 b1 f3 28 .
.:.b8X...&l"..(
00f0 97 75 33 28 d
9 12 73 85 1f 67 16
f4 d4 5d 09 ac .
u3(..s..g...]..
0100 ae e6 5c aa e
3 2c df b1 b5 3a 98
74 7d 73 5c 9d .
.\..,...:.t}s\.
0110 9f dd 40 ef f
f c8 01 14 ec c6 73
2a 53 54 bd cb .
.@.......s*ST..
0120 81 83 a3 38 d
1 5c 9c 47 f3 b5 62
29 69 57 3c 68 .
..8.\.G..b)iW<h
0130 0d c9 f3 a7 1
5 4f 43 e1 b3 03 a5
eb 54 5e 4d a4 .
....OC.....T^M.
0140 ed f4 b6 ca 0
d 28 b2 7a 2a 60 d0
bc 6c 63 f3 83 .
....(.z*`..lc..
0150 50 83 c3 5c c
b 54 3b 11 bd f2 8b
43 cc 8b 67 d4 P
..\.T;....C..g.
0160 a1 63 2e 93 c
e 1f f7 a1 db 72 02
ef 6b 46 c3 ca .
c.......r..kF..
0170 30 b8 04 c2 f
0 69 55 51 ac 2f 98
dc 7d b2 c5 82 0
....iUQ./..}...
0180 a6 d5 af 07 9

6 a0 9f b4 1e 19 40
55 3c db 3e 86 .
.........@U<.>.
0190 4f 36 70 1c 1
2 8c ba 24 9b f6 62
9e 9e 81 aa 76 O
6p....$..b....v
01a0 1f e6 e3 96 3
1 6a 52 73 80 9a 10
78 6b 98 86 c7 .
...1jRs...xk...
01b0 45 41 33 47 e
c 79 07 99 16 df 20
50 ce dc 32 a7 E
A3G.y.... P..2.
01c0 19 7c 6b dc 9
5 34 94 56 c3 f5 ac
5d e3 de 41 2a .
|k..4.V...]..A*
01d0 05 f9 33 ad 0
f 97 f2 8b 47 1a 6c
08 d2 0c 06 97 .
.3.....G.l.....
01e0 0c d7 b4 89 4
d 15 6a da 2f 63 d6
eb 31 34 48 c4 .
...M.j./c..14H.
01f0 1b 6c 0d 28 6
8 e8 72 b5 97 7f cc
77 88 7f d1 ac .
l.(h.r....w....
0200 cf 6a 85 f2 8
d 50 8f 7f fd be ee
ef b6 21 8b 71 .
j...P.......!.q
0210 ac 12 16 37 d
b f2 fd 27 86 7d 3d
0c af bd 69 77 .
..7...'.}=...iw
0220 a1 c9 8c f3 e
8 db b5 ff fb 92 04
ea 0f f3 15 29 .
..............)
0230 d7 01 ec 62 6
0 61 a6 2a d0 61 e9
4c 0b 48 69 60 .
..b`a.*.a.L.Hi`
0240 0c 3d 27 01 7
5 0f 2b c1 86 19 28
f1 57 d1 ea 98 .
='.u.+...(.W...
0250 36 d4 0e 09 5
6 51 c0 80 6a ca db
8a 9b 43 5b 6e 6
...VQ..j....C[n
0260 91 33 a2 75 1
3 9c 92 91 20 b0 2f
8a 89 60 61 71 .
3.u.... ./..`aq
0270 ce de 14 c0 c
a 41 96 e2 c8 87 f0
e8 72 a9 90 9f .
....A......r...
0280 f2 37 21 9f e
2 35 9a cd 50 be 51
aa 11 ed ff cb .
7!..5..P.Q.....
0290 a9 dd ff 4f 6
a 3b 8f d4 00 c5 00

b1 64 35 72 72 .
..Oj;......d5rr
02a0 2b d8 92 59 3
1 7a ec be 2b 73 1e
be c3 ff f8 0b +
..Y1z..+s......
02b0 47 42 22 1a 7
1 96 09 2a b9 56 ea
09 cc 32 65 aa G
B".q..*.V...2e.
02c0 0a d2 56 54 4
9 30 d2 a3 ba 02 f1
d0 b0 92 5a a2 .
.VTI0........Z.
02d0 18 da bc d8 e
7 8d 42 89 a7 ef 62
09 64 2c 04 48 .
.....B...b.d,.H
02e0 c7 08 e7 3b a
3 26 54 cf 7d 7f 6b
4f ce f0 1b b5 .
..;.&T.}.kO....
02f0 17 ff 2f fe 4
b 8c 5e 65 97 85 42
7c 56 e2 82 9b .
./.K.^e..B|V...
0300 c7 a5 24 d6 3
d c7 ae f3 82 9a 97
81 bc f9 7e a7 .
.$.=.........~.
0310 bb 2f f3 b2 f
e e5 f7 d3 92 20 68
35 2a bd 91 45 .
/....... h5*..E
0320 20 97 a9 d0 1
0 99 63 0a ac e9 71
72 d8 92 de aa
.....c...qr....
0330 60 e5 d4 a8 c
a 94 72 2c ea 33 ee
45 f3 7f cf f8 `
.....r,.3.E....
0340 cf fc 12 68 4
4 2a 03 15 3e 2e 1e
52 5a 21 17 20 .
..hD*..>..RZ!.
0350 25 cb 6a 22 b
2 a0 22 ca 7a 41 a3
dc a8 4a b5 cb %
.j"..".zA...J..
0360 15 5b a8 95 a
8 ec d6 e0 55 00 59
6c 57 88 90 10 .
[......U.YlW...
0370 18 6e f8 60 0
0 7f b6 02 f4 c5 6d
25 04 67 af 51 .
n.`......m%.g.Q
0380 60 4a f0 5d e
e 29 a6 e7 44 39 5c
7f aa 94 70 12 `
J.].)..D9\...p.
0390 69 b8 70 32 f
8 f2 67 3c 01 05 22
9f a0 a2 37 d4 i
.p2..g<.."...7.
03a0 a8 fa da 89 6
1 5c bb 56 d3 7b e2
f9 2c d6 4e 5f .

...a\.V.{..,.N_
03b0 af 35 a8 71 5
3 e4 18 14 1a f6 01
92 2a 21 6a 5c .
5.qS.......*!j\
03c0 bb 52 fa af f
a 99 fb 93 fe ff fb
92 04 eb 0f f3 .
R..............
03d0 08 1f d8 03 0
c 32 52 63 e3 fa f0
61 86 4a 4b f8 .
....2Rc...a.JK.
03e0 9b 5c 0c 3c 6
9 49 5d 0c eb 81 86
30 e0 b1 80 01 .
\.<iI]....0....
03f0 cd 15 41 3c 4
d 00 30 4c fa 5e 26
7a 5c 8c 9c 3f .
.A<M.0L.^&z\..?
0400 0e 39 9e 13 5
2 7a dc 90 62 71 47
27 d2 29 b7 f0 .
9..Rz..bqG'.)..
0410 e6 ba 4d 0f 7
a 38 83 42 cd 72 c3
40 ec 6f 6b 63 .
.M.z8.B.r.@.okc
0420 ab a1 3a b2 9
3 2f 5d 3a bf e6 ca
dc b4 de f6 b7 .
.:../]:........
0430 b7 06 74 f7 c
d fa 62 91 8a 10 03
02 62 cf 61 d1 .
.t...b.....b.a.
0440 65 90 91 5c d
9 19 13 3d 85 6a 2b
4f ff ff fa 09 e
..\...=.j+O....
0450 46 00 3c 1b 4
9 86 16 ba e1 0a 16
32 62 4a c0 0f F
.<.I......2bJ..
0460 07 10 ae 81 4
8 49 2d c9 78 2f 8c
6b 52 a8 34 82 .
...HI-.x/.kR.4.
0470 3b 2a 95 e1 4
f 6a 96 5c 9c 77 5f
a6 70 ee d3 4a ;
*..Oj.\.w_.p..J
0480 6b 13 c4 00 d
4 8b 33 25 cd 4f 22
19 1d 34 44 d4 k
.....3%.O"..4D.
0490 79 25 fb c9 d
9 3c 76 aa 77 d4 34
3c c3 bb 9e f6 y
%...<v.w.4<....
04a0 2b 5d f7 b4 e
6 d8 8f 95 aa 12 1a
06 25 00 a6 c2 +
]..........%...
04b0 5a b1 46 34 6
4 a9 0e 2a 34 21 82
e6 8c 90 90 48 Z
.F4d..*4!.....H

04c0 91 01 57 ec c
1 8f 19 85 f1 67 24
f8 1b 51 56 58 .
.W......g$..QVX
04d0 41 a4 b1 2a f
8 78 85 4d 2a 4d f0
f6 86 13 32 58 A
..*.x.M*M....2X
04e0 f5 20 f5 74 7
6 05 19 8f 7a 62 78
4d ae 75 45 c7 .
.tv...zbxM.uE.
04f0 a5 5c 77 5d f
b a8 e0 c7 dc 38 bf
e3 30 e2 57 4f .
\w].....8..0.WO
0500 37 79 ad 36 7
7 f7 4a d3 c8 aa cb
1e 0a 21 8c 58 7
y.6w.J......!.X
0510 2b ad 4c 5a a
2 a1 da 11 02 33 f2
8d 14 81 80 66 +
.LZ.....3.....f
0520 84 71
.
q
No. Time
Source
Destination
Protocol
Length Info
68 2.192082000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=35543
Ack=1 Win=46 Len=1
260
Frame 68: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.242012000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.242012000 s
econds
[Time delta fro
m previous captured
frame: 0.060005000
seconds]

[Time delta fro

m previous displaye
d frame: 0.06000500
0 seconds]
[Time since ref
erence or first fra
me: 2.192082000 sec
onds]
Frame Number: 6
8
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf194 (61844)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a96 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 35543, Ack: 1
, Len: 1260

Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 35543 (relativ
e sequence number)
[Next sequence
number: 36803 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd0e
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 94 4
0 00 31 06 3a 96 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 ed 04 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e d0 e3 0
0 00 9d 60 61 01 0c
96 50 83 02 54 .
......`a...P..T
0040 5a 40 9f 5c 2
5 8f 51 65 7e b3 90
4e bb 78 a7 32 Z
@.\%.Qe~..N.x.2
0050 d5 32 48 a6 6
f 25 4a c3 f4 be 26
98 de 4a d8 3d .
2H.o%J...&..J.=
0060 96 a3 53 b3 b
3 3f 6b 8c a8 b6 b5
11 ef a7 ca be .
.S..?k.........
0070 cd 4f b7 9f 9
6 ab 32 04 de f0 60
59 f2 eb 2e ff .
O....2...`Y....
0080 fb 92 04 ec 0
f f2 d4 22 d5 03 2f
4a 50 61 c5 0a .
......"../JPa..
0090 90 65 ec 4a 0
c 68 bd 4e 0d 61 69
81 90 15 e9 c1 .
e.J.h.N.ai.....
00a0 a7 bd 30 89 b
5 03 9c bb b9 55 29
81 8f 9c 21 8c .
.0......U)...!.
00b0 68 c1 07 0e 0
4 88 55 00 60 08 6c
18 3c 8a 31 db h
.....U.`.l.<.1.
00c0 0d 22 42 0d 1
8 66 b5 01 11 7e ba
0f 26 2a 9a e7 .
"B..f...~..&*..
00d0 f1 1b 3d 8d 8
2 84 e0 61 8e f1 b4
f8 1c 21 bf 29 .
.=....a.....!.)
00e0 b3 74 1c 1f 0
9 ce 62 c3 b0 d5 9a
a3 f3 4d 08 45 .
t....b......M.E
00f0 e7 93 04 0f 1
d 7d f3 b9 24 26 f9
7e eb cf e8 a9 .
....}..$&.~....
0100 a3 89 63 bd 2
a b3 ae 0d 0a 28 11

2e 37 91 0c a9 .
.c.*....(..7...
0110 c3 12 7c c8 0
5 2e f9 6d 0c 30 12
3c 05 c7 ea 05 .
.|....m.0.<....
0120 50 5f 1d 91 d
b 90 e3 99 50 b9 43
9b 1e 6d 5a b9 P
_......P.C..mZ.
0130 20 ee 66 4a 6
2 2c 57 1d 21 83 0c
e8 9a 1c 19 67
.fJb,W.!......g
0140 6f a4 74 b4 5
d 6f 0d 4d 7a ec 35
71 63 9b c6 c5 o
.t.]o.Mz.5qc...
0150 6b 0d b3 53 5
3 19 ae 64 92 0e 3e
b5 8d 63 cd 8d k
..SS..d..>..c..
0160 ef 1f 5f c9 c
5 97 59 9f 6e 4b ea
89 83 2f 18 98 .
._...Y.nK.../..
0170 40 81 60 41 6
6 28 22 3e 85 46 2e
c0 22 21 6a 2f @
.`Af(">.F.."!j/
0180 18 a0 fa 05 7
b 13 92 60 04 33 89
94 f6 65 42 a2 .
...{..`.3...eB.
0190 5d a0 28 68 0
3 4c ba 9b cb b5 4b
8c 03 20 9a 27 ]
.(h.L....K.. .'
01a0 20 bf ca 7a 9
6 4a d0 df 70 ac f0
17 49 f9 b2 c3
..z.J..p...I...
01b0 12 b7 77 79 3
d f4 88 91 fe be 73
5c ed bf 1b ff .
.wy=.....s\....
01c0 fb e7 3f eb d
3 5a f8 81 c5 46 d6
de bf ae 06 05 .
.?..Z...F......
01d0 02 df 58 c6 7
3 41 8e 10 32 fc 30
70 80 ca d9 2f .
.X.sA..2.0p.../
01e0 51 ae 03 7b 1
9 ae 3d 24 15 95 1e
ac 10 a5 85 c9 Q
..{..=$........
01f0 da af 55 c1 8
c 69 2c a7 9b 4b f9
20 78 dd 6d 92 .
.U..i,..K. x.m.
0200 b1 70 37 e1 3
d 83 11 fd 5e 5d 91
37 e0 de da a6 .
p7.=...^].7....
0210 9a e6 74 e1 b
9 6b f3 86 d6 eb c7
b4 3f 6f eb 2d .

.t..k......?o.0220 dd ff fb 92 0
4 e9 0f f2 d9 22 d4
03 4f 7a 50 5c .
........"..OzP\
0230 a5 9a 80 69 e
b 4c 0c 88 c5 4e 0d
3d e9 81 8b 18 .
..i.L...N.=....
0240 a9 c1 a7 bd 3
0 95 94 03 2d 02 97
cd 08 2b 53 db .
...0...-....+S.
0250 ef d6 5f 54 a
e 2a 78 8c 80 02 81
86 c3 07 5f 01 .
._T.*x......._.
0260 11 58 b0 8e b
8 49 61 4d 30 9a 10
29 90 d5 42 40 .
X...IaM0..)..B@
0270 c4 21 0a 26 3
8 2c 41 b2 81 2d a1
8e 74 3d 43 9f .
!.&8,A..-..t=C.
0280 41 0f f3 19 d
3 e8 b5 6b 8f 97 1a
21 51 f4 db 76 A
......k...!Q..v
0290 3c 45 ba 66 6
9 22 d3 31 7f c4 38
19 c6 7f a6 25 <
E.fi".1..8....%
02a0 85 9f ff cf f
2 98 79 06 93 b6 81
67 74 20 00 13 .
.....y....gt ..
02b0 3c 0a a4 c0 3
1 16 50 68 19 62 a6
0a 1c 58 16 2f <
...1.Ph.b...X./
02c0 c0 9c 99 18 9
8 57 e0 82 43 01 25
34 f5 84 9c 36 .
....W..C.%4...6
02d0 b4 e1 52 bb 2
c 68 81 de 39 a2 29
f1 80 49 1a c3 .
.R.,h..9.)..I..
02e0 d1 1e bd a5 4
3 e1 e2 58 93 da dc
d6 5e 3e 64 b3 .
...C..X....^>d.
02f0 46 1d 7b e6 9
2 2e 34 7c bd 9b ee
ef 8b 9a d7 a4 F
.{...4|........
0300 d9 51 71 34 9
d 29 4c 5b 9b b0 d9
74 03 1f 03 58 .
Qq4.)L[...t...X
0310 77 26 ad c0 9
8 d2 14 14 a2 5f 80
2d 5d e8 f8 ea w
&......._.-]...
0320 40 8d 20 bd 3
2 a7 95 e3 07 46 69
c4 65 04 c9 60 @
. .2....Fi.e..`

0330 ce 5d c7 f5 5
b 5d 46 e8 1d e3 99
a1 17 8b 8f 91 .
]..[]F.........
0340 75 54 6e bb a
5 e1 a3 5a d0 31 35
9a bd cb cd b6 u
Tn....Z.15.....
0350 bd a3 9c 58 5
0 77 88 2a d8 ce 54
dd 69 ac 3f 3e .
..XPw.*..T.i.?>
0360 f2 e0 e8 15 c
1 55 95 1a e3 78 bf
90 47 43 41 8c .
....U...x..GCA.
0370 46 b4 45 6d 4
2 8d 9a c4 b8 47 a1
60 e8 e8 19 40 F
.EmB....G.`...@
0380 ff 26 45 b9 c
8 59 95 c2 62 cc a6
2d 59 e4 2e 30 .
&E..Y..b..-Y..0
0390 93 b0 d6 97 2
9 a6 22 5a ab 4a 2e
63 46 19 03 1a .
...)."Z.J.cF...
03a0 6d ff f7 85 6
4 8a 68 3e 03 82 fa
b7 5f 4a c9 59 m
...d.h>...._J.Y
03b0 b7 1b 3b d5 1
a ad 1e 2e 61 6b e2
57 b0 b5 f3 ad .
.;.....ak.W....
03c0 5f 18 8e ff f
b 92 04 e8 8f f2 ff
28 53 83 4f 7a _
..........(S.Oz
03d0 50 5b 45 7a 8
0 61 ef 4c 0b b0 c5
4e 0d 3d 69 81 P
[Ez.a.L...N.=i.
03e0 85 93 69 81 9
c 3d 28 b1 6c 4e 03
31 50 bd 35 a0 .
.i..=(.lN.1P.5.
03f0 50 03 43 73 a
0 90 18 86 de 02 4d
0f 1c 3a 22 66 P
.Cs......M..:"f
0400 00 1a 66 1a e
3 f1 a4 52 c1 a6 23
e3 cc cc 38 67 .
.f....R..#...8g
0410 80 7e 10 98 e
9 d8 6d 30 49 6b 78
a7 aa d1 ab b8 .
~....m0Ikx.....
0420 0c a0 74 1e 4
c ff 78 fe 2e 58 68
ff 18 a4 56 da .
.t.L.x..Xh...V.
0430 e9 70 e1 a8 e
e 1a ad b3 7a c3 8f
7c 6a df 13 3b .
p......z..|j..;
0440 a7 fe f9 c7 b

4 c9 52 21 bd df ff
51 08 92 b2 21 .
.....R!...Q...!
0450 73 62 15 60 e
7 e4 17 c7 86 b3 e3
04 14 51 01 68 s
b.`.........Q.h
0460 11 0c 4a 94 f
8 0a aa e1 4a 43 47
f2 89 cd f2 d1 .
.J.....JCG.....
0470 aa ad 74 a4 d
b 08 e7 2f 21 c6 a5
2d 8f 98 09 d8 .
.t..../!..-....
0480 bd 75 8c c3 8
d b7 8b 3a 33 ed bc
32 3d 8c e1 d7 .
u.....:3..2=...
0490 48 d6 18 cc 1
6 8b fd 9c dc 6b f3
8a fc d5 1e 1a H
........k......
04a0 bc 34 b4 b4 2
1 8b 84 8e c1 6f 77
5a 53 82 91 9c .
4..!....owZS...
04b0 04 a2 81 8c 8
b 23 18 49 10 04 08
dc 22 25 e2 f4 .
....#.I...."%..
04c0 6d 18 86 f1 c
8 7a 1d e2 e4 d4 28
d5 07 2a 40 8f m
....z....(..*@.
04d0 64 56 b8 36 6
d 63 23 e4 23 ec 36
6d 6c 1e 60 58 d
V.6mc#.#.6ml.`X
04e0 8d bf 8a f9 1
2 fa 42 1c ac c4 ac
5d 37 53 af 26 .
.....B....]7S.&
04f0 9a df 29 61 3
7 7f a3 fa 57 76 92
17 ff 6f 35 ff .
.)a7...Wv...o5.
0500 f8 9a be 6a 3
4 75 37 df a6 42 13
3d 01 1c 80 1b .
..j4u7..B.=....
0510 04 8d 98 21 e
1 89 d9 88 34 61 8b
2a bd 48 81 4f .
..!....4a.*.H.O
0520 5b 61
[
a
No. Time
Source
Destination
Protocol
Length Info
69 2.192260000
pc13.home
cust-74-12412-138.dllstx01.cor

exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=36803 Win=44730 Le
n=0
Frame 69: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.242190000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.242190000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 2.192260000 sec
onds]
Frame Number: 6
9
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa

gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f34 (20276)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set

Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 36803
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 36803 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 44730
[Calculated win
dow size: 44730]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 68]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 34 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O4@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 f1 f0 50 10 .
....P..N.+...P.
0030 ae ba 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
70 2.274086000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1293 http49
574 [PSH, ACK] Seq=
36803 Ack=1 Win=46
Len=1239
Frame 70: 1293 byte
s on wire (10344 bi
ts), 1293 bytes cap
tured (10344 bits)

on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.324016000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.324016000 s
econds
[Time delta fro
m previous captured
frame: 0.081826000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08182600
0 seconds]
[Time since ref
erence or first fra
me: 2.274086000 sec
onds]
Frame Number: 7
0
Frame Length: 1
293 bytes (10344 bi
ts)
Capture Length:
1293 bytes (10344
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
279
Identification:
0xf195 (61845)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3aaa [validatio
n disabled]

[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 36803, Ack: 1
, Len: 1239
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1239]
Sequence number
: 36803 (relativ
e sequence number)
[Next sequence
number: 38042 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .

.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x2ad
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1239]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 04 ff f1 95 4
0 00 31 06 3a aa 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 f1 f0 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 2a d3 0
0 00 44 4b a5 a2 aa
b3 63 f6 27 a0 .
.*...DK....c.'.
0040 a9 c8 ad 13 d
b 31 8b f3 24 6e 6c
9e 47 63 25 b2 .
....1..$nl.Gc%.
0050 9f 3f 77 29 d
d 53 8a 86 92 b1 04
e6 a6 68 e4 eb .
?w).S.......h..
0060 11 0e 92 4d 0
d f9 fc 81 59 9c 35
9d 32 36 6f b6 .
..M....Y.5.26o.
0070 fb 9d 3e e3 b
d 43 27 7f 3f ff fb
92 04 ea 8f f2 .
.>..C'.?.......
0080 fe 2c 53 83 4
f 7a 60 5b e5 8a 70
65 ef 4c 0c 00 .
,S.Oz`[..pe.L..
0090 9d 4c 0d 3d e
9 41 74 96 29 81 a7
bd 30 ca ed a2 .
L.=.At.)...0...
00a0 a3 bd 65 d1 1
6 42 6c 23 98 02 42
4b 14 dd 5a 51 .
.e..Bl#..BK..ZQ
00b0 38 12 04 18 e

c 4c c0 4a b3 f1 75
03 e9 92 70 b9 8
....L.J..u...p.
00c0 0b 42 c5 18 d
3 09 a4 6c 05 4a f3
0c 28 82 c3 af .
B.....l.J..(...
00d0 68 3e c6 c9 0
e e2 ba 93 79 4e 4f
57 a8 e7 dc 72 h
>......yNOW...r
00e0 ea 63 5e 75 f
e 8b 77 71 ea b8 4b
1f 69 a8 af 3e .
c^u..wq..K.i..>
00f0 51 a9 0d cc 7
2 bb 86 b9 ba 1e 6e
40 46 89 23 49 Q
...r.....n@F.#I
0100 45 4f 9e 8e f
4 08 07 19 d5 c6 1c
b1 9b c8 64 00 E
O............d.
0110 18 1e 48 cc c
0 09 44 81 8e 91 61
a2 e2 b0 23 a1 .
.H...D...a...#.
0120 51 00 f0 44 1
d f0 d8 11 06 83 33
1b 81 e6 ba 1f Q
..D......3.....
0130 85 12 29 91 4
6 fd 8e 19 b8 2c 5a
d5 a4 b3 14 2d .
.).F....,Z....0140 ae cf 07 5e 9
6 66 bd f2 c5 1f ac
42 a4 6f f3 1d .
..^.f.....B.o..
0150 ce 2f cd ef 8
c 41 8f b9 3e be 66
bb 7e bf fa ce .
/...A..>.f.~...
0160 fe 23 69 41 5
d 5c 92 08 0d 37 c7
69 34 c9 04 5e .
#iA]\...7.i4..^
0170 0a 36 1f 31 5
e 42 c3 3a 20 95 09
aa aa 11 30 04 .
6.1^B.: .....0.
0180 b2 49 fc 10 1
0 d9 d8 92 03 a1 fc
eb e6 39 e8 1d .
I...........9..
0190 06 e0 ec 41 a
d ab 5f b9 17 80 83
bf 9a d6 b3 66 .
..A.._........f
01a0 69 bd 57 54 8
6 df 5d e6 02 ba 04
5a b8 6b e2 ed i
.WT..]....Z.k..
01b0 6f 60 e7 14 d
e 3c 36 5d d3 fb 6b
3a dc 6d 20 42 o
`...<6]..k:.m B
01c0 c5 06 fa c5 1
b a2 4d f0 43 23 46

30 c1 c5 34 c4 .
.....M.C#F0..4.
01d0 0d c9 f1 29 2
2 41 d0 d0 2e 58 ee
18 d2 21 c4 28 .
..)"A...X...!.(
01e0 23 29 c5 f4 9
2 56 1b 81 b0 5e 10
67 7a ba 2a 1e #
)...V...^.gz.*.
01f0 2f 55 a6 81 0
2 5a 30 a1 44 1e c4
1f 30 2b 86 d7 /
U...Z0.D...0+..
0200 cc ab 6b b5 3
c de d3 a3 64 9b 75
5b 89 a8 3a de .
.k.<...d.u[..:.
0210 be 58 2b 07 7
9 ae 71 a9 e0 53 1f
ff fb 92 04 ed .
X+.y.q..S......
0220 0f f3 0b 36 5
3 03 58 5a e0 62 c4
fa 50 69 f8 4a .
..6S.XZ.b..Pi.J
0230 0c 30 c5 4c 0
d 3d e9 81 7c 96 69
81 97 bd 30 19 .
0.L.=..|.i...0.
0240 ce e5 de bf f
1 a7 71 71 82 2c 2a
dd 49 49 71 14 .
.....qq.,*.IIq.
0250 e6 ba 66 0c a
6 4a 20 a4 cb e2 58
15 32 0c 36 12 .
.f..J ...X.2.6.
0260 e1 2d ad 52 b
f e3 c0 b3 0a aa 0e
24 5e 99 f0 83 .
-.R.......$^...
0270 5f 68 ec f6 9
4 79 2e 69 c5 80 de
d9 6c 77 00 19 _
h...y.i....lw..
0280 43 90 c7 81 f
2 dd 7c a8 a6 43 77
ec cd 15 c2 3e C
.....|..Cw....>
0290 fa ae 04 38 5
a 81 f1 05 ad ba bb
f8 af ae 67 89 .
..8Z.........g.
02a0 e1 91 52 d5 1
d bc 7b 31 5e 80 20
d2 04 22 5f 81 .
.R...{1^. .."_.
02b0 9f d6 31 94 c
2 0e 3e 60 01 8b 06
06 99 8a b5 da .
.1...>`........
02c0 60 82 98 cd a
3 5e c0 19 c4 b9 80
62 cf 14 d6 6f `
....^.....b...o
02d0 0a 09 0d 37 c
7 c3 03 a3 d5 43 04
b7 b4 62 1d 22 .

..7.....C...b."
02e0 42 c9 28 3a 6
a 00 9f a0 56 59 54
44 1c d1 b5 a0 B
.(:j...VYTD....
02f0 cd a7 49 85 4
d e6 39 61 e1 d7 31
53 77 6f 6a d1 .
.I.M.9a..1Swoj.
0300 3d 1e ef 7d 5
c 7c 57 9c fa 42 81
c4 5c c3 51 07 =
..}\|W..B..\.Q.
0310 42 78 c0 c8 9
1 88 00 64 04 1c 12
b4 15 a1 f2 e6 B
x.....d........
0320 dc 68 8a 37 1
8 f4 25 e7 83 d3 d8
9b 9d 30 cd 6c .
h.7..%......0.l
0330 8d 25 74 a1 7
8 bc a5 69 7a a5 1b
e7 81 d5 06 04 .
%t.x..iz.......
0340 59 5c 9a ce 7
b 9c 6e fd 60 36 35
67 19 57 c4 8e Y
\..{.n.`65g.W..
0350 f5 dd f7 ac 5
2 1e bf ae b3 af 20
4e 3a 88 90 ea .
...R..... N:...
0360 8a fc df bd 7
d f5 06 04 12 46 07
26 6c 88 82 bd .
...}....F.&l...
0370 99 85 42 42 8
5 05 32 31 a0 04 79
4d 33 29 3e 3b .
.BB..21..yM3)>;
0380 13 a5 f1 f8 e
e 46 41 3b 94 30 a1
33 c1 2e a3 30 .
....FA;.0.3...0
0390 fd 28 a0 b6 1
f d0 a0 98 3d 82 1c
6b 30 cf 0c b5 .
(......=..k0...
03a0 e8 b7 bb 91 9
2 33 84 5d 31 a3 ef
58 98 73 ff be .
....3.]1..X.s..
03b0 ef f1 bf eb 7
9 55 9b f8 ce bd ef
8a 7f ff fb 92 .
...yU..........
03c0 04 e9 8f f3 1
8 2e d3 03 4f 7a 60
5c 85 0a 70 67 .
.......Oz`\..pg
03d0 0f 4a 0b f8 d
9 4a 0d 3d 6b 81 72
93 a9 81 a7 bd .
J...J.=k.r.....
03e0 29 f3 4d 63 c
1 a0 cd cf 39 ab d4
5a 80 aa 33 d2 )
.Mc....9..Z..3.

03f0 90 c5 98 52 0
1 8c d9 20 a0 a8 20
c0 0f 31 c3 f9 .
..R... .. ..1..
0400 f4 c9 b3 fe 3
9 c8 af 0a b4 fd 1c
c2 7d 91 59 58 .
...9.......}.YX
0410 a5 10 4a 51 0
1 7c b2 d6 9c 84 d6
04 a4 65 8b 52 .
.JQ.|.......e.R
0420 41 d3 28 19 0
f e4 f2 10 c8 13 8a
89 42 f1 59 6a A
.(.........B.Yj
0430 89 33 62 c7 3
6 34 39 ca 89 ae ca
30 52 34 8d cc .
3b.649....0R4..
0440 6a d3 65 59 1
f e7 5c c1 ae fd 37
d9 d6 42 04 62 j
.eY..\...7..B.b
0450 c4 66 20 00 0
0 82 0e 2a 30 d3 45
58 c7 94 81 08 .
f ....*0.EX....
0460 d1 60 11 15 a
7 a4 04 48 6a 64 b6
8b 8a a1 fa 20 .
`.....Hjd.....
0470 bd b8 2e 9d b
9 b5 8b 4b c6 c5 86
83 fe 3f 3f 07 .
......K.....??.
0480 d1 34 c4 6c c
9 3a fb ca be 67 9e
48 90 15 f5 da .
4.l.:...g.H....
0490 65 e4 7e c5 a
a ff 96 f8 57 9f 35
c5 61 f6 79 fa e
.~.....W.5.a.y.
04a0 83 62 c0 96 e
4 a4 12 32 f8 07 94
3b b7 eb 1d 0c .
b.....2...;....
04b0 65 85 19 7c 8
0 56 00 82 05 03 98
38 8c 03 32 61 e
..|.V.....8..2a
04c0 c3 6c 7a 65 8
a 21 81 18 61 2e fb
00 a1 48 d0 61 .
lze.!..a....H.a
04d0 84 a8 db 84 d
f 39 ec 7f 22 0e 23
51 5a 61 cf 08 .
....9..".#QZa..
04e0 19 86 19 0f 7
d 6f 97 4b b5 04 77
35 0f 85 12 0c .
...}o.K..w5....
04f0 0d ed 27 2c d
d ec f0 bf f6 7b 1b
76 de 73 79 20 .
.',.....{.v.sy
0500 6b 7f fd 5f 1

4 cc 92 0c 93 a6 bb
f5 2a
k
.._........*
No. Time
Source
Destination
Protocol
Length Info
71 2.322088000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=38042
Ack=1 Win=46 Len=1
260
Frame 71: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.372018000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.372018000 s
econds
[Time delta fro
m previous captured
frame: 0.048002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04800200
0 seconds]
[Time since ref
erence or first fra
me: 2.322088000 sec
onds]
Frame Number: 7
1
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1

300
Identification:
0xf196 (61846)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a94 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 38042, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 38042 (relativ
e sequence number)
[Next sequence
number: 39302 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x3e9
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2499]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 96 4
0 00 31 06 3a 94 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 f6 c7 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 3e 95 0
0 00 18 0e 69 68 84
9d 34 31 88 b2 .
.>.....ih..41..
0040 19 75 63 c0 1
d 94 d0 30 61 c6 8a
8d 51 49 86 c0 .
uc....0a...QI..
0050 17 05 24 3d 9
2 fb a3 ca 18 6c 10

ba 08 44 69 9c .
.$=.....l...Di.
0060 41 54 2d 02 a
c b1 88 d3 6c f0 20
83 97 cb cf 5a A
T-.....l. ....Z
0070 22 12 02 54 a
2 2c ad 07 34 7d 61
7e 75 f5 ef 44 "
..T.,..4}a~u..D
0080 dc 7d 73 9b 4
c b5 36 bf ff fb 92
04 ea 8f f3 07 .
}s.L.6.........
0090 31 53 03 4f 7
a 60 62 06 2a 60 69
ed 4c 0c 24 a1 1
S.Oz`b.*`i.L.$.
00a0 4c 0d bd e9 4
1 78 96 69 81 a7 bd
30 77 37 c9 e4 L
...Ax.i...0w7..
00b0 8e 10 20 a1 e
d 64 b0 fe 94 57 4a
d6 04 c7 a2 33 .
. ..d...WJ....3
00c0 55 00 83 42 c
5 84 62 1a a2 cb 61
ad d5 5f ac 35 U
..B..b...a.._.5
00d0 98 c2 e3 2e 9
c d3 a5 81 12 e2 b7
dd 15 79 45 3d .
............yE=
00e0 39 eb 00 cd 5
b 9c 13 0e 4e c7 69
ae 92 72 40 2d 9
...[...N.i..r@00f0 50 7d ab 15 7
2 9c d9 30 77 67 96
4c dd fc 55 4b P
}..r..0wg.L..UK
0100 7e 35 3c f0 7
f a3 5c 48 9b bf c5
21 63 6e ff fa ~
5<...\H...!cn..
0110 dd 3f dc de 0
8 c6 bc fe ae 86 0a
41 f2 20 99 76 .
?.........A. .v
0120 3d 11 11 d7 5
c 89 d9 2a 1c df 1c
ac ea f5 59 3d =
...\..*......Y=
0130 86 87 bd 1d c
a f5 7c 64 8a be 77
1a 17 62 c2 de .
.....|d..w..b..
0140 07 f2 51 e7 e
4 1a a3 d3 cd d7 85
91 38 d2 79 6b .
.Q.........8.yk
0150 e2 e6 a5 03 5
a 33 bb 6e f7 ea 52
d2 c7 ec f4 d9 .
...Z3.n..R.....
0160 88 40 af 73 e
a 56 fe 40 2c 03 d0
f2 92 e3 a7 e7 .

@.s.V.@,.......
0170 3f f7 14 75 6
e e9 fc 40 d4 08 14
62 61 c1 6a 19 ?
..un..@...ba.j.
0180 07 c1 3b a7 4
f 44 2c 72 f9 cb c8
ae 4c a5 a0 b0 .
.;.OD,r....L...
0190 6a 3c ab 33 b
7 b2 3f 0d a8 e7 69
77 64 91 f7 d0 j
<.3..?...iwd...
01a0 2b d4 6c 8c d
9 67 36 3b 02 33 19
8d 39 8f 25 49 +
.l..g6;.3..9.%I
01b0 29 cc ed 4f 7
e 64 3f 86 57 9f 94
32 17 38 7f d7 )
..O~d?.W..2.8..
01c0 78 7f 4a b2 8
2 75 81 0c 90 bd d8
d4 17 20 4b ed x
.J..u....... K.
01d0 73 7d e1 fa 8
0 c5 46 df 16 0b 6d
f5 6f a2 ac cd s
}....F...m.o...
01e0 f9 85 47 22 f
5 58 98 00 dc d0 e0
08 5b 08 81 f8 .
.G".X......[...
01f0 a1 6f 10 1c 1
8 c7 94 b2 34 e0 70
9e 61 e6 22 62 .
o......4.p.a."b
0200 be d1 f7 57 6
f aa f7 48 94 39 ac
ea 43 37 72 8b .
..Wo..H.9..C7r.
0210 b1 dd d2 d5 f
4 6f 47 46 4b 11 d5
99 d4 8e c4 ae .
....oGFK.......
0220 8c d9 52 f7 3
f 5f aa 1d f5 fd ff
fb 92 04 e8 0f .
.R.?_..........
0230 f3 0a 2c d3 0
3 58 5a 60 5e 45 aa
60 6b 0f 4c 0b .
.,..XZ`^E.`k.L.
0240 cc 9f 56 0c 3
d 69 41 6e 96 aa 81
87 a5 30 d2 ae .
.V.=iAn.....0..
0250 bd 5d 6a f4 5
e 8b a3 12 9a 0c aa
71 eb 53 8e 95 .
]j.^......q.S..
0260 59 c2 8b 51 b
9 1d 7b 5e 6c 89 65
55 6c 80 bc 4b Y
..Q..{^l.eUl..K
0270 a3 1f c5 f7 1
6 34 c1 77 cf 67 22
04 ee dc 93 e0 .
....4.w.g".....

0280 09 de 2e a0 8
6 ab 5b 40 6e 88 ac
81 1c 90 83 9b .
.....[@n.......
0290 b9 6c a6 2d 5
a 50 8b 59 e6 5b ff
11 ff 61 8e 44 .
l.-ZP.Y.[...a.D
02a0 f8 41 7b 00 e
f 3f 50 6f 4b 34 2b
ff df 8e d7 fd .
A{..?PoK4+.....
02b0 5f f0 3f a9 e
0 3b 37 90 ff 3f a9
f6 7f e0 9b e4 _
.?..;7..?......
02c0 a2 4c 66 48 d
4 de 09 13 bc 5e 21
1d 19 3c 78 05 .
LfH.....^!..<x.
02d0 42 2b 25 b6 d
2 32 78 07 73 09 52
bd 4c f4 0c 46 B
+%..2x.s.R.L..F
02e0 51 c9 7c cd e
f 89 c3 a2 2a 01 30
2c e0 79 20 fc Q
.|.....*.0,.y .
02f0 4c b2 86 04 8
3 1c 2a 8a 87 25 89
d4 75 80 05 bc L
.....*..%..u...
0300 81 89 ea 65 0
8 0a 9a d0 c5 4d 62
ce 44 8b 76 1d .
..e.....Mb.D.v.
0310 0c 37 ac 9c 4
8 a2 e3 04 93 97 a1
93 cb b0 a5 ab .
7..H...........
0320 4c 58 8e a2 8
4 99 aa 64 4d 06 e1
a5 d2 b8 1f 35 L
X.....dM......5
0330 8c c9 d7 d9 f
2 8e 6c c4 6d 5c e5
3e e3 73 7a 24 .
.....l.m\.>.sz$
0340 dd 8e 30 8f d
e 58 7f fe 7d 66 db
b2 3b 46 a1 0c .
.0..X..}f..;F..
0350 40 22 c3 3b e
7 ff be 11 60 9d fc
9d 5f 9c f7 ab @
".;....`..._...
0360 56 9d fe a3 3
4 77 f5 db 36 ee c5
37 dc 4f 2a 7e V
...4w..6..7.O*~
0370 ff e5 3c 22 4
a 20 38 35 cc 39 06
25 f0 ba cc 12 .
.<"J 85.9.%....
0380 35 16 e5 99 5
4 43 1f f1 4d 71 0a
11 a1 75 dd ab 5
...TC..Mq...u..
0390 4c 34 ef 6a b

b ff 97 f7 ed 58 b6
f7 b3 d3 fb bf L
4.j.....X......
03a0 5e 22 da 09 7
6 b9 d8 6d dd 21 be
c1 cf 97 22 99 ^
"..v..m.!....".
03b0 20 22 d0 f9 f
e d5 7b 7f 3a 76 39
39 f0 ef db d2
"....{.:v99....
03c0 36 d6 1a df c
f cc cb e9 89 31 1c
68 ff fb 92 04 6
........1.h....
03d0 ea 0f f3 13 6
2 d9 03 08 13 70 63
86 cb 20 3d 23 .
...b....pc.. =#
03e0 5c 4a e0 6d 6
8 0c 30 c7 01 7e 95
6c c1 84 99 31 \
J.mh.0..~.l...1
03f0 2c e1 1e 4c e
8 65 ec 63 2c b0 2e
e0 65 27 48 44 ,
..L.e.c,...e'HD
0400 e4 bc b3 2c f
f 2a f3 11 e4 c5 48
12 26 12 11 f8 .
..,.*....H.&...
0410 04 54 f3 59 2
b b9 10 23 f1 6e 73
9d 26 f1 ba a3 .
T.Y+..#.ns.&...
0420 ed 70 4f ef b
0 27 9d c2 f5 0f 96
05 b5 ca b3 3b .
pO..'.........;
0430 be 3e db d6 b
b 7b 6c f1 af a5 4c
85 1f fc 9b 71 .
>...{l...L....q
0440 ba 9e 93 73 1
b 22 3e 7c cd 00 4a
cf eb df cd c1 .
..s.">|..J.....
0450 d5 27 c2 e5 f
f cf bf a2 6a 07 ef
ed ee 7e cb 00 .
'......j....~..
0460 30 90 65 41 9
2 93 52 90 e3 45 5a
f6 b6 81 70 30 0
.eA..R..EZ...p0
0470 99 45 45 36 c
8 88 38 5c 94 48 b1
6d 1f ec 3a ee .
EE6..8\.H.m..:.
0480 45 c6 6e 45 f
d c6 05 68 99 53 4f
5b ff 45 ca 1a E
.nE...h.SO[.E..
0490 f3 f3 e3 cb d
4 d6 fc f5 a5 b2 6d
8c 5a 10 50 8b .
.........m.Z.P.
04a0 46 c7 42 a1 5
4 8f 8d 34 28 77 5a

0a 0a 42 63 48 F
.B.T..4(wZ..BcH
04b0 6d 50 51 8a 5
0 50 56 92 f5 fe 14
17 01 d4 2c a6 m
PQ.PPV.......,.
04c0 6a a5 65 4e c
5 06 0f 23 b3 0b 32
f4 09 9d 17 72 j
.eN...#..2....r
04d0 a7 ae 19 47 0
f d4 fc 12 b7 9f 59
df 1f b7 95 54 .
..G......Y....T
04e0 1a 2b 23 e5 b
a 54 75 d2 47 9b 73
fe 3e 3c c9 5c .
+#..Tu.G.s.><.\
04f0 d0 8b 5e fc 6
d ba d2 94 df f4 9e
e5 1e 15 68 20 .
.^.m.........h
0500 1a 49 83 21 4
2 47 90 e1 0b 08 0a
a0 64 e7 28 a2 .
I.!BG......d.(.
0510 e3 60 67 d8 c
7 9e 7b 6f da 9a 20
41 7a d6 aa cb .
`g...{o.. Az...
0520 75 2b
u
+
No. Time
Source
Destination
Protocol
Length Info
72 2.322264000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=39302 Win=44105 Le
n=0
Frame 72: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.372194000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141

5615215.372194000 s
econds
[Time delta fro
m previous captured
frame: 0.000176000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017600
0 seconds]
[Time since ref
erence or first fra
me: 2.322264000 sec
onds]
Frame Number: 7
2
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f35 (20277)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por

t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 39302
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 39302 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 44105
[Calculated win
dow size: 44105]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[This is an
ACK to the segment
in frame: 71]
[The RTT to
ACK the segment wa
s: 0.000176000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 35 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O5@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c8 fb b3 50 10 .
....P..N.+...P.
0030 ac 49 18 d4 0
0 00
.
I....
No. Time
Source
Destination
Protocol
Length Info
73 2.459094000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=39302
Ack=1 Win=46 Len=1
260
Frame 73: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.509024000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.509024000 s
econds
[Time delta fro
m previous captured
frame: 0.136830000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13683000
0 seconds]

[Time since ref

erence or first fra
me: 2.459094000 sec
onds]
Frame Number: 7
3
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192

.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf197 (61847)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a93 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 39302, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)

[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 39302 (relativ
e sequence number)
[Next sequence
number: 40562 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xbeb
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6

4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 97 4
0 00 31 06 3a 93 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c8 fb b3 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e be b0 0
0 00 54 4b 59 74 c7
29 6f a7 00 b9 .
.....TKYt.)o...
0040 a3 fb bb 96 b
0 10 37 86 fb 34 db
6c b0 f3 68 7a .
.....7..4.l..hz
0050 c4 da 7b 4f 0
3 46 1e 81 fb 30 98
e4 74 2a 72 84 .
.{O.F...0..t*r.
0060 c7 91 5d ca 8
c ee 5b 39 c6 2a bd
6c a9 42 3a 65 .
.]...[9.*.l.B:e
0070 67 b9 3d ec e
c 52 ce 6a 49 2b 2d
49 55 64 52 a3 g
.=..R.jI+-IUdR.
0080 6a 66 ff fb 9
2 04 ea 8f f3 1e 4c
d9 03 0c 1a f0 j
f........L.....
0090 61 85 db 30 6
1 26 4c 4b 98 ab 64
07 a4 c9 81 7a a
..0a&LK..d....z
00a0 18 ac 80 f4 9
9 30 c7 90 65 48 d2
43 66 e9 c8 47 .
....0..eH.Cf..G
00b0 9e d0 54 31 8
4 e8 05 82 5e 25 f5
14 a1 bf 4d 62 .
.T1....^%....Mb
00c0 ad 4a c9 90 7
c ec ec 64 d3 9c b7
6e d4 da ca 92 .
J..|..d...n....
00d0 c7 3d 5b f3 7
3 b9 b9 11 21 21 74
3b 06 d0 98 01 .
=[.s...!!t;....
00e0 cd c0 c1 00 5
1 6c 26 13 39 11 84
d8 4d 46 ad 2a .
...Ql&.9...MF.*
00f0 17 0b 76 51 9
b 7c ff ef 35 3c f2
8c 22 b6 c6 8c .
.vQ.|..5<.."...
0100 2e c5 52 59 8
2 ab b5 43 dc cd d5
1f 16 c6 a6 90 .
.RY...C........
0110 f1 12 a5 04 2
f f2 f0 ae a1 91 78

5e 52 ac 42 7e .
.../.....x^R.B~
0120 13 ef e5 f7 8
7 cf 45 9a 6a 2b 16
a7 52 2d 79 eb .
.....E.j+..R-y.
0130 79 6c a6 8b 5
f bb e1 58 95 3a 1e
fa ee c0 87 1d y
l.._..X.:......
0140 d8 dc c1 07 d
b c9 4c b0 46 17 2d
4c 91 9a 4e 1b .
.....L.F.-L..N.
0150 2c ea 43 87 7
3 b0 93 b3 d3 bd 91
db 85 a6 97 6e ,
.C.s..........n
0160 83 68 01 e2 9
5 80 0e 19 f7 b0 61
a0 69 b4 7d 69 .
h........a.i.}i
0170 24 41 b8 3b 5
5 85 c9 70 a5 54 ee
44 48 a2 c1 58 $
A.;U..p.T.DH..X
0180 32 93 23 84 b
d df 15 74 93 7d a6
fd c9 a6 c5 73 2
.#....t.}.....s
0190 76 37 35 06 8
7 91 e1 3c 45 2c 35
a3 40 f7 2d d0 v
75....<E,5.@.-.
01a0 a8 d3 be 24 4
9 23 b1 a2 da 8c 0c
89 d4 a5 64 67 .
..$I#........dg
01b0 d6 da c4 0e 9
0 b9 97 ee c4 bb c7
88 d7 9e a3 f2 .
...............
01c0 fb 7d 97 f4 c
3 f9 6d f3 a9 bf 77
d7 ff ff f6 17 .
}....m...w.....
01d0 73 a0 5e b4 1
0 e5 7a a4 95 25 4b
ac 37 be ed c2 s
.^...z..%K.7...
01e0 01 06 15 dd c
0 8c ba 47 e7 7d e3
c8 e9 08 f0 6b .
......G.}.....k
01f0 4f 5a a4 6d a
b da 96 41 e8 1f 2c
c1 10 3a dd 90 O
Z.m...A..,..:..
0200 a6 69 8e 45 2
c 5d 2d bb 19 e6 ba
99 0c ae 57 46 .
i.E,]-.......WF
0210 29 9e 67 a2 b
5 66 62 d5 8d 52 34
62 61 a1 54 3c )
.g..fb..R4ba.T<
0220 5c 0a e2 c9 f
f fb 90 04 e9 0f f2
ff 48 58 83 0f \

...........HX..
0230 2a e0 5c 47 8
b 10 61 83 5c 0c 3d
19 60 0c 3c 6b *
.\G..a.\.=.`.<k
0240 81 7b 14 ac 4
0 f4 a1 31 8b 0a 4a
21 63 46 57 3a .
{..@..1..J!cFW:
0250 aa 15 4b 3b 7
4 98 6a c1 f8 3f 95
e4 c7 4c 1b ec .
.K;t.j..?...L..
0260 aa e8 85 8a c
1 dc 9c 51 2d 96 df
85 af e6 8e 51 .
......Q-......Q
0270 d8 89 48 65 e
e 87 ad d0 a4 f6 07
92 5d da a3 40 .
.He........]..@
0280 b1 c2 61 31 9
3 a1 f5 af 0e 5c d5
bc f7 50 f3 23 .
.a1.....\...P.#
0290 2a 2b 8b 1a 3
d a1 86 b5 0d 64 a0
80 41 43 92 e4 *
+..=....d..AC..
02a0 99 06 1e c6 a
5 b7 0d 60 8c 7c e7
61 3d e8 fd 6c .
......`.|.a=..l
02b0 b5 85 b4 c0 b
9 1f 76 93 eb 6e 91
64 3e 7f 6b 4a .
.....v..n.d>.kJ
02c0 0e 7c d2 1f 9
f 11 c8 a8 ed 79 8f
1b 9f 0e 2d 5e .
|.......y....-^
02d0 b7 e7 03 8e 8
3 da 22 46 50 cf 7c
36 3a d9 cd 79 .
....."FP.|6:..y
02e0 5b 30 e7 2e a
c e8 fa f9 23 86 29
aa 5e 6a 4f 45 [
0......#.).^jOE
02f0 01 3a 33 59 3
b 2d 3d 2f 4d 97 bd
df 68 51 80 70 .
:3Y;-=/M...hQ.p
0300 2a 1f da 3c 6
d ed 9d 3b ed fe df
f9 7e bf 65 c4 *
..<m..;....~.e.
0310 ba 83 80 23 4
3 74 b0 a5 b7 11 27
96 7e 04 10 fa .
..#Ct....'.~...
0320 24 41 01 c2 b
c b3 17 27 8b d9 a2
c2 ca af a9 cf $
A.....'........
0330 4e d9 e7 99 2
2 4a e4 41 b4 6f 68
61 c2 e1 a8 11 N
..."J.A.oha....

0340 86 a9 21 14 7
f 32 3d 0c 17 1c 52
2c b4 2d 4a 52 .
.!..2=...R,.-JR
0350 48 89 c8 c4 e
b ea 6c 65 75 26 d8
b1 91 e3 23 9a H
.....leu&....#.
0360 79 2e 20 19 4
8 49 e7 1b 12 e3 cf
2e ec a9 18 97 y
. .HI..........
0370 d1 23 00 e3 1
3 80 4d 12 53 35 56
4a 55 e8 e7 19 .
#....M.S5VJU...
0380 a1 e2 08 7e 5
a b4 78 ea c7 b9 ad
de 62 35 a7 53 .
..~Z.x.....b5.S
0390 00 46 a6 6c a
0 6d c4 4c dc 18 33
1d a8 93 d2 27 .
F.l.m.L..3....'
03a0 e2 cb 11 45 1
0 43 72 d3 50 50 1e
0f 81 c0 6a 02 .
..E.Cr.PP....j.
03b0 10 1a 61 0f 5
4 80 2e 65 8e 74 51
06 db 0e 9e 82 .
.a.T..e.tQ.....
03c0 a6 cf 16 31 4
4 ff fb 92 04 e9 0f
f3 11 3b d8 01 .
..1D........;..
03d0 ef 2a e0 5a 4
6 2b 10 3d 28 4c 0b
e0 b7 5e 0c 3d .
*.ZF+.=(L...^.=
03e0 09 89 8a 1c 6
b c0 f4 21 70 a4 af
fa 9b 03 c6 4a .
...k..!p......J
03f0 aa ef aa 8b 4
b a9 33 7f 64 54 93
d9 15 96 15 28 .
...K.3.dT.....(
0400 8a 2a 07 1b 5
2 a5 8c ac 22 44 a4
ea 8b 47 6e ae .
*..R..."D...Gn.
0410 e8 e4 41 40 d
6 59 4d d6 4c e8 e2
1a 0b 0e 12 8d .
.A@.YM.L.......
0420 9a ff 96 6a 9
1 ea dd ac 5e 36 38
35 97 b1 c7 e3 .
..j....^685....
0430 98 23 7b c8 0
d 30 50 5e 58 60 64
c4 2a 22 14 74 .
#{..0P^X`d.*".t
0440 43 f4 d8 a7 7
d 7e 86 66 5f f4 96
2a 05 8a 92 8a C
...}~.f_..*....
0450 50 8b 8f c3 4

9 90 4f 43 82 dc 16
9a 66 12 2f 71 P
...I.OC....f./q
0460 ca b4 e4 37 9
4 75 2d 0b b9 b5 2d
5c 73 aa b1 db .
..7.u-...-\s...
0470 1a f2 79 69 7
f b0 c0 98 89 83 d4
72 d1 6c 23 1a .
.yi.......r.l#.
0480 36 a8 77 be 4
d f1 15 c5 e4 a5 4b
72 bb dd 5d 4c 6
.w.M.....Kr..]L
0490 65 ff 6d f7 c
d f9 30 56 2e f3 e6
8e 21 8d 18 b2 e
.m...0V....!...
04a0 2b a9 4c 3a d
d 28 d7 53 33 6b 42
a4 2e 0d e8 09 +
.L:.(.S3kB.....
04b0 b3 4f b7 a9 e
9 35 0f e9 ab 71 b1
58 05 71 bc 5c .
O...5...q.X.q.\
04c0 4f 16 50 f5 b
6 bd 23 3d 49 e6 da
97 2b 38 c5 99 O
.P...#=I...+8..
04d0 cc 8a 52 98 1
4 7e 76 5a 24 50 54
40 09 47 9b 33 .
.R..~vZ$PT@.G.3
04e0 5e 9c 96 f6 4
a 1d 1c 57 cc 47 d4
c7 54 b8 ff f5 ^
...J..W.G..T...
04f0 fe c6 1f 7f 3
b c7 c4 a2 6f f7 b4
6f 93 95 1d e3 .
...;...o..o....
0500 d1 fa 06 04 6
b ca aa aa 95 52 95
96 44 a0 01 dd .
...k....R..D...
0510 66 6c f2 2f f
6 69 05 2b 20 4b 46
10 18 9c ed 3a f
l./.i.+ KF....:
0520 82 4a
.
J
No. Time
Source
Destination
Protocol
Length Info
74 2.471094000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1288 http49
574 [PSH, ACK] Seq=
40562 Ack=1 Win=46

Len=1234
Frame 74: 1288 byte
s on wire (10304 bi
ts), 1288 bytes cap
tured (10304 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.521024000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.521024000 s
econds
[Time delta fro
m previous captured
frame: 0.012000000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01200000
0 seconds]
[Time since ref
erence or first fra
me: 2.471094000 sec
onds]
Frame Number: 7
4
Frame Length: 1
288 bytes (10304 bi
ts)
Capture Length:
1288 bytes (10304
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
274
Identification:
0xf198 (61848)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4

9
Protocol: TCP (
6)
Header checksum
: 0x3aac [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 40562, Ack: 1
, Len: 1234
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1234]
Sequence number
: 40562 (relativ
e sequence number)
[Next sequence
number: 41796 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set

.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe32
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2494]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 04 fa f1 98 4
0 00 31 06 3a ac 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 00 9f 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e e3 20 0
0 00 9e a2 20 e1 0a
ae e5 67 0a 18 .
.. .... ....g..
0040 81 3a 7d 7a 9
9 23 13 6f df 2b 1c
2c 29 9b 91 51 .
:}z.#.o.+.,)..Q
0050 09 76 f3 9c c
1 f8 1e d9 27 57 cd
79 f6 6e b6 1c .
v......'W.y.n..
0060 90 79 4a 8e 0
8 96 50 3c 44 36 1f
01 87 92 3c b8 .
yJ...P<D6....<.
0070 6d 63 5e 00 0
b 8f 03 cf a0 7d 67
ff fb 92 04 e9 m
c^......}g.....
0080 0f f2 ba 23 5
7 81 ef 42 50 5a 46
4a f0 61 28 5c .
..#W..BPZFJ.a(\
0090 0c 24 e9 5c 0
c 3d 0b 81 82 a4 6b
81 86 21 78 15 .

$.\.=....k..!x.
00a0 90 48 cb ef 4
a 11 67 e5 d9 0d 96
a4 2c 97 cd 45 .
H..J.g.....,..E
00b0 e9 d8 dc a9 9
5 45 22 8d cc c1 7a
40 4c a5 d7 16 .
....E"...z@L...
00c0 a2 ca bf 26 a
c f3 af 5e f7 d4 8d
cc cd 92 1e 24 .
..&...^.......$
00d0 59 57 7f 42 e
2 8b 31 9b 2b 26 96
13 84 c6 d4 30 Y
W.B..1.+&.....0
00e0 af ff 35 42 b
6 4b f0 36 e2 f5 22
69 13 18 7b 6d .
.5B.K.6.."i..{m
00f0 5d fd cf 10 3
e 7b 7e 9b 7b d1 20
6f 33 f1 eb 57 ]
...>{~.{. o3..W
0100 3f 12 96 33 f
b 6d a5 f4 6f 03 a6
5e 85 36 52 b7 ?
..3.m..o..^.6R.
0110 44 90 f7 55 b
e dd 55 a4 90 2b 49
63 66 1e 0b a9 D
..U..U..+Icf...
0120 a4 26 06 95 9
c 4d 10 fe 8e f3 49
51 a4 31 8d 99 .
&...M....IQ.1..
0130 04 94 f4 2a 8
2 e6 5e 32 bf 8a 3e
5c 68 44 bd 24 .
..*..^2..>\hD.$
0140 7f a3 f0 b5 7
d a6 b3 dc c4 cc 5c
6d 77 ff 73 46 .
...}.....\mw.sF
0150 e7 c9 91 24 3
c 58 81 5a 86 25 a9
01 e8 a1 8e 92 .
..$<X.Z.%......
0160 51 74 1d bb f
f eb 64 1d a0 05 8b
42 16 4e 58 d1 Q
t....d....B.NX.
0170 89 e1 1f 72 5
f d0 ec 4d a0 42 c4
65 79 ec a3 91 .
..r_..M.B.ey...
0180 16 23 81 c1 4
6 e1 45 77 21 bb 37
32 73 4c 6e 2c .
#..F.Ew!.72sLn,
0190 7f 3f 92 f3 5
7 22 1a 7c 29 8a 97
ff ce 79 d7 93 .
?..W".|)....y..
01a0 f4 10 1f da 8
9 64 d0 e2 63 90 c6
f2 dd 9e 3d 17 .
....d..c.....=.

01b0 69 89 17 f7 1
5 39 8f 9e ce fb 53
fa 7f bf 0f fd i
....9....S.....
01c0 aa 88 02 04 0
5 08 81 ca 28 af 56
b2 6a 3f ee 0b .
.......(.V.j?..
01d0 cf 15 a1 e4 5
0 8b ef f6 73 ee fe
79 3d 4d 37 74 .
...P...s..y=M7t
01e0 d9 e3 56 5d 1
9 66 f5 2c da b5 8c
dc ba f7 35 bc .
.V].f.,......5.
01f0 37 04 81 21 7
0 70 14 e3 04 71 35
1b 16 6b 94 49 7
..!pp...q5..k.I
0200 f9 1d f9 e2 8
b 66 b5 69 26 5a b4
e9 91 45 04 44 .
....f.i&Z...E.D
0210 63 07 a9 c5 9
4 d2 ee 13 96 3c 39
02 35 ff fb 92 c
........<9.5...
0220 04 ee 0f f3 3
a 28 d6 83 0f 5a 50
5e 89 3a e0 61 .
...:(...ZP^.:.a
0230 88 5e 0b e8 d
9 5c 0c 45 0b 81 68
93 eb c0 f4 a5 .
^...\.E..h.....
0240 29 52 e4 6d 2
c d6 ba 93 e9 a4 22
28 aa d0 c2 4a )
R.m,....."(...J
0250 a7 4d 79 84 3
2 5a 48 b4 0a 86 a0
f0 2a 32 54 56 .
My.2ZH.....*2TV
0260 4f 77 71 5e 3
5 7a b0 69 01 07 a2
54 f5 4b e4 bd O
wq^5z.i...T.K..
0270 eb 7b 48 70 7
0 0e 81 d9 40 f0 52
96 da a4 97 30 .
{Hpp...@.R....0
0280 42 35 dc 98 3
e ad 22 7a 83 de 26
fd 23 e6 52 62 B
5..>."z..&.#.Rb
0290 38 4a d1 fb e
9 d2 3e 97 af a5 8a
6d ea 1f c7 ea 8
J....>....m....
02a0 f5 4a 40 2a a
7 85 10 f7 6f de 3c
ae 1f a2 2a b0 .
J@*....o.<...*.
02b0 10 f4 ce 48 8
2 42 3d 82 a6 76 12
52 9a 6a 86 9a .
..H.B=..v.R.j..
02c0 5e 06 65 16 a

8 5a e7 70 6c 52 f9
eb 5b ce 3f 51 ^
.e..Z.plR..[.?Q
02d0 47 1e 68 de 3
d c7 57 9d bc 7f fe
af c5 e1 d9 f7 G
.h.=.W.........
02e0 81 e2 ba 71 6
e 31 c4 21 39 a9 d3
dd 7f 75 48 c7 .
..qn1.!9....uH.
02f0 df e9 7d 70 3
5 4d ba f4 ff f6 a1
a6 8f a3 0c 74 .
.}p5M.........t
0300 f9 93 32 29 4
2 5c 8d 7c 5d 8c 46
af 3c bb 28 80 .
.2)B\.|].F.<.(.
0310 16 8b 7c d0 5
3 49 b5 5c f0 c3 08
7e 06 e0 3f 1b .
.|.SI.\...~..?.
0320 56 d7 83 20 f
e a4 c2 f9 48 d2 ca
4b 6c 3b 59 38 V
.. ....H..Kl;Y8
0330 c5 ff 36 82 e
2 a2 21 93 ee 0f 81
96 7a 9a a5 12 .
.6...!.....z...
0340 6c 4e 32 38 7
4 76 a6 5f 3f c5 56
f2 e6 ca d4 0d l
N28tv._?.V.....
0350 c5 c1 ac f9 9
8 b7 c8 08 30 ad 91
33 27 a1 e6 cc .
.......0..3'...
0360 ec f9 ad 9b b
4 5d 5f 6d 13 ad af
ff ff eb fb 87 .
....]_m........
0370 0b 64 60 09 9
e 2d d5 a4 b7 85 f7
96 b2 79 c9 9c .
d`..-.......y..
0380 ca 68 01 be 2
4 6d 27 5f 4a 7c 1e
78 ff ae d5 02 .
h..$m'_J|.x....
0390 74 a8 63 d5 e
1 78 f1 37 fe 2d 81
74 60 61 67 20 t
.c..x.7.-.t`ag
03a0 44 8c d4 0d 8
9 0f 12 15 41 f0 84
fd e8 dc bd 8c D
.......A.......
03b0 e2 a8 d4 5e 3
5 99 ef b4 8a 32 68
48 0a 00 9c ff .
..^5....2hH....
03c0 fb 92 04 ed 0
f f3 20 37 56 83 18
1a e0 64 08 9a .
..... 7V....d..
03d0 e0 61 88 5c 0
c 10 dd 5a 0c 61 0b

81 85 95 2b 41 .
a.\...Z.a....+A
03e0 86 2d 31 36 c
b 0e 11 3e 2c 72 41
fc 06 79 12 66 .
-16...>,rA..y.f
03f0 26 82 10 35 d
9 a2 08 e1 2c e5 d7
65 72 9c 55 d0 &
..5....,..er.U.
0400 40 0b 20 92 a
e 5b 14 b7 67 e0 71
9e e2 3b 4d 26 @
. ..[..g.q..;M&
0410 46 86 a1 fd 9
d a0 fc 79 00 ec 5d
0a 83 17 f6 7a F
......y..]....z
0420 03 d4 0e 07 8
0 d1 e9 06 87 dc ad
2a f6 e6 4c 2b .
..........*..L+
0430 dc 5d c2 a5 9
b 1f 3c f1 1f 59 09
0d 0c b5 49 3f .
]....<..Y....I?
0440 d7 98 aa 30 b
0 12 b4 10 d2 2f d6
af 56 9a 25 0e .
..0...../..V.%.
0450 52 00 92 85 4
2 55 1c 36 8a 2e 5a
5a ca e8 2b df R
...BU.6..ZZ..+.
0460 72 c3 2d 6e a
6 4e 7d 6f 6c 10 b9
cd 77 e6 e1 d4 r
.-n.N}ol...w...
0470 f7 9d ab 3d 5
3 5f 5a 43 ff ff ba
d4 e8 2a 3f 1e .
..=S_ZC.....*?.
0480 58 ea ad 0f 7
b 89 0a 0a bc 55 1f
ee de db e9 17 X
...{....U......
0490 68 eb cd cb 5
e df da 35 7d bb e2
73 83 0d cb 46 h
...^..5}..s...F
04a0 35 8a 5a 0a 0
5 da dc 97 77 75 11
57 21 a1 01 a7 5
.Z.....wu.W!...
04b0 2e 5a 30 3a 7
7 5d 65 32 ba 90 dc
96 1f 43 07 be .
Z0:w]e2.....C..
04c0 d4 a4 36 db 7
c a6 34 61 87 5f a5
b5 0c ee b3 33 .
.6.|.4a._.....3
04d0 44 d2 f5 07 9
5 bb 3f 0e f5 5e f3
6c f0 41 53 7b D
.....?..^.l.AS{
04e0 49 a5 be 78 e
4 30 f3 ef 2c 87 49
ca 6e db a9 bb I

..x.0..,.I.n...
04f0 5f 6f b2 6f e
d ef d4 85 9e f7 9d
12 0b 07 56 b3 _
o.o..........V.
0500 8a 93 64 f1 d
f 57 f1 75
.
.d..W.u
No. Time
Source
Destination
Protocol
Length Info
75 2.471278000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=41796 Win=44100 Le
n=0
Frame 75: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.521208000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.521208000 s
econds
[Time delta fro
m previous captured
frame: 0.000184000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018400
0 seconds]
[Time since ref
erence or first fra
me: 2.471278000 sec
onds]
Frame Number: 7
5
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]

[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f36 (20278)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 41796
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 41796 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 44100
[Calculated win
dow size: 44100]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 74]
[The RTT to
ACK the segment wa
s: 0.000184000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 36 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O6@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 05 71 50 10 .
....P..N.+..qP.
0030 ac 44 18 d4 0
0 00
.
D....

No. Time
Source
Destination
Protocol
Length Info
76 2.599100000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=41796
Ack=1 Win=46 Len=1
260
Frame 76: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.649030000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.649030000 s
econds
[Time delta fro
m previous captured
frame: 0.127822000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12782200
0 seconds]
[Time since ref
erence or first fra
me: 2.599100000 sec
onds]
Frame Number: 7
6
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]

Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf199 (61849)
Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a91 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 41796, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 41796 (relativ
e sequence number)
[Next sequence
number: 43056 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t

.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xcaf
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 99 4
0 00 31 06 3a 91 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 05 71 9e
87 4e aa 50 10 .
..P..+..q..N.P.
0030 00 2e ca ff 0
0 00 90 33 f0 a2 86
58 b1 d6 23 06 .
......3...X..#.
0040 19 53 b0 30 0
9 75 7a ba 69 21 e0
a2 fb b7 2f 7a .
S.0.uz.i!..../z
0050 8e 48 b1 c3 3
e 4c d1 23 e5 b9 8b
7b fc 63 92 2e .
H..>L.#...{.c..
0060 77 f5 87 8a 0
5 ec 3e 6a a1 a4 bd

72 7d 1e 3c 5c w
.....>j...r}.<\
0070 5c b4 81 a3 4
6 71 cf b4 d7 13 71
0f 7f 52 37 eb \
...Fq....q..R7.
0080 de f9 fe 96 b
2 64 f8 d7 8d 78 5a
21 7e c0 f4 ff .
....d...xZ!~...
0090 fb 92 04 e7 0
f f2 db 37 56 83 0f
2a e0 5f 27 fa .
......7V..*._'.
00a0 d0 61 28 5c 0
b 9c db 5a 0c 61 0b
81 74 9b 6b 41 .
a(\...Z.a..t.kA
00b0 86 2d 70 5d e
a 5f 5a 7e fd 8a bc
c2 84 24 71 99 .
-p]._Z~.....$q.
00c0 b2 98 41 ea d
f 14 4d c9 e8 9c 19
b6 56 6b 79 7d .
.A...M.....Vky}
00d0 26 5b 91 cf e
1 5e b3 ba 7d 67 8c
7a f8 52 2c 3f &
[...^..}g.z.R,?
00e0 b7 ed ed c6 b
0 80 0b d7 15 09 45
de ba 3e 8b 34 .
.........E..>.4
00f0 32 00 71 71 1
9 c7 d0 51 e0 c3 61
eb 9c 47 7e 19 2
.qq...Q..a..G~.
0100 63 aa e6 24 c
e 27 fb fa 1b 4c d3
63 a8 54 9c 50 c
..$.'...L.c.T.P
0110 f1 a5 ae e1 7
0 c2 f7 2b af 5b e8
48 f1 16 08 74 .
...p..+.[.H...t
0120 89 86 32 33 5
0 aa ed 2b bc 71 c6
5e a1 81 d5 a4 .
.23P..+.q.^....
0130 fd e3 85 c4 d
c d7 cc 63 96 ae a1
5c 96 5d 5b 0e .
......c...\.][.
0140 75 f7 7e f1 e
7 fd bc 88 23 0e 2e
87 84 e5 93 5a u
.~.....#......Z
0150 c0 d9 a7 18 3
0 e4 28 b1 9f 46 dc
d1 9f 3f 74 fd .
...0.(..F...?t.
0160 fe e3 ba db a
4 df 8b ce c1 b1 67
93 75 40 36 da .
.........g.u@6.
0170 2e 18 05 ce 2
9 85 47 f7 53 b7 5d
b5 c3 12 62 5a .

...).G.S.]...bZ
0180 24 a5 54 42 6
c ce 2c 0e a0 72 d8
95 6f 27 71 ff $
.TBl.,..r..o'q.
0190 14 6c f3 03 2
7 a0 af b3 66 42 f7
b1 7c e0 96 6d .
l..'...fB..|..m
01a0 7a cc ac b3 3
4 50 1b fd e4 66 d9
ff db c6 e6 28 z
...4P...f.....(
01b0 39 0a c2 3b 4
2 f9 ee ed e7 a8 1b
6e 79 51 cf ff 9
..;B......nyQ..
01c0 8c 32 e7 fc e
7 e5 fd da 20 44 5d
2b 66 c3 2a 85 .
2...... D]+f.*.
01d0 d7 55 aa 6f 2
1 bd 4e ed 14 69 03
ad 10 82 4a 59 .
U.o!.N..i....JY
01e0 06 17 10 33 1
9 dd 4e 57 fe 79 23
e0 96 18 9c 3e .
..3..NW.y#....>
01f0 b3 73 03 11 3
3 24 29 22 82 01 a9
8e e3 32 2e c9 .
s..3$)".....2..
0200 e7 8a e6 fa d
1 37 52 66 06 da 45
c6 5b 3e c8 3e .
....7Rf..E.[>.>
0210 3b 14 33 29 1
2 07 1c 8f 56 1f 42
65 de 61 d5 4f ;
.3)....V.Be.a.O
0220 30 e7 d2 fa f
b ab 9a 69 93 57 fd
37 56 73 8e 67 0
......i.W.7Vs.g
0230 4d ff fb 92 0
4 eb 8f f3 00 37 56
03 18 42 e0 5f M
........7V..B._
0240 a7 1a d0 61 e
8 5c 0c 50 d9 58 0c
61 0b 81 73 9a .
..a.\.P.X.a..s.
0250 eb 41 86 25 7
0 3a 17 1c da 3d 1d
83 c5 7a 1f 48 .
A.%p:...=...z.H
0260 78 85 0c 42 1
d 63 77 15 92 28 b1
4d 8e f2 5b 12 x
..B.cw..(.M..[.
0270 ab 3c 22 39 3
6 17 d9 ea d5 b7 e8
ea bc 82 75 8b .
<"96.........u.
0280 cf fa 24 f1 8
5 08 f3 aa 46 f4 b7
ce d0 4f 48 86 .
.$.....F....OH.

0290 46 1f 99 34 1
0 8b 4d 74 ef e1 74
4a fb d9 ff 7f F
..4..Mt..tJ....
02a0 ff da 16 23 3
1 58 c3 40 a0 a9 eb
58 62 6d 84 55 .
..#1X.@...Xbm.U
02b0 ba 6d 79 ef 2
1 e9 6c 02 13 44 8f
31 21 78 82 c2 .
my.!.l..D.1!x..
02c0 c5 c0 d5 d2 0
e 0c ef 4b b5 99 27
a4 14 f2 cc d8 .
......K..'.....
02d0 25 4b 89 99 1
9 b9 c9 eb 18 24 ab
cd 5a 7b 3b 9a %
K.......$..Z{;.
02e0 ac 02 e3 9a b
d 44 31 76 83 87 f6
c0 d8 97 e4 d1 .
....D1v........
02f0 ad 09 02 09 e
f d3 f0 cf 71 4c 6d
72 89 53 bd 71 .
.......qLmr.S.q
0300 d1 30 1d 32 a
0 64 83 12 2b 15 4b
6d 12 ae b1 53 .
0.2.d..+.Km...S
0310 4c 5b a8 21 5
b 5e 16 ba 5d 6a 53
c0 97 f0 50 60 L
[.![^..]jS...P`
0320 62 69 ef 9a e
7 96 95 08 39 15 b1
f3 a1 6d bb 07 b
i......9....m..
0330 9a 69 d8 6e b
1 fb 39 4f 4c 5c 79
e6 67 03 f8 ed .
i.n..9OL\y.g...
0340 3d 5e 49 4c b
f 70 9d 3b 50 a0 d9
b5 ca ca 9c 5c =
^IL.p.;P......\
0350 79 23 8e a2 d
7 20 79 33 ba d0 e2
57 de dd 06 2f y
#... y3...W.../
0360 30 cf fa a3 2
5 c0 b8 42 d6 13 b2
84 6f e3 71 a3 0
...%..B....o.q.
0370 b9 45 2a d6 e
c ef 37 7f bf 79 1f
77 f3 bf fd 83 .
E*...7..y.w....
0380 1f d3 18 cc 8
5 40 f4 24 33 70 82
4b d6 18 bc 9d .
....@.$3p.K....
0390 ea 38 c1 8c 4
d 1f cf 94 2e 8b a3
ad 69 bd 8e 3e .
8..M.......i..>
03a0 94 83 f1 2f 4

2 c2 e3 71 a2 40 e4
34 bc 6f 75 44 .
../B..q.@.4.ouD
03b0 a6 c8 74 55 e
6 dd ad 0f 42 52 42
a2 00 a9 c3 22 .
.tU....BRB...."
03c0 c2 89 38 34 5
f 87 de c1 10 8d 2f
2e f4 3d 8e 5e .
.84_...../..=.^
03d0 cb 22 b7 ff f
b 92 04 eb 0f f3 0a
48 56 03 12 3a .
".........HV..:
03e0 e0 57 c5 fa d
0 61 89 4c 0c 94 bf
56 0c e1 09 81 .
W...a.L...V....
03f0 91 97 eb 01 8
6 2d 31 0b 52 4d 09
27 63 b9 44 c1 .
....-1.RM.'c.D.
0400 da 09 30 06 5
2 e7 21 4e 30 50 f4
1a 68 f9 56 8c .
.0.R.!N0P..h.V.
0410 b2 0c d7 c7 a
7 4b 28 5d 2d 1d 9d
df 18 5e dc 3f .
....K(]-....^.?
0420 67 e7 50 98 5
7 49 b5 b8 58 52 49
13 8c 85 b8 4a g
.P.WI..XRI....J
0430 94 42 ac 73 0
2 da 3a 14 3e 2c 70
aa 92 27 bd a9 .
B.s..:.>,p..'..
0440 84 9c 39 ec 9
d 3d d3 33 3f 7c ab
c7 9e 08 9f 79 .
.9..=.3?|.....y
0450 e3 02 68 1d f
0 f9 e3 f4 6d 7f 79
75 93 b1 a7 f2 .
.h.....m.yu....
0460 9e ed 05 d6 9
a 05 bb 7b db 12 e7
78 15 96 19 a4 .
......{...x....
0470 9d b8 07 b2 7
2 e4 e5 a8 3b 6f 3a
9c 60 b9 da ef .
...r...;o:.`...
0480 4d b6 d7 0c 6
a 7c 4b a7 f7 a7 c6
b2 e6 8c 35 42 M
...j|K.......5B
0490 b7 47 10 f1 3
7 47 6f b7 32 61 6c
d9 12 14 bd ca .
G..7Go.2al.....
04a0 76 69 d6 e9 a
7 bc 32 e6 c7 f4 bc
3f 79 e2 02 a2 v
i....2....?y...
04b0 ad b8 c0 81 f
5 e2 ec 9f 47 9f 27

8b 77 5f 9a ae .
.......G.'.w_..
04c0 91 62 01 b8 3
0 3b 1f 76 96 43 f8
d6 64 b1 46 85 .
b..0;.v.C..d.F.
04d0 44 83 9d ab 2
9 1c 21 1d 42 f9 2f
44 e7 44 bb 9b D
...).!.B./D.D..
04e0 b1 8c aa b2 d
0 c5 e3 07 67 44 73
90 b5 37 02 0a .
.......gDs..7..
04f0 00 28 71 55 8
7 7c 8f 35 84 46 6b
7b ff 53 4d ff .
(qU.|.5.Fk{.SM.
0500 28 7b c8 59 4
3 99 1f a8 75 a2 0a
2c 54 3f 4d f8 (
{.YC...u..,T?M.
0510 5e b6 d6 ff 2
f 7d 6f fb 9e 95 94
85 48 79 09 85 ^
.../}o.....Hy..
0520 4f e2
O
.
No. Time
Source
Destination
Protocol
Length Info
77 2.618913000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
879 http49
574 [PSH, ACK] Seq=
43056 Ack=1 Win=46
Len=825
Frame 77: 879 bytes
on wire (7032 bits
), 879 bytes captur
ed (7032 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.668843000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.668843000 s
econds
[Time delta fro
m previous captured

frame: 0.019813000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01981300
0 seconds]
[Time since ref
erence or first fra
me: 2.618913000 sec
onds]
Frame Number: 7
7
Frame Length: 8
79 bytes (7032 bits
)
Capture Length:
879 bytes (7032 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)

Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
65
Identification:
0xf19a (61850)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c43 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),

Seq: 43056, Ack: 1

, Len: 825
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 825]
Sequence number
: 43056 (relativ
e sequence number)
[Next sequence
number: 43881 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x46e
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0

[SEQ/ACK analys
is]
[Bytes in f
light: 2085]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 61 f1 9a 4
0 00 31 06 3c 43 4a
7c 0c 8a c0 a8 .
a..@.1.<CJ|....
0020 01 0b 00 50 c
1 a6 2b c9 0a 5d 9e
87 4e aa 50 18 .
..P..+..]..N.P.
0030 00 2e 46 e7 0
0 00 27 c4 d3 5e 36
bb 65 f2 be 50 .
.F...'..^6.e..P
0040 a5 60 2e 2d 8
a 72 c3 01 60 64 5a
e8 60 1a c6 21 .
`.-.r..`dZ.`..!
0050 37 bc 14 c1 e
a cc e5 e2 aa 28 ff
17 33 a2 9b 12 7
........(..3...
0060 e3 16 28 c0 4
6 de a8 66 aa 93 b2
5b 32 5d 5d 2b .
.(.F..f...[2]]+
0070 99 91 17 34 a
e ec ba 25 cd bc 9e
97 ee d7 4d df .
..4...%......M.
0080 cd 90 93 3b 4
9 6f 52 ad fd ff fb
92 04 e9 0f f2 .
..;IoR.........
0090 dc 20 d6 83 0
f 42 50 61 e6 ba d0
3d 88 5c 0b d4 .
...BPa...=.\..
00a0 ff 5e 0c 3c 6
b 81 6a 1e 2c 01 84
8d 70 1e b4 24 .
^.<k.j.,...p..$
00b0 ac 45 2c 33 5
2 13 1d 0c 90 e9 59
bc 34 ff ca 20 .
E,3R.....Y.4..
00c0 a7 96 82 1f 7
c 4e 14 aa c2 4a f6
0a 92 ac 92 4f .
...|N...J.....O
00d0 a7 9c 66 d4 1
2 97 d3 f7 38 d6 be
1f 15 08 42 c4 .
.f.....8.....B.
00e0 3b f1 f2 b0 4
6 87 5c ce 6c 70 bf
58 7d 29 65 d7 ;
...F.\.lp.X})e.
00f0 37 ae 45 ed 9
7 29 61 94 30 aa 84
89 99 11 67 19 7
.E..)a.0.....g.

0100 61 06 43 4f 0
f b2 4c 75 8c ca 9e
5d 6e 59 1a 00 a
.CO..Lu...]nY..
0110 00 22 92 d1 d
2 37 e6 d2 a8 02 53
b5 92 e2 2f 12 .
"...7....S.../.
0120 af 09 d6 c1 7
d 03 b8 dc d6 a1 65
3d 18 af 9b b6 .
...}.....e=....
0130 8f 08 0a 69 6
3 ef 1a 6b 79 ab ff
fe 33 57 71 a2 .
..ic..ky...3Wq.
0140 20 e9 41 c6 6
6 81 a1 4c 56 1e 16
2d 22 90 12 58
.A.f..LV..-"..X
0150 81 b6 3d 8e a
9 eb 2e e1 0a 9a e6
c8 24 5d 63 0e .
.=.........$]c.
0160 ec 3a b2 2f 8
d ce a2 97 f5 cf 98
52 56 da a4 52 .
:./.......RV..R
0170 0a 86 2c 74 0
8 73 68 0a ae ca 14
ee 56 d8 0c 48 .
.,t.sh.....V..H
0180 42 4e 9c 57 4
4 85 31 18 60 81 a9
d9 71 e2 20 b2 B
N.WD.1.`...q. .
0190 6d a9 51 1b 7
2 39 7b 96 ee 46 33
4a 04 bf 9a d1 m
.Q.r9{..F3J....
01a0 36 0a 75 d5 9
6 72 2e 45 5f 39 d8
1b fb 5c a9 7f 6
.u..r.E_9...\..
01b0 4b 33 90 c2 a
b 64 bf 79 7f 5f 95
cd da e4 26 17 K
3...d.y._....&.
01c0 bb df be ab 4
4 df 0e 5e de b9 ee
ef b2 27 bd 5f .
...D..^.....'._
01d0 85 d5 9c 2c 4
4 bd 81 aa b1 24 dc
52 84 b0 7f 53 .
..,D....$.R...S
01e0 b6 9d fb c6 2
2 03 8c 22 5b ba b2
0a 26 44 fc 6f .
...".."[...&D.o
01f0 b7 e7 f2 a8 8
d 3e 22 1d 26 35 15
19 1f 8c be d7 .
....>".&5......
0200 c7 f0 c6 7b 5
9 45 bf a9 cd a6 61
8e 18 0e bc b9 .
..{YE....a.....
0210 11 a0 99 65 b

3 96 7b c0 59 23 a8
59 34 1a e5 8f .
..e..{.Y#.Y4...
0220 cb 42 51 73 7
a 6b 2e b1 76 24 bb
ff fb 92 04 ec .
BQszk..v$......
0230 8f f3 1f 60 d
7 03 08 13 72 5c 86
ea f0 61 63 5c .
..`....r\...ac\
0240 0b 50 65 5c 0
c 3d e7 01 92 9b ab
41 84 8d 71 c5 .
Pe\.=.....A..q.
0250 58 54 a1 fa d
a 92 2d 9b 40 e4 43
d3 a0 a6 08 50 X
T....-.@.C....P
0260 1e 55 ba 1f 6
a 80 fc 05 d5 94 c0
41 6f c4 78 8a .
U..j......Ao.x.
0270 da 3e d2 8a e
c 95 01 78 1c 15 3d
55 03 90 be ba .
>.....x..=U....
0280 ae b7 89 07 f
2 3d 9a bc f5 7b b1
22 d4 c5 0f 1d .
....=...{."....
0290 cd f4 36 29 1
6 7a eb 1c 93 2e 91
72 dc 34 00 6e .
.6).z.....r.4.n
02a0 2f 06 9a e9 e
0 eb 8f 89 54 41 6d
59 51 64 35 35 /
.......TAmYQd55
02b0 e9 37 9e 22 6
a bb e4 03 d2 c1 d4
00 11 17 69 00 .
7."j.........i.
02c0 52 61 60 0d 1
2 5d c5 91 22 98 91
c6 8e e4 75 ef R
a`..]..".....u.
02d0 d6 e4 0f 4a f
5 bc 99 6f 39 3e 6d
d1 66 d9 14 12 .
..J...o9>m.f...
02e0 4a 5d 85 0b d
5 3e 9b de cc 13 9f
2a e9 fb 5f 84 J
]...>.....*.._.
02f0 8a d5 6b 01 9
7 56 40 6f 59 82 6d
ad d2 4f ae e6 .
.k..V@oY.m..O..
0300 12 24 5d 4a b
5 86 90 ab 18 9c 52
f1 6f 73 ed ea .
$]J......R.os..
0310 b8 95 7d 8b 0
d 31 a4 08 88 34 6d
52 8f a5 c2 e1 .
.}..1...4mR....
0320 5b af 90 e0 1
d 09 0d 8f 92 01 77

ac 98 52 7b 79 [
.........w..R{y
0330 6a 2c 37 e9 2
d 8f 23 91 ad ef 2d
01 44 09 97 67 j
,7.-.#...-.D..g
0340 b9 64 44 d4 a
5 ae 92 7e 58 78 d1
f2 c5 da f3 fc .
dD....~Xx......
0350 3d 47 f5 f8 c
d 66 92 39 bb 50 6f
2f 8b ac 63 2e =
G...f.9.Po/..c.
0360 a5 4c 05 43 e
e 2b 6b fd b9 62 a3
b4 db f4 2a
.
L.C.+k..b....*
No. Time
Source
Destination
Protocol
Length Info
78 2.619078000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=43881 Win=43578 Le
n=0
Frame 78: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.669008000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.669008000 s
econds
[Time delta fro
m previous captured
frame: 0.000165000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00016500
0 seconds]
[Time since ref
erence or first fra
me: 2.619078000 sec
onds]
Frame Number: 7
8

Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f37 (20279)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 43881
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment

number: 43881 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 43578
[Calculated win
dow size: 43578]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 77]
[The RTT to
ACK the segment wa
s: 0.000165000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 37 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O7@.........J|

0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 0d 96 50 10 .
....P..N.+...P.
0030 aa 3a 18 d4 0
0 00
.
:....
No. Time
Source
Destination
Protocol
Length Info
79 2.689102000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=43881
Ack=1 Win=46 Len=1
260
Frame 79: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.739032000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.739032000 s
econds
[Time delta fro
m previous captured
frame: 0.070024000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07002400
0 seconds]
[Time since ref
erence or first fra
me: 2.689102000 sec
onds]
Frame Number: 7
9
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]

[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf19b (61851)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a8f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 43881, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 43881 (relativ
e sequence number)
[Next sequence
number: 45141 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes

.... 0000 0001

0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x085
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 9b 4
0 00 31 06 3a 8f 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 0d 96 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 08 5e 0
0 00 75 11 9c e8 49
19 10 94 84 82 .
..^..u...I.....
0040 cc 8e 80 a5 e

c ad ed 68 50 f4 12
72 9c 3d b9 4b .
......hP..r.=.K
0050 77 61 d2 b4 3
8 ea 15 22 a9 47 82
76 39 b6 1a 12 w
a..8..".G.v9...
0060 9f 5a 9e 46 2
0 93 37 e9 a8 37 05
9d e5 4a c3 f1 .
Z.F .7..7...J..
0070 b3 cf 60 f1 0
3 d2 e8 70 54 69 86
58 c7 84 5e 39 .
.`....pTi.X..^9
0080 99 dd 9b a4 a
f c8 80 13 68 ab d5
55 eb ac c2 92 .
.......h..U....
0090 b1 8f 45 5d f
f fb 92 04 eb 8f f3
15 20 d5 83 38 .
.E]........ ..8
00a0 4a 50 5f c4 e
a c0 3d 88 4a 0b 98
8d 56 0c e0 c9 J
P_...=.J...V...
00b0 41 64 16 6a c
1 86 21 30 cb 42 63
a0 83 98 a0 17 A
d.j..!0.Bc.....
00c0 88 e4 c5 10 9
4 0c 86 69 67 93 51
4b 8c de 4f cd .
......ig.QK..O.
00d0 ed c1 53 85 7
6 5c 54 ea 27 2e cd
01 b6 14 52 1c .
.S.v\T.'.....R.
00e0 4a f3 38 79 7
8 bc b4 fd ca 2a 74
d2 7b 77 a0 a9 J
.8yx....*t.{w..
00f0 cb d5 2e 95 1
d 0d 5d cc 4d eb 7d
fc c2 61 07 84 .
.....].M.}..a..
0100 4d a5 89 78 4
5 f5 62 e7 d0 cb 9f
2b 7e 8b d9 6b M
..xE.b....+~..k
0110 eb 3a 68 0c 2
b d9 42 ff eb b5 32
02 af 24 09 00 .
:h.+.B...2..$..
0120 28 56 74 24 8
f 18 6b 0c c1 12 d1
f8 6b 35 25 40 (
Vt$..k.....k5%@
0130 5a 4b 6d e1 5
5 16 2b b0 16 27 23
7e a8 2d 53 ac Z
Km.U.+..'#~.-S.
0140 a9 5b ec 1c 8
0 28 5c 72 48 82 10
23 f2 f6 50 f2 .
[...(\rH..#..P.
0150 0b 5b a4 1f 5
7 06 f9 27 8c 5d 90

50 ba c6 c7 e7 .
[..W..'.].P....
0160 3a d6 b2 46 a
9 66 33 58 77 3e 7a
e7 df cb af 62 :
..F.f3Xw>z....b
0170 f9 14 f0 8b a
2 60 0a 61 e0 3c e8
89 53 24 72 25 .
....`.a.<..S$r%
0180 12 4a 00 14 4
6 26 cb 25 95 d1 e1
35 65 73 de 56 .
J..F&.%...5es.V
0190 2b f3 2e 8e 9
f eb 10 7d b6 66 f2
3d 06 1a 1a 85 +
......}.f.=....
01a0 39 40 e5 9a 2
6 ee 1e cf 3c da 86
a0 67 dd 5e 29 9
@..&...<...g.^)
01b0 a4 9f c3 d5 3
3 35 99 7e ed 5b 2c
fc df fc e6 2d .
...35.~.[,....01c0 73 04 e8 7b 2
e e6 1c 48 d6 f7 fa
83 d4 76 a1 cb s
..{...H.....v..
01d0 b1 f4 b8 8e 2
b a3 fb 4a d5 76 48
2d 1a 24 46 18 .
...+..J.vH-.$F.
01e0 02 72 a8 4a 9
0 a8 ec e0 54 b7 99
0d a4 15 c7 2b .
r.J....T......+
01f0 ad 49 21 83 1
a cc 69 9e 2e fa 48
54 c6 57 ab 22 .
I!...i...HT.W."
0200 5b d6 20 83 a
e 38 f6 07 0e d3 db
10 52 c1 92 be [
. ..8......R...
0210 42 43 87 d5 8
9 9c 82 22 ae b7 5a
a9 7b e5 05 00 B
C....."..Z.{...
0220 33 cc 43 90 7
5 21 45 18 a9 c4 88
fc 45 ec 26 e7 3
.C.u!E.....E.&.
0230 ee ff ac 8d 3
5 e6 ff fb 92 04 ee
0f f3 02 1d 54 .
...5..........T
0240 83 38 4a 50 6
0 24 ea a0 61 eb 4a
0b 28 9d 52 0c .
8JP`$..a.J.(.R.
0250 e1 09 41 92 1
3 aa 01 9c 3d 28 1d
97 00 68 2d 83 .
.A.....=(...h-.
0260 92 20 a0 e9 a
8 6c 2d 09 a0 0a 13
a0 9f 64 7e 37 .

...l-......d~7
0270 c2 6e 1a 51 2
4 20 67 13 69 fa 3c
57 9e 37 38 88 .
n.Q$ g.i.<W.78.
0280 aa 50 e7 2e a
a 55 c7 8f 62 e8 4c
9f 41 fe 6a f6 .
P...U..b.L.A.j.
0290 8d 30 b0 67 1
9 8d 68 fb 83 35 60
4f b8 9b 96 0e .
0.g..h..5`O....
02a0 e7 a5 cb 3d 7
b c3 61 8a b3 e2 eb
ac f2 05 94 79 .
..={.a........y
02b0 cb 73 ba bb 9
2 c6 ee d5 77 90 69
ac c4 cc 9b 35 .
s......w.i....5
02c0 18 41 86 c1 4
8 9f 61 ad 4a d6 10
21 97 06 01 a5 .
A..H.a.J..!....
02d0 92 95 24 4a 6
b 31 78 e2 92 91 16
05 3c 2e 64 38 .
.$Jk1x.....<.d8
02e0 ec 46 23 6c c
c 78 94 b5 c3 6e b6
f1 e4 c8 1f 18 .
F#l.x...n......
02f0 9a 4c af 27 c
d c8 c7 03 44 79 37
2b 27 1f 6b 09 .
L.'....Dy7+'.k.
0300 af 29 6f 4d 3
c f4 df fd 7c c8 da
ef 63 69 5b 8b .
)oM<...|...ci[.
0310 ae 38 a8 f5 9
c 9a 42 94 b8 7b f5
2b 8e 4f fd 9f .
8....B..{.+.O..
0320 fb 7a 59 48 c
a 00 22 c3 74 1d 80
81 06 3c 8e 29 .
zYH..".t....<.)
0330 90 34 f8 f0 0
3 c4 57 e5 41 1a 70
78 d6 17 c8 54 .
4....W.A.px...T
0340 57 45 c4 d0 a
2 81 3e 7e ac 97 12
66 4a f1 47 8b W
E....>~...fJ.G.
0350 69 62 95 aa d
d fd e3 c7 75 23 23
2f cb f6 17 ce i
b......u##/....
0360 f6 9c 54 76 d
6 08 b0 a2 ed 91 b3
d7 18 ff f8 2e .
.Tv............
0370 18 df ae fd 2
f 0b 31 35 60 d1 35
6d a2 07 41 a4 .
.../.15`.5m..A.

0380 53 ad ca 64 5
e ce eb 7f d6 85 73
44 42 88 47 35 S
..d^.....sDB.G5
0390 8e 04 c0 68 b
0 04 14 c6 a9 61 43
02 72 15 8a 8e .
..h.....aC.r...
03a0 0e 25 de 4d 5
e 55 59 82 c9 13 29
a8 cb 24 d5 64 .
%.M^UY...)..$.d
03b0 d3 0c 6d 6b 5
0 13 ca e8 e1 ab 61
c8 b8 f2 d2 84 .
.mkP.....a.....
03c0 79 53 95 98 6
e 7d 3b b0 a4 8e 6a
70 cf b0 fc 75 y
S..n};...jp...u
03d0 cb 25 4d 0f e
e 4c ed 65 ce ff fb
92 04 ed 8f f2 .
%M..L.e........
03e0 ea 27 54 03 3
9 42 50 5e c4 6a 70
61 ef 4a 0d 08 .
'T.9BP^.jpa.J..
03f0 c5 4c 0d 69 6
9 81 9d 16 29 81 97
bd 30 53 c2 84 .
L.ii...)...0S..
0400 5d ca 0d e7 6
9 c5 5d c2 a0 00 86
cd 60 89 50 02 ]
...i.].....`.P.
0410 50 9a 8e 4a f
6 0b 2a 75 04 af 99
68 48 3f 66 3a P
..J..*u...hH?f:
0420 d8 48 94 31 5
2 c0 79 b7 31 b4 51
70 9a 3f 8f d2 .
H.1R.y.1.Qp.?..
0430 f6 fa ba 8a 3
2 d2 d8 de 72 dd 56
b7 94 49 b4 db .
...2...r.V..I..
0440 3d 77 24 fe 1
2 cc bb 7b 58 53 51
ba 0c 09 fe 33 =
w$....{XSQ....3
0450 ff bc 3d 45 4
a 80 5e ec a5 9b 75
d8 fb ff ff d6 .
.=EJ.^...u.....
0460 fe 30 53 7c 4
0 b6 0b f9 84 ab a3
82 59 a0 b0 23 .
0S|@.......Y..#
0470 8b 32 b4 3c 1
6 93 26 e5 2e 6a fa
76 5e d3 60 6a .
2.<..&..j.v^.`j
0480 08 8d 9e 36 5
9 56 46 d1 1f 6a ad
00 88 57 2b 5b .
..6YVF..j...W+[
0490 c7 ab 65 3f f

7 05 58 e9 20 66 ed
2d cc ec 54 61 .
.e?..X. f.-..Ta
04a0 fd fc b4 db 4
3 4b c6 be 35 b9 ce
f5 bc f2 73 95 .
...CK..5.....s.
04b0 3a 94 17 c9 9
3 92 da da a7 1b 62
9c 70 d6 5e 65 :
.........b.p.^e
04c0 fc 55 21 ce 4
2 b0 8e 0a 87 f2 14
7e 1d 24 40 92 .
U!.B......~.$@.
04d0 48 18 92 a9 4
d 21 9e ed 44 f1 12
a8 73 82 9b ab H
...M!..D...s...
04e0 0c 18 a5 03 4
2 96 a7 9b 96 3c 21
f4 05 c9 ef 87 .
...B....<!.....
04f0 10 b5 09 d0 2
7 1a 57 25 14 cd 45
9e d2 63 da ca .
...'.W%..E..c..
0500 b3 8c 73 29 9
7 f5 57 ff 0f ed 7d
04 e8 56 18 43 .
.s)..W...}..V.C
0510 ad 68 b2 91 b
2 2b 41 c7 9c 3f 59
ff 2e 0f fa 73 .
h...+A..?Y....s
0520 ea 73
.
s
No. Time
Source
Destination
Protocol
Length Info
80 2.767106000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
900 http49
574 [PSH, ACK] Seq=
45141 Ack=1 Win=46
Len=846
Frame 80: 900 bytes
on wire (7200 bits
), 900 bytes captur
ed (7200 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.817036000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.817036000 s
econds
[Time delta fro
m previous captured
frame: 0.078004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07800400
0 seconds]
[Time since ref
erence or first fra
me: 2.767106000 sec
onds]
Frame Number: 8
0
Frame Length: 9
00 bytes (7200 bits
)
Capture Length:
900 bytes (7200 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
86
Identification:
0xf19c (61852)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c2c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.

11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 45141, Ack: 1
, Len: 846
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 846]
Sequence number
: 45141 (relativ
e sequence number)
[Next sequence
number: 45987 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0x208
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2106]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 76 f1 9c 4
0 00 31 06 3c 2c 4a
7c 0c 8a c0 a8 .
v..@.1.<,J|....
0020 01 0b 00 50 c
1 a6 2b c9 12 82 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 20 8f 0
0 00 76 a1 8b 52 94
21 c9 36 55 34 .
. ...v..R.!.6U4
0040 51 4d 17 71 9
4 f1 a4 d2 46 17 bc
36 81 2e 64 e1 Q
M.q....F..6..d.
0050 d3 5b 3c 12 8
c e9 56 4e f5 fc ef
48 63 5d 03 d1 .
[<...VN...Hc]..
0060 7c 30 2d 23 f
a 8c db a3 f7 7d 7d
98 6a 01 cd 2d |
0-#.....}}.j..0070 80 00 d2 63 f
6 df c7 a2 81 75 ba
12 a0 ba 2b 37 .
..c.....u....+7
0080 12 0f 26 e5 1
8 56 69 88 42 03 29
d9 39 c7 a5 ff .
.&..Vi.B.).9...
0090 fb 92 04 e6 8
f f2 c2 28 53 83 39
62 50 59 a4 fa .
......(S.9bPY..
00a0 70 65 ef 4a 0
b fc 9d 52 0c 61 29
41 97 96 6a 01 p
e.J...R.a)A..j.
00b0 97 ad 30 6d 2
8 71 c6 94 1f 9c 76
cb 0b 21 79 08 .
.0m(q....v..!y.
00c0 d6 06 14 f9 8
9 a1 7b 54 16 39 b2
c2 88 7a 94 b2 .
.....{T.9...z..
00d0 ab 51 ea a6 9
9 3b c4 49 95 23 03
52 63 d1 c0 08 .

Q...;.I.#.Rc...
00e0 7f 7e 42 15 5
c 59 3f 39 a9 38 84
48 38 08 b7 0e .
~B.\Y?9.8.H8...
00f0 a5 4f 6d a8 7
f 1e b9 01 e9 74 35
a7 59 b4 12 1e .
Om......t5.Y...
0100 d3 aa 72 9c 1
e 20 a0 c2 29 99 d5
7e c4 97 9c 4b .
.r.. ..)..~...K
0110 58 2e 3a 2a a
c 48 09 07 4c 18 f5
84 46 f0 4b 95 X
.:*.H..L...F.K.
0120 12 08 d4 8b 1
5 dd c2 ba 39 57 ed
55 72 6e a7 ec .
.......9W.Urn..
0130 de 32 d9 9b 5
c c1 cc a4 50 b8 a0
b4 93 20 dc b9 .
2..\...P.... ..
0140 fb 64 15 1e 5
2 64 ea 21 5c 51 63
cd 9a 5a e5 d3 .
d..Rd.!\Qc..Z..
0150 88 a9 f2 82 6
7 50 05 10 89 28 e4
4e a9 f6 0b 1a .
...gP...(.N....
0160 22 f0 a8 b5 6
0 11 c6 89 15 82 bb
e0 57 3d 41 d4 "
...`.......W=A.
0170 06 ec ad f8 d
c 7b b6 b0 ac 50 55
26 8b 98 dc 15 .
....{...PU&....
0180 0b 72 4d 76 f
5 63 10 b5 0b 1e 15
c2 20 c1 bb 0c .
rMv.c...... ...
0190 86 2b 8c 0d 2
c b8 b0 a6 e0 2e 2c
d8 e4 4d a2 33 .
+..,.....,..M.3
01a0 ee a0 30 78 f
7 e2 d0 60 77 61 d1
d9 3c b5 c3 9c .
.0x...`wa..<...
01b0 65 41 b4 b2 5
a 1f 2d f7 3b 11 55
f5 7f 38 ee ee e
A..Z.-.;.U..8..
01c0 d3 49 24 a1 e
1 91 87 94 54 8b 84
ad 32 e0 d9 dc .
I$.....T...2...
01d0 04 e3 45 90 5
a 58 d0 d8 35 11 26
ea 9c 2e 74 89 .
.E.ZX..5.&...t.
01e0 6a 62 a4 84 c
b e4 61 64 8a 09 16
84 f8 1b 81 85 j
b....ad........

01f0 f1 24 1f 17 5
0 6d b3 c3 bc 87 36
bc 0f 25 4d 28 .
$..Pm....6..%M(
0200 b2 08 57 bc 2
2 4d d7 9e 65 d0 63
6f 53 a4 ef cb .
.W."M..e.coS...
0210 2f 5f a4 23 0
3 52 ff a7 a5 88 1e
48 1c cf 02 33 /
_.#.R.....H...3
0220 50 eb 34 d5 b
5 35 fd 59 74 79 1a
f9 f2 4b 31 bf P
.4..5.Yty...K1.
0230 ee ff fb 92 0
4 e9 8f f2 d8 1e d6
03 0f 42 50 59 .
............BPY
0240 c3 7a b0 61 e
9 38 0c bc 9b 54 0c
61 09 41 9f 96 .
z.a.8...T.a.A..
0250 aa 41 87 a1 3
0 c2 7d 83 4b 31 04
d4 a6 45 90 8d .
A..0.}.K1...E..
0260 ff 7e bf d9 c
6 35 01 1e 2f 59 e2
f1 60 43 74 a4 .
~...5../Y..`Ct.
0270 e6 56 f0 21 a
6 30 c0 f2 1d 4e aa
3a 82 3c dc 8e .
V.!.0...N.:.<..
0280 b0 16 9e c0 2
e 8c 27 4a b5 06 c2
4c 0a 53 f8 bf .
.....'J...L.S..
0290 13 75 6b 1b 4
b 28 bc 02 ce 5f 98
2b 03 a9 c1 f0 .
uk.K(..._.+....
02a0 71 53 9b 92 5
7 b6 8e f6 59 91 d1
ef 73 52 34 63 q
S..W...Y...sR4c
02b0 a3 f9 95 4f 5
7 df 35 ad 5f ac d4
9f 46 a6 39 4f .
..OW.5._...F.9O
02c0 fd f5 ff 61 5
6 d0 10 89 bc b1 8c
81 a6 31 8b 2a .
..aV........1.*
02d0 8b 1a 7d ad 0
3 28 a2 60 e1 60 73
50 59 8a 82 cb .
.}..(.`.`sPY...
02e0 67 5f cc 52 b
6 34 9f e9 64 f2 32
5a 58 5d 34 f0 g
_.R.4..d.2ZX]4.
02f0 d0 69 54 04 e
1 bb 14 b7 23 6d 85
4b ca bf a3 06 .
iT.....#m.K....
0300 d4 8c 7a 34 f

3 f7 59 5f d2 ab e6
34 6b 32 43 97 .
.z4..Y_...4k2C.
0310 e6 13 7c 67 1
f 49 29 9f a7 ba ff
fc 4a f2 31 0e .
.|g.I).....J.1.
0320 60 53 53 ba 9
e 51 4a cd 8b 0e 72
0d 88 82 a9 ab `
SS..QJ...r.....
0330 69 2a 29 fc 1
7 a8 e4 08 6e f6 04
e8 84 b0 ab 62 i
*).....n......b
0340 80 9a e6 e6 d
c 11 49 6a c6 8c 29
81 da 73 95 42 .
.....Ij..)..s.B
0350 e6 b9 89 23 9
a a4 74 93 4a bf ab
e7 78 41 45 72 .
..#..t.J...xAEr
0360 41 fd c1 95 7
1 be d6 af d4 ef a3
43 89 e1 33 af A
...q......C..3.
0370 45 be ef 8d 6
6 0e 22 e7 ff f1 8d
4c 79 40 69 c7 E
...f."....Ly@i.
0380 7b 3b fd 75
{
;.u
No. Time
Source
Destination
Protocol
Length Info
81 2.767281000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=45987 Win=43052 Le
n=0
Frame 81: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.817211000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]

Epoch Time: 141

5615215.817211000 s
econds
[Time delta fro
m previous captured
frame: 0.000175000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 2.767281000 sec
onds]
Frame Number: 8
1
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f38 (20280)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro

l Protocol, Src Por

t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 45987
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 45987 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 43052
[Calculated win
dow size: 43052]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys

is]
[This is an
ACK to the segment
in frame: 80]
[The RTT to
ACK the segment wa
s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 38 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O8@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 15 d0 50 10 .
....P..N.+...P.
0030 a8 2c 18 d4 0
0 00
.
,....
No. Time
Source
Destination
Protocol
Length Info
82 2.887066000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=45987
Ack=1 Win=46 Len=1
260
Frame 82: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.936996000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.936996000 s
econds
[Time delta fro
m previous captured
frame: 0.119785000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11978500

0 seconds]
[Time since ref
erence or first fra
me: 2.887066000 sec
onds]
Frame Number: 8
2
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),

Dst: pc13.home (192

.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf19d (61853)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a8d [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 45987, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por

t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 45987 (relativ
e sequence number)
[Next sequence
number: 47247 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x35e
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 9d 4
0 00 31 06 3a 8d 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 15 d0 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 35 ee 0
0 00 60 82 14 ea c8
63 73 08 0c 26 .
.5...`....cs..&
0040 20 92 f3 36 8
1 4b cc 78 a1 60 a2
31 13 b0 30 5a
..6.K.x.`.1..0Z
0050 c2 88 e0 e6 c
2 f5 a5 7e 4a ca df
2b c6 97 62 e5 .
......~J..+..b.
0060 5c 54 22 37 0
d 36 78 29 ae 7c a5
a2 c7 7b 53 f5 \
T"7.6x).|...{S.
0070 4f b0 28 12 1
2 80 24 f1 24 9b 74
19 0d a0 b0 8d O
.(...$.$.t.....
0080 2a cf 87 05 5
7 ff fb 92 04 e7 0f
f3 01 2c 53 03 *
...W........,S.
0090 59 4a 60 5f 6
5 da 60 65 eb 4c 0b
f8 ab 4a 0c e9 Y
J`_e.`e.L...J..
00a0 e9 81 7c 96 2
9 41 97 bd 30 13 3c
bb 7a 45 29 5c .
.|.)A..0.<.zE)\
00b0 cf fd ff 23 b
7 36 21 3d d0 b7 44
09 81 6a 38 57 .
..#.6!=..D..j8W
00c0 35 94 46 12 6
0 80 02 11 04 09 0c
0a 22 3d 1d d0 5
.F.`......."=..
00d0 67 28 e3 c2 e
8 51 8e d1 52 18 5f
de 61 e1 1a 50 g
(...Q..R._.a..P
00e0 95 21 00 0b 2
6 a5 1d d1 20 93 5b
6b 85 f3 56 26 .
!..&... .[k..V&
00f0 f6 79 a4 9f 3
8 ab c5 7c 6f 06 2c
4a 3d 89 7f e5 .
y..8..|o.,J=...
0100 63 81 35 33 a
f fe ae f3 10 94 00
ec 51 7e a4 3a c
.53........Q~.:
0110 a3 0d 83 94 0

5 16 6d 08 33 32 9a
02 f4 69 85 5a .
.....m.32...i.Z
0120 d9 59 60 39 4
c 38 3b d1 6f 25 ae
13 c2 a6 14 4c .
Y`9L8;.o%.....L
0130 c4 1c a2 fd 7
5 e2 76 30 5f 09 6c
d0 15 49 a1 49 .
...u.v0_.l..I.I
0140 5e 1e dc 10 1
1 4c 8e c9 b8 c2 44
d0 5f 27 8f 54 ^
....L....D._'.T
0150 d4 6e 60 44 2
4 d0 51 61 b2 28 39
7c d6 b3 42 11 .
n`D$.Qa.(9|..B.
0160 c7 5d 1d 65 d
2 cd 1d 69 b2 06 ea
ef cd d6 b5 61 .
].e...i.......a
0170 1a 19 63 ee 1
5 94 63 26 98 d0 c0
02 0d a0 55 42 .
.c...c&......UB
0180 70 96 54 52 5
2 70 95 c2 e0 04 27
05 71 ea 01 72 p
.TRRp....'.q..r
0190 81 ac cc 13 b
3 e1 4b 13 27 c0 1e
89 e0 32 03 d2 .
.....K.'....2..
01a0 a6 0e e3 0e 9
1 46 64 4f 96 f5 63
8a e5 27 a2 fb .
....FdO..c..'..
01b0 1f 11 e0 4f 2
c fb 86 a5 71 db 94
76 3f 89 32 cf .
..O,...q..v?.2.
01c0 9d 7d d7 fc 5
b 7a f8 df c5 f1 3d
b2 45 8e b5 d5 .
}..[z....=.E...
01d0 9b e6 95 52 c
0 b8 e1 72 63 0f d1
81 10 d1 c4 e7 .
..R...rc.......
01e0 91 57 a6 38 d
2 ba 43 85 05 80 69
43 60 38 8b 75 .
W.8..C...iC`8.u
01f0 c0 26 66 29 3
c 2a 0c 3d 1a 69 71
bb 0d c9 f5 61 .
&f)<*.=.iq....a
0200 0a 39 2f 8c f
d c9 a1 74 0f a5 9a
e6 06 ee fd 6a .
9/....t.......j
0210 0a 72 6d e6 1
4 ee 7f 51 9d 52 47
7a f7 c5 df d5 .
rm....Q.RGz....
0220 df f6 ff 12 b
9 ef fa ff fb 92 04

e6 8f f2 f7 31 .
..............1
0230 d2 83 59 42 e
0 56 44 fa 50 65 ef
4a 0c 44 c5 4a .
.YB.VD.Pe.J.D.J
0240 0c e5 a9 81 8
4 16 69 01 a7 bd 30
d7 54 c4 78 da .
.....i...0.T.x.
0250 86 9e b1 ed c
5 d9 d2 98 81 75 07
15 41 b4 04 3d .
........u..A..=
0260 2c b9 2c 94 c
2 89 26 00 c1 e8 a6
ab d9 72 c4 93 ,
.,...&......r..
0270 6e 13 60 0c d
7 92 d5 b2 69 c6 60
39 64 fc d4 a9 n
.`.....i.`9d...
0280 a3 21 e4 5a 9
1 b1 dc 9a 06 90 16
dc 5b 4d 56 c5 .
!.Z........[MV.
0290 12 a9 d1 cc 4
c 66 cf b9 d3 e4 5c
ad 73 c3 9b 40 .
...Lf....\.s..@
02a0 c5 35 bc e1 2
8 55 32 a8 eb d4 60
4c 96 bb d6 cb .
5..(U2...`L....
02b0 37 69 27 97 1
7 56 a0 9d 80 a1 87
aa c6 03 a0 a4 7
i'..V..........
02c0 c4 50 b3 f3 7
0 55 37 01 3c 42 40
9f 1e b1 86 3b .
P..pU7.<B@....;
02d0 48 29 21 45 9
e c2 06 86 a1 60 90
24 e6 19 7f 4d H
)!E.....`.$...M
02e0 9d 32 04 14 b
e 9b ca 98 f3 43 78
79 8f 4b 8c 48 .
2.......Cxy.K.H
02f0 6c ea 78 ea 5
7 76 26 ae b1 0e 77
f0 35 43 b5 c7 l
.x.Wv&...w.5C..
0300 e2 f7 89 f1 5
6 5b 6f fd ff 8f 37
f8 c6 b1 7c eb .
...V[o...7...|.
0310 7f fd cd 2c f
7 ff 4b 80 40 90 dc
a4 36 d2 89 04 .
..,..K.@...6...
0320 85 89 bb e6 1
9 18 f0 72 51 af 7c
dc be 89 b5 22 .
......rQ.|...."
0330 75 68 1e b0 d
5 ac d4 49 54 92 76
d7 7d 13 fe fe u

h.....IT.v.}...
0340 21 7c 34 87 8
f 6b 60 90 5e cc 34
c6 a3 82 a3 da !
|4..k`.^.4.....
0350 03 46 13 b0 0
6 a3 ac 45 67 65 9e
26 20 b0 6e d3 .
F.....Ege.& .n.
0360 f9 b7 f0 bd 0
6 1f d6 37 fd df 4d
f1 e9 f1 ac e7 .
......7..M.....
0370 ff 9a 7f e5 9
0 76 7b 86 55 60 23
b2 35 80 c0 63 .
....v{.U`#.5..c
0380 49 d9 62 92 0
4 1a 7c 2c d5 a4 92
ba ed a7 7a a5 I
.b...|,......z.
0390 9d c8 14 cc 8
6 71 c4 56 36 35 2a
e4 1a 0b 33 21 .
....q.V65*...3!
03a0 c7 84 65 0b f
8 25 19 77 36 f5 6b
37 69 fb 64 8a .
.e..%.w6.k7i.d.
03b0 b8 d6 b6 17 3
4 ab e7 cc 99 9e d6
cf f7 85 3e fe .
...4.........>.
03c0 fe 77 fd 7d f
7 99 c6 0a 8e ff fb
92 04 e9 0f f2 .
w.}............
03d0 ff 2c d2 83 5
9 7a 60 60 c5 9a 50
6b 12 4c 0b e0 .
,..Yz``..Pk.L..
03e0 bb 4c 0c bd e
9 81 86 98 69 01 ac
3d 30 18 35 25 .
L......i..=0.5%
03f0 02 37 8d 2e 7
e 0f be 18 cf fd 5f
20 50 8b 50 01 .
7..~....._ P.P.
0400 b3 40 21 a8 7
a 08 45 05 cc 30 37
2b 9b e6 f5 23 .
@!.z.E..07+...#
0410 24 cd a5 81 0
8 81 04 c4 97 9d 6a
84 91 0f 6f 5d $
.........j...o]
0420 1e 10 a5 cc 1
2 36 c6 fd 8e 9e 04
48 9f 0a b7 f4 .
....6.....H....
0430 a6 f1 9b da 9
5 ce 6d 4b 53 72 c7
bf cf d6 6f bf .
.....mKSr....o.
0440 14 4e 07 3e e
b 04 00 3c 1c 86 09
97 89 cf b0 a6 .
N.>...<........

0450 5d fe 53 39 d
6 f1 8e d3 f2 0f 08
59 01 e2 00 79 ]
.S9.......Y...y
0460 02 45 b6 5b 4
d de cc 40 19 1d a7
3e 2a 24 27 89 .
E.[M..@...>*$'.
0470 0f 02 27 6b 8
f 54 d0 a8 7e 70 5b
5e 27 00 72 05 .
.'k.T..~p[^'.r.
0480 24 f3 62 81 8
0 9f b6 e3 57 12 21
4d 29 0c ad db $
.b.....W.!M)...
0490 82 b5 28 46 1
b 92 93 40 9c 50 9b
95 07 1e e6 b8 .
.(F...@.P......
04a0 54 10 29 a8 4
0 52 79 05 ce 28 81
75 9b 38 94 b4 T
.).@Ry..(.u.8..
04b0 31 7e 98 c7 8
4 bd 06 70 8f 05 8e
b0 76 94 bb e1 1
~.....p....v...
04c0 f7 38 44 05 8
b 68 c6 25 34 67 15
12 cf 5a 2c a2 .
8D..h.%4g...Z,.
04d0 3e bc 67 07 e
7 cd 2f 24 5d d2 dc
63 02 98 8c d0 >
.g.../$]..c....
04e0 83 99 92 0d a
a 30 db c4 a4 cd ad
7c 94 b0 91 3c .
....0.....|...<
04f0 ef da f5 fd 6
b f6 66 8a f0 de f5
f3 70 a0 74 4c .
...k.f.....p.tL
0500 1a 10 4c 30 b
1 2a 87 2c b3 59 4a
15 96 d5 41 5c .
.L0.*.,.YJ...A\
0510 73 1d a7 1e 7
6 06 0d 2d 61 ea a8
b3 93 81 88 21 s
...v..-a......!
0520 23 2a
#
*
No. Time
Source
Destination
Protocol
Length Info
83 2.916112000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
HTTP
1296 Continuat
ion

Frame 83: 1296 byte

s on wire (10368 bi
ts), 1296 bytes cap
tured (10368 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.966042000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.966042000 s
econds
[Time delta fro
m previous captured
frame: 0.029046000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02904600
0 seconds]
[Time since ref
erence or first fra
me: 2.916112000 sec
onds]
Frame Number: 8
3
Frame Length: 1
296 bytes (10368 bi
ts)
Capture Length:
1296 bytes (10368
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
282
Identification:
0xf19e (61854)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9

Protocol: TCP (
6)
Header checksum
: 0x3a9e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 47247, Ack: 1
, Len: 1242
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1242]
Sequence number
: 47247 (relativ
e sequence number)
[Next sequence
number: 48489 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1

... = Push: Set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x450
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2502]
Hypertext Transfer
Protocol
[truncated]:\2
21A*A\201\323|US\37
0d\341p\230L\261E\2
04\023\002\374\273\
246\223U~\351\177\3
53n\373'\365\364\22
2=\vt\373^k\3138G\3
56\366\252\355\333\
372U\017>\237f\206\
360;o\344L\222_q>u\
373\374\370\362\317
\372\377\373\222\00
4\347\017\362\3
Data (1054 byte
s)
Data: da8df
1bb6d5a07f6cc49bd6f
97ce7bc1bff53d8fdc8
ef7ab...
[Length: 10
54]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 02 f1 9e 4
0 00 31 06 3a 9e 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 1a bc 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 45 0b 0
0 00 3a 91 41 2a 41
81 d3 7c 55 53 .
.E...:.A*A..|US
0040 f8 64 e1 70 9

8 4c b1 45 84 13 02
fc bb a6 93 55 .
d.p.L.E.......U
0050 7e e9 7f eb 6
e fb 27 f5 f4 92 3d
0b 74 fb 5e 6b ~
...n.'...=.t.^k
0060 cb 38 47 ee f
6 aa ed db fa 55 0f
3e 9f 66 86 f0 .
8G......U.>.f..
0070 3b 6f e4 4c 9
2 5f 71 3e 75 fb fc
f8 f2 cf fa ff ;
o.L._q>u.......
0080 fb 92 04 e7 0
f f2 f7 29 d4 03 0f
7a 60 5d 84 ea .
......)...z`]..
0090 b0 3d ef 4a 0
b 44 8b 56 0c 31 29
41 81 98 6b 41 .
=.J.D.V.1)A..kA
00a0 86 19 30 bd f
7 4b c0 3e fa cd c7
fe 8b e0 21 85 .
.0..K.>......!.
00b0 dc 36 c7 d2 d
1 e2 68 c3 54 dd c6
ae 49 22 9b 2d .
6....h.T...I".00c0 6f d5 d5 95 5
7 58 b7 80 f2 77 36
68 33 5e 4c 54 o
...WX...w6h3^LT
00d0 30 4e de 82 5
6 b1 95 c4 08 22 34
be 59 ef dc 2b 0
N..V...."4.Y..+
00e0 bb d1 11 15 1
e ae 7d 5b 6e 86 8e
3c f9 6a 6c 97 .
.....}[n..<.jl.
00f0 2d 0d da 8d f
1 bb 6d 5a 07 f6 cc
49 bd 6f 97 ce .....mZ...I.o..
0100 7b c1 bf f5 3
d 8f dc 8e f7 ab d9
79 af fc 3a fd {
...=......y..:.
0110 bd 0e 58 00 6
3 01 5a 0a db 4c 0d
2a 85 5c b0 91 .
.X.c.Z..L.*.\..
0120 99 b9 54 2d f
2 d6 14 08 af 41 d2
75 bd db 34 7e .
.T-.....A.u..4~
0130 86 6c c4 53 5
d 6e 27 fb 27 a2 38
f7 16 7b 41 b6 .
l.S]n'.'.8..{A.
0140 05 09 ac 4a c
a 90 2a f1 80 73 6c
7b 62 f6 bd 51 .
..J..*..sl{b..Q
0150 03 0b a1 2d 7
2 14 54 5d 6d 73 b7

34 eb d6 db af .
..-r.T]ms.4....
0160 9b 99 b7 70 a
2 e8 5a ed 36 d5 11
cc 18 38 69 aa .
..p..Z.6....8i.
0170 43 32 a7 0a 0
8 ca 88 6e f5 4b 53
47 45 9b 51 c5 C
2.....n.KSGE.Q.
0180 ea 52 99 7f 6
5 b7 22 ed 90 18 4b
6e 57 8c ed 11 .
R..e."...KnW...
0190 d8 fb 7b ed 7
5 1a f7 85 9d ca dc
7f de ab bb bf .
.{.u...........
01a0 68 24 19 04 c
b 80 67 c4 6e a5 6f
24 91 a9 44 e0 h
$....g.n.o$..D.
01b0 a0 f1 54 a5 2
7 d4 4e 12 60 65 6a
eb d0 f8 a4 2a .
.T.'.N.`ej....*
01c0 e4 39 0c 50 a
3 93 83 59 30 08 ac
ad be 5d 0d 8c .
9.P...Y0....]..
01d0 68 aa 73 65 9
5 10 cb a5 c8 18 a7
8d 09 27 12 39 h
.se.........'.9
01e0 f2 b7 46 bd 6
e d0 0c 06 78 3b c6
aa d1 69 b5 46 .
.F.n...x;...i.F
01f0 c4 bb 7e 7d f
9 53 5d 1e ef 6c 6c
7b 1b 27 6f fe .
.~}.S]..ll{.'o.
0200 e2 df 3b ab a
e 3a b9 af 55 e4 ec
63 54 eb 2b 9d .
.;..:..U..cT.+.
0210 15 16 3e 2c 8
7 3c 54 51 c9 14 69
e6 0d 7a d4 39 .
.>,.<TQ..i..z.9
0220 e9 ff fb 92 0
4 ea 8f f3 02 1b d7
03 0f 49 c2 63 .
............I.c
0230 e5 5a f0 3d e
8 4c 4b 18 5b 5e 0c
3d 87 01 74 15 .
Z.=.LK.[^.=..t.
0240 6b c1 86 19 3
0 b4 82 83 76 06 7b
54 59 b5 98 2a k
...0...v.{TY..*
0250 41 4c ad 43 0
c 3a b1 78 4d 88 71
63 52 a5 86 64 A
L.C.:.xM.qcR..d
0260 d9 72 69 2f 0
9 17 65 70 76 3b 79
82 99 54 2a d4 .

ri/..epv;y..T*.
0270 39 53 f7 7f 7
5 f2 33 b9 e6 c7 8c
20 41 ee ea 5a 9
S..u.3.... A..Z
0280 9d a2 f8 79 e
5 c7 8d 46 d0 45 37
65 3f 74 bd 4c .
..y...F.E7e?t.L
0290 62 77 f5 b6 b
6 25 a5 74 75 be 61
72 44 f7 b2 8e b
w...%.tu.arD...
02a0 da cd 5e 5f 0
0 d7 4a 7d 24 6c b7
d5 fb 92 05 67 .
.^_..J}$l.....g
02b0 22 c1 81 8b b
6 f9 34 62 ae b5 7d
f2 74 cd 54 62 "
.....4b..}.t.Tb
02c0 15 a6 88 b9 3
4 91 b0 d7 48 be 75
33 54 08 98 a0 .
...4...H.u3T...
02d0 8a a6 47 10 4
5 66 02 e6 3d d3 4e
a6 74 97 26 9b .
.G.Ef..=.N.t.&.
02e0 a9 b0 c8 ec 8
8 26 ee b7 bf 32 f4
dd cb 62 a9 93 .
....&...2...b..
02f0 db e4 66 6d 0
e f5 65 36 87 32 ba
4c af 33 a5 52 .
.fm..e6.2.L.3.R
0300 a7 4e 95 ab 9
7 75 6a 1c c0 a8 16
6b b5 dd 25 5b .
N...uj....k..%[
0310 e2 aa 80 f8 2
e 01 ce 39 f5 08 fd
27 ed 8b 10 eb .
......9...'....
0320 ad 9e 5b bc 5
c e4 69 f1 7e b9 58
62 48 db d6 ea .
.[.\.i.~.XbH...
0330 c8 60 3b bb f
9 1b b9 97 ac a4 dc
df 7f 79 ea 78 .
`;..........y.x
0340 90 b4 8e 7e 5
e 97 fa b8 ab c7 b2
80 65 96 09 00 .
..~^.......e...
0350 99 5c 9b c4 1
2 cf 2d 2c b5 8a a6
04 50 d5 15 5c .
\....-,....P..\
0360 b9 57 12 9c 7
a e3 6e 5b d8 f1 73
45 f5 aa 70 0c .
W..z.n[..sE..p.
0370 65 2d 90 06 4
8 7b 0b 84 98 d2 d0
12 55 5c 4a 24 e
-..H{......U\J$

0380 8a 40 84 fe 9
9 cd 23 f3 d6 2e eb
5e d6 ab 1d a6 .
@....#....^....
0390 04 b3 13 54 b
4 c2 50 b2 82 2b 75
98 9a 17 19 4b .
..T..P..+u....K
03a0 65 bf a3 31 6
5 3b 19 18 01 a7 a0
50 0f 68 70 58 e
..1e;.....P.hpX
03b0 42 61 d4 36 5
a d2 00 44 e8 7a 4e
18 14 43 0a ae B
a.6Z..D.zN..C..
03c0 88 aa c8 ff f
b 92 04 ec 8f f3 16
2f d7 03 0f 5a .
........../...Z
03d0 60 61 09 1a e
0 3d 25 5e 4c 75 49
5a 0c 44 4b c1 `
a...=%^LuIZ.DK.
03e0 6f 16 6b 80 f
6 21 30 a9 b8 09 cd
2a c3 74 cb 55 o
.k..!0....*.t.U
03f0 7b 92 b7 d1 0
b c2 e4 42 36 53 22
8c 33 c7 42 52 {
......B6S".3.BR
0400 88 99 68 0a c
b eb 5a 04 1b d7 28
5a 2a fa 58 57 .
.h...Z...(Z*.XW
0410 2c 55 49 a5 4
5 9a b7 ef 4b 7b 6c
c6 61 1f 5b 6c ,
UI.E...K{l.a.[l
0420 a9 b6 c8 29 0
2 a6 36 fe fe f9 0f
fb 37 de ee ff .
..)..6.....7...
0430 ed f5 04 e0 0
c 04 f1 65 a1 6f 6d
ab 04 5c 29 14 .
......e.om..\).
0440 53 5e 80 0c 7
9 01 e0 39 6a 57 3a
97 21 cb 6e b2 S
^..y..9jW:.!.n.
0450 af 88 00 26 5
4 24 98 60 54 de 1b
03 06 16 c3 25 .
..&T$.`T......%
0460 6e fe af c7 c
6 a5 3f 86 f7 dd 41
b5 79 cc 7e 4b n
.....?...A.y.~K
0470 2e 63 04 e2 9
a 26 8e 99 30 36 d0
76 5b a0 9a 47 .
c...&..06.v[..G
0480 0f d2 98 9b d
e ad 9e 9a 15 20 b4
9a fa 8c d4 f9 .
........ ......
0490 a1 01 2a a2 c

f b7 04 18 26 52 6b
71 2b 4e a8 f2 .
.*.....&Rkq+N..
04a0 29 dc 75 43 e
e 27 0f 52 3f 7a 77
d4 a6 50 dd d2 )
.uC.'.R?zw..P..
04b0 80 03 24 b7 9
0 a7 5e d8 93 64 76
86 24 7b 3e 5f .
.$...^..dv.${>_
04c0 49 cb 9f 0d e
6 d4 11 6b 44 52 53
32 68 01 02 e1 I
......kDRS2h...
04d0 e0 87 b8 a8 e
6 b9 e5 9e 98 43 98
60 c5 57 a8 ed .
........C.`.W..
04e0 6e 86 a0 7e d
4 3e da 13 94 dc aa
c7 1c 3a b6 15 n
..~.>.......:..
04f0 32 f5 e7 81 4
4 8e b6 24 95 43 82
aa 93 5d 90 ac 2
...D..$.C...]..
0500 e8 95 ca 16 2
c 66 6c 25 64 43 5b
ef 14 5b 03 75 .
...,fl%dC[..[.u
No. Time
Source
Destination
Protocol
Length Info
84 2.916279000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=48489 Win=42426 Le
n=0
Frame 84: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
5.966209000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615215.966209000 s
econds
[Time delta fro

m previous captured
frame: 0.000167000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00016700
0 seconds]
[Time since ref
erence or first fra
me: 2.916279000 sec
onds]
Frame Number: 8
4
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)

Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f39 (20281)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 48489

, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 48489 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 42426
[Calculated win
dow size: 42426]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 83]

[The RTT to
ACK the segment wa
s: 0.000167000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 39 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O9@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 1f 96 50 10 .
....P..N.+...P.
0030 a5 ba 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
85 3.028118000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=48489
Ack=1 Win=46 Len=1
260
Frame 85: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.078048000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.078048000 s
econds
[Time delta fro
m previous captured
frame: 0.111839000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11183900
0 seconds]
[Time since ref
erence or first fra
me: 3.028118000 sec

onds]
Frame Number: 8
5
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:

20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf19f (61855)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a8b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 48489, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le

n: 1260]
Sequence number
: 48489 (relativ
e sequence number)
[Next sequence
number: 49749 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x3f2
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.

0010 05 14 f1 9f 4
0 00 31 06 3a 8b 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 1f 96 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 3f 23 0
0 00 5f 23 af 3f 88
bb ac a1 18 de .
.?#.._#.?......
0040 80 bf 2b 30 6
4 d2 6a 78 85 18 60
45 dd 55 19 e9 .
.+0d.jx..`E.U..
0050 35 b7 52 44 8
a 91 5a 1d ed cc 6d
6f b3 8a 0a 54 5
.RD..Z...mo...T
0060 6b ef 3a de d
d e3 16 f8 96 3e bf
7f 35 69 36 f7 k
.:......>..5i6.
0070 6c e1 96 f8 f
f 5f f8 35 c5 22 07
ae 90 35 1d 64 l
...._.5."...5.d
0080 a0 57 2a f6 f
d 83 74 ed fb e2 cf
ff fb 92 04 e9 .
W*...t.........
0090 8f f3 04 22 5
6 03 0f 6a 50 5d e5
fa d0 61 86 4c .
.."V..jP]...a.L
00a0 0b b0 9d 58 0
c 61 a9 41 86 13 ea
c1 86 21 28 a7 .
..X.a.A.....!(.
00b0 9c e6 84 ab e
5 55 cc a8 35 19 83
3e f4 cb 6d 85 .
....U..5..>..m.
00c0 a7 b9 e8 fb 6
3 53 01 37 d0 19 5b
ab ad 1a 8c d7 .
...cS.7..[.....
00d0 44 f2 81 70 0
2 13 c0 b6 50 c0 6c
f5 ef f2 d5 21 D
..p....P.l....!
00e0 05 3d 16 65 5
c fd 5c f2 de bd 2d
06 aa a2 aa 5b .
=.e\.\...-....[
00f0 92 1c 14 5a 0
7 11 a1 14 ee 7c b5
eb a8 29 22 84 .
..Z.....|...)".
0100 65 22 31 eb d
6 71 da d5 ba 73 98
e8 5d 09 f8 6d e
"1..q...s..]..m
0110 98 64 12 01 2
1 74 26 18 56 d5 ca
8d b7 da d5 cd .
d..!t&.V.......
0120 b9 03 65 9c a

0 7a 9a ed ad 3c 2e
b4 9b b7 3b 11 .
.e..z...<....;.
0130 79 d2 90 3e 2
4 e7 23 01 e0 49 96
d0 c8 34 f6 05 y
..>$.#..I...4..
0140 e9 5e 39 ab 1
5 13 39 94 1b 0f 0b
07 09 a4 68 08 .
^9...9.......h.
0150 56 a7 5f 9d 3
e 65 bc 5c 54 70 55
e3 54 90 50 ce V
._.>e.\TpU.T.P.
0160 d6 95 1c a4 2
b 48 a0 75 2b 3f d1
18 dd 97 5c da .
...+H.u+?....\.
0170 14 e6 28 f0 5
5 06 80 31 85 0c 53
ef 4c 0a 20 5a .
.(.U..1..S.L. Z
0180 f7 86 ac c4 a
a 12 2a aa d7 8b 03
9d 60 0a 44 39 .
.....*.....`.D9
0190 74 ed 23 01 b
1 10 e7 19 ec 4b 33
36 c3 be eb 1a t
.#......K36....
01a0 64 30 c1 28 2
d f1 82 20 a7 c1 bc
29 12 3c f4 71 d
0.(-.. ...).<.q
01b0 d7 2d 4e ec c
f 1e bc 76 47 6b 15
5f 1c 77 d7 73 .
-N....vGk._.w.s
01c0 fc bd cc dc 5
d c6 58 ca 82 94 a3
02 e0 4c 46 28 .
...].X......LF(
01d0 49 04 5b f5 2
5 d6 2e e7 9d a1 2a
49 e3 11 17 51 I
.[.%.....*I...Q
01e0 f8 45 be 45 c
6 58 70 b2 fa c5 ac
b6 c9 90 d8 3f .
E.E.Xp........?
01f0 61 27 5c 83 2
e 35 4e f7 d7 53 cc
fa e9 e1 25 56 a
'\..5N..S....%V
0200 35 6d e7 c0 a
6 a9 9d 67 c9 0f 0f
ed 85 a9 f5 4d 5
m.....g.......M
0210 5b 59 db 74 4
c b6 38 f8 f7 fd b8
4a f7 11 5a 90 [
Y.tL.8....J..Z.
0220 7d c1 dd cb 0
b 8b 76 a4 5d fd 54
d6 c4 ff fb 92 }
.....v.].T.....
0230 04 e9 8f f2 c
b 27 55 83 0f 7a 50

58 a4 4a b0 61 .
....'U..zPX.J.a
0240 89 4a 0c 9c 7
d 52 0c e1 09 41 a6
1e 2a 41 87 a1 .
J..}R...A..*A..
0250 70 be dc 46 d
a 5e fb ff 6c ef 5d
67 75 2d a4 58 p
..F.^..l.]gu-.X
0260 2f c8 b5 51 8
0 1a 06 38 f5 a9 52
13 06 b9 a3 09 /
..Q...8..R.....
0270 b6 80 c1 9e 0
c a1 15 0f 69 02 4b
a5 7b a8 cd e4 .
.......i.K.{...
0280 34 cf 14 13 a
e b2 6a 0f 8e a5 a7
a7 16 76 29 e3 4
.....j......v).
0290 e7 a6 8c d2 0
f 96 99 ea bf ef fc
cc 38 6c 50 f1 .
...........8lP.
02a0 64 ea be 41 2
0 55 6f 40 ab 8c f4
0a 1f 17 a4 55 d
..A Uo@.......U
02b0 31 af 57 f4 3
5 fe 88 ab 85 12 92
e0 59 45 e5 1c 1
.W.5.......YE..
02c0 28 88 25 dd 8
1 43 2d bb 6f b4 14
ce ad 5f 41 10 (
.%..C-.o...._A.
02d0 67 e2 ee 7c 7
5 4a 2c 5f 66 30 e4
1f 00 d2 5e 92 g
..|uJ,_f0....^.
02e0 b2 f2 25 3c 5
7 b1 af f9 0d 31 83
d6 bd a4 d1 bb .
.%<W....1......
02f0 0b 4b 0d 1e c
f f1 35 b7 02 0e e9
3d e3 5a 9e ef .
K....5....=.Z..
0300 2b fe 31 f3 1
9 f5 ff cd 35 7f e3
ee a4 48 51 28 +
.1.....5....HQ(
0310 ca 13 b2 cf 3
5 65 6f f7 23 a5 d7
fa 93 fc cf e3 .
...5eo.#.......
0320 16 c4 13 41 d
0 6b 64 ce e2 81 88
5c 95 32 b1 08 .
..A.kd....\.2..
0330 a3 07 33 5a 5
9 4a 3a 59 62 95 4f
54 48 97 91 5b .
.3ZYJ:Yb.OTH..[
0340 68 1f a3 99 d
e af ac 9b aa e5 99
be 27 fa 7b b5 h

...........'.{.
0350 64 da b2 2e 2
4 d5 f4 5d ea 94 9f
36 a7 ab eb ce d
...$..]...6....
0360 b7 89 c3 4f 7
1 87 17 35 ae b0 8c
b3 20 02 1b 36 .
..Oq..5.... ..6
0370 5c 1b b5 52 6
b 8d 94 a9 14 50 ee
af 91 4e 93 09 \
..Rk....P...N..
0380 78 c3 13 2d c
8 58 88 54 7b c6 35
55 e1 43 9b 3b x
..-.X.T{.5U.C.;
0390 84 ee 5a a3 a
2 fe 8d d4 e2 f9 8c
cb ac 2e 1a 68 .
.Z............h
03a0 8e 3c 78 e0 7
4 84 b2 ab 10 74 89
49 a0 ce d2 4a .
<x.t....t.I...J
03b0 b4 3b c1 23 d
d 79 ab 2b e5 90 49
3c 74 37 75 34 .
;.#.y.+..I<t7u4
03c0 24 d1 f3 fe e
2 c3 74 12 1a fa 43
ea ee 4b df ff $
.....t...C..K..
03d0 fb 92 04 e8 0
f f2 f1 22 54 83 0f
7a 50 5c c4 5a .
......"T..zP\.Z
03e0 90 61 ec 4a 0
c 4c b3 50 0d 61 e9
81 83 11 ea 01 .
a.J.L.P.a......
03f0 87 bd 28 98 e
9 49 0b 1d fe df 7f
ff ad 22 4c 2b .
.(..I......."L+
0400 87 25 32 1d 2
8 58 a8 5a bb 2c 14
f6 05 c7 6d 62 .
%2.(X.Z.,....mb
0410 36 6c ad 01 6
6 c8 5d 4c 2b 6a 95
e8 77 dc d8 ce 6
l..f.]L+j..w...
0420 f1 99 54 0f 0
8 b9 3d bb ac 58 59
19 8f a9 b5 98 .
.T...=..XY.....
0430 17 81 6d aa 9
d d2 ed 6a dc 7c 42
62 be 73 1b 1b .
.m....j.|Bb.s..
0440 bc 68 11 61 7
d 67 7f ed 8a af 62
64 6d 4d d5 4a .
h.a}g....bdmM.J
0450 7a 1f a4 da d
4 53 d1 d8 54 8d 1a
d5 bb 93 11 04 z
....S..T.......

0460 31 f3 8c d1 9
1 18 d1 91 69 4c dc
8d b9 64 c0 50 1
.......iL...d.P
0470 94 ea 6f ea d
9 11 cc 8d 57 60 4b
50 7c 8a ab 03 .
.o.....W`KP|...
0480 67 33 31 ce d
f 6c 2c d0 a1 2d 67
4a ba 0e 27 56 g
31..l,..-gJ..'V
0490 89 32 b7 77 c
6 27 59 79 a5 8b d2
2e a5 89 9c c8 .
2.w.'Yy........
04a0 fa 34 58 ed 7
0 29 9f 2d 9c b3 ff
f9 ac 6a 61 91 .
4X.p).-.....ja.
04b0 50 0d a1 82 c
2 15 32 8f d1 d4 22
00 c1 80 29 49 P
.....2..."...)I
04c0 2a 86 59 40 8
8 95 31 66 da e0 10
56 6c d4 aa de *
.Y@..1f...Vl...
04d0 58 e2 57 97 5
d b5 2b 94 76 02 72
a6 63 15 ed e0 X
.W.].+.v.r.c...
04e0 ab 14 30 61 1
e 2e 79 b5 93 c0 b3
54 c4 fe d3 c2 .
.0a..y....T....
04f0 8f 85 4d 33 5
5 95 3d 7e a4 87 4b
c0 91 75 4d 42 .
.M3U.=~..K..uMB
0500 9d c6 6c eb f
f 98 b0 f4 c4 24 d1
89 26 aa 96 b0 .
.l......$..&...
0510 9b 21 57 7f 4
b bf 77 ff fa ea 67
e2 06 46 70 e8 .
!W.K.w...g..Fp.
0520 34 79
4
y
No. Time
Source
Destination
Protocol
Length Info
86 3.064116000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
884 http49
574 [PSH, ACK] Seq=
49749 Ack=1 Win=46
Len=830
Frame 86: 884 bytes

on wire (7072 bits

), 884 bytes captur
ed (7072 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.114046000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.114046000 s
econds
[Time delta fro
m previous captured
frame: 0.035998000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03599800
0 seconds]
[Time since ref
erence or first fra
me: 3.064116000 sec
onds]
Frame Number: 8
6
Frame Length: 8
84 bytes (7072 bits
)
Capture Length:
884 bytes (7072 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
70
Identification:
0xf1a0 (61856)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)

Header checksum
: 0x3c38 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 49749, Ack: 1
, Len: 830
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 830]
Sequence number
: 49749 (relativ
e sequence number)
[Next sequence
number: 50579 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc69
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2090]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 66 f1 a0 4
0 00 31 06 3c 38 4a
7c 0c 8a c0 a8 .
f..@.1.<8J|....
0020 01 0b 00 50 c
1 a6 2b c9 24 82 9e
87 4e aa 50 18 .
..P..+.$...N.P.
0030 00 2e c6 9c 0
0 00 08 11 27 cb 6c
d8 63 5b e3 09 .
.......'.l.c[..
0040 9c e5 bb 2b a
4 2a 46 d9 e6 1f 5a
14 12 46 69 96 .
..+.*F...Z..Fi.
0050 62 ec 87 26 b
0 81 23 22 84 29 8c
8d f0 8d 44 2d b
..&..#".)....D0060 f4 16 23 26 6
f 69 d0 1e 00 98 01
c2 71 61 04 32 .
.#&oi......qa.2
0070 16 70 f8 f8 7
6 0a 43 fc c9 34 d6
56 67 b8 35 5f .
p..v.C..4.Vg.5_
0080 d4 b3 62 e2 0
b ff fb 90 04 e8 0f
f2 de 27 d4 03 .
.b..........'..
0090 58 4a 50 61 4
4 fa 70 67 0f 4a 0b
7c 9f 4e 0d 61 X
JPaD.pg.J.|.N.a
00a0 e9 41 7d 93 e
9 81 9c 3d 28 14 70

78 2a b7 4d 9d .
A}....=(.px*.M.
00b0 cb 3f ad e3 0
4 4c 31 d9 cb 22 13
0c d1 0a 0c 00 .
?...L1.."......
00c0 26 cb c4 11 4
1 0d 36 6e 50 cd 0c
c4 a2 91 6e 92 &
...A.6nP.....n.
00d0 29 5a b3 89 1
7 78 ae 3c 9b 68 28
35 0e 35 c8 7e )
Z...x.<.h(5.5.~
00e0 b5 3d 80 65 8
7 42 5e 0d 7b 2e 9e
de 10 f5 ef 73 .
=.e.B^.{......s
00f0 38 a4 ab 5f 2
5 3c 68 30 a4 cc 5e
a5 9a 26 69 bd 8
.._%<h0..^..&i.
0100 ff 87 df 5f 1
f 5a f6 9b ff 2c d4
bd 95 a0 c5 30 .
.._.Z...,.....0
0110 ef b7 ff d0 5
d 53 1a f4 5a 29 8f
74 a0 01 0b e2 .
...]S..Z).t....
0120 e6 c6 90 b0 f
0 30 62 64 15 75 d8
64 a9 08 f4 57 .
....0bd.u.d...W
0130 da 16 2c ee b
d 64 d7 60 b4 11 28
c7 c4 c2 c2 35 .
.,..d.`..(....5
0140 05 84 8b 0e 2
8 70 01 91 25 0d ff
9f 25 ae 24 50 .
...(p..%...%.$P
0150 e3 a5 aa 24 7
e 66 85 b8 d5 42 ff
4c e2 15 5e ae .
..$~f...B.L..^.
0160 6c f4 e2 b6 1
e 40 b9 61 92 48 59
36 b7 16 ea 2f l
....@.a.HY6.../
0170 29 89 56 5c 9
3 8e 48 cd 09 1c 76
d4 02 c4 9a 19 )
.V\..H...v.....
0180 8f 16 b7 13 5
a bc 02 ad c0 43 f3
39 2b 43 ad 6a .
...Z....C.9+C.j
0190 71 7e b5 39 5
3 f9 9c ad 56 a7 b9
71 32 20 a4 d8 q
~.9S...V..q2 ..
01a0 63 92 42 ab 1
4 f9 87 11 8d cd bd
4d 7e d5 64 74 c
.B........M~.dt
01b0 7a f6 3d 5d 9
a 90 db eb f4 fe 3b
ac 66 98 d7 cb z

.=]......;.f...
01c0 8e 98 28 0a 1
6 74 93 55 39 a9 ff
ff 67 f4 d5 05 .
.(..t.U9...g...
01d0 04 33 b5 cd c
1 23 5e 38 00 80 02
55 c6 0f aa 85 .
3...#^8...U....
01e0 84 a5 51 e5 a
e d0 c6 8b f2 45 b6
68 eb 5b 76 ec .
.Q......E.h.[v.
01f0 bc 2d 7a 0a a
3 a4 9c 91 3c 28 ce
c8 09 ea bb 28 .
-z.....<(.....(
0200 8e 98 0d 23 f
0 87 57 79 7c c3 09
6d 81 ec 4f 48 .
..#..Wy|..m..OH
0210 d3 df 7d fa 1
f 0e 4d ba 79 7f e3
bc 79 8d 6a d8 .
.}...M.y...y.j.
0220 d6 2b 3e 1a 7
8 60 ff fb 92 04 ea
0f f3 06 2c 53 .
+>.x`........,S
0230 03 59 4a 60 6
1 25 da 50 67 0f 4c
0b 64 9f 4c 0d .
YJ`a%.Pg.L.d.L.
0240 65 89 41 7c 9
3 e9 41 ac 3d 28 80
ec 6c 4e d2 78 e
.A|..A.=(..lN.x
0250 ed d5 f1 81 8
2 0c 98 f3 3c 90 e7
cb 30 00 41 82 .
.......<...0.A.
0260 c9 91 af 64 e
8 32 03 52 49 14 65
6f 64 60 6d 68 .
..d.2.RI.eod`mh
0270 3e 5d 32 0a 1
2 e4 79 b8 c3 6e f7
6f c6 9b 1d 66 >
]2...y..n.o...f
0280 98 03 3b e4 8
2 62 b0 00 76 53 af
6f 55 8e e0 c2 .
.;..b..vS.oU...
0290 63 31 9e 13 f
6 e5 56 6f 37 3e 62
c3 92 1c 08 b1 c
1....Vo7>b.....
02a0 ff 58 9a 0e 2
b 6f 8d 4f 22 1b 16
30 d5 3e 61 4c .
X..+o.O"..0.>aL
02b0 dd d1 e8 f6 f
5 ba 46 44 fe 64 86
40 d0 53 04 1e .
.....FD.d.@.S..
02c0 1c 30 41 63 8
5 27 82 92 e5 5d 26
93 ea f8 05 ba .
0Ac.'...]&.....

02d0 69 d1 f6 29 5
d c0 b6 f0 aa 16 69
0f 43 8e e4 53 i
..)].....i.C..S
02e0 82 58 35 a6 d
5 d3 db ef a8 92 08
43 95 d3 fa b0 .
X5........C....
02f0 9c 54 b5 8e 3
8 bf b9 1c ee be 0f
55 73 6c ed 7e .
T..8......Usl.~
0300 b6 f4 82 e3 5
f ff c6 73 7b 7f e7
cb ff 87 ec be .
..._..s{.......
0310 65 3c e7 43 b
f d6 d5 0c c1 f3 2d
58 55 2a 71 88 e
<.C......-XU*q.
0320 20 27 30 a0 3
8 04 85 93 70 5f 52
9b 68 73 03 22
'0.8...p_R.hs."
0330 75 f8 82 82 0
3 4d 4e b6 46 8f 10
8c 3f 92 19 0b u
....MN.F...?...
0340 ac 98 4b 02 f
1 cc 43 f8 4f 8a a0
51 cc 92 a8 72 .
.K...C.O..Q...r
0350 97 92 37 59 c
6 b1 b0 97 94 17 31
40 ba 6e 7c e9 .
.7Y......1@.n|.
0360 93 ba cd 8c 1
e b3 b4 a6 26 bd 6e
b4 26 47 ff ce .
.......&.n.&G..
0370 df 93 f2 0a
.
...
No. Time
Source
Destination
Protocol
Length Info
87 3.064284000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=50579 Win=41904 Le
n=0
Frame 87: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})

Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.114214000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.114214000 s
econds
[Time delta fro
m previous captured
frame: 0.000168000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00016800
0 seconds]
[Time since ref
erence or first fra
me: 3.064284000 sec
onds]
Frame Number: 8
7
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As

ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f3a (20282)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)

Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 50579
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 50579 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41904
[Calculated win
dow size: 41904]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d

4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 86]
[The RTT to
ACK the segment wa
s: 0.000168000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 3a 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O:@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 27 c0 50 10 .
....P..N.+.'.P.
0030 a3 b0 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
88 3.171121000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=50579
Ack=1 Win=46 Len=1
260
Frame 88: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.221051000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141

5615216.221051000 s
econds
[Time delta fro
m previous captured
frame: 0.106837000
seconds]
[Time delta fro
m previous displaye
d frame: 0.10683700
0 seconds]
[Time since ref
erence or first fra
me: 3.171121000 sec
onds]
Frame Number: 8
8
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1a1 (61857)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a89 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]

Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 50579, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 50579 (relativ
e sequence number)
[Next sequence
number: 51839 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x54f
4 [validation disab
led]
[Good Check
sum: False]

[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 a1 4
0 00 31 06 3a 89 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 27 c0 9e
87 4e aa 50 10 .
..P..+.'...N.P.
0030 00 2e 54 f4 0
0 00 20 22 01 62 63
60 18 86 2a 4d .
.T... ".bc`..*M
0040 8e 18 61 67 3
9 72 83 85 c9 24 ca
08 62 72 50 5a .
.ag9r...$..brPZ
0050 89 93 6e 23 2
8 62 34 93 28 0d 68
30 04 71 e5 a2 .
.n#(b4.(.h0.q..
0060 72 d9 3b 65 5
3 b9 0b a6 d8 6b 40
03 54 4f 30 88 r
.;eS....k@.TO0.
0070 e8 72 af 26 5
e c3 c5 0f 8a 14 d6
3f 26 d0 ad 5b .
r.&^......?&..[
0080 cc 62 fe fa d
a 7b f9 89 67 45 ff
fb 92 04 ea 8f .
b...{..gE......
0090 f3 03 28 52 8
3 58 7a 50 61 c4 ea
40 6b 2f 4a 0c .
.(R.XzPa..@k/J.
00a0 18 b1 4a 0d e
5 e9 81 76 18 69 41
ac 35 30 d5 be .
.J....v.iA.50..
00b0 10 46 a2 dd 5
f f5 21 e8 08 51 2f
03 28 58 78 78 .
F.._.!..Q/.(Xxx
00c0 f2 a1 e4 2a 2
5 2e 31 e7 50 b5 37
65 37 dd 00 34 .
..*%.1.P.7e7..4
00d0 65 50 1d 62 8
7 5d 95 a7 a9 10 a0
48 e3 bb 02 cf e
P.b.].....H....
00e0 b2 e4 1d 61 3
1 3b ed 76 b5 70 00
12 1f f3 58 d1 .
..a1;.v.p....X.

00f0 35 89 e4 29 c
e 8c d2 4c 5e a7 93
aa 56 e3 36 ae 5
..)...L^...V.6.
0100 46 fd a5 e3 9
b 75 ff cc 9f ef f2
55 bd af 95 6f F
....u.....U...o
0110 42 38 87 40 6
f a0 0b 84 df 5c b7
24 26 1b 0a ad B
8.@o....\.$&...
0120 00 69 f3 cc 2
b b0 68 8a b8 2e 82
35 12 b5 32 cc .
i..+.h....5..2.
0130 17 4b 56 8a e
1 0e c2 a6 c3 1c 71
0e 52 e5 1d e3 .
KV.......q.R...
0140 7a 61 54 26 b
1 e6 b5 e1 2a 54 f3
b7 c7 9f de 90 z
aT&....*T......
0150 ab 5a a9 5c 6
f 77 19 3f bc 55 e8
57 f6 a6 f3 df .
Z.\ow.?.U.W....
0160 b3 f1 eb 2e 5
8 f3 ee 2d 46 41 fd
3e 94 b9 31 0a .
...X..-FA.>..1.
0170 0a ec 78 3c 9
e 43 8d c0 00 d2 5d
20 22 6c 5d 72 .
.x<.C....] "l]r
0180 39 b0 ce 03 0
4 36 cc 04 a1 85 58
87 98 59 6a 61 9
....6....X..Yja
0190 66 4f 88 f3 e
8 84 d9 99 50 fd ac
ca 29 12 ee b7 f
O......P...)...
01a0 b4 9c 11 b2 d
8 dc a0 9d 10 19 84
5a 14 2b a9 33 .
..........Z.+.3
01b0 72 9d a6 f6 a
a 35 73 cb ef f7 ff
fb 6a 5e cf e6 r
....5s.....j^..
01c0 6c 3b f2 03 1
5 51 b1 bb 1d 5a 1f
f1 bf fa 91 6e l
;...Q...Z.....n
01d0 48 64 6d 43 9
9 22 ce da 2c a1 cc
e7 81 4a 27 15 H
dmC."..,....J'.
01e0 6f b2 4a ef 7
8 50 90 b9 f6 e7 17
6e 71 a6 60 e2 o
.J.xP.....nq.`.
01f0 c7 f3 80 24 d
4 94 8b ce 1e 0e 19
3e 36 48 fa d1 .
..$.......>6H..
0200 ea d7 73 d1 5

9 95 4b 49 8f de 8e
3d f7 e4 8a 77 .
.s.Y.KI...=...w
0210 f2 99 db 2c 7
7 db af 56 a1 81 73
90 3e 74 b0 a8 .
..,w..V..s.>t..
0220 d1 55 56 44 c
d 67 2c 30 2a 2a 64
eb ff fb 92 04 .
UVD.g,0**d.....
0230 e9 0f f2 e1 2
c 52 83 58 5a 60 5a
85 9a 50 6b 09 .
...,R.XZ`Z..Pk.
0240 4c 0b 7c 9f 4
c 0c e5 e9 41 89 98
e9 81 97 a5 70 L
.|.L...A......p
0250 3a 0d 3a 4e 3
8 99 c8 b8 88 0a 45
a5 d4 59 c8 22 :
.:N8.....E..Y."
0260 57 6e 23 3a 9
d 44 10 56 23 9d 2c
89 5e d1 cb 58 W
n#:.D.V#.,.^..X
0270 d2 67 50 58 9
4 cb aa c6 7a c1 15
bc f5 92 3c 58 .
gPX....z.....<X
0280 d1 60 4f 91 0
b 7f 94 9d 23 57 35
39 0f fb ce 53 .
`O.....#W59...S
0290 ec 9c f8 4b f
e ec ff ff 34 df f8
bc a7 96 78 5c .
..K....4.....x\
02a0 85 45 03 cf 9
a 09 03 80 50 64 31
c9 02 c4 9f 4d .
E......Pd1....M
02b0 4d 7f 8b 99 a
2 11 c4 91 ec d1 55
54 45 53 83 9c M
.........UTES..
02c0 82 52 48 bc 2
1 0e 2a b2 2d 75 0b
26 82 17 11 89 .
RH.!.*.-u.&....
02d0 38 a7 63 55 b
0 49 52 6c f2 7a a1
f8 82 a9 04 b1 8
.cU.IRl.z......
02e0 9a 08 34 7d d
9 3d 56 b9 3b 27 71
ea 56 5b d4 5f .
.4}.=V.;'q.V[._
02f0 ee ed b8 fd 9
e af 5e cb b2 67 1a
bc 59 07 d7 ff .
.....^..g..Y...
0300 a7 ce 4c 9d 0
f 1c 65 84 80 8d 16
12 0a 90 07 1f .
.L...e.........
0310 8b 3a 4d 32 1
1 6f 9c f4 22 90 c6

81 51 a0 aa 87 .
:M2.o.."...Q...
0320 c0 4c 59 b5 7
1 d9 3a 01 50 9a 3f
83 a2 51 e6 09 .
LY.q.:.P.?..Q..
0330 03 9a 84 76 3
f 64 9e 60 c2 52 8c
27 50 9f eb 67 .
..v?d.`.R.'P..g
0340 84 13 31 31 0
0 a4 7e ff 49 d4 55
a5 4d eb 1c 81 .
.11..~.I.U.M...
0350 3a 5d af 9b 9
3 f2 63 e4 21 be df
ee d7 f3 40 99 :
]....c.!.....@.
0360 66 5e c4 1e e
9 f0 40 2c 27 79 00
19 93 22 c2 42 f
^....@,'y...".B
0370 0f 07 00 81 1
5 9a 41 fa b6 a7 fe
73 e8 78 02 ee .
.....A....s.x..
0380 11 65 b4 2e e
4 b1 c8 45 98 c3 75
89 72 4e 00 a6 .
e.....E..u.rN..
0390 3a 5e 84 c3 d
a 3c 8d e7 6c 7c ea
6a 08 c7 17 2a :
^...<..l|.j...*
03a0 18 73 a5 c8 1
7 3c 39 22 e9 0a ee
66 3a a2 60 69 .
s...<9"...f:.`i
03b0 b0 10 f0 b3 5
4 08 b0 48 74 0e 1b
73 45 2c 60 32 .
...T..Ht..sE,`2
03c0 d5 15 15 73 2
c 5b 5a ce 0c 6d 31
5d e1 95 ff fb .
..s,[Z..m1]....
03d0 92 04 ed 8f f
2 f9 27 54 83 58 62
50 61 e6 9a c0 .
.....'T.XbPa...
03e0 61 e6 5c 0c 9
8 c5 5a 0c bc c9 81
91 17 2b c1 86 a
.\...Z......+..
03f0 25 30 a5 db e
d fd bf d0 dd 00 a4
14 9b 04 71 1b %
0............q.
0400 4a 06 e5 18 8
a 0e 83 28 22 2c dd
da 2b 1c 28 a2 J
......(",..+.(.
0410 69 fc d2 32 a
9 49 69 39 95 f1 54
e0 2e 53 ca 16 i
..2.Ii9..T..S..
0420 e1 ca 58 ea 6
e 5c 6c 52 40 96 b9
b2 0d 87 49 89 .

.X.n\lR@.....I.
0430 ae 22 51 b4 1
a 68 f7 a5 54 26 04
4d 88 04 04 83 .
"Q..h..T&.M....
0440 82 11 56 86 4
2 a2 30 08 18 9d 4e
de f8 61 1c 33 .
.V.B.0...N..a.3
0450 4b b7 da ff b
7 fa 1b a2 c1 0a 98
b5 6d 0d de 97 K
...........m...
0460 0d 8d ae 35 d
9 ce 85 85 d0 b7 21
d5 53 c9 1d 95 .
..5......!.S...
0470 43 16 48 3b 4
3 5b a1 a0 25 8b 01
e3 d9 f6 b0 02 C
.H;C[..%.......
0480 7b 90 7d 6c 2
5 26 6d 6a 06 a9 ea
9e 1f f9 ef db {
.}l%&mj........
0490 cd f7 f8 ef 8
d e3 3f 6f f7 2d b4
c1 52 e0 03 8a .
.....?o.-..R...
04a0 70 bd 0d 2e 1
0 15 69 31 52 54 24
fb 10 b4 68 7b p
.....i1RT$...h{
04b0 d3 71 6a a8 e
b 6e 10 fd f2 83 aa
bb 97 20 a7 62 .
qj..n....... .b
04c0 12 c7 52 40 1
4 2c 1a 7d 01 e1 e0
e8 94 85 e2 ea .
.R@.,.}........
04d0 bc a9 15 ad 3
6 45 b5 77 96 d4 08
b6 2c 4d f4 c7 .
...6E.w....,M..
04e0 61 96 76 a1 2
1 aa de e6 5d a6 7c
bf d3 e1 3a 6b a
.v.!...].|...:k
04f0 c4 7b 10 47 2
6 b5 0d 52 71 a4 19
e9 34 30 34 22 .
{.G&..Rq...404"
0500 58 bc c0 90 f
0 20 19 17 26 44 d0
f6 34 91 7c c1 X
.... ..&D..4.|.
0510 96 89 4d 53 7
5 ca 3c 84 f6 bb 5a
78 0b aa 7c 5e .
.MSu.<...Zx..|^
0520 de 28
.
(
No. Time
Source
Destination

Protocol
Length Info
89 3.213123000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1303 http49
574 [PSH, ACK] Seq=
51839 Ack=1 Win=46
Len=1249
Frame 89: 1303 byte
s on wire (10424 bi
ts), 1303 bytes cap
tured (10424 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.263053000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.263053000 s
econds
[Time delta fro
m previous captured
frame: 0.042002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04200200
0 seconds]
[Time since ref
erence or first fra
me: 3.213123000 sec
onds]
Frame Number: 8
9
Frame Length: 1
303 bytes (10424 bi
ts)
Capture Length:
1303 bytes (10424
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),

Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
289
Identification:
0xf1a2 (61858)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a93 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 51839, Ack: 1
, Len: 1249
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1249]
Sequence number
: 51839 (relativ
e sequence number)
[Next sequence
number: 53088 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xbca
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2509]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 09 f1 a2 4
0 00 31 06 3a 93 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 2c ac 9e
87 4e aa 50 18 .
..P..+.,...N.P.
0030 00 2e bc a7 0
0 00 d2 c4 64 2b c1
b3 b7 47 69 3d .
.......d+...Gi=
0040 9f e0 b9 34 5
4 8a 55 5a 8d cd 3a
72 43 86 d8 9b .
..4T.UZ..:rC...
0050 a2 49 c6 80 6
8 a4 1d 02 67 1a 5f
05 09 5e 0c 66 .
I..h...g._..^.f
0060 3c 70 e9 22 2
e 94 e2 0f b6 c6 c5
44 74 52 64 93 <
p.".......DtRd.
0070 36 90 55 cf 1

2 84 04 81 30 00 f3
6f 53 da d3 4c 6
.U.....0..oS..L
0080 71 24 07 45 f
f fb 92 04 e7 8f f2
b7 1e 58 03 0c q
$.E.........X..
0090 42 50 5e 65 a
b 00 61 88 4c 0b d8
bd 5e 0c 3c c9 B
P^e..a.L...^.<.
00a0 81 96 99 2b c
1 84 99 70 dc e4 11
b4 ed af de db .
..+...p........
00b0 af af f5 47 1
2 f4 c4 76 5e d4 5b
1c ea f1 7c db .
..G...v^.[...|.
00c0 2a c1 f8 a0 a
8 52 6e 91 0c dd b3
75 cb 56 55 62 *
....Rn....u.VUb
00d0 bb 2e 8b 83 2
2 88 27 14 15 51 04
9a da 4e 19 6c .
...".'..Q...N.l
00e0 ce 83 99 22 c
6 0d 1f 0d 05 51 31
7a ef 11 2e b6 .
..".....Q1z....
00f0 3d eb 02 ec e
6 24 54 78 b4 c5 dd
bc 5e 04 ac da =
....$Tx....^...
0100 fc bb 5e bd 8
f 7a 5e 7e e5 df ff
ea 2a 3a 59 db .
.^..z^~....*:Y.
0110 31 9a f2 e7 4
a 76 b0 12 6b a3 4a
e4 46 97 8b f0 1
...Jv..k.J.F...
0120 0a 09 af 11 5
a 7e 24 4f dd 18 ce
6a 96 a8 e4 c8 .
...Z~$O...j....
0130 e3 d1 ec 87 2
6 91 b1 e3 80 41 82
4b b5 0f 39 a1 .
...&....A.K..9.
0140 05 0d d8 6a 3
e 9e d6 86 10 bf 45
f9 88 b7 ff de .
..j>.....E.....
0150 ca 1c ed 01 0
1 80 4c 3f 06 1c 92
01 87 92 12 0c .
.....L?........
0160 70 70 44 4d 0
c 52 11 27 72 d5 f7
73 fa 55 61 b1 p
pDM.R.'r..s.Ua.
0170 9a f0 12 2a a
d bc 0e cb 9d 14 79
9e 6b 0c 8a 61 .
..*......y.k..a
0180 36 1e 30 18 1
b 4e 05 98 ea d5 74

17 07 d3 ab 95 6
.0..N....t.....
0190 6a 42 e8 a2 6
4 75 5c 29 5f 4c f7
6e 9c ed 51 68 j
B..du\)_L.n..Qh
01a0 ca e3 49 4c 3
9 36 66 83 d1 a2 f4
6d f9 b6 77 7d .
.IL96f....m..w}
01b0 84 76 9d 56 9
d 3d 32 57 f3 f6 cd
a9 6f 9f 7b 4f .
v.V.=2W....o.{O
01c0 54 e7 74 b0 1
2 ad f3 05 2d b9 24
9b a9 47 7b f1 T
.t.....-.$..G{.
01d0 6f a6 80 4c 2
0 73 80 b8 74 0a 48
01 00 23 70 09 o
..L s..t.H..#p.
01e0 7b 02 50 4a 1
6 c3 21 95 00 96 fd
61 4b 39 12 b9 {
.PJ..!....aK9..
01f0 33 a9 ba d2 c
9 fa b1 24 a2 a7 69
54 98 53 55 b8 3
......$..iT.SU.
0200 05 01 a1 19 1
3 45 1c 8b 83 73 88
61 c3 44 19 55 .
....E...s.a.D.U
0210 16 1e f6 4f c
4 8a 8c eb 7b 43 77
ba bd a1 b5 a9 .
..O....{Cw.....
0220 b7 ae 1a 09 a
9 11 ff fb 92 04 e9
8f f3 01 25 d6 .
.............%.
0230 03 2f 42 50 5
8 a4 ea f0 61 88 4a
4c 44 a5 56 0c .
/BPX...a.JLD.V.
0240 bc c9 81 8f 9
d 2b 01 87 99 70 70
f1 d5 c7 01 e5 .
....+...pp.....
0250 19 fb 3c 55 8
9 b3 fd 51 12 80 4c
48 90 16 48 00 .
.<U...Q..LH..H.
0260 c0 57 51 b9 7
c 20 81 e9 ee c0 ae
0d 94 7b 54 17 .
WQ.| .......{T.
0270 87 cb c7 ac a
f 1b a9 0d bd c1 37
0c bf 38 e3 c3 .
.........7..8..
0280 c0 1d 55 2e 2
2 ec 38 bd ce 81 92
4d 3a 8e bb 92 .
.U.".8....M:...
0290 26 bd 45 5f b
8 66 31 61 d2 3a 39
9a e0 c5 67 31 &

.E_.f1a.:9...g1
02a0 42 00 55 40 d
0 74 7c aa d4 0f a4
40 19 38 56 ae B
.U@.t|....@.8V.
02b0 38 b1 e4 75 7
5 f4 7c aa 52 a6 01
bf 1b 4d 4f 25 8
..uu.|.R....MO%
02c0 1c 55 13 5c e
7 5d 06 86 d1 9d 01
6c 1e 33 26 57 .
U.\.].....l.3&W
02d0 e1 9c 6b 0c a
7 59 e7 22 f3 75 53
eb cb cc aa 48 .
.k..Y.".uS....H
02e0 36 83 18 0c 0
8 f4 50 56 13 30 7f
38 96 7c c8 89 6
.....PV.0.8.|..
02f0 51 da a6 bf d
9 34 6e bd 7c 9a e8
17 8f bb ba c5 Q
....4n.|.......
0300 86 84 83 e0 e
9 d0 89 35 2c 22 d9
60 6e dc 4c 85 .
......5,".`n.L.
0310 b6 cd df ff d
4 a3 e5 dc 26 3a 09
13 19 bb 2f 52 .
.......&:..../R
0320 fe c3 6c 9c 5
8 28 92 b0 16 1e 92
9d af 0e 9d 5a .
.l.X(.........Z
0330 5d 75 44 57 4
3 5f 4b 90 24 83 a3
b1 16 86 29 9d ]
uDWC_K.$.....).
0340 aa 3a c6 b5 7
b 5e f7 2c 85 33 41
ad 64 37 b6 3d .
:..{^.,.3A.d7.=
0350 88 fb a5 8a a
9 0b 3c 68 1c 2a b0
d0 80 f8 f9 d2 .
.....<h.*......
0360 f6 82 2c 59 2
5 14 1c d7 b4 b2 fe
e6 fb 7d 7f e8 .
.,Y%........}..
0370 20 05 19 ce 9
8 09 4d 2d aa 0d a0
68 4c 0b 34 54
.....M-...hL.4T
0380 92 24 ef 70 5
f 00 45 34 55 7b c2
48 e1 04 e7 b3 .
$.p_.E4U{.H....
0390 2b 06 98 53 2
4 72 5d d2 b1 96 6a
b5 88 c1 d8 54 +
..S$r]...j....T
03a0 3d 2b 30 e9 3
8 61 86 d6 8d 46 8d
75 4b 51 b3 1b =
+0.8a...F.uKQ..

03b0 67 54 f7 7d 7
1 74 b5 17 57 92 a9
95 3c 7b 52 34 g
T.}qt..W...<{R4
03c0 8b d2 a1 56 a
1 ca bd 7a ff fb 92
04 e9 0f f3 0b .
..V...z........
03d0 31 55 03 58 4
2 60 60 45 ca c0 65
e8 4c 0b a8 af 1
U.XB``E..e.L...
03e0 54 0c bc c9 8
1 6c 93 eb 01 86 2d
28 d6 fb 34 7f T
....l....-(..4.
03f0 f4 28 6b 08 0
4 d1 88 31 14 10 c3
10 99 58 58 36 .
(k....1.....XX6
0400 a3 6e 39 13 f
3 15 c5 fc 52 d2 2b
0b 5b 44 58 0f .
n9.....R.+.[DX.
0410 db 57 db d4 c
c 10 1c 20 d3 6a a7
ad b5 b6 35 67 .
W..... .j....5g
0420 2a 33 3b a3 7
7 98 60 6c ca bb cb
bb dc 7d da 76 *
3;.w.`l.....}.v
0430 79 dc 97 ba c
a e6 f7 e6 ce b5 6e
3c be 3e a9 ac y
.........n<.>..
0440 2e 7c 32 f7 8
d b2 56 a2 cd 37 8c
fd 6c 5f ab 2e .
|2...V..7..l_..
0450 83 29 3e 07 f
0 23 52 21 d2 54 b6
c2 37 d8 20 b0 .
)>..#R!.T..7. .
0460 a9 47 18 9e a
3 04 3e 4f ba 67 d1
c7 75 e1 e6 b7 .
G....>O.g..u...
0470 37 8c bb 73 c
d 82 01 80 e0 28 85
ba 3c e6 23 11 7
..s.....(..<.#.
0480 5b 12 2c ea 5
d f1 0c 78 c4 9b 72
02 21 2d 51 18 [
.,.]..x..r.!-Q.
0490 d4 b2 cd 58 5
2 12 b8 a5 77 28 74
d3 44 ec 89 ed .
..XR...w(t.D...
04a0 ed 70 e6 5f e
8 8d 95 26 a8 73 90
38 60 a8 f5 e9 .
p._...&.s.8`...
04b0 4d 6c 51 4d 0
a 2b 0b 0f 20 4e 54
ad 15 47 96 65 M
lQM.+.. NT..G.e
04c0 13 58 2a 98 b

1 23 2f 18 1b 02 fd
5e cd 02 32 1e .
X*..#/....^..2.
04d0 aa 57 11 0c 2
f a7 9d 95 f3 39 44
c9 0b 0c f6 08 .
W../....9D.....
04e0 41 ac 9d 8c 2
6 f3 14 3e bc 43 db
84 81 cb 0f c5 A
...&..>.C......
04f0 3a 8a 90 6a 4
c 56 a9 6b 50 b7 46
55 4c 37 71 73 :
..jLV.kP.FUL7qs
0500 03 08 02 a1 0
6 1e 76 05 22 c0 85
69 2c 44 f3 d0 .
.....v."..i,D..
0510 8e c2 65 7e b
f e2 d5
.
.e~...
No. Time
Source
Destination
Protocol
Length Info
90 3.213299000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=53088 Win=41277 Le
n=0
Frame 90: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.263229000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.263229000 s
econds
[Time delta fro
m previous captured
frame: 0.000176000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017600
0 seconds]
[Time since ref

erence or first fra

me: 3.213299000 sec
onds]
Frame Number: 9
0
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4

Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f3b (20283)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 53088
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le

n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 53088 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41277
[Calculated win
dow size: 41277]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 89]
[The RTT to
ACK the segment wa
s: 0.000176000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .

.;....`n.dx..E.
0010 00 28 4f 3b 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O;@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 31 8d 50 10 .
....P..N.+.1.P.
0030 a1 3d 18 d4 0
0 00
.
=....
No. Time
Source
Destination
Protocol
Length Info
91 3.224127000
Netgear_2e:1a:0
9
Broadcast
HomePlug
AV 60 MAC Manag
ement, Get Bridge I
nformations Confirm
ation
Frame 91: 60 bytes
on wire (480 bits),
60 bytes captured
(480 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.274057000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.274057000 s
econds
[Time delta fro
m previous captured
frame: 0.010828000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01082800
0 seconds]
[Time since ref
erence or first fra
me: 3.224127000 sec
onds]
Frame Number: 9
1
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke

d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:homeplug-av]
[Coloring Rule
Name: Broadcast]
[Coloring Rule
String: eth[0] & 1]
Ethernet II, Src: N
etgear_2e:1a:09 (20
:0c:c8:2e:1a:09), D
st: Broadcast (ff:f
f:ff:ff:ff:ff)
Destination: Br
oadcast (ff:ff:ff:f
f:ff:ff)
Address: Br
oadcast (ff:ff:ff:f
f:ff:ff)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f
actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Netgear
_2e:1a:09 (20:0c:c8
:2e:1a:09)
Address: Ne
tgear_2e:1a:09 (20:
0c:c8:2e:1a:09)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: Homeplug
AV (0x88e1)
HomePlug AV protoco
l
MAC Management
Header
.... ...1 =
Version: 1.1 (1)
Type: Get B
ridge Informations
Confirmation (0x602
1)
.... ..
01 = LSB: Confirm (
0x01)
.... .0
0. = MSB: STA - Cen
tral Coordinator (0
x00)
Fragmentati
on Info: 0x0000
.... 00

00 = Fragment count
:0
0000 ..
.. = Fragment index
:0
Fragmen
t Sequence number:
0
Get Bridge Info
rmations Confirmati
on
Bridging: T
rue
Bridge Term
inal Equipement Ide
ntifier: 5
Number of s
tations: 4
Bridged Des
tination Address: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1)
Bridged Des
tination Address: A
pple_86:da:3d (04:e
5:36:86:da:3d)
Bridged Des
tination Address: H
onHaiPr_be:71:b9 (8
4:4b:f5:be:71:b9)
Bridged Des
tination Address: H
onHaiPr_c9:0e:4a (0
0:1f:3a:c9:0e:4a)
0000 ff ff ff ff f
f ff 20 0c c8 2e 1a
09 88 e1 01 21 .
..... ........!
0010 60 00 00 01 0
5 04 90 01 3b d0 17
e1 04 e5 36 86 `
.......;.....6.
0020 da 3d 84 4b f
5 be 71 b9 00 1f 3a
c9 0e 4a 00 00 .
=.K..q...:..J..
0030 00 00 00 00 0
0 00 00 00 00 00 00
00
.
...........
No. Time
Source
Destination
Protocol
Length Info
92 3.314128000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=53088
Ack=1 Win=46 Len=1
260
Frame 92: 1314 byte
s on wire (10512 bi

ts), 1314 bytes cap

tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.364058000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.364058000 s
econds
[Time delta fro
m previous captured
frame: 0.090001000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09000100
0 seconds]
[Time since ref
erence or first fra
me: 3.314128000 sec
onds]
Frame Number: 9
2
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1a3 (61859)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum

: 0x3a87 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 53088, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 53088 (relativ
e sequence number)
[Next sequence
number: 54348 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xacd
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 a3 4
0 00 31 06 3a 87 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 31 8d 9e
87 4e aa 50 10 .
..P..+.1...N.P.
0030 00 2e ac da 0
0 00 67 22 31 0e fd
42 d0 2a c5 84 .
.....g"1..B.*..
0040 4e 33 dc 85 1
9 30 54 ca 51 1c 8c
15 69 0e d0 40 N
3...0T.Q...i..@
0050 b4 ee 75 c8 2
9 d3 95 cf dc ca 95
bb 2b 5c c5 1c .
.u.).......+\..
0060 31 52 97 1a e
2 73 ad 16 43 42 2c
0f be 90 b5 51 1
R...s..CB,....Q
0070 51 58 47 96 3
d e7 6e 9b ed 36 fe
7f 0b 8c 31 f7 Q
XG.=.n..6....1.
0080 3a 6a 5b b6 9
0 e1 af 96 59 ff fb
92 04 eb 0f f2 :
j[.....Y.......
0090 e9 2c 54 83 2
f 42 60 5e c6 9a b0
61 e6 5c 0c 90 .
,T./B`^...a.\..
00a0 d9 50 0c e1 0
b 81 88 18 6a 41 87
a1 30 77 18 0a .

P......jA..0w..
00b0 35 c5 a2 42 9
b 24 28 ea 7e 56 90
5f 69 e0 b0 aa 5
..B.$(.~V._i...
00c0 a5 12 4d 18 9
a ff 65 53 33 41 10
b4 56 35 b8 f2 .
.M...eS3A..V5..
00d0 46 e7 8b c7 f
1 ab 58 ac aa 37 8f
f1 f8 0b 08 52 F
.....X..7.....R
00e0 64 c5 9f 34 a
2 87 c4 d1 29 d5 aa
6d 45 b6 3d 59 d
..4....)..mE.=Y
00f0 2b 8a 9e 96 f
2 30 31 b0 eb 04 e4
10 7d 8c 8b 9d +
....01.....}...
0100 b1 ef ac 34 2
4 bd 5a 5f dc 35 55
6c b7 fb a9 5c .
..4$.Z_.5Ul...\
0110 80 d0 09 ee 0
8 2c 2a 40 5c 44 04
9c 48 3a a3 27 .
....,*@\D..H:.'
0120 b2 48 4b c6 b
b c4 67 9e b1 4f 49
4b 3e e9 4b 6b .
HK...g..OIK>.Kk
0130 bb f2 a9 f9 f
8 0d 33 ad 1d 9e 46
5e cd 20 88 98 .
.....3...F^. ..
0140 fd eb ae d6 c
d 0c e7 f1 84 ec c5
bd 15 f5 77 f5 .
.............w.
0150 a9 5b b6 87 1
c 28 13 75 11 18 5a
a3 16 b3 cc de .
[...(.u..Z.....
0160 f1 25 ab ff b
1 ff c7 69 4d 7e fe
87 71 bf 04 fd .
%.....iM~..q...
0170 15 da 11 8c 4
9 30 a7 9f f4 41 53
b2 e5 9c 23 04 .
...I0...AS...#.
0180 4b 23 cb 69 d
b 93 c3 17 55 72 8e
c0 a8 62 15 99 K
#.i....Ur...b..
0190 11 59 2a 85 2
7 8d 5c c7 f3 2c 3e
8c 1e 86 42 b3 .
Y*.'.\..,>...B.
01a0 da e7 fa 86 b
b 38 61 74 d9 ea 6a
0f c0 d3 ae 60 .
....8at..j....`
01b0 b0 b1 67 90 1
c 09 3c 3e 41 c8 1a
2c e6 b7 39 12 .
.g...<>A..,..9.

01c0 8a 16 4c 28 c
5 3c 77 6b eb fa 19
4f 42 43 81 0a .
.L(.<wk...OBC..
01d0 43 94 a0 20 2
2 aa 82 88 88 c1 19
c4 a5 e0 07 04 C
.. "...........
01e0 29 cb 95 0b a
0 6a 09 b3 82 18 a5
6e 7a 5d 15 08 )
....j.....nz]..
01f0 bb 3c 55 32 0
5 a5 08 53 21 b0 60
42 a3 f5 20 b5 .
<U2...S!.`B.. .
0200 42 72 83 67 9
a 85 13 73 ef ea 33
06 6d 69 37 7a B
r.g...s..3.mi7z
0210 e7 1a f6 ee 1
0 a9 aa 5f 14 d5 a5
f9 91 81 50 19 .
......_......P.
0220 f0 5c 54 88 8
8 02 f0 34 fa 25 18
ff fb 92 04 e8 .
\T....4.%......
0230 8f f2 f0 2b d
4 03 38 4a 60 57 05
2a b0 61 e8 4c .
..+..8J`W.*.a.L
0240 0b 90 8b 50 0
c e1 89 49 84 93 ea
81 87 ad 28 b5 .
..P...I......(.
0250 1d 76 ff ed a
f b3 5a aa 5b 0d a2
64 17 80 42 b9 .
v....Z.[..d..B.
0260 00 39 ca f0 4
0 4b 11 2d bd 24 e1
ee ce a5 9d fe .
9..@K.-.$......
0270 8d c8 96 b3 9
4 45 c2 75 f1 cb 58
2a 2d 69 c4 64 .
....E.u..X*-i.d
0280 db 56 ab 75 5
0 28 a2 41 db 20 92
84 26 b6 7a 8a .
V.uP(.A. ..&.z.
0290 19 b3 10 ad c
5 c0 ed 05 79 48 e2
69 ef 57 a7 8f .
.......yH.i.W..
02a0 ba e2 6f 9a f
1 b4 a0 4a 77 6b 0c
8f 16 2d 8e b0 .
.o....Jwk...-..
02b0 85 f8 b5 af f
7 77 d2 83 02 35 0d
46 58 c8 34 76 .
....w...5.FX.4v
02c0 0e a0 c5 7e a
6 70 84 23 80 9e c6
3f 42 44 1d 32 .
..~.p.#...?BD.2
02d0 5e 64 4c 16 e

4 6b 7b 42 b3 6f 51
20 e8 3b 4e 6f ^
dL..k{B.oQ .;No
02e0 19 ef ad 3a 0
1 34 62 2b 47 4b 2d
81 85 9b 37 25 .
..:.4b+GK-...7%
02f0 2e fb 61 b5 3
a 99 4a e7 a6 c7 ef
f6 fb 4e 2c ec .
.a.:.J......N,.
0300 4b 64 06 4f 6
1 7d 3d d9 69 dd 5b
7f ec 7d d4 f3 K
d.Oa}=.i.[..}..
0310 a1 ed 32 17 7
8 08 28 0e 15 42 1d
5a da 99 bb 48 .
.2.x.(..B.Z...H
0320 fc 3c 0b ec 5
b 11 25 82 8a ab 9e
8e 2d e8 8b e1 .
<..[.%.....-...
0330 b2 76 b4 82 a
8 ed 03 33 4c cd d8
d2 06 99 a9 c5 .
v.....3L.......
0340 82 c4 74 1f c
b b9 91 24 b7 b7 c3
23 96 9f 94 56 .
.t....$...#...V
0350 36 6c 1e 51 0
8 b1 01 18 2a 9a c3
d2 c2 a1 99 0b 6
l.Q....*.......
0360 10 ea 12 65 c
9 dc 93 bf ff bb ff
ae 2f 60 ab 27 .
..e......../`.'
0370 2d 60 43 4b 4
a d6 06 0b 04 5c 5a
91 93 53 c5 87 `CKJ....\Z..S..
0380 4b 9a d1 80 e
a ea 3d 15 b0 c4 23
12 f7 16 00 94 K
.....=...#.....
0390 c5 ac 4b ad b
1 19 64 cd 79 1c 6e
57 95 13 5b 9e .
.K...d.y.nW..[.
03a0 c7 55 2a de 9
2 44 06 44 68 d7 a7
34 f1 e1 de bb .
U*..D.Dh..4....
03b0 5a bb 27 6a 4
7 9f 77 2e e7 31 5b
e6 a1 b7 0c 7c Z
.'jG.w..1[....|
03c0 54 b9 7b db 7
1 0a b9 b2 82 f8 f4
53 bd ff fb 92 T
.{.q......S....
03d0 04 ee 0f f3 2
d 28 d3 83 4f 7a 50
60 46 ca 90 61 .
...-(..OzP`F..a
03e0 e8 5c 0b 5c 9
f 50 0c bd 89 49 68

11 6a 41 87 a5 .
\.\.P...Ih.jA..
03f0 28 8e fd 3e f
3 f6 7f 52 72 16 25
38 dd 18 3c a8 (
..>...Rr.%8..<.
0400 41 ac 34 0e 0
e b5 10 c9 21 7a d7
76 db 81 8c 7f A
.4.....!z.v....
0410 bc 3c 27 0a 1
c 14 8b 13 b2 e6 a6
8a cc 6f 25 15 .
<'..........o%.
0420 0c 32 f5 bc f
e 7b 1e 16 91 e3 c6
51 84 9e 23 99 .
2...{.....Q..#.
0430 63 75 08 d4 e
1 0c 3b 35 60 6a 58
c9 91 a7 3e b1 c
u....;5`jX...>.
0440 c5 12 b7 eb 0
7 42 25 45 75 17 8c
eb 5e f9 dc 99 .
....B%Eu...^...
0450 cd a1 ed d2 f
9 3a f4 5e cc bb 77
7d 0e 00 53 f4 .
....:.^..w}..S.
0460 98 10 90 83 4
9 86 9b 87 b4 65 c8
11 0e ac 6b 57 .
...I....e....kW
0470 1b c0 56 48 6
8 28 63 28 97 5d aa
d5 6f 21 e8 ed .
.VHh(c(.]..o!..
0480 25 eb 4b 5a 0
a 75 79 2b 81 2d 62
40 82 40 0c 27 %
.KZ.uy+.-b@.@.'
0490 7b da c1 da b
0 fa b4 44 26 6b ea
93 c8 6b 33 51 {
......D&k...k3Q
04a0 0e 4e a6 49 7
f 0d fd f9 e6 77 2e
74 c5 21 6c 42 .
N.I.....w.t.!lB
04b0 8b 98 15 40 f
7 d5 56 af 54 10 60
42 5d 2a 65 d6 .
..@..V.T.`B]*e.
04c0 9f 0c 29 69 3
0 84 7d 0b 20 94 bc
5c 83 25 1f 01 .
.)i0.}. ..\.%..
04d0 5b 28 6d 46 5
6 ab 90 d5 25 e8 c9
b2 3d 20 15 7b [
(mFV...%...= .{
04e0 48 2a 4a 81 a
1 92 97 4b ca 85 52
0c 92 63 34 75 H
*J....K..R..c4u
04f0 29 32 a9 59 6
c 51 c3 d5 c2 5a dd
2b 0b 20 55 22 )

2.YlQ...Z.+. U"
0500 60 ab c8 1f 6
3 9e 27 ac 1b dc 89
d6 4a 7f e8 f5 `
...c.'.....J...
0510 df eb 69 26 4
4 20 ad 4b 8e 1c 88
c0 41 44 0d 98 .
.i&D .K....AD..
0520 c3 97
.
.
No. Time
Source
Destination
Protocol
Length Info
93 3.361132000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
885 http49
574 [PSH, ACK] Seq=
54348 Ack=1 Win=46
Len=831
Frame 93: 885 bytes
on wire (7080 bits
), 885 bytes captur
ed (7080 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.411062000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.411062000 s
econds
[Time delta fro
m previous captured
frame: 0.047004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04700400
0 seconds]
[Time since ref
erence or first fra
me: 3.361132000 sec
onds]
Frame Number: 9
3
Frame Length: 8
85 bytes (7080 bits
)
Capture Length:
885 bytes (7080 bi

ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
71
Identification:
0xf1a4 (61860)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c33 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 54348, Ack: 1
, Len: 831
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 831]
Sequence number
: 54348 (relativ
e sequence number)
[Next sequence
number: 55179 (r
elative sequence nu
mber)]

Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x769
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2091]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 67 f1 a4 4
0 00 31 06 3c 33 4a
7c 0c 8a c0 a8 .
g..@.1.<3J|....
0020 01 0b 00 50 c
1 a6 2b c9 36 79 9e
87 4e aa 50 18 .
..P..+.6y..N.P.

0030 00 2e 76 90 0
0 00 06 20 4d 32 63
de 91 92 9c 59 .
.v.... M2c....Y
0040 11 e8 f4 a5 2
4 61 e6 46 ec 41 d1
78 8b f7 18 9c .
...$a.F.A.x....
0050 8f c7 61 b6 0
d ee 9c 62 5c 08 4f
0f bd aa 4b 48 .
.a....b\.O...KH
0060 c0 a4 e9 70 9
e de c3 b4 5f 0d 2e
1f 9c 64 9b bf .
..p...._....d..
0070 29 2b 67 17 f
a 65 25 ab 44 1e 96
e7 ac 18 8c 17 )
+g..e%.D.......
0080 60 37 51 ff f
b 92 04 ef 8f f3 3d
33 53 83 38 5a `
7Q.......=3S.8Z
0090 e0 64 c6 da 7
0 65 e8 5c 0b 88 b3
4e 0c e1 69 81 .
d..pe.\...N..i.
00a0 65 91 ea 01 9
7 a5 28 57 3d 69 3a
e7 db be cf d6 e
.....(W=i:.....
00b0 bb c8 58 90 7
0 e9 24 50 85 d1 03
09 77 92 b0 93 .
.X.p.$P....w...
00c0 02 a9 59 08 1
9 85 d1 b1 ca c9 58
88 b7 ca b7 ad .
.Y.......X.....
00d0 ae e2 ae 14 2
e c9 60 c9 34 33 ab
87 52 d2 8c f8 .
.....`.43..R...
00e0 7f 4f a2 54 9
6 6d 6b 5a b6 d3 d9
b5 ab f3 ab 1a .
O.T.mkZ........
00f0 83 cc ae 25 6
8 32 2e 44 44 bc 5d
2f 00 1a 25 72 .
..%h2.DD.]/..%r
0100 d2 12 ad ba 7
7 22 ab 69 af a5 09
ee ef fc 89 7d .
...w".i.......}
0110 5f 83 9f 10 8
6 d0 12 0d 0c aa c1
c3 13 1e 0a 98 _
...............
0120 e8 06 26 9a 8
9 b9 a3 1e df 3a 6c
1f 76 5b 19 64 .
.&......:l.v[.d
0130 af ec e3 67 c
9 db 57 10 58 4e 6c
5d 29 34 72 0e .
..g..W.XNl])4r.
0140 9b 87 97 62 1

5 8e b0 43 c2 c9 22
59 a2 64 28 ec .
..b...C.."Y.d(.
0150 76 f9 a7 47 4
d 7e 6e c3 f1 3d 6e
99 9f 6a 18 a4 v
..GM~n..=n..j..
0160 92 44 80 fd 8
3 00 c5 da c6 8a ab
42 10 ae 41 ba .
D.........B..A.
0170 88 a8 35 49 1
5 28 a8 1c f4 a8 a0
84 ad 61 ca 00 .
.5I.(.......a..
0180 11 5e ba 20 4
2 72 ab 66 82 0b 37
25 3a f4 88 4b .
^. Br.f..7%:..K
0190 45 f6 f8 2c 9
1 6a 75 b9 10 ec c1
0e 43 01 4f c8 E
..,.ju.....C.O.
01a0 14 2c 2e a0 d
0 46 6f 10 03 92 3c
1d 1c a3 8b 23 .
,...Fo...<....#
01b0 8a 81 01 97 4
9 f5 1e 4f b6 df 2e
d7 f7 f8 d2 ad .
...I..O........
01c0 7a 96 71 e7 4
c 2e a5 4d 31 e6 be
ca 7f bf 64 ad z
.q.L..M1.....d.
01d0 41 56 40 73 c
2 18 d0 a4 02 c8 02
96 78 c3 8c 77 A
V@s........x..w
01e0 1e 36 ac 67 2
4 82 6d 79 2e 18 9c
d4 6d 93 4e d2 .
6.g$.my....m.N.
01f0 72 d5 98 0a 1
5 da 37 66 62 1c 6a
71 97 9b 1d 02 r
.....7fb.jq....
0200 a0 12 c6 d5 f
a 98 d1 1c c9 c7 72
74 50 7a 54 54 .
.........rtPzTT
0210 aa b0 24 69 9
9 7b 1a 64 ad 7a 85
46 b0 96 3f f9 .
.$i.{.d.z.F..?.
0220 c7 3e e7 f5 a
f ff fb 92 04 ed 8f
f3 34 2c 53 03 .
>..........4,S.
0230 38 5a 60 5e 2
4 6a 80 61 ec 4a 0c
04 a3 4c 0c e1 8
Z`^$j.a.J...L..
0240 89 41 83 98 6
9 c1 97 a1 30 89 4b
9f 08 50 71 1b .
A..i...0.K..Pq.
0250 f8 df 5a ed 2
a dc 1d 30 70 49 12

9f 54 40 a0 d4 .
.Z.*..0pI..T@..
0260 e9 e1 8c 00 e
9 92 20 99 84 61 84
e0 d8 8a 3a ba .
..... ..a....:.
0270 35 69 46 8a 9
e cb bd 3f 72 3e e3
cd 9a 35 8c a5 5
iF....?r>...5..
0280 9b ff 0d 86 5
7 58 7c ef e2 24 91
e9 bb ac de 98 .
...WX|..$......
0290 f7 f9 fd ec 7
f fd bf f5 9c da 0a
1b 10 5a 08 c3 .
............Z..
02a0 ca 6e 7a ce d
5 7d ff 5b 6c fe af
fe 95 31 30 04 .
nz..}.[l....10.
02b0 05 26 33 a1 4
0 84 24 83 01 92 91
11 07 51 06 7e .
&3.@.$......Q.~
02c0 00 1d 2c 94 4
6 30 e1 b8 0c 11 25
01 c9 7c 9d 46 .
.,.F0....%..|.F
02d0 56 af 21 2c a
9 f3 b7 5a 83 6d 82
27 c7 5e 92 f1 V
.!,...Z.m.'.^..
02e0 50 19 d1 f5 6
6 b7 26 68 07 95 f2
ed 81 c1 9a a9 P
...f.&h........
02f0 bc c6 82 62 4
d 9c 42 87 f1 12 78
51 33 67 fa f6 .
..bM.B...xQ3g..
0300 6c 93 ef fc c
9 27 cd 73 f5 ed f5
98 6a 6e a3 4b l
....'.s....jn.K
0310 c3 e9 ca 3b 7
1 9c f0 54 b5 60 4b
36 e6 9d 08 f7 .
..;q..T.`K6....
0320 19 9b 10 16 2
9 11 41 51 20 c6 20
9a 04 a5 90 50 .
...).AQ . ....P
0330 34 fa 19 74 a
a 15 7d d3 86 20 21
32 e5 d2 fd 18 4
..t..}.. !2....
0340 1c 0e cb 3d 3
a 7b 76 0a 0d 12 4f
9c b7 6d ff 18 .
..=:{v...O..m..
0350 41 f6 55 b3 4
9 db 79 ed 7e 96 e9
96 e3 f2 aa 4b A
.U.I.y.~......K
0360 42 e5 cb a5 4
2 00 73 1d 7d 04 9c
86 f2 e9 f5 df B

...B.s.}.......
0370 8a bb 3f 77 a
5
.
.?w.
No. Time
Source
Destination
Protocol
Length Info
94 3.361313000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=55179 Win=41580 Le
n=0
Frame 94: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.411243000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.411243000 s
econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 3.361313000 sec
onds]
Frame Number: 9
4
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 4
0
Identification:
0x4f3c (20284)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 55179
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 55179 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t

.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41580
[Calculated win
dow size: 41580]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 93]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 3c 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O<@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 39 b8 50 10 .
....P..N.+.9.P.
0030 a2 6c 18 d4 0
0 00
.
l....
No. Time
Source
Destination
Protocol

Length Info
95 3.460008000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=55179
Ack=1 Win=46 Len=1
260
Frame 95: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.509938000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.509938000 s
econds
[Time delta fro
m previous captured
frame: 0.098695000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09869500
0 seconds]
[Time since ref
erence or first fra
me: 3.460008000 sec
onds]
Frame Number: 9
5
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64

:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1a5 (61861)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a85 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 55179, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 55179 (relativ
e sequence number)
[Next sequence
number: 56439 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set

.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf9f
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 a5 4
0 00 31 06 3a 85 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 39 b8 9e
87 4e aa 50 10 .
..P..+.9...N.P.
0030 00 2e f9 fe 0
0 00 7c 82 90 1a 42
08 94 4f f2 62 .
.....|...B..O.b
0040 d3 98 b7 8c 6
c d2 58 ec 08 d3 37
8e ae 47 1d cb .
...l.X...7..G..
0050 6c 0c 4d af 4
7 20 45 de ee 33 c9
97 5e ba b7 bd l
.M.G E..3..^...
0060 f1 30 1c 02 0
2 84 15 6a 14 8a 17
12 9e 92 c4 bd .
0.....j........
0070 d3 1e 23 a8 9
e 31 53 d2 9e 9e 12

5b 5b 9d 37 36 .
.#..1S....[[.76
0080 90 a9 21 77 8
f 93 05 d7 ff fb 92
04 e9 8f f2 f5 .
.!w............
0090 2f 53 03 58 4
a 60 59 e4 fa 70 65
ef 4a 0c 9c c3 /
S.XJ`Y..pe.J...
00a0 4a 0d 61 e9 8
1 8d 93 e9 81 9c 31
28 e3 5e 17 7f J
.a.......1(.^..
00b0 67 a9 c7 fe 8
5 fc bf a7 fe a6 b2
4a c3 e1 10 4a g
..........J...J
00c0 8d 4a c6 f5 3
7 65 b8 c0 89 c0 28
14 69 05 78 76 .
J..7e....(.i.xv
00d0 9b 86 ba b4 1
a 49 85 2b e7 14 4a
bd 0b 7e 7a a3 .
....I.+..J..~z.
00e0 0e 62 60 50 c
b 4b 20 2c 48 0c 62
35 cd 20 18 8b .
b`P.K ,H.b5. ..
00f0 62 a6 3e 59 8
7 ce 68 98 7e 47 61
fd 46 2f 1a 24 b
.>Y..h.~Ga.F/.$
0100 70 2d 17 20 5
0 f5 0b 28 4b 26 b5
1c 52 cd 3a 16 p
-. P..(K&..R.:.
0110 fe 4f b3 bf d
3 f8 7f fa ac b5 e0
e5 1d 00 58 85 .
O............X.
0120 33 94 b0 d3 2
8 94 5c d3 a8 5b 2b
f7 25 0a e9 85 3
...(.\..[+.%...
0130 93 0e 6a 15 7
9 5b 05 db a6 f9 e1
6f 10 22 3e 8f .
.j.y[.....o.">.
0140 88 82 06 40 8
0 f4 37 5c cb 2d 20
db 91 ba 8e bb .
..@..7\.- .....
0150 dc e6 cb df f
4 b7 db 86 68 86 68
6f 1c cc 5b 14 .
.......h.ho..[.
0160 e5 20 20 e7 a
2 4d 62 44 53 4d 65
85 cf f7 f7 df .
..MbDSMe.....
0170 38 8f ce 36 f
e a4 44 5a da 69 09
a1 4c b1 65 ce 8
..6..DZ.i..L.e.
0180 74 3f 23 00 3
4 a5 77 5d f6 49 4c
be 8d 52 82 db t

?#.4.w].IL..R..
0190 64 94 13 c5 e
6 2b 16 c6 14 7b 6a
91 06 0f 30 80 d
....+...{j...0.
01a0 d3 9f b7 29 9
d 59 99 33 0d 9d be
73 6e 26 43 62 .
..).Y.3...sn&Cb
01b0 8d 2e 0f 8c 0
0 02 07 01 07 1c 1e
c1 00 cd 95 ae .
...............
01c0 7d 2a 43 d6 a
3 7e 51 02 7e 99 c6
be ad 4e e6 63 }
*C..~Q.~....N.c
01d0 7a d5 4e 88 c
0 2e 81 2a d4 74 17
c2 12 91 04 cb z
.N....*.t......
01e0 3a 60 54 b1 d
c 48 bd 32 3b d4 a4
40 1f 76 35 17 :
`T..H.2;..@.v5.
01f0 37 d9 a2 13 0
e ba c9 fb d2 b1 98
2c 14 08 c5 52 7
..........,...R
0200 14 b4 23 0b 0
9 91 d5 ae c8 e4 2a
ca 64 25 5e db .
.#.......*.d%^.
0210 b5 66 ac b7 5
2 48 74 18 00 6a d3
22 30 ee 2d 63 .
f..RHt..j."0.-c
0220 42 2a 82 d5 2
a d7 d6 43 2a 9b ff
fb 92 04 e8 0f B
*..*..C*.......
0230 f2 fc 27 54 8
3 38 42 50 5e c4 6a
90 61 e9 4a 0b .
.'T.8BP^.j.a.J.
0240 bc b5 60 0c 3
c c9 81 6c 90 2b c1
86 25 28 1d d4 .
.`.<..l.+..%(..
0250 67 cb c0 6c 1
3 a7 45 84 5d 86 a3
5b 3a 90 b8 1e g
..l..E.]..[:...
0260 aa 95 67 02 6
2 c7 0f 16 37 63 2b
d2 03 89 6e e8 .
.g.b...7c+...n.
0270 93 9b bf 90 5
1 58 a2 c2 ef 48 1a
76 18 33 31 e3 .
...QX...H.v.31.
0280 1f b4 65 6a b
4 92 4c 81 10 54 28
09 05 8d 28 0a .
.ej..L..T(...(.
0290 5d 4b 2a 93 4
2 04 1e 14 89 d8 83
42 ba d6 38 06 ]
K*.B......B..8.

02a0 e3 ec 05 55 4
b 06 93 7a 04 99 6b
d5 f0 8a 5a c6 .
..UK..z..k...Z.
02b0 72 11 8c 41 3
8 08 f8 82 9d 26 ea
b2 00 6d 35 21 r
..A8....&...m5!
02c0 d4 bb 44 e6 5
1 14 0e cd 04 4d 20
50 56 89 11 a6 .
.D.Q....M PV...
02d0 e9 2d 29 b1 e
9 20 2a 47 af 82 04
88 ac b7 a7 99 .
-).. *G........
02e0 d9 ec bf 08 8
8 72 49 47 63 2f e8
22 7d 3f 4e 21 .
....rIGc/."}?N!
02f0 39 08 0e 3c 2
e b0 b9 90 23 4e 3c
50 4c 75 ee 0a 9
..<....#N<PLu..
0300 3c 06 a9 73 2
2 e9 4d ca 69 04 c8
63 93 a9 29 55 <
..s".M.i..c..)U
0310 57 d1 62 e2 3
9 84 b9 9a 72 9f b0
e2 13 e4 51 d4 W
.b.9...r.....Q.
0320 f2 e0 a1 53 2
f 20 db 41 10 da 48
05 64 48 8f b7 .
..S/ .A..H.dH..
0330 49 48 a6 c6 6
c 0a 0e 91 c9 f0 30
43 44 d4 bf 78 I
H..l.....0CD..x
0340 e9 d5 b3 fa 9
f fa f1 d7 90 c5 ad
f7 1f bf 31 57 .
.............1W
0350 af ae d9 da 3
1 7e 49 87 42 eb 07
cc 81 1a 31 e1 .
...1~I.B.....1.
0360 02 cd 78 d7 b
c d9 49 32 66 dc d5
2d 4b 4a 8e 80 .
.x...I2f..-KJ..
0370 df f5 30 9a 2
8 9e 6a d5 20 70 13
24 2c 99 9a d1 .
.0.(.j. p.$,...
0380 9a 5b 87 39 2
a 67 e0 c3 bb 99 30
9b 05 c4 44 7d .
[.9*g....0...D}
0390 35 a4 8e 46 d
4 6e 2a 32 43 88 63
10 86 18 c8 84 5
..F.n*2C.c.....
03a0 40 a2 ba 03 8
2 6d 52 69 b2 32 86
3e 48 c5 92 a1 @
....mRi.2.>H...
03b0 05 b7 ce ba e

9 8d 88 db 60 8a e1
e2 67 fc 27 89 .
.......`...g.'.
03c0 c5 e7 5d a1 d
f 3c 9c 5e fe df bb
ff ff fb 92 04 .
.]..<.^........
03d0 eb 0f f2 f9 3
3 59 01 ec 2a e0 5c
43 db 20 3d 86 .
...3Y..*.\C. =.
03e0 4a 0c 10 cb 6
8 07 a4 6b 81 95 99
6c c0 f4 99 70 J
...h..k...l...p
03f0 fe e9 5f 47 f
4 a3 8a 4f cb 19 d6
85 3e 7a f9 26 .
._G...O....>z.&
0400 42 55 ff a3 4
c 5b 31 56 0b 96 3b
89 a4 b2 3d 36 B
U..L[1V..;...=6
0410 a3 71 52 30 9
a 07 6a 19 b4 bc e8
30 1a 5d c4 f8 .
qR0..j....0.]..
0420 a7 35 47 78 f
5 1d e3 79 4c c9 63
62 30 a9 af a9 .
5Gx...yL.cb0...
0430 ee 38 ba e0 d
6 f2 34 a3 99 b7 f1
1b 6a a2 6d eb .
8....4.....j.m.
0440 c3 77 7f 7f 9
b bf 95 d2 ee ff 3e
ff af d0 c1 47 .
w........>....G
0450 88 b9 2e 1f 4
7 db d4 35 1a 38 25
99 02 12 31 f6 .
...G..5.8%...1.
0460 80 dc 87 13 9
9 51 40 4d 69 aa 60
8e 76 86 69 4b .
....Q@Mi.`.v.iK
0470 13 b5 50 ac a
1 98 9d 38 0f 6d bf
32 8a a7 89 68 .
.P....8.m.2...h
0480 8b 3a dd d0 f
e 35 59 dd a2 1b a7
a8 11 f5 28 c9 .
:...5Y.......(.
0490 8f 4f b4 d0 e
4 5a 72 92 9c a6 96
ff f9 c2 a8 1a .
O...Zr.........
04a0 85 ee 50 e0 2
3 ec 7c 5a cd a9 39
3d ae 47 ac 90 .
.P.#.|Z..9=.G..
04b0 b1 03 0d 36 a
2 73 82 ba 42 62 c3
64 61 29 f8 cd .
..6.s..Bb.da)..
04c0 18 97 6f 4f 8
5 52 cc 70 3e bd c3

16 ae 97 e0 5d .
.oO.R.p>......]
04d0 c9 6a d9 ce 1
c 1e 54 c9 c0 f4 c5
e6 49 23 12 79 .
j....T.....I#.y
04e0 f5 90 91 0b 7
6 43 f6 a4 67 97 48
76 d4 f2 48 be .
...vC..g.Hv..H.
04f0 4a 39 0f 0f 6
c d1 e5 a7 34 e3 e6
e1 30 ed 8a 48 J
9..l...4...0..H
0500 75 27 c6 ba 8
1 51 a3 92 74 06 59
94 24 06 68 02 u
'...Q..t.Y.$.h.
0510 2d 55 13 ce 7
3 7d 4a 88 ac 1b 47
04 80 75 13 17 U..s}J...G..u..
0520 67 5f
g
_
No. Time
Source
Destination
Protocol
Length Info
96 3.509875000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
876 http49
574 [PSH, ACK] Seq=
56439 Ack=1 Win=46
Len=822
Frame 96: 876 bytes
on wire (7008 bits
), 876 bytes captur
ed (7008 bits) on i
nterface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.559805000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.559805000 s
econds
[Time delta fro
m previous captured
frame: 0.049867000
seconds]
[Time delta fro
m previous displaye

d frame: 0.04986700
0 seconds]
[Time since ref
erence or first fra
me: 3.509875000 sec
onds]
Frame Number: 9
6
Frame Length: 8
76 bytes (7008 bits
)
Capture Length:
876 bytes (7008 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co

m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
62
Identification:
0xf1a6 (61862)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c3a [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 56439, Ack: 1
, Len: 822
Source Port: ht
tp (80)

Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 822]
Sequence number
: 56439 (relativ
e sequence number)
[Next sequence
number: 57261 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc5d
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2082]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5e f1 a6 4
0 00 31 06 3c 3a 4a
7c 0c 8a c0 a8 .
^..@.1.<:J|....
0020 01 0b 00 50 c
1 a6 2b c9 3e a4 9e
87 4e aa 50 18 .
..P..+.>...N.P.
0030 00 2e c5 da 0
0 00 e5 11 a4 a1 ed
79 9b 0f d1 13 .
..........y....
0040 b9 27 44 32 2
5 1b 9c 30 ad c3 cd
ec 6e 8d 5a 96 .
'D2%..0....n.Z.
0050 65 41 ec e3 8
b 01 04 12 c2 e6 67
1e 0a 04 ce 68 e
A........g....h
0060 70 7d f8 4a 8
1 c1 17 14 a5 d9 4f
ea af 41 d5 9a p
}.J......O..A..
0070 36 14 b2 74 7
3 08 82 42 c7 0b 0b
91 69 c9 04 05 6
..ts..B....i...
0080 82 a2 ff fb 9
2 04 e9 0f f2 c6 2a
da 81 e9 1a 62 .
.........*....b
0090 58 e5 4b 40 3
d 26 4c 4c 24 f3 64
07 a4 cb 81 9e X
.K@=&LL$.d.....
00a0 9c 2c 40 f6 1
9 70 c9 53 c1 67 95
aa ff f5 30 b1 .
,@..p.S.g....0.
00b0 27 c5 b8 fe 5
3 d4 c3 6e 3d 20 31
ab a7 82 28 4d '
...S..n= 1...(M
00c0 2a 34 b2 88 4
7 59 15 0f a8 71 0f
8a 7d a4 6c 49 *
4..GY...q..}.lI
00d0 88 4a 2c 46 8
b dd 09 83 3c 4e 3c
55 f7 eb 2b 5d .
J,F....<N<U..+]
00e0 78 f2 bd af e
e 5e e3 7b 3c c5 fa
2d 7e b5 e7 b9 x
....^.{<..-~...
00f0 7c 00 50 f1 5
0 e3 c3 e7 07 28 b9
30 f9 69 c9 51 |
.P.P....(.0.i.Q
0100 51 e1 11 64 a
a 76 bd 3e 85 1d 25
0a b8 2d f2 0c Q
..d.v.>..%..-..

0110 32 5b 56 d9 5
8 30 b0 b8 28 61 e4
55 8b 51 38 39 2
[V.X0..(a.U.Q89
0120 ac 65 d1 0c 6
4 da d7 56 84 5c 9d
1c 6b 8e ab 68 .
e..d..V.\..k..h
0130 0e 2b 57 27 c
9 a7 3d ef b5 32 44
7c a8 ac a9 2b .
+W'..=..2D|...+
0140 23 1a 99 f7 f
d 56 be c4 33 e7 c6
c7 b6 e9 23 99 #
....V..3.....#.
0150 39 aa 7b 78 b
6 cd 77 65 87 0c a4
ec 98 2d c4 5e 9
.{x..we.....-.^
0160 4b e1 42 15 b
3 f5 f8 5a 07 db 6b
94 2b c2 c8 0e K
.B....Z..k.+...
0170 60 60 1f cb 6
c 23 ed 69 1a 86 04
45 71 46 54 75 `
`..l#.i...EqFTu
0180 10 22 14 ab 1
6 5a 68 6c c3 68 11
9a d1 32 25 64 .
"...Zhl.h...2%d
0190 f1 52 b7 09 6
8 58 e4 76 ef b5 31
d2 d8 a3 29 ae .
R..hX.v..1...).
01a0 3a 1a 63 4f b
d b2 4d b3 be 1a b3
e6 bd 63 32 44 :
.cO..M......c2D
01b0 55 e7 b2 2f e
6 2d b2 ad de d2 5d
35 ea d4 0a 34 U
../.-....]5...4
01c0 48 a8 2c f0 4
8 65 21 67 10 00 91
66 d7 d3 59 29 H
.,.He!g...f..Y)
01d0 ee 87 42 e7 9
0 1d 11 64 f7 9f 42
a4 87 61 e5 4b .
.B....d..B..a.K
01e0 41 13 c7 25 0
b c6 b1 00 bc 4b 12
b9 6c 6c 8b cc A
..%.....K..ll..
01f0 4f 96 74 39 6
8 34 6a 39 f7 1c bc
49 2d ba 0e 77 O
.t9h4j9...I-..w
0200 d7 66 d7 cc d
e 85 65 76 fe b2 de
f5 d8 fc fc a4 .
f....ev........
0210 34 02 25 12 0
a 07 20 ac 32 a4 bc
0c e8 ab 85 92 4
.%... .2.......
0220 e2 08 2c 33 f

f fb 92 04 ea 8f f2
f9 3a 58 03 0c .
.,3........:X..
0230 1a e0 5a 66 4
b 00 3d 26 5c 0c 54
e5 5c 0c 30 cb .
.ZfK.=&\.T.\.0.
0240 89 8b 1e 2b 4
0 f4 99 70 1c f2 ac
73 05 aa 5b 77 .
..+@..p...s..[w
0250 56 c8 55 58 5
2 0a 0e cc 18 a5 aa
06 e0 ac b3 74 V
.UXR..........t
0260 64 aa 07 47 5
7 16 d0 48 30 38 0e
03 28 91 26 7e d
..GW..H08..(.&~
0270 01 d1 12 8c 2
a ad 4f 03 c2 69 5d
b7 92 87 66 6b .
...*.O..i]...fk
0280 39 31 49 78 e
8 2c fe ec c8 54 33
36 7a ce d7 a6 9
1Ix.,...T36z...
0290 b2 79 18 d1 4
d 92 f3 1a c4 bf d9
47 94 7c 0e 13 .
y..M......G.|..
02a0 11 b5 47 c2 e
7 43 84 5c e2 a1 06
96 55 55 2c 8c .
.G..C.\....UU,.
02b0 8f 42 d1 64 6
7 b9 08 16 54 8b 2a
82 94 49 b6 2d .
B.dg...T.*..I.02c0 1a 68 f6 da 4
5 40 74 a9 93 b1 47
a2 49 a1 2e d5 .
h..E@t...G.I...
02d0 9a 7b 65 f2 1
d 42 87 08 32 4c 6a
1d cf 48 0a 3b .
{e..B..2Lj..H.;
02e0 f2 0b 86 9b 9
f b2 a5 b4 4c 63 3b
99 bb 51 bd 00 .
.......Lc;..Q..
02f0 5c 3a 60 b8 0
5 63 4b b0 4c 28 50
b8 ba c5 4f b1 \
:`..cK.L(P...O.
0300 41 60 33 1b 4
3 b1 cc d2 56 8e cf
fa 19 4b 02 06 A
`3.C...V....K..
0310 c0 08 16 b6 a
e 22 09 e9 16 c2 07
88 33 4b 31 0f .
...."......3K1.
0320 62 61 61 50 4
5 7a 92 57 da 1e 7b
d6 e8 8e 0f a0 b
aaPEz.W..{.....
0330 30 5b 1b 84 b
5 a7 fb c3 e6 2c 78

3d 51 c9 63 75 0
[.......,x=Q.cu
0340 34 96 46 b4 3
5 09 c6 31 cc 94 86
2c 34 0e aa e6 4
.F.5..1...,4...
0350 e6 47 4c e9 0
f 09 e9 f3 5b a6 f7
1e 96 51 61 11 .
GL.....[....Qa.
0360 f5 03 62 23 7
1 46 4e 27 b3 eb fa
95
.
.b#qFN'....
No. Time
Source
Destination
Protocol
Length Info
97 3.510046000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=57261 Win=41059 Le
n=0
Frame 97: 54 bytes
on wire (432 bits),
54 bytes captured
(432 bits) on inter
face 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.559976000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.559976000 s
econds
[Time delta fro
m previous captured
frame: 0.000171000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017100
0 seconds]
[Time since ref
erence or first fra
me: 3.510046000 sec
onds]
Frame Number: 9
7
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f3d (20285)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 57261
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 57261 (r
elative ack number)
Header Length:
20 bytes

.... 0000 0001

0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41059
[Calculated win
dow size: 41059]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 96]
[The RTT to
ACK the segment wa
s: 0.000171000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 3d 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O=@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 41 da 50 10 .
....P..N.+.A.P.

0030 a0 63 18 d4 0
0 00
.
c....
No. Time
Source
Destination
Protocol
Length Info
98 3.528135000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=57261
Ack=1 Win=46 Len=1
260
Frame 98: 1314 byte
s on wire (10512 bi
ts), 1314 bytes cap
tured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.578065000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.578065000 s
econds
[Time delta fro
m previous captured
frame: 0.018089000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01808900
0 seconds]
[Time since ref
erence or first fra
me: 3.528135000 sec
onds]
Frame Number: 9
8
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 1
300
Identification:
0xf1a7 (61863)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a83 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 57261, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 57261 (relativ
e sequence number)
[Next sequence
number: 58521 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .

... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x466
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 a7 4
0 00 31 06 3a 83 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 41 da 9e
87 4e aa 50 10 .
..P..+.A...N.P.
0030 00 2e 46 6c 0
0 00 66 29 54 72 a4
25 8b 57 05 0c .
.Fl..f)Tr.%.W..
0040 f9 40 e9 82 4
4 2b 9b c5 53 e3 dc
cb d1 7a 78 40 .
@..D+..S....zx@
0050 5f 33 e3 43 3

5 3b 77 13 0d 6e 71
08 ad 23 54 cb _
3.C5;w..nq..#T.
0060 c9 1b 44 9c 5
8 d8 8f c5 17 96 b1
5b 9f cf a4 d6 .
.D.X......[....
0070 cd 38 43 2a 5
5 b5 1c e5 b5 93 e0
93 81 00 7d 62 .
8C*U.........}b
0080 54 9d 05 10 f
2 65 64 96 b1 82 ac
09 30 d0 08 ea T
....ed.....0...
0090 ff fb 92 04 e
a 0f f2 f7 2c d6 83
0c 32 60 60 c6 .
.......,...2``.
00a0 8a c0 61 26 5
c 0b 54 99 58 0c 3c
c9 41 7c 1d 2a .
.a&\.T.X.<.A|.*
00b0 c1 87 a1 70 c
5 85 d7 c6 58 52 9f
f4 2d a4 a8 31 .
..p....XR..-..1
00c0 96 60 b9 20 1
2 58 23 f0 a8 93 a4
50 c5 c3 e5 a9 .
`. .X#....P....
00d0 2c 28 22 39 5
4 cf 4f 2d 31 16 27
ad 6d f8 cc 14 ,
("9T.O-1.'.m...
00e0 29 4a c7 36 2
3 32 a6 01 59 c0 73
81 cb 40 8f 43 )
J.6#2..Y.s..@.C
00f0 dc 5a 59 ba 3
3 d1 c9 a7 6d 05 2d
2a f5 ef 40 9d .
ZY.3...m.-*..@.
0100 ad e5 23 00 3
6 2e b2 7d 54 4e 39
b5 36 2e 9e 64 .
.#.6..}TN9.6..d
0110 18 45 85 bd 5
3 f4 c3 bd 5f f8 bb
ea 77 95 77 45 .
E..S..._...w.wE
0120 64 05 36 72 2
c 23 88 1a 0b 92 91
b0 00 04 a5 05 d
.6r,#..........
0130 96 a5 3f 99 1
e a9 14 e0 d2 b4 36
f3 f9 42 ac a6 .
.?.......6..B..
0140 88 cc 69 4c 9
f 68 ac d9 98 81 8b
87 c8 d9 ba 30 .
.iL.h.........0
0150 fc 7e 78 fe 9
b 30 8c 2f c5 69 3e
71 95 6c 26 cc .
~x..0./.i>q.l&.
0160 5b 24 54 55 e
8 0b 01 96 54 07 91

13 b5 23 1e 01 [
$TU....T....#..
0170 d8 c7 75 ad 7
e 7b a7 fd 6f ca 19
10 12 71 18 32 .
.u.~{..o....q.2
0180 49 77 df 52 0
4 5c a4 72 56 09 85
a8 6a a2 c2 f4 I
w.R.\.rV...j...
0190 ca 94 a2 9a 3
b 6e da 5e 6e 79 62
2a 56 1d c6 9b .
...;n.^nyb*V...
01a0 30 db d3 5a 8
3 06 0d 6b 29 b8 18
76 3b 7c cd 58 0
..Z...k)..v;|.X
01b0 b9 2d b7 66 a
9 20 ee ed b9 a8 cb
be 63 ff 31 b7 .
-.f. ......c.1.
01c0 fe 5b 6d 7d a
e f5 b9 fb 5c df 6f
f0 c0 33 89 ac .
[m}....\.o..3..
01d0 f3 06 6d 5a d
7 b1 6a 72 0c 4c 63
26 d4 ca 1a 24 .
.mZ..jr.Lc&...$
01e0 4c 50 75 c6 5
9 0b d8 aa 5e 89 db
91 4b 99 4b 9b L
Pu.Y...^...K.K.
01f0 26 77 63 22 c
c 96 e7 1d 5a c9 67
6b b8 a8 ec 09 &
wc"....Z.gk....
0200 8c 4b b2 f9 4
7 d4 0a 8c 90 b6 a1
33 55 8b 16 11 .
K..G......3U...
0210 d5 27 72 d8 c
c 6a 78 a7 8c 61 b8
5a e7 5e b2 e6 .
'r..jx..a.Z.^..
0220 8c c6 6e 4e 1
1 cf 3f 0a 86 c6 ab
bf a4 10 20 83 .
.nN..?....... .
0230 c3 66 ff fb 9
2 04 ec 0f f3 16 27
d5 03 2f 4a 50 .
f........'../JP
0240 61 45 4a 90 6
5 e6 4c 4b 4c 9b 52
0c bd 29 41 78 a
EJ.e.LKL.R..)Ax
0250 1c ea 41 97 9
9 70 d0 85 1a 2c b5
56 ad 39 28 41 .
.A..p...,.V.9(A
0260 86 11 8f e9 a
4 62 70 2c 75 d4 62
2c ef 15 57 56 .
....bp,u.b,..WV
0270 bf 72 60 16 c
7 8e 27 8c 02 da ad
74 da 84 61 ec .

r`...'....t..a.
0280 18 2d ea 95 c
9 69 2e b5 30 87 57
7a 84 cf f6 6e .
-...i..0.Wz...n
0290 43 12 a9 4b 7
7 26 bb ff 87 84 2d
95 5f 36 10 13 C
..Kw&....-._6..
02a0 9a 48 64 02 4
0 f9 92 e7 67 ab 20
50 30 25 17 2c .
Hd.@...g. P0%.,
02b0 86 35 75 aa 2
e aa d3 ff af ea 4b
c3 1a f8 03 0c .
5u.......K.....
02c0 74 38 30 48 1
9 43 4b 65 cc a4 b2
0d f3 ab 01 5a t
80H.CKe.......Z
02d0 1d 42 d7 3a 9
8 dc 0c 57 4f dd 19
a1 d4 bf 87 01 .
B.:...WO.......
02e0 07 29 50 c5 3
2 ea ad b0 2c 8a 52
31 e2 15 9a a0 .
)P.2...,.R1....
02f0 8b a1 00 2c c
c 53 8a b5 48 b0 9c
a8 4b 1b 8f 61 .
..,.S..H...K..a
0300 a3 26 62 5e 9
4 41 15 bd 2e fd cc
47 a8 b7 ea e7 .
&b^.A.....G....
0310 ba 3d d3 e1 2
6 61 fa c7 33 6d df
17 bf a1 92 11 .
=..&a..3m......
0320 04 0d fc 46 3
9 8c 60 5c 89 48 94
eb f4 b2 09 d5 .
..F9.`\.H......
0330 1d 79 51 bc 3
1 ed 0d 58 4e 9d c1
98 27 5b d2 39 .
yQ.1..XN...'[.9
0340 98 a3 2c 65 b
d 89 a9 b1 c6 90 68
4c 35 16 17 be .
.,e......hL5...
0350 43 25 0a 12 4
3 14 a7 db 1a 12 ca
20 73 be 75 96 C
%..C...... s.u.
0360 21 8e 9d 7a a
a 41 fd 71 c8 f5 8e
d9 7e 2e a6 e8 !
..z.A.q....~...
0370 7f 05 05 00 a
c 07 e5 5a 6c ff 77
ca d5 10 04 31 .
......Zl.w....1
0380 a4 0c 22 b3 0
e bc 41 2d 7f a6 a5
58 60 c3 82 59 .
."...A-...X`..Y

0390 29 a6 58 14 9
2 dd b8 0e 40 52 7b
d8 89 48 5c 27 )
.X.....@R{..H\'
03a0 70 fc f5 29 1
2 d1 19 a2 ab a7 b1
50 a5 c1 15 a8 p
..).......P....
03b0 e1 93 cd 2e 2
f 94 d2 f0 95 92 9a
ae 9e 31 e5 21 .
.../........1.!
03c0 1d bf 76 15 7
7 14 5f e7 63 cf 66
ee 5e 11 3c b5 .
.v.w._.c.f.^.<.
03d0 70 8e c5 3b f
f fb 92 04 ec 8f f3
1c 31 54 03 58 p
..;........1T.X
03e0 4a 60 5b 84 6
a 80 65 e9 4a 0c 78
cb 4e 0d 3d 0b J
`[.j.e.J.x.N.=.
03f0 81 79 99 69 c
1 97 a1 70 7b b6 5f
10 a4 92 eb 45 .
y.i...p{._....E
0400 cc 22 1c 2f 9
9 9b 1a 0c 17 39 28
4d 03 60 72 cb .
"./.....9(M.`r.
0410 4a db c7 f2 0
4 89 95 a6 35 35 6d
35 e4 54 b2 74 J
.......55m5.T.t
0420 d5 92 55 9a a
1 67 ac 7d b1 3a d7
ed c8 29 f2 21 .
.U..g.}.:...).!
0430 40 65 63 86 f
f 28 0c 91 58 fe 6a
f5 ea 90 3d 69 @
ec..(..X.j...=i
0440 62 f3 84 dc 4
a 81 fb 28 e5 f9 20
fd 9d 84 67 a9 b
...J..(.. ...g.
0450 34 7b c6 ee 0
6 05 c0 86 08 a8 f1
62 8f 43 23 76 4
{.........b.C#v
0460 7d 02 21 8b d
4 1a 29 b2 28 21 73
34 d7 fe 7a 98 }
.!...).(!s4..z.
0470 2c 9d ca 58 9
0 09 b8 bd 4d 35 b7
83 11 c5 ba 8e ,
..X....M5......
0480 81 13 16 34 6
c 9b 46 cb 73 6e ab
0a 64 6c ae ce .
..4l.F.sn..dl..
0490 52 ce 2a 0c 5
9 14 ae 4a 37 09 e2
6d 46 4d 53 95 R
.*.Y..J7..mFMS.
04a0 ae 56 6d 7a 6

e 3e a4 ae d5 dd e6
5f 62 06 0b 81 .
Vmzn>....._b...
04b0 a0 20 d9 87 0
1 41 4a 54 84 04 1c
59 eb 4e 94 e8 .
...AJT...Y.N..
04c0 ff f5 0a 08 5
f 61 19 40 ad c8 87
10 47 0d 98 e9 .
..._a.@....G...
04d0 32 67 94 a5 3
8 dc 74 5e 44 69 28
ca 6c 8b 33 84 2
g..8.t^Di(.l.3.
04e0 23 74 bf 9e 0
b b7 cf 98 25 3b 60
2b 55 91 24 dc #
t......%;`+U.$.
04f0 a4 29 62 54 4
5 88 8d 96 0f 42 73
24 25 3f 1c d3 .
)bTE....Bs$%?..
0500 0d cb ca d7 7
5 64 6b d4 a3 f4 da
8f a9 df 67 a0 .
...udk.......g.
0510 20 1a 18 06 1
7 13 2f 00 b5 65 ac
84 1d 5a 74 08
...../..e...Zt.
0520 b9 0f
.
.
No. Time
Source
Destination
Protocol
Length Info
99 3.659141000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1301 http49
574 [PSH, ACK] Seq=
58521 Ack=1 Win=46
Len=1247
Frame 99: 1301 byte
s on wire (10408 bi
ts), 1301 bytes cap
tured (10408 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.709071000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]

Epoch Time: 141

5615216.709071000 s
econds
[Time delta fro
m previous captured
frame: 0.131006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13100600
0 seconds]
[Time since ref
erence or first fra
me: 3.659141000 sec
onds]
Frame Number: 9
9
Frame Length: 1
301 bytes (10408 bi
ts)
Capture Length:
1301 bytes (10408
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
287
Identification:
0xf1a8 (61864)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a8f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 58521, Ack: 1
, Len: 1247
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1247]
Sequence number
: 58521 (relativ
e sequence number)
[Next sequence
number: 59768 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x8e0
b [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2507]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 07 f1 a8 4
0 00 31 06 3a 8f 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 46 c6 9e
87 4e aa 50 18 .
..P..+.F...N.P.
0030 00 2e 8e 0b 0
0 00 ff 52 10 08 56
a3 24 60 cb 96 .
......R..V.$`..
0040 18 80 1c 09 b
e 7d 16 14 18 b0 a4
2e 50 5b 4b 80 .
....}......P[K.
0050 ad 9e 12 e8 2
8 d6 e6 6f 20 41 ba
e9 cb d0 34 14 .
...(..o A....4.
0060 24 71 c5 a9 9
c a0 0b 2d aa a5 5e
51 01 ef 8e 0a $
q.....-..^Q....
0070 2a df 3c be 7
d 2a fa fd 5c fb fd
9a ad a9 33 4b *
.<.}*..\.....3K
0080 4c 0b bc 04 c
6 3c 19 9d 09 b4 ff
fb 92 04 ea 8f L
....<..........
0090 f2 f3 2c d3 8
3 4f 4a 62 62 05 7a
60 67 09 4c 0c .
.,..OJbb.z`g.L.
00a0 18 b3 4e 0c b
d 29 81 86 15 69 81
97 a5 30 0a a6 .
.N..)...i...0..
00b0 0a ac 6b 9e f
2 b9 63 9f a4 44 18
46 60 72 21 89 .
.k...c..D.F`r!.
00c0 2c 5e b4 21 4
8 22 61 2d 74 b9 6a
d1 89 76 63 e0 ,
^.!H"a-t.j..vc.
00d0 40 39 8e a5 0
8 95 4b 12 98 46 d9
d2 38 98 cc 10 @
9....K..F..8...
00e0 15 59 3c c5 5
1 95 92 50 74 18 aa
94 3b 50 92 74 .

Y<.Q..Pt...;P.t
00f0 5e 3b 67 7d 8
8 d5 ed cf 21 da c7
8c 53 d0 a0 8b ^
;g}....!...S...
0100 66 76 7e f4 8
c 34 7c 58 8a 45 88
08 4a 89 9e 0d f
v~..4|X.E..J...
0110 29 2c 34 9b 7
d ad cd 20 40 39 87
85 dd 19 13 c6 )
,4.}.. @9......
0120 16 51 9e 1c a
c 65 cf 55 03 5b 1d
a6 bd 74 f1 0c .
Q...e.U.[...t..
0130 5e 4d bf 75 8
b 65 4d 65 e1 10 0a
09 b7 57 18 29 ^
M.u.eMe.....W.)
0140 2b 63 94 90 e
6 50 d6 f1 27 42 1a
62 30 1b 65 43 +
c...P..'B.b0.eC
0150 26 9b 56 08 5
8 8b 17 d3 b6 cc 4a
e3 0c c4 94 62 &
.V.X.....J....b
0160 3d 2a fb 23 2
c fd bc f5 74 d4 86
2d ab 00 b1 6d =
*.#,...t..-...m
0170 53 c2 17 7a 8
4 42 89 50 00 66 0a
18 73 48 0d 32 S
..z.B.P.f..sH.2
0180 60 10 b5 1e 3
0 01 d4 45 93 d1 cd
92 21 59 e5 33 `
...0..E....!Y.3
0190 58 30 ca 59 6
b d4 d9 e1 56 ee 55
9f 75 17 62 bd X
0.Yk...V.U.u.b.
01a0 59 8d d2 13 1
0 e7 59 ce de c5 99
48 b3 44 0f dc Y
.....Y....H.D..
01b0 48 36 bd 7c f
0 b2 f6 1d 6f 5d 7d
bf c7 ff 15 c3 H
6.|....o]}.....
01c0 35 ce 41 72 2
0 59 1a 02 cb 19 51
17 f6 6c e6 aa 5
.Ar Y....Q..l..
01d0 10 14 04 07 2
c 3c 05 00 30 31 c0
cf 14 e8 50 a9 .
...,<..01....P.
01e0 10 b3 88 14 7
b f0 5b 9f 05 ad 66
b9 93 89 33 14 .
...{.[...f...3.
01f0 73 22 b0 2a 6
e 2f 79 8b b1 68 f1
76 28 de d7 83 s
".*n/y..h.v(...

0200 df 5b 59 88 c
8 82 a8 63 c8 5a 2c
92 20 50 27 91 .
[Y....c.Z,. P'.
0210 a1 92 28 48 3
e 4a 66 0c 94 b9 d5
97 50 f4 ee e5 .
.(H>Jf.....P...
0220 9d b9 63 7f f
9 2f 8e d5 5c 45 a0
10 ff fb 92 04 .
.c../..\E......
0230 e8 0f f2 e6 2
7 d3 83 4f 62 50 5f
04 ea 60 69 ec .
...'..ObP_..`i.
0240 4a 0b 90 b3 4
c 0d 61 29 81 6c 13
a9 81 ac 3d 28 J
...L.a).l....=(
0250 6a 32 b3 28 4
2 d2 53 b7 a0 28 81
04 80 8f 81 5e j
2.(B.S..(.....^
0260 a2 49 9e 21 1
0 82 24 98 c8 83 c7
f1 a8 3f 4f 2a .
I.!..$......?O*
0270 71 86 6a 45 2
4 86 86 43 02 3f ac
41 70 bd af fd q
.jE$..C.?.Ap...
0280 e9 e6 32 34 b
5 06 8a 3c 0d 82 19
b5 98 5c a9 81 .
.24...<.....\..
0290 36 58 9e 40 f
4 d2 0f 64 69 70 f3
55 a2 10 ca 75 6
X.@...dip.U...u
02a0 9b 39 d7 22 6
c fc aa b2 70 48 ae
6f f0 d4 b1 34 .
9."l...pH.o...4
02b0 92 2e b5 10 4
4 7a 93 b8 ab ee 4b
1a 5a 86 08 e1 .
...Dz....K.Z...
02c0 66 00 9f cb a
6 4c 04 10 59 2a cd
3b a7 79 55 28 f
....L..Y*.;.yU(
02d0 ea b6 89 5f 3
1 2b a7 42 7c 39 72
20 14 21 33 a6 .
.._1+.B|9r .!3.
02e0 29 27 29 d7 6
b ea 03 cf 50 84 66
64 d2 21 01 54 )
').k...P.fd.!.T
02f0 e9 d5 20 b3 c
b 4f 2b 2f 5b 3b 24
f1 4f 46 f7 d3 .
. ..O+/[;$.OF..
0300 ec 86 c7 57 a
0 ce 9a ad 8d e9 52
8a 8d a5 ab 1e .
..W......R.....
0310 c1 4d 0d c4 c

9 58 40 b3 01 0e 9d
85 b6 e4 38 ac .
M...X@.......8.
0320 d3 21 b9 d0 1
3 65 60 5e d1 d9 78
a5 43 a9 18 92 .
!...e`^..x.C...
0330 ca c0 a8 94 4
d 44 11 62 19 a7 7f
25 8c 85 e0 86 .
...MD.b...%....
0340 6a 44 66 1c 2
a b7 11 b5 2d 1c 6f
2b 05 e4 7d 64 j
Df.*...-.o+..}d
0350 bc 5f 9b ab 2
3 6b 2d f0 af 99 6d
8d ee cf f1 4a .
_..#k-...m....J
0360 62 b3 6f c2 d
6 b7 fe f5 9f ad 63
fd 49 d4 6e cf b
.o.......c.I.n.
0370 24 db 2a f4 5
5 24 02 a3 83 a0 8c
b0 60 14 90 77 $
.*.U$......`..w
0380 36 76 64 c3 2
1 81 80 a2 88 ea 5e
bb 6e 05 d8 80 6
vd.!.....^.n...
0390 38 ce fc 20 9
7 a0 c8 1f 81 67 1d
09 3c 2a 2a 10 8
.. .....g..<**.
03a0 d2 fe 8b 72 5
4 d7 48 e1 f2 4d 63
c4 f0 1c 18 3e .
..rT.H..Mc....>
03b0 20 15 03 0a 2
8 e1 30 aa d9 02 21
aa 69 a7 d7 4a
...(.0...!.i..J
03c0 2d 1e dd 74 7
8 b3 ff 6f 72 4d df
4e d3 08 ff fb ..tx..orM.N....
03d0 92 04 ed 0f f
3 26 2c d2 83 58 4a
60 61 e5 8a 40 .
....&,..XJ`a..@
03e0 67 09 4c 0b 4
c a3 4c 0d 61 89 41
7c 97 69 01 9c g
.L.L.L.a.A|.i..
03f0 3d 30 5f 35 d
7 f2 34 67 ed 77 ff
ff fa 9a 4b 58 =
0_5..4g.w....KX
0400 32 2b 28 b1 4
9 05 05 28 2c d9 39
2f 88 33 97 c3 2
+(.I..(,.9/.3..
0410 b7 6c 3c a8 a
7 2b b3 d3 00 e5 d1
e4 40 8f bf f7 .
l<..+......@...
0420 e1 16 31 5b a
e cb c3 11 b7 4f 8e

0a 20 70 98 b1 .
.1[.....O.. p..
0430 a9 65 64 4c 6
3 47 eb 54 4d 6d 25
98 bb d2 a6 b4 .
edLcG.TMm%.....
0440 c5 9d 7a d2 a
f 63 fc c1 d5 37 df
d7 1f e7 75 c6 .
.z..c...7....u.
0450 b5 f1 7f 2e f
a 29 45 b4 f2 1e ef
ff ff 6a 94 ec .
....)E......j..
0460 44 45 9e 84 f
0 64 93 ed 8e 25 bb
d0 16 50 7c 03 D
E...d...%...P|.
0470 1e 48 0b 19 8
e eb 8e 20 2e 8b 81
01 79 69 b3 57 .
H..... ....yi.W
0480 fb c4 40 08 c
a 86 d7 8a 19 21 7c
f5 a8 ae 7d b3 .
.@......!|...}.
0490 0c 18 47 b3 9
4 2a 9d 15 cd ff 14
63 0c c9 a0 10 .
.G..*.....c....
04a0 32 7c 20 4c 3
c 7c bb 6c fa 8a 47
94 47 ed c8 74 2
| L<|.l..G.G..t
04b0 ff d3 d4 4c 9
b 3e 42 01 67 e4 0b
77 9a 50 80 53 .
..L.>B.g..w.P.S
04c0 8b 72 2a d7 0
3 e3 8e 80 73 26 2f
96 00 51 4c 76 .
r*.....s&/..QLv
04d0 11 02 35 90 2
2 33 7c be 78 00 43
14 23 17 52 4d .
.5."3|.x.C.#.RM
04e0 15 3c bb 39 4
6 9e 79 05 08 82 e9
46 19 18 ca 73 .
<.9F.y....F...s
04f0 df 53 ef 8a e
5 fe a0 50 c1 f3 88
3e 7c 06 27 72 .
S.....P...>|.'r
0500 c8 cd 35 14 0
7 1e 68 a5 93 f4 4b
b3 a6 37 57 77 .
.5...h...K..7Ww
0510 93 83 ca 67 e
b
.
..g.
No. Time
Source
Destination
Protocol
Length Info
100 3.659327000

pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=59768 Win=40432 Le
n=0
Frame 100: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.709257000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.709257000 s
econds
[Time delta fro
m previous captured
frame: 0.000186000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018600
0 seconds]
[Time since ref
erence or first fra
me: 3.659327000 sec
onds]
Frame Number: 1
00
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa

gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f3e (20286)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t

..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 59768
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 59768 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40432
[Calculated win
dow size: 40432]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 99]
[The RTT to
ACK the segment wa
s: 0.000186000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 3e 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O>@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 4b a5 50 10 .
....P..N.+.K.P.
0030 9d f0 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
101 3.670141000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=59768
Ack=1 Win=46 Len=1
260
Frame 101: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.720071000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.720071000 s
econds
[Time delta fro
m previous captured
frame: 0.010814000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01081400
0 seconds]
[Time since ref
erence or first fra
me: 3.670141000 sec
onds]
Frame Number: 1
01
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1a9 (61865)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)

Header checksum
: 0x3a81 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 59768, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 59768 (relativ
e sequence number)
[Next sequence
number: 61028 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf4a
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 a9 4
0 00 31 06 3a 81 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 4b a5 9e
87 4e aa 50 10 .
..P..+.K...N.P.
0030 00 2e f4 ae 0
0 00 2e a0 17 1d 61
69 05 12 01 54 .
.........ai...T
0040 74 1c e3 6c 1
9 13 cc a8 7c c9 24
41 d7 a2 98 61 t
..l....|.$A...a
0050 a1 5c 3a 02 2
0 b0 49 00 50 34 16
8a 67 86 d3 f9 .
\:. .I.P4..g...
0060 db 05 0a 48 7
4 a0 e5 ec 3b 3c cc
6b cc 56 bb ef .
..Ht...;<.k.V..
0070 66 66 ab 45 c
0 70 d3 0b 34 3a fe
1f 7a 6a 1a 49 f
f.E.p..4:..zj.I
0080 e8 32 11 94 1
a 0f 85 8c b5 9d ab
7d f2 8d fd 22 .
2.........}..."
0090 84 ff fb 92 0
4 eb 8f f3 22 36 53
03 4f 42 e0 61 .
......."6S.OB.a
00a0 05 da 50 67 0
f 4c 0b 10 85 5a 0c

31 29 41 79 13 .
.Pg.L...Z.1)Ay.
00b0 ab 01 86 21 2
8 d2 85 40 0a 58 e4
9c a1 5e 40 c5 .
..!(..@.X...^@.
00c0 88 fe 24 ca c
8 26 e8 a7 2f 6f 54
96 06 91 d0 fc .
.$..&../oT.....
00d0 a6 49 5c d9 e
1 d1 dd 9a 69 e1 e8
66 80 42 55 87 .
I\.....i..f.BU.
00e0 b2 dc cf 49 7
e b6 b9 22 cf 6a d8
b4 f6 17 be 31 .
..I~..".j.....1
00f0 b9 76 4e 05 4
9 81 04 09 06 44 86
ca 84 8a 85 54 .
vN.I....D.....T
0100 f1 16 e0 78 6
b e7 05 c5 ab 35 28
c5 bc e3 1c f6 .
..xk....5(.....
0110 2c 1f 9f 87 e
9 b3 eb 20 5d 6a 9c
58 2e 6d e9 13 ,
...... ]j.X.m..
0120 b1 c2 21 a2 e
2 10 70 6c 3c 2f ca
c1 71 41 44 66 .
.!...pl</..qADf
0130 7e e9 09 ac 5
9 d5 2e 16 8b d2 31
f3 ce 7e 13 ac ~
...Y.....1..~..
0140 b2 d1 fe 7e c
b be 1a a5 ef 29 d2
83 77 33 2f a8 .
..~.....)..w3/.
0150 be ef b3 bf f
f 9a e7 e3 90 8f fd
28 60 94 52 c7 .
..........(`.R.
0160 bc f8 ef d4 f
a 0b b0 be 5c 22 2d
f5 78 65 25 9c .
.......\"-.xe%.
0170 91 4f 7e e9 7
8 b5 55 f8 dc e2 55
f6 14 5b 2d 77 .
O~.x.U...U..[-w
0180 dd 98 76 40 e
3 46 2d b6 b1 a4 d4
02 2c c9 33 66 .
.v@.F-.....,.3f
0190 26 dd ac aa 0
c 65 98 9d 38 43 63
19 4b 48 37 75 &
....e..8Cc.KH7u
01a0 5c 68 d5 a9 9
f 89 ea 07 9b 5e dd
7d 25 d1 19 9b \
h.......^.}%...
01b0 ff ee f8 b7 3
4 db 0e ff f9 18 76
4f 2f 55 c8 de .

...4.....vO/U..
01c0 ad 11 b3 d4 d
f 24 57 36 86 3d 20
1a 4e c8 7b df .
....$W6.= .N.{.
01d0 cb 3c b7 0b 6
5 13 53 14 18 68 aa
41 87 21 11 85 .
<..e.S..h.A.!..
01e0 69 3e fc 24 7
b ce 32 28 b4 8f 95
06 22 f7 dd 2b i
>.${.2(...."..+
01f0 27 24 e8 f1 5
3 c7 25 97 e3 58 cc
3d 94 bf 9a ed '
$..S.%..X.=....
0200 3e 55 34 0c 4
d 01 96 54 f5 57 cd
3f 37 bb 7d 85 >
U4.M..T.W.?7.}.
0210 db c3 d8 ef b
4 3b ff bf 61 ea ba
b3 2d 2d 4b b9 .
....;..a...--K.
0220 46 14 df f8 c
5 0a 3a d3 7d 22 bf
9a 2b 91 c4 86 F
.....:.}"..+...
0230 c5 e2 55 ff f
b 90 04 ec 8f f3 09
28 58 01 e9 32 .
.U........(X..2
0240 50 63 e4 1a f
0 3d 89 4a 0b 70 65
62 07 bc c7 09 P
c...=.J.peb....
0250 76 0f ab c1 8
4 a1 29 66 09 f1 bf
89 df bf 8d 89 v
.....)f........
0260 01 c8 62 98 c
5 f3 95 ac 5c 63 2c
a9 25 6d c5 a8 .
.b.....\c,.%m..
0270 c2 4c 50 70 d
b e3 44 43 64 8a cc
f1 d7 7b 83 ed .
LPp..DCd....{..
0280 8d fc 1c 40 d
c ee 4d 93 d2 d5 f0
ab 17 12 5e b8 .
..@..M.......^.
0290 f8 99 ca 52 d
d 3b bc 63 5f a2 b5
1e 67 fb ad b7 .
..R.;.c_...g...
02a0 d5 1d f3 51 d
5 5b 49 90 b4 7a b6
ad 59 8c fd 0d .
..Q.[I..z..Y...
02b0 da 5d a8 18 7
3 a5 80 cf 6f de 59
ff 3a 93 18 a3 .
]..s...o.Y.:...
02c0 96 11 54 4d 7
d 0d 24 4d 97 5d b2
d8 34 20 2b a7 .
.TM}.$M.]..4 +.

02d0 08 f9 51 d8 3
d 14 58 4a 28 42 79
10 9d a1 a0 95 .
.Q.=.XJ(By.....
02e0 78 fb 07 ea b
9 56 48 51 7b 51 40
b1 f1 71 d3 56 x
....VHQ{Q@..q.V
02f0 c1 65 2a 72 4
c 19 77 56 ce 0a 8b
a4 fc cb 62 2c .
e*rL.wV......b,
0300 e5 b2 29 9b a
e dd 7c 6f b8 b4 4d
b5 a8 0e 8e 38 .
.)...|o..M....8
0310 f0 c8 b6 05 6
b fa 56 d2 aa 79 2a
72 2c 7d ff ff .
...k.V..y*r,}..
0320 fc 89 80 01 8
a 09 ce 92 19 a4 da
f6 77 83 85 56 .
...........w..V
0330 f5 2c 35 87 2
a d9 d4 03 e0 72 43
39 8e 18 ce 09 .
,5.*....rC9....
0340 54 99 d0 b7 f
0 e0 91 26 d7 15 94
e3 5c d1 f4 64 T
......&....\..d
0350 25 6b 6a c5 b
9 aa 58 b7 b5 bf ea
9d 9c 73 6d da %
kj...X......sm.
0360 fe 65 ad ce 6
7 53 3e fc ca 11 16
34 3e 78 16 69 .
e..gS>....4>x.i
0370 06 89 07 e9 0
9 a2 9d e5 55 6a fd
4f a0 0c bd 5f .
.......Uj.O..._
0380 eb fd 2a 11 9
4 01 3c 84 23 d5 03
e9 a0 17 4a 4c .
.*...<.#.....JL
0390 2a 63 04 0c 7
0 bd 0e 43 b9 84 84
84 4b 03 c3 a4 *
c..p..C....K...
03a0 0d 07 13 fc b
f 3c 67 43 25 b6 58
8f d5 83 33 75 .
....<gC%.X...3u
03b0 b6 78 49 27 c
4 9e d9 68 d0 94 30
29 8a 95 f6 69 .
xI'...h..0)...i
03c0 33 73 78 dc a
3 7c df d8 bd 93 d7
84 cc 32 1f 16 3
sx..|.......2..
03d0 4a c5 69 90 f
f fb 92 04 ec 0f f3
1d 3d 56 83 0c J
.i.........=V..
03e0 1a e2 5d e9 7

a d0 61 e2 5e 0c 84
af 50 0c bd 69 .
.].z.a.^...P..i
03f0 81 83 13 aa 0
1 97 b1 28 90 b0 ba
b4 55 d1 a7 a8 .
......(....U...
0400 46 21 24 47 7
c 03 06 29 c8 70 d8
8d 1d 70 65 44 F
!$G|..).p...peD
0410 69 40 ae 43 4
0 5b 0a d8 8e 2c 82
61 29 db 04 e5 i
@.C@[...,.a)...
0420 53 32 42 a2 e
d 3c 5f 38 b6 6e a6
6c 3c 81 68 d3 S
2B..<_8.n.l<.h.
0430 fd 56 46 52 5
2 e0 fb 7b b3 8c 52
de 91 ff ab 7f .
VFRR..{..R.....
0440 2d df a1 7b 6
7 f7 be 75 f1 e2 76
0d 7d 74 3b 52 ..{g..u..v.}t;R
0450 c3 cf c3 6e 1
1 0b ed 57 fe da 93
c4 2c 14 91 d1 .
..n...W....,...
0460 a1 8a 61 32 1
8 58 ca 6a 3a 95 22
4c 1c 20 5a 01 .
.a2.X.j:."L. Z.
0470 56 8a f4 e0 3
4 df ed 68 02 7e bb
21 43 d6 33 95 V
...4..h.~.!C.3.
0480 d1 54 0a e6 f
4 34 4c 9b d4 56 d3
72 b8 68 b2 4f .
T...4L..V.r.h.O
0490 1f 2c 3d 48 a
5 7e 73 ad dd fd 17
6b 36 a4 ab d9 .
,=H.~s....k6...
04a0 84 d7 f5 bf 5
c b7 36 db c0 f8 ae
a1 47 f5 a7 bc .
...\.6.....G...
04b0 0f 78 9a 54 f
a b0 23 50 0a b2 59
86 78 50 5a df .
x.T..#P..Y.xPZ.
04c0 ea 52 c0 a7 2
3 26 68 cd 0c 79 0b
bc 82 54 9c 69 .
R..#&h..y...T.i
04d0 46 24 ea 5c a
9 6c d3 9c 50 12 25
46 eb c2 83 87 F
$.\.l..P.%F....
04e0 3c a7 72 27 4
d f4 87 a7 25 0f 84
fc a9 31 74 fd <
.r'M...%....1t.
04f0 4f 1d 26 0b b
9 a7 dc 4b c5 c2 7f

93 14 53 68 57 O
.&....K.....ShW
0500 ef c5 d0 7c c
7 05 36 5d 8d f6 29
5b d2 7c ed b0 .
..|..6]..)[.|..
0510 98 68 98 64 2
f 63 45 80 ab 49 12
88 e4 2f 4b 22 .
h.d/cE..I.../K"
0520 b5 ba
.
.
No. Time
Source
Destination
Protocol
Length Info
102 3.809148000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=61028
Ack=1 Win=46 Len=1
260
Frame 102: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.859078000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.859078000 s
econds
[Time delta fro
m previous captured
frame: 0.139007000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13900700
0 seconds]
[Time since ref
erence or first fra
me: 3.809148000 sec
onds]
Frame Number: 1
02
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:

1314 bytes (10512

bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))

0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1aa (61866)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a80 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 61028, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 61028 (relativ
e sequence number)
[Next sequence
number: 62288 (r
elative sequence nu

mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4ee
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 aa 4
0 00 31 06 3a 80 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 50 91 9e
87 4e aa 50 10 .

..P..+.P...N.P.
0030 00 2e 4e e0 0
0 00 df 5d 69 00 10
c6 55 e0 5a b9 .
.N....]i...U.Z.
0040 9f 28 34 65 3
5 40 81 53 cc c0 b1
1e 4b 30 8c c0 .
(4e5@.S....K0..
0050 54 29 71 22 8
d d1 2d a7 be 18 8d
69 a0 40 f1 db T
)q"..-....i.@..
0060 75 92 8a 24 2
e a9 31 07 a6 4c 87
c8 a5 4a 44 b2 u
..$..1..L...JD.
0070 88 82 02 f3 8
d ac a7 c4 c2 95 6b
21 66 3b ca a7 .
.........k!f;..
0080 38 7f 09 7a 4
e 94 91 74 99 73 ff
fb 92 04 e7 8f 8
..zN..t.s......
0090 f2 c6 24 d3 8
3 2f 62 50 5a 84 ea
70 65 ec 4a 0c .
.$../bPZ..pe.J.
00a0 d8 b3 4a 0d 3
d e9 81 8a 93 a9 41
ac 31 28 c0 6e .
.J.=.....A.1(.n
00b0 00 b5 99 a7 e
2 74 dc 10 c4 26 68
60 c2 66 0c 87 .
....t...&h`.f..
00c0 c1 24 42 29 d
2 18 5a 4b 8d 58 24
b0 21 c2 91 19 .
$B)..ZK.X$.!...
00d0 28 91 04 69 3
e ad 3f 8b da da da
26 71 a4 6d 9b (
..i>.?....&q.m.
00e0 86 66 90 11 6
5 41 f5 90 9f 97 23
99 75 08 80 52 .
f..eA....#.u..R
00f0 b4 ac 67 06 9
4 2a 4b 0c 49 b4 e7
ab b2 81 bb 94 .
.g..*K.I.......
0100 e3 69 c4 5f 2
d 70 e9 78 d6 40 4f
af 9e 11 fe fe .
i._-p.x.@O.....
0110 56 bf 53 c0 d
8 b4 33 81 ce 2d 33
3c b5 54 08 08 V
.S...3..-3<.T..
0120 35 e3 20 34 5
f a1 eb 2a 91 ba a6
65 3c 28 09 c7 5
. 4_..*...e<(..
0130 05 d4 62 de 4
d 17 11 93 8c e7 5b
48 a4 27 df 41 .
.b.M.....[H.'.A

0140 be a1 95 03 c
a 2d de 30 da 32 9b
69 f3 42 90 3b .
....-.0.2.i.B.;
0150 03 3f b5 55 0
c f0 9e cf 1b 19 c5
63 da 0f ce 33 .
?.U.......c...3
0160 ad e1 82 87 8
1 b8 ac f5 16 76 25
7b 8e d0 e9 f2 .
........v%{....
0170 ec a3 bf fd 6
5 38 04 e0 37 85 c8
46 97 86 10 b0 .
...e8..7..F....
0180 46 25 7b 4f 3
0 29 1a d4 1b c7 e8
29 37 5e 58 e2 F
%{O0).....)7^X.
0190 bd 2b 96 47 4
4 bb 9b 78 54 9b 08
a3 4f 66 ce 5b .
+.GD..xT...Of.[
01a0 24 8f cd d7 b
1 89 56 14 86 ac 4c
c9 aa 1f 89 56 $
.....V...L....V
01b0 f4 6b 54 4b b
0 c3 7d 1a cb a4 bc
ab 88 52 c7 cd .
kTK..}......R..
01c0 e8 ea 2d 3d 6
b af 99 31 6a 5f 5a
81 ef 13 3e fb .
.-=k..1j_Z...>.
01d0 dc 3e a4 0a a
c 55 00 de 46 aa 34
2a 70 19 60 09 .
>...U..F.4*p.`.
01e0 51 a4 9c 60 5
d af 15 ec e3 44 4a
03 91 44 e5 58 Q
..`]....DJ..D.X
01f0 86 1f c0 7f 6
c 9d 38 1b ea 45 6b
88 e6 2e 32 d7 .
...l.8..Ek...2.
0200 9d e3 d4 8b 6
6 5c df bf b1 80 9e
2d fb 21 39 cc .
...f\.....-.!9.
0210 19 58 bc 9f 2
d ec b7 f4 42 31 32
7d e8 79 4f 72 .
X..-...B12}.yOr
0220 48 62 b5 b3 2
6 61 89 64 ce 75 6f
b9 ff fb 92 04 H
b..&a.d.uo.....
0230 e8 0f f2 cc 2
7 d3 03 58 4a 50 5b
64 da 50 6d e9 .
...'..XJP[d.Pm.
0240 4a 4c 74 a1 4
a 0d 3d e9 49 9a 97
a9 01 ac 3d 30 J
Lt.J.=.I.....=0
0250 1a 52 38 4e 4

d ab de 77 af fd 2b
f1 02 67 30 c8 .
R8NM..w..+..g0.
0260 c8 96 50 87 c
c 8c 64 f3 16 19 12
a4 5a 6e 34 81 .
.P...d.....Zn4.
0270 56 0b 12 1c 9
1 4e 17 72 ec 39 3f
07 59 82 2d d5 V
....N.r.9?.Y.-.
0280 4d d8 72 b3 e
9 11 8c 52 e3 91 40
02 8f 9f 5a a6 M
.r....R..@...Z.
0290 a2 b3 72 98 e
0 ef bc e1 eb d6 a1
ca 89 f5 ae 5a .
.r............Z
02a0 72 a7 8e 5e 7
a b9 3a ca ea e4 cd
af 59 77 98 94 r
..^z.:.....Yw..
02b0 0f 63 35 9e 1
b fa d4 f0 50 81 65
cc 45 63 1c 78 .
c5.....P.e.Ec.x
02c0 d4 ae 4f 14 c
d 57 00 a6 a1 3c 5b
2e ca 84 81 11 .
.O..W...<[.....
02d0 ad 86 52 c2 d
e 80 82 74 1e 35 8d
04 fd 2e e9 c2 .
.R....t.5......
02e0 c4 a9 82 84 2
d cc 7e 0b 91 da ab
c6 d1 79 3b c9 .
...-.~......y;.
02f0 a5 19 da 36 b
2 77 0e 6e e1 ea 6d
ea f4 09 6b 15 .
..6.w.n..m...k.
0300 1b b4 f3 27 c
f cc cf da 9d af c7
bd 01 f5 9e 71 .
..'...........q
0310 52 7c aa 7e b
4 06 83 67 9c 61 f0
d8 8c 40 50 13 R
|.~...g.a...@P.
0320 14 30 03 98 8
b a8 fe 31 2a 92 54
65 47 b8 1b 6c .
0.....1*.TeG..l
0330 f0 a8 7b 2d 8
2 e2 70 3c f2 4e c8
5a 4b 98 aa 21 .
.{-..p<.N.ZK..!
0340 71 89 78 9b 1
d d5 9d 06 ce 54 fd
09 48 f2 99 29 q
.x......T..H..)
0350 cb 8f 2d c3 f
5 7b 43 a3 3f 80 c6
f5 a5 73 59 a6 .
.-..{C.?....sY.
0360 4f f6 49 c9 d
4 4f 26 0a 01 8f 53

05 5e 71 d4 a2 O
.I..O&...S.^q..
0370 fa ac b2 fd 3
5 65 82 1a 46 34 a8
55 59 b8 fc 01 .
...5e..F4.UY...
0380 46 34 25 86 3
e a6 0e c0 60 12 7a
a1 20 7e 01 3d F
4%.>...`.z. ~.=
0390 68 bf 40 42 9
2 c7 4c 40 d5 0b 1b
e7 ce cc f1 2c h
.@B..L@.......,
03a0 67 1d 45 c5 d
b c9 f9 66 12 82 f4
ff 31 9b 20 d6 g
.E....f....1. .
03b0 2c 22 0d 1a 9
0 6b 75 9d 66 8c d6
d4 68 5f 1e 0a ,
"...ku.f...h_..
03c0 ed f3 aa da f
f 1e 03 2d f7 8d e6
91 bc b0 ff fb .
......-........
03d0 92 04 e7 0f f
2 d3 2c 53 03 4f 62
60 5b e5 8a 50 .
.....,S.Ob`[..P
03e0 6b 0c 4c 0b c
8 b3 4a 0d 3d 89 81
7f 93 e9 01 ac k
.L...J.=.......
03f0 31 28 2f ff 8
9 03 05 14 8a 42 3d
9e 96 d4 93 48 1
(/......B=....H
0400 d0 81 66 61 0
0 82 88 60 02 c4 75
51 4d 37 5e 01 .
.fa...`..uQM7^.
0410 88 ac 23 0c 2
4 45 e7 4a 50 06 f4
eb b5 0e 36 b0 .
.#.$E.JP.....6.
0420 d4 72 1d 99 9
a 70 e5 ae bb 6b 2f
89 53 cb 0c d1 .
r...p...k/.S...
0430 05 4d 26 f5 5
a cd 2b 8d 89 4d b5
03 6d 6f b1 a9 .
M&.Z.+..M..mo..
0440 16 ab 49 ee f
6 de 0b 72 df b5 75
af bc 32 c5 de .
.I....r..u..2..
0450 73 ab d6 3d 9
e e7 d0 14 84 30 4f
c3 2c 50 c2 6e s
..=.....0O.,P.n
0460 11 23 0a 79 2
f b1 c2 06 44 59 2d
6d 19 bc 6a e5 .
#.y/...DY-m..j.
0470 ec 76 60 22 f
4 a7 b5 97 97 17 96
d4 e6 6a 88 89 .

v`".........j..
0480 76 a9 27 9a a
b dd 0f 47 59 a4 8e
63 2a 53 f0 0b v
.'....GY..c*S..
0490 d3 5f c4 81 4
d cc d8 52 e6 b0 5f
9b 92 fb bf 73 .
_..M..R.._....s
04a0 a4 d6 6a 8b 9
c 66 0b 74 5f e4 be
7c 25 57 ff e3 .
.j..f.t_..|%W..
04b0 13 7d ba ff 7
6 9a 20 42 1b 24 fb
e2 3d 72 6a 94 .
}..v. B.$..=rj.
04c0 19 1c d0 90 2
c 0a 32 22 c3 9a 8b
13 47 e3 0e 09 .
...,.2"....G...
04d0 82 c0 ec 56 6
5 ba ab e0 b0 6e c0
b4 21 d1 7e e8 .
..Ve....n..!.~.
04e0 1c 08 fb 50 8
4 58 b9 4e 9b 32 a7
7d fc 8b 5b fb .
..P.X.N.2.}..[.
04f0 69 c2 03 3a c
d b6 8b 8f eb 81 c9
4f 24 ef 24 d7 i
..:.......O$.$.
0500 c3 ad 62 91 e
7 ff ce 7d d7 17 b4
d8 f8 8d f1 9d .
.b....}........
0510 63 e3 78 6e d
6 b1 e0 ed 62 3b 4b
3d 2f ba 47 52 c
.xn....b;K=/.GR
0520 4c 03
L
.
No. Time
Source
Destination
Protocol
Length Info
103 3.809328000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=62288 Win=40320 Le
n=0
Frame 103: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B

-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.859258000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615216.859258000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 3.809328000 sec
onds]
Frame Number: 1
03
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f3f (20287)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho

me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 62288
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 62288 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40320
[Calculated win
dow size: 40320]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 102]
[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 3f 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O?@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 55 7d 50 10 .
....P..N.+.U}P.
0030 9d 80 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
104 3.810868000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
889 http49
574 [PSH, ACK] Seq=
62288 Ack=1 Win=46
Len=835
Frame 104: 889 byte
s on wire (7112 bit
s), 889 bytes captu
red (7112 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
6.860798000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]

Epoch Time: 141

5615216.860798000 s
econds
[Time delta fro
m previous captured
frame: 0.001540000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00154000
0 seconds]
[Time since ref
erence or first fra
me: 3.810868000 sec
onds]
Frame Number: 1
04
Frame Length: 8
89 bytes (7112 bits
)
Capture Length:
889 bytes (7112 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
75
Identification:
0xf1ab (61867)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c28 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 62288, Ack: 1
, Len: 835
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 835]
Sequence number
: 62288 (relativ
e sequence number)
[Next sequence
number: 63123 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x11c
a [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 835]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 6b f1 ab 4
0 00 31 06 3c 28 4a
7c 0c 8a c0 a8 .
k..@.1.<(J|....
0020 01 0b 00 50 c
1 a6 2b c9 55 7d 9e
87 4e aa 50 18 .
..P..+.U}..N.P.
0030 00 2e 11 ca 0
0 00 0e b8 d9 21 30
89 cd fd 93 3c .
........!0....<
0040 31 4a 9c 76 c
8 6e 06 03 58 bb b9
bf 09 e0 3c ba 1
J.v.n..X.....<.
0050 6f 4c 10 c6 c
7 57 27 e1 94 ce d7
33 2c 01 ee de o
L...W'....3,...
0060 88 4c ab fc 7
6 62 7e a9 8d e9 2e
9b e6 48 16 ae .
L..vb~......H..
0070 bd 75 3c 6a 7
6 14 bd 9a dd db ff
69 59 be 25 cf .
u<jv......iY.%.
0080 fe 9a ce 7e f
f fb 92 04 eb 8f f3
1c 2e d2 03 4f .
..~...........O
0090 7a 60 5f e5 8
a 40 6b 0f 4c 0c 40
bb 48 0d 61 e9 z
`_..@k.L.@.H.a.
00a0 81 85 17 a9 0
1 ac 3d 30 3c 0b fa
cd b8 d9 67 1e .
.....=0<.....g.
00b0 c4 de 95 a8 1
4 02 68 c8 02 0c 12
13 0b 0c 8a 18 .
.....h.........
00c0 e8 0d 54 2e 0
a 4c d6 fb 34 a6 20
23 50 4d d2 07 .
.T..L..4. #PM..
00d0 39 fc 87 67 5
6 7a ff a7 bd 45 1d
8e 41 12 f7 83 9
..gVz...E..A...
00e0 90 5c fd d1 1
8 0f 90 c3 f5 30 e9
3a 4f 50 9c 68 .

\.......0.:OP.h
00f0 f7 2e 4f 39 6
f 0f 6f b7 b9 9f a6
4a 77 4a 57 10 .
.O9o.o....JwJW.
0100 78 fd 4f d3 9
c f4 db ce a0 f5 9b
56 b3 7d 69 c2 x
.O........V.}i.
0110 97 e7 d8 88 8
e 01 a7 ba 1d c9 5c
cc 2a b9 b1 84 .
.........\.*...
0120 56 26 34 fc 4
8 4b d0 86 f2 ec a6
82 27 6a eb e0 V
&4.HK......'j..
0130 ca 60 09 5d d
9 2a 9d 3c 8d d2 9e
65 e4 96 61 a2 .
`.].*.<...e..a.
0140 ee 38 d8 dd 3
c 80 a0 64 52 aa 1f
42 d5 2e b9 73 .
8..<..dR..B...s
0150 c5 68 ba 5a 8
c df a8 17 ff 09 eb
c6 be 75 af 87 .
h.Z.........u..
0160 8e f7 fe f7 8
9 b0 fa b8 f8 b4 fb
fe 39 87 d6 2a .
...........9..*
0170 fd 24 97 e8 a
2 40 ac 80 52 18 cf
87 84 0e 10 62 .
$...@..R......b
0180 50 e7 51 35 f
4 5c 93 b1 91 10 8c
41 7d e4 12 53 P
.Q5.\.....A}..S
0190 50 60 e9 b8 2
d a7 44 25 71 fc 58
5c 4d 3b 21 fd P
`..-.D%q.X\M;!.
01a0 42 29 a9 ae c
a c8 43 6d fd fc e5
b5 d4 06 24 7d B
)....Cm......$}
01b0 21 65 8f 81 d
5 7d 00 f0 f5 98 e6
b5 e9 9a 9c b8 !
e...}..........
01c0 a6 73 44 b2 1
b 96 35 67 56 b3 3d
f3 7f 48 75 d7 .
sD...5gV.=..Hu.
01d0 f7 74 d5 40 c
2 1a a6 a0 e9 2c 83
54 20 ce a5 43 .
t.@.....,.T ..C
01e0 24 76 55 62 a
e 93 64 95 a2 d0 a1
eb 0e a6 59 8f $
vUb..d.......Y.
01f0 70 81 1b 6b 1
2 0e 91 48 43 16 d2
f5 1d 0d aa f5 p
..k...HC.......

0200 3a 99 9e 04 e
a 11 68 6f 87 15 b9
3a 95 81 06 42 :
.....ho...:...B
0210 c7 6a 30 55 b
e b7 da fc 4d 4b 3d
dc f7 59 17 a2 .
j0U....MK=..Y..
0220 4f 03 33 e3 f
8 f1 ff fb 92 04 e7
0f f2 d4 2c d2 O
.3...........,.
0230 83 4f 7a 60 5
b e5 da 40 6b 0b 4c
0c 7c c3 48 0d .
Oz`[..@k.L.|.H.
0240 61 e9 81 7f 9
8 e8 c1 9c 2d 70 71
f7 9a ff 9d 4f a
.......-pq....O
0250 e9 97 47 53 b
e 9d 0a 40 94 c3 1d
12 f0 98 40 80 .
.GS...@......@.
0260 65 8d 9b 36 a
b e4 40 78 73 cf 08
04 b0 0c 9f 2c e
..6..@xs......,
0270 b6 80 02 b2 f
a 24 5e 38 9c 89 f6
28 61 18 1b 05 .
....$^8...(a...
0280 ee 56 b2 e5 9
9 52 60 6a b8 b1 c7
7a f9 f4 64 1c .
V...R`j...z..d.
0290 43 e1 c6 f3 4
f 77 91 b5 d9 a9 23
6e a3 df fc ab C
...Ow....#n....
02a0 1f 6f de 2f c
d de b8 58 c8 8c 04
eb a5 af c4 87 .
o./...X........
02b0 7a 9a 08 ae 5
3 12 08 5a 31 b6 a4
61 15 0c 03 55 z
...S..Z1..a...U
02c0 70 b0 13 50 e
8 05 22 62 38 50 62
d0 2b 14 b7 29 p
..P.."b8Pb.+..)
02d0 d1 6c c4 a1 a
a 76 48 c5 5a 24 3d
84 89 70 be ad .
l...vH.Z$=..p..
02e0 86 8a 1a 8c 6
7 61 44 dd 16 36 35
09 ec 76 b8 24 .
...gaD..65..v.$
02f0 ca be 0c 53 7
2 6d 59 bd 19 06 ce
17 dc 6c 45 6f .
..SrmY......lEo
0300 71 9e da ff f
9 54 5a f6 ce ab 5c
66 10 6a 72 0a q
....TZ...\f.jr.
0310 0d 76 4b 96 7

d 0a f0 60 e3 97 b0
64 60 82 11 48 .
vK.}..`...d`..H
0320 c1 34 01 40 7
2 e1 85 a0 06 29 1f
cc c0 00 88 db .
4.@r....)......
0330 fa 73 01 e7 d
a db 70 6d 60 67 69
ce ca 48 5b d5 .
s....pm`gi..H[.
0340 14 7d e7 62 6
d db 38 e9 00 3e 98
82 63 52 37 1d .
}.bm.8..>..cR7.
0350 05 65 a8 80 5
9 1a 9e e2 44 a0 c4
c9 cd 62 0c 33 .
e..Y...D....b.3
0360 7c 2c 81 24 d
2 9f f2 c5 03 c2 fc
d7 b1 6e a6 38 |
,.$.........n.8
0370 ff cd ac c4 8
7 34 9e d7 d6
.
....4...
No. Time
Source
Destination
Protocol
Length Info
105 3.951152000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=63123
Ack=1 Win=46 Len=1
260
Frame 105: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.001082000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.001082000 s
econds
[Time delta fro
m previous captured
frame: 0.140284000
seconds]
[Time delta fro

m previous displaye
d frame: 0.14028400
0 seconds]
[Time since ref
erence or first fra
me: 3.951152000 sec
onds]
Frame Number: 1
05
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls

tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ac (61868)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a7e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 63123, Ack: 1
, Len: 1260
Source Port: ht

tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 63123 (relativ
e sequence number)
[Next sequence
number: 64383 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe13
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f

light: 2095]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ac 4
0 00 31 06 3a 7e 4a
7c 0c 8a c0 a8 .
...@.1.:~J|....
0020 01 0b 00 50 c
1 a6 2b c9 58 c0 9e
87 4e aa 50 10 .
..P..+.X...N.P.
0030 00 2e e1 35 0
0 00 62 20 4b 26 a4
51 2d 32 47 40 .
..5..b K&.Q-2G@
0040 53 8a 2a a4 4
a 0b 1a 75 86 e5 06
be e3 c6 8a 62 S
.*.J..u.......b
0050 47 a6 a4 a6 2
2 b5 7a dc 8e 3f 6f
b3 e6 d6 98 63 G
...".z..?o....c
0060 01 6e d2 ab d
0 03 e9 19 8c 0a 41
2d 49 39 8b b8 .
n........A-I9..
0070 e0 51 41 29 8
e ad 14 31 f3 9e 31
35 cf b5 55 ca .
QA)...1..15..U.
0080 97 76 f8 7f 7
d ff fb 92 04 e8 8f
f2 fb 2c d2 83 .
v..}........,..
0090 4f 7a 60 5a e
4 ea 40 65 ef 4a 0c
84 b1 4a 0d 61 O
z`Z..@e.J...J.a
00a0 e9 81 8e 18 a
8 81 9c 2d 30 84 f7
de cf 63 72 62 .
......-0....crb
00b0 c7 49 37 50 9
1 dc 84 08 30 d0 24
94 3f 14 38 2a .
I7P....0.$.?.8*
00c0 34 50 c5 91 8
e 08 87 8b c3 d7 aa
26 b8 92 a3 51 4
P.........&...Q
00d0 59 29 8c 54 f
4 ed 21 f3 a9 2a 7c
ed c4 93 8e 0c Y
).T..!..*|.....
00e0 7d 66 1e 99 9
a b5 8f 8f e5 f2 3a
cf 0c 54 e7 5c }
f........:..T.\
00f0 2b 5a 8b 9f 7
4 15 13 94 d8 dd 8d
29 a4 a3 e6 6d +
Z..t......)...m
0100 5b a9 03 84 8
3 d3 a5 53 52 be 6f
ba 8f 5b 89 5d [

......SR.o..[.]
0110 94 4b ca 5a 1
3 6a 50 c6 37 33 e6
cd 33 55 63 40 .
K.Z.jP.73..3Uc@
0120 7a 40 8e 49 5
7 81 a2 97 e0 da 2b
ce df 82 61 98 z
@.IW.....+...a.
0130 6e 59 28 75 1
3 5a 02 8c 32 86 ea
cb 1b a2 2b ea n
Y(u.Z..2.....+.
0140 e4 be ac 04 7
2 ab 4b 55 63 d8 ad
b8 88 c5 21 e4 .
...r.KUc.....!.
0150 ad be 71 3b 3
d 35 45 6b 86 31 89
e0 d2 f0 2f 9b .
.q;=5Ek.1..../.
0160 67 3a f4 92 7
8 5f ff 4d 63 34 9f
94 03 38 2a 74 g
:..x_.Mc4...8*t
0170 bb ed f4 3b a
d b3 0a 64 50 a0 b1
c2 84 3a 2e 09 .
..;...dP....:..
0180 82 a8 70 09 1
0 c7 a3 f1 aa a2 00
8f 43 92 7b 44 .
.p.........C.{D
0190 e8 7b 28 ac 2
c eb 37 e1 f8 33 14
ae 87 dc 1c 1f .
{(.,.7..3......
01a0 18 3b 5c 3b 4
8 2a 6e 6a 5a 2b 92
fa 3e 18 fa 68 .
;\;H*njZ+..>..h
01b0 ad f2 f5 c6 9
8 f2 66 5c 44 ce 61
dd 70 e5 9f f1 .
.....f\D.a.p...
01c0 36 2b 3c 68 b
f e3 38 d6 a5 9e 3c
5a 3c 60 77 31 6
+<h..8...<Z<`w1
01d0 d5 4a c0 a4 8
1 be 09 01 b7 a6 80
17 cd 3d cb dc .
J...........=..
01e0 0c 33 88 ae 9
f c8 48 93 97 e4 04
3a 9c ad 35 3e .
3....H....:..5>
01f0 0b 0b 1b e8 a
f 15 88 7b f8 a4 bd
47 66 76 40 34 .
......{...Gfv@4
0200 0b 30 ba 08 2
8 8d c4 f8 18 71 73
68 15 3a 4f 5a .
0..(....qsh.:OZ
0210 cb 18 bb 75 0
4 db 52 6f 84 27 3f
08 20 c9 d7 fb .
..u..Ro.'?. ...

0220 08 ea 06 41 f
9 a1 00 ff fb 92 04
e6 8f f2 e5 2c .
..A...........,
0230 d2 83 58 4a 6
0 5b 06 2a 40 67 0d
4c 0c 64 b5 4c .
.XJ`[.*@g.L.d.L
0240 0d 61 e9 81 7
0 96 29 01 9c 3d 30
3c 50 cc a3 5f .
a..p.)..=0<P.._
0250 a1 7f 52 14 0
e d0 f0 e5 39 4a f4
f8 60 62 00 b2 .
.R.....9J..`b..
0260 f6 b8 ca 5e c
9 82 12 5e ca 63 11
5f 08 0b 69 7a .
..^...^.c._..iz
0270 2e 94 c7 3c f
2 97 c3 92 29 ee 64
13 04 cd 0a cf .
..<....).d.....
0280 0b 80 62 84 9
3 20 24 72 6d 20 0c
04 08 cd a0 b3 .
.b.. $rm ......
0290 31 91 1b 90 4
0 bb 74 c2 69 59 3a
26 22 c5 f8 30 1
...@.t.iY:&"..0
02a0 92 ad a0 1e 4
0 2c 08 83 f3 42 02
68 26 5c d0 3e .
...@,...B.h&\.>
02b0 fe 27 9c ea 2
d d9 e9 e2 4b 06 31
ad 92 42 28 93 .
'..-...K.1..B(.
02c0 cb bc a0 c5 c
4 fc e4 b9 c1 17 09
3e 88 10 e6 7b .
..........>...{
02d0 a6 11 49 ad a
b a5 bb d3 96 51 af
68 e8 f4 4b 1c .
.I......Q.h..K.
02e0 5b 42 7d 2b d
7 1a 5b 59 81 2c d7
bc fb d5 b7 5c [
B}+..[Y.,.....\
02f0 63 eb ea 9b d
5 e7 a8 d6 97 59 45
94 b1 c1 f2 67 c
........YE....g
0300 24 d0 78 9a 9
4 08 3a e2 ec 43 fa
59 47 f0 c7 bb $
.x...:..C.YG...
0310 b6 4e 73 a9 2
a cd 09 d8 8a ec 4c
f6 3a ef 27 74 .
Ns.*.....L.:.'t
0320 0a 86 00 8a 7
1 dc c8 7c 36 74 4b
70 2e 27 c7 03 .
...q..|6tKp.'..
0330 c7 f6 fe 4c 6

a 72 9c 6e b3 c9 e9
d3 26 c2 0c 01 .
..Ljr.n....&...
0340 d0 62 52 44 8
d 5f 88 66 97 4f 3c
6a 0f d9 d7 3d .
bRD._.f.O<j...=
0350 37 ee cd b0 e
f 6c d9 76 67 78 aa
c7 24 4e 2b 08 7
....l.vgx..$N+.
0360 a8 e1 90 c7 1
d 67 ab 77 e5 1d fb
97 5b d9 c3 e4 .
....g.w....[...
0370 15 2c 4d 1e 2
1 6c 41 05 0b ac ad
2d 79 9f a5 eb .
,M.!lA....-y...
0380 6e 61 87 20 2
e 38 2a 21 4d 28 20
62 d8 40 e3 11 n
a. .8*!M( b.@..
0390 17 14 48 66 0
9 c9 db 4d 6a 15 15
36 45 65 18 80 .
.Hf...Mj..6Ee..
03a0 8c b2 bc 41 d
7 07 6d 1f f2 fd fd
18 c6 81 ed cc .
..A..m.........
03b0 26 e7 19 19 3
7 c7 93 0c 0c b3 c8
3f db a5 f9 b6 &
...7......?....
03c0 3f bb f7 00 d
b af e7 3f fe ff fb
92 04 ea 0f f2 ?
......?........
03d0 ed 2c d5 03 0
f 4a 60 61 65 1a 90
61 e9 4a 0b f8 .
,...J`ae..a.J..
03e0 91 5a 0c 3d e
9 41 72 16 6b 41 96
19 30 4d 76 4d .
Z.=.Ar.kA..0MvM
03f0 49 6d 23 c0 a
8 35 31 56 e6 02 99
30 d4 91 ff be I
m#..51V...0....
0400 cb c7 10 ae 2
a 36 6d 55 89 82 a9
a4 4a ca 5b e6 .
...*6mU....J.[.
0410 c4 46 51 ac 0
1 dd 28 86 c6 10 22
42 c3 df 28 91 .
FQ...(..."B..(.
0420 94 5e 1a dc e
f 50 e9 b8 31 ae 8c
5e 8e ea 48 6a .
^...P..1..^..Hj
0430 10 5e 1f b7 1
5 83 20 10 10 79 57
43 6a 94 2a 51 .
^.... ..yWCj.*Q
0440 4c 20 89 72 2
5 10 c5 39 d8 fb c4

e1 77 cd c9 b0 L
.r%..9....w...
0450 e6 af 5d 34 3
0 e4 4e 50 5a 00 5e
42 cc f2 f9 18 .
.]40.NPZ.^B....
0460 1d 05 dc fa 1
c 8c c6 6a 44 90 26
90 4d 04 05 c1 .
......jD.&.M...
0470 94 cc 0e 91 6
3 8c 84 25 2b 33 65
e6 7d 22 72 30 .
...c..%+3e.}"r0
0480 38 f9 89 16 8
7 7b 3c cf 2b d0 dc
c5 af 59 f4 25 8
....{<.+....Y.%
0490 7d 76 cc eb 7
5 6e e6 75 63 b3 df
23 50 95 06 dc }
v..un.uc..#P...
04a0 98 ca 5e a7 3
9 03 68 da e3 c3 08
96 ea 4d 7d f7 .
.^.9.h......M}.
04b0 63 d1 98 cc d
b e6 c1 49 20 9b 89
88 dc 56 a0 9e c
......I ....V..
04c0 b7 c1 20 b2 1
1 a8 68 44 c4 89 51
86 1b 42 d3 2e .
. ...hD..Q..B..
04d0 9c f4 ea 25 4
9 3a 54 f3 86 5b e7
db 13 86 9b 3b .
..%I:T..[.....;
04e0 55 a5 b2 4b 7
9 cc d6 73 b4 d1 32
1e 59 2d 52 0d U
..Ky..s..2.Y-R.
04f0 a8 e1 2a f2 c
b 49 2a 4d 92 3f 79
47 08 20 12 82 .
.*..I*M.?yG. ..
0500 53 82 af 31 b
0 9a 64 03 af 01 a2
40 ff 63 d2 e7 S
..1..d....@.c..
0510 44 d4 21 25 6
1 09 8d 88 70 36 26
21 84 78 57 51 D
.!%a...p6&!.xWQ
0520 5f 2e
_
.
No. Time
Source
Destination
Protocol
Length Info
106 3.951327000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP

54 49574h
ttp [ACK] Seq=1 Ack
=64383 Win=39796 Le
n=0
Frame 106: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.001257000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.001257000 s
econds
[Time delta fro
m previous captured
frame: 0.000175000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 3.951327000 sec
onds]
Frame Number: 1
06
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90

:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f40 (20288)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset

:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 64383
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 64383 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39796
[Calculated win
dow size: 39796]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 105]
[The RTT to
ACK the segment wa
s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 40 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O@@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 5d ac 50 10 .
....P..N.+.].P.
0030 9b 74 18 d4 0
0 00
.
t....
No. Time
Source
Destination
Protocol
Length Info
107 4.024721000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=64383
Ack=1 Win=46 Len=1
260
Frame 107: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.074651000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.074651000 s
econds
[Time delta fro
m previous captured
frame: 0.073394000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07339400
0 seconds]
[Time since ref
erence or first fra
me: 4.024721000 sec
onds]
Frame Number: 1
07
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ad (61869)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a7d [validatio
n disabled]
[Good: Fals

e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 64383, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 64383 (relativ
e sequence number)
[Next sequence
number: 65643 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x661
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ad 4
0 00 31 06 3a 7d 4a
7c 0c 8a c0 a8 .
...@.1.:}J|....
0020 01 0b 00 50 c
1 a6 2b c9 5d ac 9e
87 4e aa 50 10 .
..P..+.]...N.P.
0030 00 2e 66 11 0
0 00 f6 44 e2 dc 41
cc 0e 9e d9 e2 .
.f....D..A.....
0040 34 a1 3f 6b 3
1 31 91 1f 30 e9 08
d4 40 90 5d 63 4
.?k11..0...@.]c
0050 d4 f4 1f 5f b
7 7a a9 a1 ce d7 39
f2 d9 f1 eb 27 .
.._.z....9....'
0060 7b 25 df 05 b
f 3f b3 6c dc 41 02
9b 67 f2 0a 68 {
%...?.l.A..g..h
0070 24 15 c2 bf 9
e 29 8f f0 af 4d f8
c2 1b 23 e6 ff $
....)...M...#..
0080 fb 92 04 eb 0
f f2 f6 1d d8 03 09
42 52 64 05 1b .
..........BRd..
0090 10 61 29 4a 0
b f1 09 62 07 98 4b
89 6e 11 2c 80 .
a)J...b..K.n.,.
00a0 f4 99 28 3b d
8 d7 34 33 ed 7c 7c
2d 16 ca ae 7b .
.(;..43.||-...{
00b0 05 87 00 28 d
3 73 96 41 4e d2 5b

11 2a 56 90 81 .
..(.s.AN.[.*V..
00c0 39 44 ac a2 6
4 c0 da 92 80 a7 b4
30 1f 14 81 e1 9
D..d......0....
00d0 f2 13 0d 38 e
b 26 06 95 9a 2a a9
0c cb 0a 73 a6 .
..8.&...*....s.
00e0 3f 89 99 48 c
e 24 26 48 76 55 ab
7b 56 75 70 99 ?
..H.$&HvU.{Vup.
00f0 90 e9 26 c1 a
7 88 80 21 a5 bb 15
30 c9 63 c9 64 .
.&....!...0.c.d
0100 58 1a 36 d6 0
c 7f bb fd 65 b3 30
e2 81 42 03 88 X
.6.....e.0..B..
0110 a4 58 e5 34 c
f 47 a2 ec 17 85 f1
f8 75 3d 1f 48 .
X.4.G......u=.H
0120 1d 17 a8 a7 3
2 ad 42 8a 69 bb 89
fd 0a 43 ed ea .
...2.B.i....C..
0130 e4 a7 a6 f4 3
4 74 22 d8 e2 4d ea
f6 2a 9a 3f 66 .
...4t"..M..*.?f
0140 2c cc ce fd f
e af 52 7e d6 e8 7b
73 e7 6a d6 95 ,
.....R~..{s.j..
0150 3e 80 9b 4a a
a 45 85 52 d5 d3 a5
5d 7f d7 db 03 >
..J.E.R...]....
0160 5b ab fa 91 4
c 05 e3 1a dd b1 dd
2f 45 46 b1 5d [
...L....../EF.]
0170 b0 b8 4d 53 d
5 b1 54 4a 9a 5b a1
9c 23 e9 dc 38 .
.MS..TJ.[..#..8
0180 69 b4 d3 8b 7
3 93 8b 92 7a 9d 34
b5 02 2b a0 92 i
...s...z.4..+..
0190 56 8c 4b d7 6
4 bd b0 8f 0e 9c 39
04 7d 13 75 34 V
.K.d.....9.}.u4
01a0 b3 76 8e d0 f
d 2b d6 b3 af b0 e6
da d3 3e ea 4a .
v...+.......>.J
01b0 9d 94 48 75 2
5 9d 80 dd a4 b6 c5
ff 5f 6c b4 ea .
.Hu%......._l..
01c0 6a fe 59 31 0
3 2c 88 b1 86 63 4c
d4 c2 84 8c 31 j

.Y1.,...cL....1
01d0 d1 47 5a 05 1
4 71 05 22 51 50 74
27 dd 9a 8a 53 .
GZ..q."QPt'...S
01e0 cd 44 fa 2a 8
9 9d bc dd a2 a4 7a
d5 50 83 8f 01 .
D.*......z.P...
01f0 17 de 28 a8 e
6 9d 89 93 96 18 29
9d f5 5c 50 8e .
.(.......)..\P.
0200 7f 16 f5 1a 7
7 a8 d3 f6 d8 ba b3
d3 35 98 28 d9 .
...w.......5.(.
0210 60 19 d0 18 9
8 50 44 1d bd 65 0f
35 c9 59 95 45 `
....PD..e.5.Y.E
0220 6b ff fb 92 0
4 eb 0f f3 12 27 57
03 2c 32 52 5b k
........'W.,2R[
0230 24 7a f0 61 2
8 4a 0b 5c 9d 56 0d
3d 89 41 7e 14 $
z.a(J.\.V.=.A~.
0240 aa c1 87 b1 3
0 eb 59 a1 23 10 1e
59 71 d4 64 1e .
...0.Y.#..Yq.d.
0250 86 cc b4 12 1
0 0d 96 da ca 34 dd
1c 2a f5 33 22 .
........4..*.3"
0260 16 44 3b 3a 8
e db 41 6d b5 59 93
6b a6 14 31 c0 .
D;:..Am.Y.k..1.
0270 76 b3 c4 2f 4
a 65 98 5a 72 51 48
f5 e1 09 cf 79 v
../Je.ZrQH....y
0280 42 94 7f 0b 7
5 4e ca bd 71 87 be
d3 5f 7f 3b ec B
...uN..q..._.;.
0290 7f 57 29 ba e
4 d2 d7 9c cd ff b5
b3 2e f7 8d d6 .
W).............
02a0 80 71 ca a5 4
a 5b 96 10 d6 5d cc
dd f4 ac 72 60 .
q..J[...]....r`
02b0 6e a6 51 26 6
2 41 63 11 38 8d f4
54 05 26 05 1e n
.Q&bAc.8..T.&..
02c0 28 b9 95 b7 1
3 63 f9 91 86 28 ae
42 8e 77 9f ee (
....c...(.B.w..
02d0 cf f8 4a c5 d
1 90 ac 6e 57 c3 1e
ca e6 15 61 43 .
.J....nW.....aC

02e0 2e 5f a9 d4 5
6 8c e6 f9 77 bc da
25 e2 56 8f 99 .
_..V...w..%.V..
02f0 66 8b 25 f7 9
8 5a 9a 69 fc 5a 6e
f5 d6 e6 b6 31 f
.%..Z.i.Zn....1
0300 8f ad 4f d7 4
c d9 7a 85 8b 2a e9
cc 6a 15 f5 50 .
.O.L.z..*..j..P
0310 31 23 9e be 8
7 9e 30 e9 7e 51 35
af a6 90 e8 8d 1
#....0.~Q5.....
0320 f3 4b 80 a6 6
9 0e 62 f8 a3 6e 35
d8 24 6f 43 10 .
K..i.b..n5.$oC.
0330 d3 dd cd 55 1
1 ce e9 86 05 b3 39
88 fd 65 52 23 .
..U......9..eR#
0340 6f 2b 1b 13 a
2 01 a4 00 d0 fe 18
70 72 17 33 80 o
+.........pr.3.
0350 16 14 52 35 1
a 53 23 98 76 97 67
d0 fb 6b de 69 .
.R5.S#.v.g..k.i
0360 e9 6a eb d3 e
e a6 fe e2 79 61 d1
e3 0c 77 39 db .
j......ya...w9.
0370 6b 0a 8a 41 3
8 ad 62 22 45 08 20
0c 9b e4 ca 0b k
..A8.b"E. .....
0380 16 3a c2 12 9
1 40 be 1b a8 7c 15
13 50 fd a4 63 .
:...@...|..P..c
0390 0d d3 72 e5 1
d 56 35 4b 16 4e 45
c1 6f 82 fc 79 .
.r..V5K.NE.o..y
03a0 23 9c b2 e0 d
a a4 7b 0d f3 2a 92
7d c2 8b b8 99 #
.....{..*.}....
03b0 b3 7d a7 a4 5
d 4f 7f af 4d 63 fc
53 3d 9f 4f 49 .
}..]O..Mc.S=.OI
03c0 07 36 20 ff f
b 92 04 ee 0f f2 fd
27 d5 03 2f 62 .
6 ........'../b
03d0 50 67 26 3a 8
0 61 ec 5c 0c 44 b1
50 0c bd e9 81 P
g&:.a.\.D.P....
03e0 84 9b 6a 01 9
7 a1 70 95 2c 9d 66
92 2f 53 18 bf .
.j...p.,.f./S..
03f0 a0 b9 61 d2 4

9 63 58 01 93 0b 96
95 40 d6 c9 50 .
.a.IcX.....@..P
0400 06 a8 dc 58 5
5 12 a2 25 43 f0 62
3c 8e f9 c2 29 .
..XU..%C.b<...)
0410 ce d9 96 e7 a
c 67 a6 03 90 87 74
e0 38 ca 27 9c .
....g....t.8.'.
0420 be b7 84 f7 5
2 2a ab 5b 1d be 9e
53 fd 86 b6 dd .
...R*.[...S....
0430 9c 47 6a 4f d
7 ab 30 c0 30 2c c0
b8 63 51 27 57 .
GjO..0.0,..cQ'W
0440 5d 2d 85 19 7
5 4e b1 1a 05 89 00
92 6d ea 29 09 ]
-..uN......m.).
0450 09 60 28 02 5
f 4d 17 7c c3 35 a0
92 2e 2f 59 65 .
`(._M.|.5.../Ye
0460 35 ca 67 b6 9
5 58 a2 f3 ee ea dc
81 60 38 66 6e 5
.g..X......`8fn
0470 a2 e0 ec 37 0
4 cd 41 15 7a 3a 5d
78 12 62 22 b6 .
..7..A.z:]x.b".
0480 0a b2 22 9e d
b b6 31 88 91 e0 a8
35 89 7c f0 73 .
."...1....5.|.s
0490 f5 48 d7 c6 3
f f9 6b ce ff ff 75
dc 98 b4 25 60 .
H..?.k...u...%`
04a0 61 bd 76 c3 b
9 cd 54 7f ba fd 1a
50 1b 00 aa 42 a
.v...T....P...B
04b0 33 a5 21 85 b
1 f6 00 aa 8d 29 50
ae d6 d6 31 4d 3
.!......)P...1M
04c0 05 bb e5 84 3
4 5a 9a 50 4c 8f 8e
34 be 9e 99 e4 .
...4Z.PL..4....
04d0 bc 77 97 57 a
9 24 e3 db 12 56 15
7a 99 bb 2a d6 .
w.W.$...V.z..*.
04e0 b7 03 05 cb 1
1 ea 4e 72 b2 90 7b
d0 82 28 5e 97 .
.....Nr..{..(^.
04f0 70 28 b0 de b
3 42 b5 fa db cc a4
70 d7 69 47 52 p
(...B.....p.iGR
0500 c3 8e 15 4b 4
4 08 ff 6d 2a 2f 31

82 0c 66 cd a2 .
..KD..m*/1..f..
0510 69 8b 52 61 3
c 19 10 00 80 20 d2
e0 a8 28 30 1f i
.Ra<.... ...(0.
0520 06 b4
.
.
No. Time
Source
Destination
Protocol
Length Info
108 4.073158000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=65643
Ack=1 Win=46 Len=1
260
Frame 108: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.123088000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.123088000 s
econds
[Time delta fro
m previous captured
frame: 0.048437000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04843700
0 seconds]
[Time since ref
erence or first fra
me: 4.073158000 sec
onds]
Frame Number: 1
08
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]

[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)

.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ae (61870)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a7c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 65643, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 65643 (relativ
e sequence number)
[Next sequence
number: 66903 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)

Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe1b
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ae 4
0 00 31 06 3a 7c 4a
7c 0c 8a c0 a8 .
...@.1.:|J|....
0020 01 0b 00 50 c
1 a6 2b c9 62 98 9e
87 4e aa 50 10 .
..P..+.b...N.P.
0030 00 2e e1 be 0
0 00 11 27 34 dc 52
e9 c0 8c b9 30 .

......'4.R....0
0040 30 06 4a 31 e
1 1e e6 7c 07 3b 5b
24 17 e3 7e 33 0
.J1...|.;[$..~3
0050 e2 73 83 a7 9
7 20 5a 58 2f d5 0d
ec 1e 23 1c bd .
s... ZX/....#..
0060 b3 4a 2a 86 3
d 4f f5 e8 72 31 ae
b7 8c be e7 bf .
J*.=O..r1......
0070 75 2b c9 52 f
0 fa b2 67 84 ff fb
92 04 e8 0f f2 u
+.R...g........
0080 de 27 d4 83 2
f 7a 50 57 84 fa 80
61 ec 4a 0c 38 .
'../zPW...a.J.8
0090 b3 50 0c e1 e
9 89 79 98 e9 c1 97
a1 70 e5 42 19 .
P....y.....p.B.
00a0 e8 d6 d2 a6 e
3 ba 05 4e 25 18 ca
11 86 18 49 05 .
......N%.....I.
00b0 d2 86 1c f5 e
c 33 6c 45 8c 59 84
b1 86 01 56 39 .
....3lE.Y....V9
00c0 1e 0c 4d a8 c
4 a1 8e 32 6e 4b ed
40 29 d1 11 71 .
.M....2nK.@)..q
00d0 4e c2 1c 73 c
e ab 3d d6 b5 0e 03
54 6f 9a b8 34 N
..s..=....To..4
00e0 fa cf 84 7c 2
f 85 64 90 75 17 51
b7 e5 6e 7d f3 .
..|/.d.u.Q..n}.
00f0 a8 85 81 d3 c
1 e5 91 52 02 81 f3
60 c3 9c 81 45 .
......R...`...E
0100 92 0e c0 3a b
d 5b 69 fe b0 b0 31
a1 24 cb 85 50 .
..:.[i...1.$..P
0110 27 d9 af fc 6
a 81 12 8c 32 44 8a
a1 0e a1 16 64 '
...j...2D.....d
0120 5c 9c 8a 7b 3
1 70 c2 36 95 ad 87
9c 53 b9 f3 c9 \
..{1p.6....S...
0130 c5 89 26 be 8
6 3f 2e cf db 89 50
f8 7f 2e ec d8 .
.&..?....P.....
0140 dd 78 53 2e 9
4 52 62 95 ae 2f a8
6f 33 0a f6 be .
xS..Rb../.o3...

0150 77 0d 5d fe a
0 d7 19 d5 22 ff f1
b9 75 7c 47 f7 w
.]....."...u|G.
0160 15 2a 71 b9 3
4 2a aa b9 aa 28 45
51 08 c1 cc 37 .
*q.4*...(EQ...7
0170 2d 04 09 dc b
0 91 24 d1 0d 82 31
b1 1b 52 86 9e .....$...1..R..
0180 95 f2 d9 3d 3
0 93 a0 48 ac 79 c1
79 1f 4a df 51 .
..=0..H.y.y.J.Q
0190 18 5a 2c 6e 5
1 9b ed 76 f3 fc aa
b4 75 72 b3 2a .
Z,nQ..v....ur.*
01a0 97 56 f4 28 a
0 67 77 bb 96 6b 74
fe 2f 4a da 79 .
V.(.gw..kt./J.y
01b0 6d 96 87 b6 f
a ae f5 a9 a3 ff eb
9b e7 30 bf fe m
............0..
01c0 bf e7 12 ea e
5 33 7d 0e 5f f6 e8
06 0c 00 98 31 .
....3}._......1
01d0 e1 8c 4a 83 1
8 d0 da ab 09 12 02
04 05 54 61 ca .
.J..........Ta.
01e0 b1 80 96 da 9
2 40 a1 96 49 c4 02
ae 66 6f 20 d0 .
....@..I...fo .
01f0 54 c3 6a 63 0
d 06 9f 32 53 4c 83
16 93 2a 17 90 T
.jc...2SL...*..
0200 4a cc 6a 04 3
8 4b 1b 49 c7 8d 98
ef dc 6b ec bf J
.j.8K.I.....k..
0210 36 63 61 7a d
a f0 6d 07 5e b8 ce
ff fb 92 04 ed 6
caz..m.^.......
0220 0f f3 2a 31 5
3 83 4f 4a 60 62 44
aa 70 67 0f 4a .
.*1S.OJ`bD.pg.J
0230 0c 30 b5 4e 0
d 3d e9 81 84 18 e9
c1 8c 3d 70 6d .
0.N.=.......=pm
0240 39 e6 1a 16 2
2 c8 62 a7 18 0c 8a
64 7f a7 f5 81 9
...".b....d....
0250 1c 2a 4b 03 9
9 89 80 83 14 15 4d
50 c9 3d 0c 1f .
*K.......MP.=..
0260 98 e3 5e 91 c

7 55 0a 00 23 33 f2
92 8c 39 98 4d .
.^..U..#3...9.M
0270 43 d1 58 e4 c
c b5 bb 3c b4 f4 df
2d 64 37 aa 96 C
.X....<...-d7..
0280 0d 06 77 fc b
d 4a 49 23 0e cb 36
85 e2 b6 3f 30 .
.w..JI#..6...?0
0290 99 7e 75 23 b
7 6b 6e a0 ee 6e 6d
28 f5 ff 26 db .
~u#.kn..nm(..&.
02a0 dd ac b1 67 9
0 19 7d 2a 12 a9 94
31 4a 79 8a a4 .
..g..}*...1Jy..
02b0 43 c2 c2 c1 4
6 0c 5c 60 13 24 80
22 11 90 ba 69 C
...F.\`.$."...i
02c0 83 08 4f 8d 0
2 2d 26 43 4c e7 7e
5e 95 80 da 8c .
.O..-&CL.~^....
02d0 cf 0d a0 9b b
3 99 30 4f 96 ec 93
f6 d7 a4 bb b5 .
.....0O........
02e0 0d 92 e7 19 3
7 a6 a6 47 cc 13 bc
0e 91 ee 68 d4 .
...7..G......h.
02f0 f5 54 1f 6b 8
d da cf 89 2d 46 b7
4f 15 0b 7f 5b .
T.k....-F.O...[
0300 5b ab fc bf 9
f 3f 89 fa 7a bf e8
04 80 30 69 c6 [
....?..z....0i.
0310 55 83 86 00 8
5 82 01 b2 64 3b af
73 1b 0c 20 a1 U
.......d;.s.. .
0320 72 cb 80 d5 0
1 86 1b 12 e0 71 ad
3f 6e 34 19 cf r
........q.?n4..
0330 f4 a4 a5 91 c
6 27 88 53 fd 08 56
28 6e ad 20 d8 .
....'.S..V(n. .
0340 35 86 bb a2 8
f 19 4f f6 9b 66 0d
e3 67 55 6b db 5
.....O..f..gUk.
0350 e6 7c d7 1b e
c 13 44 a6 31 9f 89
5b 0d 95 10 10 .
|....D.1..[....
0360 12 4a 3e 48 a
8 41 2a 7b f4 55 4d
53 3a e9 7d 88 .
J>H.A*{.UMS:.}.
0370 57 8d 1a 3b c
1 47 cf 91 1c 32 c4

11 fd a8 15 be W
..;.G...2......
0380 43 28 57 93 9
1 f5 59 14 47 d8 ad
ff 75 69 2c 73 C
(W...Y.G...ui,s
0390 28 0e 1c 82 5
3 fe 27 2f 70 6f c4
8f 61 1c c2 57 (
...S.'/po..a..W
03a0 c2 55 ea ec 5
9 3f a3 7c 51 76 ef
f6 c7 0a e1 eb .
U..Y?.|Qv......
03b0 5b 6d 29 0e 3
c cf ff d6 3e a1 4d
37 d5 ff fb 92 [
m).<...>.M7....
03c0 04 e7 0f f3 0
1 27 53 83 4f 7a 50
5d e5 8a 60 67 .
....'S.OzP]..`g
03d0 0c 4c 0b c0 c
7 4e 0d bd 6b 81 78
93 a9 41 a7 bd .
L...N..k.x..A..
03e0 28 3d a0 e6 5
3 8d 24 25 10 1c 53
85 6e ff ee a4 (
=..S.$%..S.n...
03f0 78 46 b2 63 a
e 38 72 80 24 a2 5d
b4 b4 a0 0f 14 x
F.c.8r.$.].....
0400 27 83 49 f3 0
0 e4 04 53 30 78 7a
33 95 f2 39 05 '
.I....S0xz3..9.
0410 62 14 39 53 8
a d3 cd 10 69 15 68
95 19 eb 1d 89 b
.9S....i.h.....
0420 5c 23 28 29 7
5 86 f7 26 f4 2d f9
cd 1b 18 6d 5d \
#()u..&.-....m]
0430 53 58 5e 4b 6
2 3b fd bc a5 29 78
d3 d7 1a dd b5 S
X^Kb;...)x.....
0440 0d 83 5f 53 5
e 98 f3 67 ef db 39
af 9e 5e b6 18 .
._S^..g..9..^..
0450 65 4f e9 29 8
0 28 c0 60 b4 c5 cd
4c 4a a0 c0 40 e
O.).(.`...LJ..@
0460 86 46 0c 74 c
8 bb b4 00 32 ca a5
2a 0f 4b 59 75 .
F.t....2..*.KYu
0470 cc 11 1b 09 5
5 f4 e1 8a cc de c2
30 bd da c3 3c .
...U......0...<
0480 93 c0 cd 52 8
e 3e 36 00 83 2d f5
76 42 81 c1 92 .

..R.>6..-.vB...
0490 73 d9 50 d7 f
4 c9 89 ee 39 d6 f2
e5 1c 8b da 0b s
.P.....9.......
04a0 8e 29 8e f2 f
2 ad d7 2f d8 02 30
c5 d7 32 ed ab .
)...../..0..2..
04b0 55 00 a1 01 7
4 46 a6 18 28 46 42
a5 1c 14 42 11 U
...tF..(FB...B.
04c0 9f 51 6e 03 0
c 24 a3 74 43 08 ff
30 43 7e 47 c4 .
Qn..$.tC..0C~G.
04d0 ac 1e 03 a9 5
b 15 b4 14 24 d0 3e
08 aa d7 81 45 .
...[...$.>....E
04e0 49 cd 41 20 f
d 46 1c 2c 6d 49 d5
44 77 6b 91 38 I
.A .F.,mI.Dwk.8
04f0 a7 bc ae 44 e
4 2c 6d e9 82 c8 df
51 79 ca 57 61 .
..D.,m....Qy.Wa
0500 e8 94 b1 c7 0
c b1 42 06 01 c9 61
2e 52 95 4b d6 .
.....B...a.R.K.
0510 12 0a d1 0f 0
5 63 3e 64 23 80 b8
62 0e c4 6b 3a .
....c>d#..b..k:
0520 86 92
.
.
No. Time
Source
Destination
Protocol
Length Info
109 4.073332000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=66903 Win=40005 Le
n=0
Frame 109: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:26:5

7.123262000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.123262000 s
econds
[Time delta fro
m previous captured
frame: 0.000174000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017400
0 seconds]
[Time since ref
erence or first fra
me: 4.073332000 sec
onds]
Frame Number: 1
09
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f41 (20289)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.

com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 66903
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 66903 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40005
[Calculated win
dow size: 40005]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 108]
[The RTT to
ACK the segment wa
s: 0.000174000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 41 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OA@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 67 84 50 10 .
....P..N.+.g.P.
0030 9c 45 18 d4 0
0 00
.
E....
No. Time
Source
Destination
Protocol
Length Info
110 4.100160000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1283 http49
574 [PSH, ACK] Seq=
66903 Ack=1 Win=46
Len=1229
Frame 110: 1283 byt
es on wire (10264 b
its), 1283 bytes ca
ptured (10264 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.150090000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.150090000 s
econds
[Time delta fro

m previous captured
frame: 0.026828000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02682800
0 seconds]
[Time since ref
erence or first fra
me: 4.100160000 sec
onds]
Frame Number: 1
10
Frame Length: 1
283 bytes (10264 bi
ts)
Capture Length:
1283 bytes (10264
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080

0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
269
Identification:
0xf1af (61871)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a9a [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P

ort: 49574 (49574),

Seq: 66903, Ack: 1
, Len: 1229
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1229]
Sequence number
: 66903 (relativ
e sequence number)
[Next sequence
number: 68132 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x5fd
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:

0
[SEQ/ACK analys
is]
[Bytes in f
light: 1229]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 04 f5 f1 af 4
0 00 31 06 3a 9a 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 67 84 9e
87 4e aa 50 18 .
..P..+.g...N.P.
0030 00 2e 5f d2 0
0 00 52 51 a7 42 b0
47 59 54 7e 18 .
._...RQ.B.GYT~.
0040 9c a7 82 d4 8
c ec 7e 29 5d 8c 34
ea 80 28 e2 27 .
.....~)].4..(.'
0050 0f 68 24 07 8
b 51 61 c8 fb c9 9b
43 1e 54 56 5b .
h$..Qa....C.TV[
0060 8a 39 d2 6a 1
5 61 49 47 69 ad ac
6d d9 d7 26 75 .
9.j.aIGi..m..&u
0070 96 c6 14 ff f
b 92 04 e8 8f f3 0e
2b d3 03 58 7a .
..........+..Xz
0080 60 61 a6 1a 5
0 65 ef 4c 0b d4 b3
4c 0d e1 29 81 `
a..Pe.L...L..).
0090 76 13 e9 41 9
7 b1 28 17 16 00 3e
d2 c6 5a fa 7b v
..A..(...>..Z.{
00a0 ad ad 0e 26 5
2 cf b1 ae bb 98 16
0e 70 01 32 99 .
..&R.......p.2.
00b0 88 89 59 80 9
1 3f 11 35 6e 44 69
22 e6 76 41 58 .
.Y..?.5nDi".vAX
00c0 90 57 6e ac 3
5 c2 7f de ca 58 a3
69 00 b3 88 1a .
Wn.5....X.i....
00d0 3d 1c 8c d3 2
8 08 1f 6e 72 5b 5a
16 60 43 08 ee =
...(..nr[Z.`C..
00e0 8e 3b f0 78 5
7 34 86 29 ba cc 27
13 37 19 6c 76 .
;.xW4.)..'.7.lv
00f0 c8 95 74 3c 2
b 21 8f a4 12 69 60
41 c9 6a 5d d5 .

.t<+!...i`A.j].
0100 99 e9 5d 82 1
1 31 22 00 a9 f1 6a
0c a6 b4 1c 42 .
.]..1"...j....B
0110 db 18 71 01 6
0 dd c7 00 1e 2f 4c
df 34 b9 f4 b9 .
.q.`..../L.4...
0120 67 e9 b3 3b 7
5 c9 7f 5c 88 25 a8
4d 36 f0 97 79 g
..;u..\.%.M6..y
0130 40 9c d0 e6 e
1 48 f4 02 29 83 17
1e 49 32 c8 49 @
....H..)...I2.I
0140 27 fb d6 da 2
9 46 95 62 84 cf f2
ef 5b 43 f6 aa '
...)F.b....[C..
0150 d7 6c c3 02 f
9 ad 67 82 8b 9a 0d
0c ef 43 69 6f .
l....g......Cio
0160 4c 08 01 91 2
5 78 84 d1 11 af f9
ae c8 d0 25 a8 L
...%x........%.
0170 7c 0a a5 96 b
b 09 42 1d c8 61 f9
b4 b9 68 ab bf |
.....B..a...h..
0180 0a 4d 7e c1 6
c 93 24 dc 75 a8 c1
44 8e 8d 6b 12 .
M~.l.$.u..D..k.
0190 15 00 e2 36 a
b 51 db 8b a7 eb 84
ae f6 e3 7d 45 .
..6.Q........}E
01a0 24 bf 07 ba e
4 08 b2 d0 23 8b aa
ed fa 67 d9 95 $
.......#....g..
01b0 14 30 2a c1 7
2 63 03 28 e9 ba 95
62 21 5b cb 7a .
0*.rc.(...b![.z
01c0 62 b0 0c b0 f
8 a4 27 b4 04 80 b6
0a 34 3f 80 9e b
.....'.....4?..
01d0 5b 46 29 4b d
3 59 4e a5 09 8d ce
46 8a 67 33 34 [
F)K.YN....F.g34
01e0 86 68 10 a8 c
2 58 0b 86 17 86 cb
fd 84 c7 b1 d0 .
h...X..........
01f0 53 d1 08 70 d
8 98 54 7a 61 b0 09
0f 5b 30 27 65 S
..p..Tza...[0'e
0200 4f 92 ed 43 1
5 49 ed ca 3b da a9
4b 7e ea 6e e5 O
..C.I..;..K~.n.

0210 5c 48 04 b0 5
d ff fb 92 04 e7 8f
f2 de 27 53 83 \
H..]........'S.
0220 38 62 50 60 4
5 8a 50 67 09 4c 0b
a0 9f 4c 0d e1 8
bP`E.Pg.L...L..
0230 89 41 6e 13 a
9 41 9c 31 28 3b 0f
eb 52 3a 80 40 .
An..A.1(;..R:.@
0240 35 26 30 06 1
8 6c 2a 02 03 c0 4e
82 54 32 e9 67 5
&0..l*...N.T2.g
0250 61 60 3d f4 2
0 23 01 43 03 0f 1d
fc 62 4d 3a 1e a
`=. #.C....bM:.
0260 7d 8a 1f 1d a
6 68 16 0a 80 52 6b
ed 84 46 65 8c }
....h...Rk..Fe.
0270 66 37 92 3c 0
5 eb 33 f9 53 38 61
62 8a 57 c1 c6 f
7.<..3.S8ab.W..
0280 70 86 28 3c a
f 57 76 8a ad fb f8
c3 d6 49 fe f1 p
.(<.Wv......I..
0290 af 97 aa dc f
c d6 b4 ce b2 f0 5c
5d 90 32 cc 60 .
.........\].2.`
02a0 77 ea 57 81 6
1 d7 44 10 3a 9d 86
61 68 62 21 00 w
.W.a.D.:..ahb!.
02b0 01 01 43 33 1
3 12 07 80 dd 71 57
8f e6 d7 a1 04 .
.C3.....qW.....
02c0 55 0b ac 29 8
c e2 1c 2f cc f4 0b
b8 8d 28 e5 11 U
..).../.....(..
02d0 4a 6f 25 5c a
a 56 8f c4 aa 3b 70
9c a2 d1 be 11 J
o%\.V...;p.....
02e0 57 3c 5b d6 3
6 73 b8 47 d5 1d 2e
71 8f f6 db 7a W
<[.6s.G...q...z
02f0 7f 12 d8 f5 8
3 bf f5 6f f7 88 1f
5f 11 e9 3c 04 .
......o..._..<.
0300 7d 0f ea 0a 0
d 19 cc 8c 12 01 56
46 f1 0a 28 c1 }
.........VF..(.
0310 e0 70 cf 00 4
4 a6 3d 29 9f 04 1c
46 2b 69 c9 51 .
p..D.=)...F+i.Q
0320 6b cd d1 c1 a

4 42 8a 33 27 e6 30
dc 9e e5 b6 cb k
....B.3'.0.....
0330 9a 0b c4 fe c
2 b8 30 a3 20 64 12
94 51 59 34 82 .
.....0. d..QY4.
0340 88 48 53 3d 3
5 32 41 35 0f e2 7c
ea 5a ce ce a0 .
HS=52A5..|.Z...
0350 54 7b bb 2a a
4 f5 da a6 a6 8d e6
5d 13 47 3f 32 T
{.*.......].G?2
0360 fb 3d 2a 8a 2
f 07 d1 17 ca a7 4d
2d 81 b0 80 60 .
=*./.....M-...`
0370 c6 41 01 04 5
6 32 e9 33 21 d2 84
2e 88 dc 74 f2 .
A..V2.3!.....t.
0380 32 67 63 3d e
6 5e 2b 8c 21 9e 66
87 ec 45 e1 b0 2
gc=.^+.!.f..E..
0390 f2 43 f9 98 a
5 83 48 0f 3e e1 60
ec 85 5c c4 7b .
C....H.>.`..\.{
03a0 5b 5a ec 76 7
8 c1 09 97 c0 d6 f2
f6 f8 89 bc 7a [
Z.vx..........z
03b0 43 9f fd 67 e
7 7e 7d ff fb 92 04
ec 0f f2 ed 2c C
..g.~}........,
03c0 d3 03 2f 5a 6
0 65 65 8a 40 67 0f
4c 0c 20 bb 4a .
./Z`ee.@g.L. .J
03d0 0d bd e9 81 7
d 98 a9 01 8c 35 30
7f 8f ff ac ce .
...}....50.....
03e0 0d 62 37 ea 1
1 07 13 00 1a 50 a1
2d 8c 01 1f 45 .
b7......P.-...E
03f0 be 03 1a 61 f
c 0b c1 c2 e4 af 15
e0 3b d8 2a 63 .
..a........;.*c
0400 8e 86 55 c1 9
a 61 08 09 9c a8 7c
b6 5e d8 89 5a .
.U..a....|.^..Z
0410 00 fe 20 51 b
0 49 13 85 62 1a 07
c7 ab a6 5f 38 .
. Q.I..b....._8
0420 18 0b 86 a9 a
3 76 62 b1 39 4d 05
1e 4a d2 a2 fb .
....vb.9M..J...
0430 bd 99 4e a7 d
9 94 9b 33 21 5a d6

77 6a 28 5b f8 .
.N....3!Z.wj([.
0440 bb f7 2d 59 c
b 36 5c b5 8e 55 04
c3 ac ac 45 e3 .
.-Y.6\..U....E.
0450 03 20 20 94 7
8 e1 99 3c ce c2 71
6d 0c 80 04 07 .
.x..<..qm....
0460 90 8c e4 cf 9
2 30 f1 c9 04 ff e3
a2 f4 c4 89 4a .
....0.........J
0470 ce 19 09 90 8
0 20 d4 00 08 8d 68
82 19 9a 9e 5a .
.... ....h....Z
0480 6d 06 19 9d f
5 a3 b3 64 7c 66 fc
b7 84 40 83 7c m
......d|f...@.|
0490 30 5d cb c9 6
b e8 a6 53 f2 5f 53
97 97 79 31 c9 0
]..k..S._S..y1.
04a0 3a 61 39 7d d
9 ac 0c af 5f 82 f0
a3 20 aa 4b 43 :
a9}...._... .KC
04b0 e1 e9 ce 5b c
7 f4 e8 53 3a 5c ec
17 03 f6 24 ae .
..[...S:\....$.
04c0 51 94 8e 0a c
6 c0 07 87 cd 28 2b
36 0f 92 ae 4e Q
........(+6...N
04d0 41 92 d3 98 b
1 95 80 c0 a1 03 19
08 3f 53 46 dc A
...........?SF.
04e0 66 f5 20 a2 0
c 78 20 10 0c 2a f0
7c d8 20 4c e0 f
. ..x ..*.|. L.
04f0 3e fc a4 94 a
2 86 bb af 1a 04 7c
e7 e5 1c 8a 9d >
.........|.....
0500 dd 53 a9
.
S.
No. Time
Source
Destination
Protocol
Length Info
111 4.214166000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=68132
Ack=1 Win=46 Len=1
260

Frame 111: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.264096000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.264096000 s
econds
[Time delta fro
m previous captured
frame: 0.114006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11400600
0 seconds]
[Time since ref
erence or first fra
me: 4.214166000 sec
onds]
Frame Number: 1
11
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1b0 (61872)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9

Protocol: TCP (
6)
Header checksum
: 0x3a7a [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 68132, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 68132 (relativ
e sequence number)
[Next sequence
number: 69392 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0

... = Push: Not set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4d2
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2489]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 b0 4
0 00 31 06 3a 7a 4a
7c 0c 8a c0 a8 .
...@.1.:zJ|....
0020 01 0b 00 50 c
1 a6 2b c9 6c 51 9e
87 4e aa 50 10 .
..P..+.lQ..N.P.
0030 00 2e 4d 26 0
0 00 10 cd 13 a0 55
83 67 41 69 8d .
.M&......U.gAi.
0040 0e 28 1d e2 7
0 84 b1 61 bd a9 0f
d4 b1 a4 b4 23 .
(..p..a.......#
0050 e2 07 36 ed 4
9 eb d2 27 ac a6 aa
33 ac dc d5 6a .
.6.I..'...3...j
0060 b5 96 62 9a 1
7 62 bf ca 00 ef 14
8f 30 7a 10 9f .
.b..b......0z..
0070 b5 0f 18 af b
1 f2 08 af 36 de c8
ff 57 0c de ec .
.......6...W...
0080 30 e5 a0 dd f
f 7f ff fe 88 fe fc
ce ff fb 92 04 0
...............
0090 e9 0f f2 e8 3
1 53 03 4f 7a 60 5e
c5 da 50 65 ed .
...1S.Oz`^..Pe.

00a0 4c 0b 94 b1 5
a 0c b0 c9 81 8e 91
ea c1 87 a5 28 L
...Z..........(
00b0 fd 73 fb 34 0
4 70 ff f0 b5 c3 c4
6f 56 e8 61 ed .
s.4.p.....oV.a.
00c0 6e 2b a6 37 7
a 15 0c d5 52 e5 c5
51 36 1e 8f 6a n
+.7z...R..Q6..j
00d0 b8 ad 03 8a 9
9 aa 65 0d 25 49 8a
29 32 cd 22 ad .
.....e.%I.)2.".
00e0 2c 16 1d d1 0
0 a2 5c e3 bc 6b c1
dc a0 3c c0 82 ,
.....\..k...<..
00f0 01 63 ae e8 7
a 1c a0 41 a2 ef 6a
0b c3 0f 01 8b .
c..z..A..j.....
0100 15 e2 80 04 9
7 4a de 0f b5 8e 6d
2f 33 4b f4 34 .
....J....m/3K.4
0110 00 71 ea ca 3
b 20 28 d0 6a a1 94
8d 45 60 41 93 .
q..; (.j...E`A.
0120 a9 da 67 0f 5
8 e9 d4 cc 35 16 35
22 12 54 b4 cc .
.g.X...5.5".T..
0130 a6 ca 18 41 5
1 19 31 71 47 af 63
b5 63 7c fb f3 .
..AQ.1qG.c.c|..
0140 27 de b4 31 f
4 2f d7 e6 b4 31 4f
d0 c7 e9 9f e3 '
..1./...1O.....
0150 2e f5 a8 ef f
d f4 d4 fb 3e 8c ef
29 3d 1c d5 b6 .
.......>..)=...
0160 e4 c9 66 1d f
9 5b 47 87 bd af ff
fa ed ab ca 70 .
.f..[G........p
0170 a3 5c b0 c1 0
4 cb bc c3 e0 56 5f
75 e8 58 66 4b .
\.......V_u.XfK
0180 00 5c ac 86 9
0 6a 55 13 ed 16 0e
71 7d de ba 93 .
\...jU....q}...
0190 9a a0 f8 11 0
9 41 d2 1a e8 46 c4
6c e8 66 4b d7 .
....A...F.l.fK.
01a0 04 a9 05 80 9
f bb 41 51 14 ce e7
27 aa 6b f2 95 .
.....AQ...'.k..
01b0 b9 e0 90 26 f

e df 80 67 1e 7f bc
40 4d 44 17 db .
..&...g...@MD..
01c0 fa e9 41 e3 f
2 9d 2c 8f 61 fb b6
bd db d3 ae a2 .
.A...,.a.......
01d0 45 f3 c4 12 7
a 30 02 32 c3 76 d0
f9 61 85 62 62 E
...z0.2.v..a.bb
01e0 b0 a7 7a 03 a
8 75 11 fe 15 cc 92
be 84 e5 bd 75 .
.z..u.........u
01f0 75 17 1c 29 5
4 13 10 2a d5 6a 1e
9e 31 2b 8e bc u
..)T..*.j..1+..
0200 c7 a6 d2 51 4
c ad 9b fe ff d7 95
57 ea 7e 53 3f .
..QL......W.~S?
0210 1e 27 eb a6 9
8 df e8 57 45 e3 40
55 e6 15 16 57 .
'.....WE.@U...W
0220 4b 29 db bd f
8 36 33 83 0e c9 ef
74 21 8d ff fb K
)...63....t!...
0230 92 04 ea 0f f
3 02 1b d8 03 0f 49
c2 5b a3 ca f0 .
.........I.[...
0240 61 86 4a 0b b
4 7f 62 0c 24 c9 49
84 0f ab c1 86 a
.J...b.$.I.....
0250 0d 29 9b f5 5
c e9 af 52 6d 80 10
71 78 62 dc b6 .
)..\..Rm..qxb..
0260 20 97 cf 0b f
4 ec 46 31 65 05 c0
38 05 04 84 2d
.....F1e..8...0270 03 64 b0 5c 5
d a6 5d 32 13 84 c5
01 0d 4d da 43 .
d.\].]2.....M.C
0280 39 d7 66 c7 5
b 82 a2 d3 4f 0f 1c
ef 96 ef ed f7 9
.f.[...O.......
0290 4e 82 bf 8a 4
b 94 c7 7d 0d ef 9a
89 ff da 1f 6c N
...K..}.......l
02a0 68 e5 53 60 d
e e0 89 1b 4b 8d 37
f7 97 f7 ff db h
.S`....K.7.....
02b0 74 2c 5e 6e 2
2 af ff f7 0a df b6
21 b4 9a aa 54 t
,^n"......!...T
02c0 01 5c 91 a6 2
d 88 f2 47 f4 40 1d

c5 2f 69 9c 25 .
\..-..G.@../i.%
02d0 15 6a 87 ca d
5 48 ae b5 b2 bf 3a
a3 e5 28 cc 50 .
j...H....:..(.P
02e0 3f d0 ac 59 2
6 b1 3d 7b 51 d9 c5
5d 44 90 cb a5 ?
..Y&.={Q..]D...
02f0 0a 52 37 b4 6
e 4d 25 2c 7d 54 5a
86 4b 2f da 89 .
R7.nM%,}TZ.K/..
0300 f7 88 09 21 e
9 59 14 30 2d 11 8f
0d 06 05 96 92 .
..!.Y.0-.......
0310 c4 e8 43 7e b
4 ee 77 ce b3 fa 85
62 16 70 c7 83 .
.C~..w....b.p..
0320 4f 74 0a 62 6
e 02 26 b2 f6 a5 b7
90 e2 8e 42 1d O
t.bn.&.......B.
0330 1d 1a ca 70 4
a d0 93 70 66 97 4d
cb 93 69 38 42 .
..pJ..pf.M..i8B
0340 05 0f 80 3b 2
b ab 52 0c 2d cc e8
5e a3 46 df ec .
..;+.R.-..^.F..
0350 33 dd 3f df a
d 99 ef bf 73 0b ef
10 12 43 d2 b2 3
.?.....s....C..
0360 25 4f 09 a2 3
1 e1 a0 c0 b2 d2 59
b3 9f 45 7c 67 %
O..1.....Y..E|g
0370 45 dd 57 68 f
c 7d 31 e1 49 5f 99
22 06 0c d0 08 E
.Wh.}1.I_."....
0380 08 52 b8 18 1
a 7c 03 02 10 02 66
3e 15 ae 6a c3 .
R...|....f>..j.
0390 f5 26 a2 7a 2
c 4e 4c 10 55 d2 42
46 4c 5f a4 62 .
&.z,NL.U.BFL_.b
03a0 23 31 d7 32 6
2 41 39 30 4a a3 22
b0 b4 45 92 7f #
1.2bA90J."..E..
03b0 94 ca c2 53 2
8 63 be 14 ff 53 bb
74 7c 2a a0 e9 .
..S(c...S.t|*..
03c0 cb ff 0b fe 5
0 da af 2b ce d2 82
6b c8 4a 36 55 .
...P..+...k.J6U
03d0 ff fb 92 04 e
b 8f f3 01 1e 57 83
2c 42 52 61 c3 .

........W.,BRa.
03e0 ca d0 61 26 4
a 4b ec 9f 54 0d 3d
29 41 6d 93 ea .
.a&JK..T.=)Am..
03f0 81 a7 99 28 d
6 de 8f 7e b3 68 42
99 34 20 0a 63 .
..(...~.hB.4 .c
0400 8a 8b ca d2 d
0 c1 d9 50 d3 2c fc
4e b9 06 98 78 .
......P.,.N...x
0410 63 73 78 ed 8
9 a9 84 e0 58 be 18
65 12 a8 f4 8c c
sx.....X..e....
0420 68 2d 51 a4 2
1 80 4c 87 85 56 b3
ca 93 8a 8a 17 h
-Q.!.L..V......
0430 d0 b2 e8 7b d
0 45 cf d4 4d b0 e5
96 7b 76 43 9a .
..{.E..M...{vC.
0440 ad bb f9 7b 6
d 47 5c 76 e9 64 a5
88 4e 92 5c 36 .
..{mG\v.d..N.\6
0450 c7 3a 1a c1 9
b dc 52 e2 eb 33 87
cc f8 f3 2c 08 .
:....R..3....,.
0460 c2 df 07 40 3
0 8f 0c f8 04 32 4f
b1 61 61 29 26 .
..@0....2O.aa)&
0470 7d 48 71 1d 0
8 6a 55 72 5f d9 e3
2e 98 de 2c 2b }
Hq..jUr_.....,+
0480 66 25 69 c5 5
0 18 2d 1c b9 8b c4
92 61 1e cf 75 f
%i.P.-.....a..u
0490 6f 13 2e 2b 5
1 b0 36 af de 82 25
ba ca fe b6 ed o
..+Q.6...%.....
04a0 f5 8f 9a db 6
6 0f 04 84 c5 88 06
9f 0e 21 8a 00 .
...f........!..
04b0 8e 3e 0b 9c 4
b 34 c8 68 14 d0 6d
7f e9 39 34 fa .
>..K4.h..m..94.
04c0 63 42 09 a4 8
a 48 40 cc 8b 2c 9f
00 c7 3a 4c ed c
B...H@..,...:L.
04d0 48 64 03 9d 2
2 b8 73 6f 73 76 7c
a0 6d a5 5a a5 H
d..".sosv|.m.Z.
04e0 3f 00 f9 50 a
b 9b 58 31 51 e4 29
37 8b d9 89 d5 ?
..P..X1Q.)7....

04f0 ae 69 9a 8a 3
f ae df a9 75 9c cc
3f 6e e8 9c 45 .
i..?...u..?n..E
0500 49 ef e9 9c f
c ad a6 d9 d7 7d ab
62 18 2c b0 e0 I
........}.b.,..
0510 5c 9b 9c 45 2
0 24 f6 20 51 74 0e
5f fa d5 24 60 \
..E $. Qt._..$`
0520 19 b5
.
.
No. Time
Source
Destination
Protocol
Length Info
112 4.214348000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=69392 Win=40005 Le
n=0
Frame 112: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.264278000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.264278000 s
econds
[Time delta fro
m previous captured
frame: 0.000182000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018200
0 seconds]
[Time since ref
erence or first fra
me: 4.214348000 sec
onds]
Frame Number: 1
12
Frame Length: 5
4 bytes (432 bits)

Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f42 (20290)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 69392
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 69392 (r
elative ack number)

Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40005
[Calculated win
dow size: 40005]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 111]
[The RTT to
ACK the segment wa
s: 0.000182000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 42 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OB@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b

c9 71 3d 50 10 .
....P..N.+.q=P.
0030 9c 45 18 d4 0
0 00
.
E....
No. Time
Source
Destination
Protocol
Length Info
113 4.241166000
pc9.home
239.255.255.
250
SSDP
366 NOTIFY * HTT
P/1.1
Frame 113: 366 byte
s on wire (2928 bit
s), 366 bytes captu
red (2928 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.291096000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.291096000 s
econds
[Time delta fro
m previous captured
frame: 0.026818000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02681800
0 seconds]
[Time since ref
erence or first fra
me: 4.241166000 sec
onds]
Frame Number: 1
13
Frame Length: 3
66 bytes (2928 bits
)
Capture Length:
366 bytes (2928 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:http]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: W
esternD_d0:f3:c2 (0
0:90:a9:d0:f3:c2),
Dst: IPv4mcast_7f:f
f:fa (01:00:5e:7f:f
f:fa)
Destination: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
Address: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Western
D_d0:f3:c2 (00:90:a
9:d0:f3:c2)
Address: We
sternD_d0:f3:c2 (00
:90:a9:d0:f3:c2)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc9.
home (192.168.1.13)
, Dst: 239.255.255.
250 (239.255.255.25
0)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 3

52
Identification:
0x442a (17450)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
Protocol: UDP (
17)
Header checksum
: 0xbfb3 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc9.hom
e (192.168.1.13)
Destination: 23
9.255.255.250 (239.
255.255.250)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 5865
7 (58657), Dst Port
: ssdp (1900)
Source Port: 58
657 (58657)
Destination Por
t: ssdp (1900)
Length: 332
Checksum: 0xb01
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
1]
Hypertext Transfer
Protocol
NOTIFY * HTTP/1
.1\r\n
[Expert Inf
o (Chat/Sequence):
NOTIFY * HTTP/1.1\r
\n]
[NOTIFY
* HTTP/1.1\r\n]
[Severi
ty level: Chat]
[Group:
Sequence]
Request Met
hod: NOTIFY
Request URI

:*
Request Ver
sion: HTTP/1.1
HOST: 239.255.2
55.250:1900\r\n
CACHE-CONTROL:
max-age=100\r\n
LOCATION: http:
//192.168.1.13:4915
3/nasdevice.xml\r\n
NT: upnp:rootde
vice\r\n
NTS: ssdp:alive
\r\n
SERVER: Linux/3
.2.26, UPnP/1.0, Po
rtable SDK for UPnP
devices/1.6.6\r\n
X-User-Agent: r
edsonic\r\n
USN: uuid:73656
761-7465-7375-636b0090a9d0f3c2::upnp:
rootdevice\r\n
\r\n
[Full request U
RI: http://239.255.
255.250:1900*]
0000 01 00 5e 7f f
f fa 00 90 a9 d0 f3
c2 08 00 45 00 .
.^...........E.
0010 01 60 44 2a 0
0 00 04 11 bf b3 c0
a8 01 0d ef ff .
`D*............
0020 ff fa e5 21 0
7 6c 01 4c b0 19 4e
4f 54 49 46 59 .
..!.l.L..NOTIFY
0030 20 2a 20 48 5
4 54 50 2f 31 2e 31
0d 0a 48 4f 53
* HTTP/1.1..HOS
0040 54 3a 20 32 3
3 39 2e 32 35 35 2e
32 35 35 2e 32 T
: 239.255.255.2
0050 35 30 3a 31 3
9 30 30 0d 0a 43 41
43 48 45 2d 43 5
0:1900..CACHE-C
0060 4f 4e 54 52 4
f 4c 3a 20 6d 61 78
2d 61 67 65 3d O
NTROL: max-age=
0070 31 30 30 0d 0
a 4c 4f 43 41 54 49
4f 4e 3a 20 68 1
00..LOCATION: h
0080 74 74 70 3a 2
f 2f 31 39 32 2e 31
36 38 2e 31 2e t
tp://192.168.1.
0090 31 33 3a 34 3
9 31 35 33 2f 6e 61
73 64 65 76 69 1
3:49153/nasdevi

00a0 63 65 2e 78 6
d 6c 0d 0a 4e 54 3a
20 75 70 6e 70 c
e.xml..NT: upnp
00b0 3a 72 6f 6f 7
4 64 65 76 69 63 65
0d 0a 4e 54 53 :
rootdevice..NTS
00c0 3a 20 73 73 6
4 70 3a 61 6c 69 76
65 0d 0a 53 45 :
ssdp:alive..SE
00d0 52 56 45 52 3
a 20 4c 69 6e 75 78
2f 33 2e 32 2e R
VER: Linux/3.2.
00e0 32 36 2c 20 5
5 50 6e 50 2f 31 2e
30 2c 20 50 6f 2
6, UPnP/1.0, Po
00f0 72 74 61 62 6
c 65 20 53 44 4b 20
66 6f 72 20 55 r
table SDK for U
0100 50 6e 50 20 6
4 65 76 69 63 65 73
2f 31 2e 36 2e P
nP devices/1.6.
0110 36 0d 0a 58 2
d 55 73 65 72 2d 41
67 65 6e 74 3a 6
..X-User-Agent:
0120 20 72 65 64 7
3 6f 6e 69 63 0d 0a
55 53 4e 3a 20
redsonic..USN:
0130 75 75 69 64 3
a 37 33 36 35 36 37
36 31 2d 37 34 u
uid:73656761-74
0140 36 35 2d 37 3
3 37 35 2d 36 33 36
62 2d 30 30 39 6
5-7375-636b-009
0150 30 61 39 64 3
0 66 33 63 32 3a 3a
75 70 6e 70 3a 0
a9d0f3c2::upnp:
0160 72 6f 6f 74 6
4 65 76 69 63 65 0d
0a 0d 0a
r
ootdevice....
No. Time
Source
Destination
Protocol
Length Info
114 4.341418000
pc9.home
239.255.255.
250
SSDP
375 NOTIFY * HTT
P/1.1
Frame 114: 375 byte
s on wire (3000 bit
s), 375 bytes captu
red (3000 bits) on

interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.391348000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.391348000 s
econds
[Time delta fro
m previous captured
frame: 0.100252000
seconds]
[Time delta fro
m previous displaye
d frame: 0.10025200
0 seconds]
[Time since ref
erence or first fra
me: 4.341418000 sec
onds]
Frame Number: 1
14
Frame Length: 3
75 bytes (3000 bits
)
Capture Length:
375 bytes (3000 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: W
esternD_d0:f3:c2 (0
0:90:a9:d0:f3:c2),
Dst: IPv4mcast_7f:f
f:fa (01:00:5e:7f:f
f:fa)
Destination: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
Address: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...1 .
... .... .... ....

= IG bit: Group add

ress (multicast/bro
adcast)
Source: Western
D_d0:f3:c2 (00:90:a
9:d0:f3:c2)
Address: We
sternD_d0:f3:c2 (00
:90:a9:d0:f3:c2)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc9.
home (192.168.1.13)
, Dst: 239.255.255.
250 (239.255.255.25
0)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 3
61
Identification:
0x442b (17451)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
Protocol: UDP (
17)
Header checksum
: 0xbfa9 [validatio
n disabled]
[Good: Fals
e]

[Bad: False
]
Source: pc9.hom
e (192.168.1.13)
Destination: 23
9.255.255.250 (239.
255.255.250)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 5865
7 (58657), Dst Port
: ssdp (1900)
Source Port: 58
657 (58657)
Destination Por
t: ssdp (1900)
Length: 341
Checksum: 0x70f
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
1]
Hypertext Transfer
Protocol
NOTIFY * HTTP/1
.1\r\n
[Expert Inf
o (Chat/Sequence):
NOTIFY * HTTP/1.1\r
\n]
[NOTIFY
* HTTP/1.1\r\n]
[Severi
ty level: Chat]
[Group:
Sequence]
Request Met
hod: NOTIFY
Request URI
:*
Request Ver
sion: HTTP/1.1
HOST: 239.255.2
55.250:1900\r\n
CACHE-CONTROL:
max-age=100\r\n
LOCATION: http:
//192.168.1.13:4915
3/nasdevice.xml\r\n
NT: uuid:736567
61-7465-7375-636b-0
090a9d0f3c2\r\n
NTS: ssdp:alive
\r\n
SERVER: Linux/3
.2.26, UPnP/1.0, Po
rtable SDK for UPnP
devices/1.6.6\r\n
X-User-Agent: r
edsonic\r\n
USN: uuid:73656
761-7465-7375-636b-

0090a9d0f3c2\r\n
\r\n
[Full request U
RI: http://239.255.
255.250:1900*]
0000 01 00 5e 7f f
f fa 00 90 a9 d0 f3
c2 08 00 45 00 .
.^...........E.
0010 01 69 44 2b 0
0 00 04 11 bf a9 c0
a8 01 0d ef ff .
iD+............
0020 ff fa e5 21 0
7 6c 01 55 70 ff 4e
4f 54 49 46 59 .
..!.l.Up.NOTIFY
0030 20 2a 20 48 5
4 54 50 2f 31 2e 31
0d 0a 48 4f 53
* HTTP/1.1..HOS
0040 54 3a 20 32 3
3 39 2e 32 35 35 2e
32 35 35 2e 32 T
: 239.255.255.2
0050 35 30 3a 31 3
9 30 30 0d 0a 43 41
43 48 45 2d 43 5
0:1900..CACHE-C
0060 4f 4e 54 52 4
f 4c 3a 20 6d 61 78
2d 61 67 65 3d O
NTROL: max-age=
0070 31 30 30 0d 0
a 4c 4f 43 41 54 49
4f 4e 3a 20 68 1
00..LOCATION: h
0080 74 74 70 3a 2
f 2f 31 39 32 2e 31
36 38 2e 31 2e t
tp://192.168.1.
0090 31 33 3a 34 3
9 31 35 33 2f 6e 61
73 64 65 76 69 1
3:49153/nasdevi
00a0 63 65 2e 78 6
d 6c 0d 0a 4e 54 3a
20 75 75 69 64 c
e.xml..NT: uuid
00b0 3a 37 33 36 3
5 36 37 36 31 2d 37
34 36 35 2d 37 :
73656761-7465-7
00c0 33 37 35 2d 3
6 33 36 62 2d 30 30
39 30 61 39 64 3
75-636b-0090a9d
00d0 30 66 33 63 3
2 0d 0a 4e 54 53 3a
20 73 73 64 70 0
f3c2..NTS: ssdp
00e0 3a 61 6c 69 7
6 65 0d 0a 53 45 52
56 45 52 3a 20 :
alive..SERVER:
00f0 4c 69 6e 75 7
8 2f 33 2e 32 2e 32
36 2c 20 55 50 L

inux/3.2.26, UP
0100 6e 50 2f 31 2
e 30 2c 20 50 6f 72
74 61 62 6c 65 n
P/1.0, Portable
0110 20 53 44 4b 2
0 66 6f 72 20 55 50
6e 50 20 64 65
SDK for UPnP de
0120 76 69 63 65 7
3 2f 31 2e 36 2e 36
0d 0a 58 2d 55 v
ices/1.6.6..X-U
0130 73 65 72 2d 4
1 67 65 6e 74 3a 20
72 65 64 73 6f s
er-Agent: redso
0140 6e 69 63 0d 0
a 55 53 4e 3a 20 75
75 69 64 3a 37 n
ic..USN: uuid:7
0150 33 36 35 36 3
7 36 31 2d 37 34 36
35 2d 37 33 37 3
656761-7465-737
0160 35 2d 36 33 3
6 62 2d 30 30 39 30
61 39 64 30 66 5
-636b-0090a9d0f
0170 33 63 32 0d 0
a 0d 0a
3
c2....
No. Time
Source
Destination
Protocol
Length Info
115 4.351725000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=69392
Ack=1 Win=46 Len=1
260
Frame 115: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.401655000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.401655000 s

econds
[Time delta fro
m previous captured
frame: 0.010307000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01030700
0 seconds]
[Time since ref
erence or first fra
me: 4.351725000 sec
onds]
Frame Number: 1
15
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1b1 (61873)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a79 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro

l Protocol, Src Por

t: http (80), Dst P
ort: 49574 (49574),
Seq: 69392, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 69392 (relativ
e sequence number)
[Next sequence
number: 70652 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x9f1
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks

um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 b1 4
0 00 31 06 3a 79 4a
7c 0c 8a c0 a8 .
...@.1.:yJ|....
0020 01 0b 00 50 c
1 a6 2b c9 71 3d 9e
87 4e aa 50 10 .
..P..+.q=..N.P.
0030 00 2e 9f 15 0
0 00 ad 99 87 a3 a7
0d 1e 01 21 20 .
.............!
0040 92 a0 01 e0 0
1 e5 8c 7e 65 cc a8
37 60 a1 a6 c9 .
......~e..7`...
0050 3e bc e7 a3 d
7 ec 6c 92 09 ea 6a
43 c9 b9 8d e5 >
.....l...jC....
0060 e0 93 12 23 6
7 96 26 98 54 24 44
0b b0 eb 68 bb .
..#g.&.T$D...h.
0070 ea cd 0a a6 a
a f5 90 4e 52 12 5f
8c 25 fb 0c 6d .
......NR._.%..m
0080 2d b3 df 18 2
6 b4 ff fb 92 04 ec
0f f2 f4 30 d4 ...&.........0.
0090 83 4f 4a 60 6
0 86 2a 80 61 eb 4c
0c 80 9b 4e 0d .
OJ``.*.a.L...N.
00a0 3d 89 41 81 1
5 e9 c1 87 b1 30 0e
59 97 20 a3 10 =
.A......0.Y. ..
00b0 fa 82 2e 45 d
f ff ff 59 05 c7 62
46 93 00 c3 0c .
..E...Y..bF....
00c0 a2 cb a4 cc c
7 17 5b 22 47 b2 58
a7 2c 37 25 cd .
.....["G.X.,7%.
00d0 76 04 89 91 3
a 4d 1b 86 e3 4f 7d
b8 5d c5 3b 62 v
...:M...O}.].;b
00e0 d0 3a 35 0c 1
6 5e de 5c 7d dd 25
d7 44 38 70 56 .
:5..^.\}.%.D8pV
00f0 a4 2d e4 ed 3

b 58 66 44 6e 51 87
5d 20 d7 ff 5f .
-..;XfDnQ.] .._
0100 d2 8a 28 18 1
4 08 1c 1a 81 cd 0c
1d 42 18 87 c4 .
.(.........B...
0110 09 49 05 47 e
d fe df fa d2 15 1c
7a e0 d1 cc a1 .
I.G.......z....
0120 8f 35 8c be 4
a 14 04 00 3a c0 a0
85 38 bf 7c 8d .
5..J...:...8.|.
0130 43 03 4a 1b e
5 c8 6e a7 9f b1 26
53 89 19 20 81 C
.J...n...&S.. .
0140 b1 52 a9 1f b
0 a2 32 5f 41 b0 48
2f f4 c2 a1 f1 .
R....2_A.H/....
0150 41 90 e1 66 4
6 bb b4 8a 05 70 88
d9 ba 24 40 1e A
..fF....p...$@.
0160 a3 34 e7 97 1
9 ac 26 9a a2 73 bc
c6 31 dc c5 aa .
4....&..s..1...
0170 9d 1e a5 33 8
1 55 8d 38 05 24 93
5d a0 27 b7 46 .
..3.U.8.$.].'.F
0180 65 2e 04 6c e
3 82 f8 f5 11 f2 ff
85 09 82 0f c4 e
..l............
0190 39 3e 77 16 2
8 f5 6e 7a 86 1a c7
0b 93 54 7b 4f 9
>w.(.nz.....T{O
01a0 0c 56 43 8c f
e 0a 5e 62 47 17 08
cb 2b 2a 95 17 .
VC...^bG...+*..
01b0 1d d7 2e a9 4
9 69 d8 86 e6 76 f6
72 9b 29 be e6 .
...Ii...v.r.)..
01c0 b9 7a 0d aa 2
d 26 dd 13 ea 61 9d
7f 55 22 2a 64 .
z..-&...a..U"*d
01d0 a0 1c 10 66 4
a 70 42 63 4d 64 20
99 08 60 29 50 .
..fJpBcMd ..`)P
01e0 b8 24 30 25 0
c 2e 69 b3 c2 21 c1
3b f5 74 f0 e5 .
$0%..i..!.;.t..
01f0 40 2e af 18 9
b 68 eb 3a ad 01 53
88 2e 41 ad 6f @
....h.:..S..A.o
0200 0d 99 57 03 a
5 59 5a af 68 6f 5a

f5 48 50 a3 6f .
.W..YZ.hoZ.HP.o
0210 74 97 58 d6 9
b ab 5d 47 c6 fe 5b
5f 4d cb 02 40 t
.X...]G..[_M..@
0220 e1 37 14 63 0
b 8a 86 c5 ff fb 92
04 e9 0f f3 0d .
7.c............
0230 2c 53 83 4f 4
a 60 61 44 ea 60 67
09 4a 0b 70 c3 ,
S.OJ`aD.`g.J.p.
0240 4e 0c bd 09 8
9 5f 95 e9 81 87 ad
31 56 85 ea 4f N
...._.....1V..O
0250 5f fe 80 51 d
3 15 68 ca 83 31 c7
ca 87 95 72 fb _
..Q..h..1....r.
0260 42 54 68 08 7
8 b1 2a e7 55 05 60
70 44 52 24 4d B
Th.x.*.U.`pDR$M
0270 15 e9 0b f1 7
2 76 c7 95 d2 e0 bc
27 dc a1 36 b2 .
...rv.....'..6.
0280 37 47 61 0d 4
2 0e 7b e2 f6 60 5c
2e 98 f3 0a 1b 7
Ga.B.{..`\.....
0290 0c 28 f9 a2 c
b 44 4a 6e 0d f7 96
a8 ee 73 e6 d8 .
(...DJn.....s..
02a0 9b cb 15 ca 2
f 28 26 0a 01 5c 91
41 51 67 45 49 .
.../(&..\.AQgEI
02b0 a9 74 a1 ae f
9 1a fe b4 86 41 a1
65 61 58 06 98 .
t.......A.eaX..
02c0 59 9c 9c 18 5
8 74 b8 61 04 99 25
00 2d bd 37 90 Y
...Xt.a..%.-.7.
02d0 96 8b 1a 6d c
b 96 37 25 dd 1a 95
d9 43 4c 82 f6 .
..m..7%....CL..
02e0 67 90 c7 d4 5
4 47 7e 71 83 ed 32
d3 83 ca d8 2e g
...TG~q..2.....
02f0 d3 ad 41 27 4
5 cb 5f 92 8e a8 d5
26 52 36 55 8b .
.A'E._....&R6U.
0300 47 b5 e5 b7 f
c 7e 8d d4 36 60 9d
b4 bf 2b 7e 95 G
....~..6`...+~.
0310 bc ad e0 d9 b
6 74 05 02 00 a5 04
d5 51 d2 f5 16 .

....t......Q...
0320 1e 9c 3a 40 6
b 0c 15 61 6d 6a 06
a5 50 ca 23 e0 .
.:@k..amj..P.#.
0330 29 2a e0 7e 0
4 e9 80 b8 84 25 28
b4 65 83 73 f8 )
*.~.....%(.e.s.
0340 d8 b3 ca ca c
3 a9 70 1d 5e ed 5c
bd 62 f2 92 fd .
.....p.^.\.b...
0350 60 ce 0a 65 2
5 5b fd b5 d8 a7 6a
5b 74 78 20 0d `
..e%[....j[tx .
0360 28 39 97 00 0
4 51 6d 27 d0 5c ea
19 d3 d0 31 02 (
9...Qm'.\....1.
0370 cc cc 21 a1 e
6 7e 39 bc 36 74 dc
11 40 2d a9 32 .
.!..~9.6t..@-.2
0380 f3 12 2c be 8
1 b2 e2 6a 88 37 b2
4f a8 cf 2b 01 .
.,....j.7.O..+.
0390 f2 ac ca 7e 1
4 00 bf 27 49 f2 3d
79 70 ac c4 15 .
..~...'I.=yp...
03a0 30 5a 13 55 e
f db 5c a0 ab a9 9b
67 13 46 8d 13 0
Z.U..\....g.F..
03b0 72 49 01 ed b
7 8f 17 10 df cb 98
98 be 29 de b8 r
I...........)..
03c0 7f ac d2 fb f
0 27 db 1a 5c 48 ff
fb 90 04 ec 8f .
....'..\H......
03d0 f3 0c 28 53 0
3 4f 7a 50 65 05 0a
50 69 ef 4a 0b .
.(S.OzPe..Pi.J.
03e0 00 b3 4e 0d 3
d 69 81 79 93 e9 41
87 b1 28 c0 57 .
.N.=i.y..A..(.W
03f0 58 db 55 98 3
2 9d 03 c6 86 86 98
c2 a9 85 41 54 X
.U.2.........AT
0400 85 c3 4d 00 4
3 eb 7f 18 02 2c 8b
03 d6 7d 94 94 .
.M.C....,...}..
0410 3c 2d 77 6e 0
4 8d 3c 10 74 a6 9a
22 dc 18 ea 8b <
-wn..<.t.."....
0420 3b 91 2a 47 9
3 72 99 d6 4d bf 89
ab b6 24 fc 83 ;
.*G.r..M....$..

0430 e9 f6 64 7a 9
2 d7 8b 02 07 d4 08
52 fd c2 49 c4 .
.dz.......R..I.
0440 72 85 88 18 c
5 7e b3 bd 6b 78 85
5d 3f 5c c1 e9 r
....~..kx.]?\..
0450 f1 69 b2 ff 4
b 3f 7f b7 eb 80 c2
e2 64 50 12 89 .
i..K?......dP..
0460 51 95 73 80 6
4 57 29 60 b8 14 20
60 03 63 3c 60 Q
.s.dW)`.. `.c<`
0470 ce 73 30 19 e
c 65 c7 88 63 9b 0b
d5 31 ca 88 86 .
s0..e..c...1...
0480 e2 42 01 a8 6
0 87 53 12 b1 fb a8
26 e0 a3 4d de .
B..`.S....&..M.
0490 d7 3b 02 17 9
b b0 f2 14 68 43 2f
74 3d 1c 5a 4a .
;......hC/t=.ZJ
04a0 cf a1 76 ab 1
7 88 3d 1d f2 9d c7
f2 d9 95 27 d8 .
.v...=.......'.
04b0 bc 5d c0 55 a
4 1a 76 f2 1a c0 91
1c 56 9a 8b 1b .
].U..v.....V...
04c0 2f 01 27 1d 6
5 67 a5 9b be 20 41
e6 6b 72 e8 15 /
.'.eg... A.kr..
04d0 35 85 a1 00 b
e 92 70 30 1e 7b 53
54 55 f3 a5 8c 5
.....p0.{STU...
04e0 bc 0e 5d 33 1
0 97 42 1f 9b 98 64
36 12 f5 de 73 .
.]3..B...d6...s
04f0 7a ad 41 2e f
1 23 40 aa b2 2e 73
df c9 ac 57 54 z
.A..#@...s...WT
0500 d6 db 59 26 c
6 e0 63 ef df 3b c7
ff 1a db ce d7 .
.Y&..c..;......
0510 91 9f 51 66 9
6 35 a7 da 8a 30 24
41 d5 8f 10 f0 .
.Qf.5...0$A....
0520 b2 53
.
S
No. Time
Source
Destination
Protocol

Length Info
116 4.362171000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1300 http49
574 [PSH, ACK] Seq=
70652 Ack=1 Win=46
Len=1246
Frame 116: 1300 byt
es on wire (10400 b
its), 1300 bytes ca
ptured (10400 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.412101000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.412101000 s
econds
[Time delta fro
m previous captured
frame: 0.010446000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01044600
0 seconds]
[Time since ref
erence or first fra
me: 4.362171000 sec
onds]
Frame Number: 1
16
Frame Length: 1
300 bytes (10400 bi
ts)
Capture Length:
1300 bytes (10400
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64

:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
286
Identification:
0xf1b2 (61874)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a86 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 70652, Ack: 1
, Len: 1246
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1246]
Sequence number
: 70652 (relativ
e sequence number)
[Next sequence
number: 71898 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set

.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x56a
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2506]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 06 f1 b2 4
0 00 31 06 3a 86 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 76 29 9e
87 4e aa 50 18 .
..P..+.v)..N.P.
0030 00 2e 56 a8 0
0 00 46 00 d6 2a 28
76 9b 29 1e 28 .
.V...F..*(v.).(
0040 90 40 8c ab b
2 43 08 04 25 15 00
2f 80 cc c0 70 .
@...C..%../...p
0050 14 c8 5d b6 3
9 cc 16 40 8c 3d 70
f8 6b b2 9d 71 .
.].9..@.=p.k..q
0060 9f 23 63 a6 2
c 46 1e f5 ff 10 b7
ad e1 61 53 b8 .
#c.,F.......aS.
0070 b0 ae f6 24 6
8 70 a1 cc eb 5b ce

fc 78 9b ff ff .
..$hp...[..x...
0080 fb 92 04 ec 8
f f3 10 2d 52 83 4f
7a 60 65 65 8a .
......-R.Oz`ee.
0090 40 67 0f 4c 4
b fc bd 4a 0d bd 69
81 7d 16 69 41 @
g.LK..J..i.}.iA
00a0 9c 3d 30 1a c
c 96 81 5c 7f b8 9e
46 e9 e3 5d 4c .
=0....\...F..]L
00b0 d4 05 14 f9 0
4 fc a8 03 38 42 a6
8a 4a 8c bc 19 .
.......8B..J...
00c0 0f 16 ad 2c e
2 91 a1 22 68 64 e6
98 6e 66 30 c7 .
..,..."hd..nf0.
00d0 a7 a9 32 94 e
1 da 67 2d 5a df f4
ac 8e c3 11 99 .
.2...g-Z.......
00e0 56 2c 07 43 f
2 ed 6b 97 a0 30 b0
26 97 fc 10 44 V
,.C..k..0.&...D
00f0 2d 5c 9f e5 2
3 a6 c9 28 a3 04 0a
4c bb bf d9 7f \..#..(...L....
0100 c4 20 76 d2 e
3 de bc a2 9a 76 3b
36 a2 7b e9 33 .
v......v;6.{.3
0110 42 41 c6 4e f
0 10 65 a0 30 b3 4b
a8 48 61 02 d2 B
A.N..e.0.K.Ha..
0120 83 21 c0 ce 1
3 96 8c 2c 41 57 b7
b9 00 50 ad d2 .
!.....,AW...P..
0130 98 e9 64 3e 9
5 ef 0a 06 93 b0 9a
b5 b1 53 4d 70 .
.d>.........SMp
0140 08 e0 c2 0d 7
d 2a 2d 36 c6 51 cc
ce 11 a7 f4 96 .
...}*-6.Q......
0150 ca 3a c4 c7 2
f 77 88 9b 95 9d e7
77 3e f3 37 ad .
:../w.....w>.7.
0160 76 8b b3 09 4
2 2b 4e fa 91 6e d5
04 5a 0a c0 e0 v
...B+N..n..Z...
0170 38 da 7c 41 1
1 ba d2 b0 24 ac 40
44 9a 9c 7f b2 8
.|A....$.@D....
0180 97 91 74 01 0
2 a4 bb 21 28 4e c5
5c 2b 21 3c 31 .

.t....!(N.\+!<1
0190 db 9a c0 4c 3
d 4b 01 da dc b5 e5
78 7a 42 b5 63 .
..L=K.....xzB.c
01a0 a2 bd 89 7e 0
b 24 b7 fd aa 3c 79
f0 7e 49 89 d6 .
..~.$...<y.~I..
01b0 20 7d f6 cb 4
4 9b 59 89 af e3 3b
bc 44 22 43 e6
}..D.Y...;.D"C.
01c0 58 5a fb 92 d
e 4a 20 28 69 e1 82
98 19 fa 86 48 X
Z...J (i......H
01d0 09 ab c6 0a 2
2 5a c0 52 e1 c0 aa
b2 08 fe 33 d1 .
..."Z.R......3.
01e0 bc e6 c6 77 0
a fe a6 5d 26 dd 0b
a6 9a 00 67 7c .
..w...]&.....g|
01f0 f8 4c a1 be 8
3 78 2e 21 fa b0 e9
91 77 2d 14 f1 .
L...x.!....w-..
0200 6e 92 81 5a 6
a ec 50 30 f5 bb 11
e2 c1 ae 1e d9 n
..Zj.P0........
0210 30 c3 0f 4f a
f 6c 6e 90 a3 7f f3
5b fc 3d 69 d3 0
..O.ln....[.=i.
0220 93 ff fb 92 0
4 e8 0f f2 ff 2f d2
83 4f 7a 60 5e .
......../..Oz`^
0230 25 ea 40 67 0
b 4c 0b 84 b3 4a 0d
3d 89 81 6a 94 %
.@g.L...J.=..j.
0240 29 01 97 bd 2
8 eb 3d 86 d1 d2 4b
61 a6 d9 9a 38 )
...(.=...Ka...8
0250 0c 83 6f 03 0
d f2 fb 89 24 cb 98
4a ba 42 8a ee .
.o.....$..J.B..
0260 7a 39 9b 4a b
a df d8 c2 fe a2 a5
a4 6d de 7a 5a z
9.J........m.zZ
0270 af eb 3c 07 4
5 d9 93 4a 60 67 5d
df 7e 22 a6 45 .
.<.E..J`g].~".E
0280 04 3a 65 8b c
3 50 48 9e 5a a3 c8
8d 8c 11 e1 59 .
:e..PH.Z......Y
0290 1c f2 3c 38 b
a d4 d1 20 37 c6 89
9c d7 eb d2 9f .
.<8... 7.......

02a0 ff af 17 c8 e
c bd 90 e2 35 93 d4
be c4 95 0e 99 .
.......5.......
02b0 25 20 ed c2 1
9 26 d8 71 86 26 24
58 0a 70 c4 13 %
...&.q.&$X.p..
02c0 30 87 1c 25 2
f 70 fb 05 07 52 1d
9f 91 a4 74 6a 0
..%/p...R....tj
02d0 1c 74 1b 67 9
a 03 6b 11 14 79 a1
70 14 61 d4 a5 .
t.g..k..y.p.a..
02e0 8b 76 f0 30 5
2 b1 54 94 dd 89 38
ef 50 23 df d0 .
v.0R.T...8.P#..
02f0 ac 2c 3c f7 2
f e4 85 37 51 e2 15
b9 d5 df 0d 2f .
,<./..7Q....../
0300 b9 a9 3a 67 f
b 6f ef c1 a3 40 93
e5 11 85 53 5c .
.:g.o...@....S\
0310 22 2a 89 8c a
1 eb a9 b4 f0 18 e0
76 37 17 40 30 "
*.........v7.@0
0320 72 43 01 46 4
0 33 36 8d c4 4c 4a
80 9f a9 2b 35 r
C.F@36..LJ...+5
0330 81 23 12 d6 2
e ba 99 1b 4c 92 b7
45 bd 2f 81 1d .
#......L..E./..
0340 89 ab d7 f8 7
e 92 11 a9 23 36 df
49 0e 69 a2 b9 .
...~...#6.I.i..
0350 c5 d5 57 d5 3
7 d4 ad b3 5a 04 69
6d ac e5 6a 1d .
.W.7...Z.im..j.
0360 6d 9a 67 34 5
6 3a f9 d7 d6 ff 86
41 81 86 dc 7f m
.g4V:.....A....
0370 46 f9 0a 04 0
9 30 54 4a ee 98 08
e0 92 83 10 12 F
....0TJ........
0380 68 70 d8 30 8
0 18 70 80 9e 0a 28
e7 30 1a b1 19 h
p.0..p...(.0...
0390 0b 33 7d 5d 8
5 79 90 9c 3d cf 95
03 61 88 85 c2 .
3}].y..=...a...
03a0 78 f2 34 2c 0
d 43 e9 22 f2 cd a8
99 23 64 44 76 x
.4,.C."....#dDv
03b0 b6 1c 28 fc 3

3 2f 53 cf 6a f5 3c
e9 e2 3b 72 d6 .
.(.3/S.j.<..;r.
03c0 7c c0 98 ff f
b 92 04 ec 8f f2 ff
2c 52 83 4f 7a |
..........,R.Oz
03d0 60 63 45 9a 3
0 67 0f 4c 0c 78 b3
48 0d 61 89 81 `
cE.0g.L.x.H.a..
03e0 86 96 29 01 9
c 3d 30 eb a6 7a 5a
90 7c da c4 f6 .
.)..=0..zZ.|...
03f0 82 c9 cc bb 4
8 af 48 00 b3 2a 73
de f3 35 60 62 .
...H.H..*s..5`b
0400 a6 04 c9 a2 0
4 3d 1c 08 5c 59 89
f2 fd d6 4a 40 .
....=..\Y....J@
0410 0a f1 94 43 2
e ad 1d d8 25 cd 52
10 0b a3 0c 3f .
..C....%.R....?
0420 6e 73 ff 76 f
5 4b d5 b6 98 34 8a
c7 2f a9 bc 08 n
s.v.K...4../...
0430 34 3f b7 68 5
8 61 a4 f8 cd 6b 95
d4 67 d4 b5 1b 4
?.hXa...k..g...
0440 77 6f ef af e
4 8c eb d7 59 f5 d5
a9 bf 8e fe b3 w
o......Y.......
0450 ef 6e ee a4 0
2 09 34 7f ba 19 29
f2 08 e4 ec 7c .
n....4...)....|
0460 ca 20 c3 14 4
1 4a 8a 82 98 9c 91
bd 02 e1 d3 ce .
..AJ..........
0470 c4 51 52 97 d
a 2b 24 bc e1 c5 36
16 02 cd 13 34 .
QR..+$...6....4
0480 a9 33 2e e6 4
7 b0 ed 4b da 04 18
0d f2 45 48 a7 .
3..G..K.....EH.
0490 b3 ec dd 15 a
3 70 e8 c3 86 d9 29
a8 72 37 35 b4 .
....p....).r75.
04a0 c9 f3 7d f9 1
e be d7 fa c6 ab 0f
7a fe 5f af 9b .
.}........z._..
04b0 79 dd 90 47 f
4 a5 01 92 21 a2 a9
ba e8 a4 e0 a9 y
..G....!.......
04c0 e0 53 18 62 f
5 82 47 42 90 35 29

24 03 31 3e 8a .
S.b..GB.5)$.1>.
04d0 37 15 a8 a6 1
6 2a bd 2c 52 42 ca
e0 58 52 98 b9 7
....*.,RB..XR..
04e0 0f 0c c6 17 6
9 bf 27 40 4c b0 cc
f3 2a f8 ef 18 .
...i.'@L...*...
04f0 25 56 bd f6 b
2 46 6b d9 bd 82 d1
9e 52 90 f1 65 %
V...Fk.....R..e
0500 fa 32 fd d2 b
9 bd a0 cd fe a9 99
f5 8d 63 42 c8 .
2...........cB.
0510 6e 12 fe 9a
n
...
No. Time
Source
Destination
Protocol
Length Info
117 4.362357000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=71898 Win=40005 Le
n=0
Frame 117: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.412287000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.412287000 s
econds
[Time delta fro
m previous captured
frame: 0.000186000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018600
0 seconds]
[Time since ref
erence or first fra

me: 4.362357000 sec

onds]
Frame Number: 1
17
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:

20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f43 (20291)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 71898
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]

Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 71898 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40005
[Calculated win
dow size: 40005]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 116]
[The RTT to
ACK the segment wa
s: 0.000186000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.

0010 00 28 4f 43 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OC@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 7b 07 50 10 .
....P..N.+.{.P.
0030 9c 45 18 d4 0
0 00
.
E....
No. Time
Source
Destination
Protocol
Length Info
118 4.404385000
pc9.home
192.168.1.25
5
NBNS
92 Name query N
B WORKGROUP<1d>
Frame 118: 92 bytes
on wire (736 bits)
, 92 bytes captured
(736 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.454315000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.454315000 s
econds
[Time delta fro
m previous captured
frame: 0.042028000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04202800
0 seconds]
[Time since ref
erence or first fra
me: 4.404385000 sec
onds]
Frame Number: 1
18
Frame Length: 9
2 bytes (736 bits)
Capture Length:
92 bytes (736 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]

[Protocols in f
rame: eth:ethertype
:ip:udp:nbns]
[Coloring Rule
Name: SMB]
[Coloring Rule
String: smb || nbss
|| nbns || nbipx |
| ipxsap || netbios
]
Ethernet II, Src: W
esternD_d0:f3:c2 (0
0:90:a9:d0:f3:c2),
Dst: Broadcast (ff:
ff:ff:ff:ff:ff)
Destination: Br
oadcast (ff:ff:ff:f
f:ff:ff)
Address: Br
oadcast (ff:ff:ff:f
f:ff:ff)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f
actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Western
D_d0:f3:c2 (00:90:a
9:d0:f3:c2)
Address: We
sternD_d0:f3:c2 (00
:90:a9:d0:f3:c2)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc9.
home (192.168.1.13)
, Dst: 192.168.1.25
5 (192.168.1.255)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
8
Identification:
0x8ba4 (35748)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0x6a9e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc9.hom
e (192.168.1.13)
Destination: 19
2.168.1.255 (192.16
8.1.255)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: netb
ios-ns (137), Dst P
ort: netbios-ns (13
7)
Source Port: ne
tbios-ns (137)
Destination Por
t: netbios-ns (137)
Length: 58
Checksum: 0xda1
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
2]
NetBIOS Name Servic
e
Transaction ID:
0x1d77
Flags: 0x0110 (
Name query)
0... .... .
... .... = Response
: Message is a quer
y

.000 0... .
... .... = Opcode:
Name query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
..1 .... = Broadcas
t: Broadcast packet
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
WORKGROUP<1
d>: type NB, class
IN
Name: W
ORKGROUP<1d> (Local
Master Browser)
Type: N
B
Class:
IN
0000 ff ff ff ff f
f ff 00 90 a9 d0 f3
c2 08 00 45 00 .
.............E.
0010 00 4e 8b a4 0
0 00 40 11 6a 9e c0
a8 01 0d c0 a8 .
N....@.j.......
0020 01 ff 00 89 0
0 89 00 3a da 17 1d
77 01 10 00 01 .
......:...w....
0030 00 00 00 00 0
0 00 20 46 48 45 50
46 43 45 4c 45 .
..... FHEPFCELE
0040 48 46 43 45 5
0 46 46 46 41 43 41
43 41 43 41 43 H
FCEPFFFACACACAC
0050 41 43 41 43 4
1 42 4e 00 00 20 00
01
A
CACABN.. ..
No. Time
Source
Destination
Protocol
Length Info
119 4.440697000
pc9.home
239.255.255.
250
SSDP
420 NOTIFY * HTT
P/1.1

Frame 119: 420 byte

s on wire (3360 bit
s), 420 bytes captu
red (3360 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.490627000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.490627000 s
econds
[Time delta fro
m previous captured
frame: 0.036312000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03631200
0 seconds]
[Time since ref
erence or first fra
me: 4.440697000 sec
onds]
Frame Number: 1
19
Frame Length: 4
20 bytes (3360 bits
)
Capture Length:
420 bytes (3360 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: W
esternD_d0:f3:c2 (0
0:90:a9:d0:f3:c2),
Dst: IPv4mcast_7f:f
f:fa (01:00:5e:7f:f
f:fa)
Destination: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
Address: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
.... ..0. .
... .... .... ....
= LG bit: Globally

unique address (fac

tory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Western
D_d0:f3:c2 (00:90:a
9:d0:f3:c2)
Address: We
sternD_d0:f3:c2 (00
:90:a9:d0:f3:c2)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc9.
home (192.168.1.13)
, Dst: 239.255.255.
250 (239.255.255.25
0)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
06
Identification:
0x442c (17452)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
Protocol: UDP (
17)
Header checksum

: 0xbf7b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc9.hom
e (192.168.1.13)
Destination: 23
9.255.255.250 (239.
255.255.250)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 5865
7 (58657), Dst Port
: ssdp (1900)
Source Port: 58
657 (58657)
Destination Por
t: ssdp (1900)
Length: 386
Checksum: 0x2d7
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
1]
Hypertext Transfer
Protocol
NOTIFY * HTTP/1
.1\r\n
[Expert Inf
o (Chat/Sequence):
NOTIFY * HTTP/1.1\r
\n]
[NOTIFY
* HTTP/1.1\r\n]
[Severi
ty level: Chat]
[Group:
Sequence]
Request Met
hod: NOTIFY
Request URI
:*
Request Ver
sion: HTTP/1.1
HOST: 239.255.2
55.250:1900\r\n
CACHE-CONTROL:
max-age=100\r\n
LOCATION: http:
//192.168.1.13:4915
3/nasdevice.xml\r\n
NT: urn:schemas
-wd-com:device:WdNA
S-DEV_0064:1\r\n
NTS: ssdp:alive
\r\n
SERVER: Linux/3
.2.26, UPnP/1.0, Po
rtable SDK for UPnP
devices/1.6.6\r\n

X-User-Agent: r
edsonic\r\n
USN: uuid:73656
761-7465-7375-636b0090a9d0f3c2::urn:s
chemas-wd-com:devic
e:WdNAS-DEV_0064:1\
r\n
\r\n
[Full request U
RI: http://239.255.
255.250:1900*]
0000 01 00 5e 7f f
f fa 00 90 a9 d0 f3
c2 08 00 45 00 .
.^...........E.
0010 01 96 44 2c 0
0 00 04 11 bf 7b c0
a8 01 0d ef ff .
.D,.....{......
0020 ff fa e5 21 0
7 6c 01 82 2d 72 4e
4f 54 49 46 59 .
..!.l..-rNOTIFY
0030 20 2a 20 48 5
4 54 50 2f 31 2e 31
0d 0a 48 4f 53
* HTTP/1.1..HOS
0040 54 3a 20 32 3
3 39 2e 32 35 35 2e
32 35 35 2e 32 T
: 239.255.255.2
0050 35 30 3a 31 3
9 30 30 0d 0a 43 41
43 48 45 2d 43 5
0:1900..CACHE-C
0060 4f 4e 54 52 4
f 4c 3a 20 6d 61 78
2d 61 67 65 3d O
NTROL: max-age=
0070 31 30 30 0d 0
a 4c 4f 43 41 54 49
4f 4e 3a 20 68 1
00..LOCATION: h
0080 74 74 70 3a 2
f 2f 31 39 32 2e 31
36 38 2e 31 2e t
tp://192.168.1.
0090 31 33 3a 34 3
9 31 35 33 2f 6e 61
73 64 65 76 69 1
3:49153/nasdevi
00a0 63 65 2e 78 6
d 6c 0d 0a 4e 54 3a
20 75 72 6e 3a c
e.xml..NT: urn:
00b0 73 63 68 65 6
d 61 73 2d 77 64 2d
63 6f 6d 3a 64 s
chemas-wd-com:d
00c0 65 76 69 63 6
5 3a 57 64 4e 41 53
2d 44 45 56 5f e
vice:WdNAS-DEV_
00d0 30 30 36 34 3
a 31 0d 0a 4e 54 53
3a 20 73 73 64 0
064:1..NTS: ssd

00e0 70 3a 61 6c 6
9 76 65 0d 0a 53 45
52 56 45 52 3a p
:alive..SERVER:
00f0 20 4c 69 6e 7
5 78 2f 33 2e 32 2e
32 36 2c 20 55
Linux/3.2.26, U
0100 50 6e 50 2f 3
1 2e 30 2c 20 50 6f
72 74 61 62 6c P
nP/1.0, Portabl
0110 65 20 53 44 4
b 20 66 6f 72 20 55
50 6e 50 20 64 e
SDK for UPnP d
0120 65 76 69 63 6
5 73 2f 31 2e 36 2e
36 0d 0a 58 2d e
vices/1.6.6..X0130 55 73 65 72 2
d 41 67 65 6e 74 3a
20 72 65 64 73 U
ser-Agent: reds
0140 6f 6e 69 63 0
d 0a 55 53 4e 3a 20
75 75 69 64 3a o
nic..USN: uuid:
0150 37 33 36 35 3
6 37 36 31 2d 37 34
36 35 2d 37 33 7
3656761-7465-73
0160 37 35 2d 36 3
3 36 62 2d 30 30 39
30 61 39 64 30 7
5-636b-0090a9d0
0170 66 33 63 32 3
a 3a 75 72 6e 3a 73
63 68 65 6d 61 f
3c2::urn:schema
0180 73 2d 77 64 2
d 63 6f 6d 3a 64 65
76 69 63 65 3a s
-wd-com:device:
0190 57 64 4e 41 5
3 2d 44 45 56 5f 30
30 36 34 3a 31 W
dNAS-DEV_0064:1
01a0 0d 0a 0d 0a
.
...
No. Time
Source
Destination
Protocol
Length Info
120 4.483646000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=71898
Ack=1 Win=46 Len=1
260
Frame 120: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.533576000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.533576000 s
econds
[Time delta fro
m previous captured
frame: 0.042949000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04294900
0 seconds]
[Time since ref
erence or first fra
me: 4.483646000 sec
onds]
Frame Number: 1
20
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1b3 (61875)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)

Header checksum
: 0x3a77 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 71898, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 71898 (relativ
e sequence number)
[Next sequence
number: 73158 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x151
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 b3 4
0 00 31 06 3a 77 4a
7c 0c 8a c0 a8 .
...@.1.:wJ|....
0020 01 0b 00 50 c
1 a6 2b c9 7b 07 9e
87 4e aa 50 10 .
..P..+.{...N.P.
0030 00 2e 15 1e 0
0 00 1c 04 11 14 02
54 a9 28 42 3c .
..........T.(B<
0040 14 51 1f 90 8
8 bf 83 81 1a 98 8c
f6 ec a5 2a 3a .
Q............*:
0050 47 65 56 d5 e
d 2d 25 9c ab 4a db
7a cd 2d fb 95 G
eV..-%..J.z.-..
0060 bc 78 5c a2 9
7 d2 80 57 12 a2 1d
6e 20 08 f8 76 .
x\....W...n ..v
0070 46 9b 87 99 6
6 88 f6 41 50 3f d8
56 9e 9a 7b 88 F
...f..AP?.V..{.
0080 51 d7 16 8e c
9 2c 8a ff fb 92 04
e7 0f f2 fd 2a Q
....,.........*
0090 d2 83 4f 62 6
0 5c e5 da 40 67 0f
4c 0c 34 c5 4a .
.Ob`\..@g.L.4.J
00a0 0c e5 e9 81 7
9 95 a9 01 9c 3d 30

60 73 a6 c8 f3 .
...y....=0`s...
00b0 1f 79 48 a4 d
f 30 db 2c 0d 2b 41
40 f6 42 0d 1c .
yH..0.,.+A@.B..
00c0 30 a1 4d 20 4
4 37 2c ba f5 60 68
98 fb 22 af 3d 0
.M D7,..`h..".=
00d0 33 93 95 23 c
7 2e ad 04 c0 f1 a4
08 b4 16 14 db 3
..#............
00e0 d2 d9 b1 4f 2
0 00 ad 92 ba 4b 38
8d 62 55 02 a9 .
..O ....K8.bU..
00f0 3b d3 eb 11 9
5 12 ea 8b f6 f2 ab
50 cb 36 f2 e0 ;
..........P.6..
0100 e9 c2 e5 38 2
6 dc 22 ba 98 c7 6b
37 01 03 71 60 .
..8&."...k7..q`
0110 b1 96 2d 28 2
4 00 1f 84 78 7a 83
44 10 c6 e1 4a .
.-($...xz.D...J
0120 cc 4a d5 c3 7
1 63 6b a0 f0 c9 24
28 72 2e 10 86 .
J..qck...$(r...
0130 a6 f9 ed 66 5
b 43 96 4b e1 c2 60
40 bc 6e c6 0c .
..f[C.K..`@.n..
0140 2c fa cb 7d 7
d ef 0b 56 c5 b5 47
33 c9 d2 d1 e1 ,
..}}..V..G3....
0150 b3 bb ae a7 3
6 f3 a7 22 49 9c 0f
60 a1 13 35 04 .
...6.."I..`..5.
0160 16 2a 07 78 4
5 84 04 0d 15 0b 0b
56 86 fb c9 ef .
*.xE......V....
0170 de 2a 7e 6b e
8 10 1f 80 3d 86 a9
a9 0c 33 1c 90 .
*~k....=....3..
0180 d7 6d 6f 18 2
1 e1 70 63 78 1e fb
30 4c b4 37 82 .
mo.!.pcx..0L.7.
0190 36 68 dd 6d 9
4 89 d2 04 e1 d9 90
8b 3c 50 c4 cb 6
h.m........<P..
01a0 29 f1 9f 2a 7
5 91 4c c9 d3 10 62
0e df 61 9d bf )
..*u.L...b..a..
01b0 64 ec 59 09 0
9 e4 05 4c 1f 65 e3
d8 2a c0 1a de d

.Y....L.e..*...
01c0 7d 4e 94 9f 4
f 16 cf ff 86 26 30
87 20 4e 11 30 }
N..O....&0. N.0
01d0 85 0c 49 2d 5
c 56 74 f2 bf d3 33
85 41 ce 2b 89 .
.I-\Vt...3.A.+.
01e0 c0 4e a4 a2 6
8 83 b0 b6 7c 74 c3
af c0 a2 f6 52 .
N..h...|t.....R
01f0 47 a0 ec 47 e
b e2 a7 6c 91 f2 70
0b 7e e3 b3 34 G
..G...l..p.~..4
0200 a5 b2 cf a8 2
0 bf c6 ec 76 86 cc
72 72 a2 e9 db .
... ...v..rr...
0210 b0 f5 78 d4 4
e 6e 9d 19 0c a4 7d
f4 f5 0b 2f f7 .
.x.Nn....}.../.
0220 d1 ef 7c bf e
e ce af d6 bb ff fb
92 04 e7 8f f2 .
.|.............
0230 e5 2d d3 83 5
8 42 62 5d 65 ea 60
63 09 4c 0c 44 .
-..XBb]e.`c.L.D
0240 b5 62 07 bc c
9 81 5e 94 ec 80 f6
19 30 7f f4 97 .
b....^.....0...
0250 a3 de ef fe f
4 09 80 81 15 c4 d2
29 d9 05 99 ed .
..........)....
0260 18 9d ab c6 0
1 f5 eb 98 31 65 7f
66 6c 4f e4 53 .
.......1e.flO.S
0270 d4 8e eb 26 6
b 17 7c c5 5d d3 ab
6a 9d 24 f2 bb .
..&k.|.]..j.$..
0280 53 f9 36 33 0
5 98 e9 f7 9d c8 b9
bb d4 9d f2 b2 S
.63............
0290 19 f5 de 3b 6
c b3 4f ff d6 f6 ef
ff 7e ff 5f db .
..;l.O.....~._.
02a0 af 8d 41 f3 8
e 0a a5 67 a1 f6 8f
38 1f a1 6f 84 .
.A....g...8..o.
02b0 0d 34 00 44 e
8 83 ab 3c b5 0c a8
44 45 9c 86 2b .
4.D...<...DE..+
02c0 b9 85 b7 b2 f
6 e3 47 4b 05 40 95
90 b0 6e 08 cf .
.....GK.@...n..

02d0 13 91 63 92 7
3 6e 51 78 d2 18 ad
d2 df 5e 3e 0c .
.c.snQx.....^>.
02e0 a9 4e 9c 2c a
8 a4 91 03 cc 35 cc
86 11 2d 33 92 .
N.,.....5...-3.
02f0 89 cc 45 66 9
0 aa 9f d5 14 8a 8f
4e bd e9 77 44 .
.Ef.......N..wD
0300 7a 46 bb c6 0
f 3a a1 5b 01 39 f9
96 09 cd 49 21 z
F...:.[.9....I!
0310 6e 63 59 5d 3
7 34 28 d6 24 74 c1
44 24 12 b8 5d n
cY]74(.$t.D$..]
0320 52 a6 f2 9d 9
c c8 e9 5f eb f7 88
41 fb cf 2d 57 R
......_...A..-W
0330 1f 5a 3e fe 6
2 ee e3 ac cc d2 29
bd 77 a0 65 c1 .
Z>.b.....).w.e.
0340 a7 0e 87 45 3
4 82 46 62 0c 04 21
31 26 23 fc b2 .
..E4.Fb..!1&#..
0350 25 99 c5 a5 a
4 f3 f9 ce c6 4b 0d
64 f2 9e b9 33 %
........K.d...3
0360 8b 76 6b f4 a
3 82 6c 18 6b c4 81
8c 30 81 19 07 .
vk...l.k...0...
0370 24 fb a9 57 6
9 b2 c7 27 97 37 20
e1 1c 1e 91 11 $
..Wi..'.7 .....
0380 0a e4 35 50 8
c 52 2c a5 02 ab 9d
84 75 59 f2 f3 .
.5P.R,.....uY..
0390 57 80 b7 8b 8
e fc e2 ab 10 a0 3c
51 8a 77 45 7c W
.........<Q.wE|
03a0 f5 47 c6 8b 1
7 23 b3 48 28 25 65
ed 89 50 f3 37 .
G...#.H(%e..P.7
03b0 22 d3 47 94 2
5 79 26 2c a0 54 64
34 38 5a e9 e6 "
.G.%y&,.Td48Z..
03c0 0b 35 3b e9 a
a 0a 9d 7c dc b0 50
ff fb 92 04 ec .
5;....|..P.....
03d0 8f f3 16 22 5
9 03 0c 32 52 64 67
eb 30 3d 86 5c .
.."Y..2Rdg.0=.\
03e0 0b f5 07 66 0

c 24 ab 81 84 a1 2c
81 86 0d 70 96 .
..f.$....,...p.
03f0 ba ce e5 ab 2
d e4 d0 dd 2d 15 49
33 22 64 32 b8 .
...-...-.I3"d2.
0400 05 4b 4a 50 c
4 95 ca d8 47 17 3c
df fd ec c5 5c .
KJP....G.<....\
0410 9e 6e 8e 64 4
5 15 9d 54 a4 23 8f
b0 58 a1 4c 56 .
n.dE..T.#..X.LV
0420 16 b4 c0 aa 2
a 40 95 91 ed a9 d4
ba b6 db 2a 34 .
...*@........*4
0430 c5 12 7b 0d a
c 59 ed 13 21 8b 3a
c3 88 41 67 ad .
.{..Y..!.:..Ag.
0440 90 24 b5 c4 5
8 23 79 84 d2 fa 58
9c 72 c8 22 05 .
$..X#y...X.r.".
0450 1a 5a 8a 29 4
b e0 56 d6 1a 6e 4c
ea aa 8a 44 6b .
Z.)K.V..nL...Dk
0460 47 12 6a bf e
8 aa 3e cb 94 49 dc
62 ae 9c ec d2 G
.j...>..I.b....
0470 cc dc df 12 b
2 49 78 3a c6 e1 90
ec 2c b8 44 ec .
....Ix:....,.D.
0480 47 53 32 bb 8
3 a8 84 c6 15 7a a2
33 96 7b bd ee G
S2......z.3.{..
0490 e8 7e ac e8 4
5 7a 75 31 59 ca dc
8d cc fb 44 20 .
~..Ezu1Y.....D
04a0 c1 56 a0 c5 a
d 42 2b be ed 19 aa
3a 87 0e 06 78 .
V...B+....:...x
04b0 5c 69 e8 ff 9
2 06 f4 18 de 4d 71
b8 2b 7e 31 99 \
i.......Mq.+~1.
04c0 6b d7 ca 8f 6
5 ef cd 70 ea d6 3e
a2 13 6b 21 71 k
...e..p..>..k!q
04d0 65 a6 d9 f1 b
9 68 2c fe c0 5d 5b
61 83 d5 48 34 e
....h,..][a..H4
04e0 84 0d 0b 10 8
9 b0 75 8c f5 35 4c
3d 94 44 fb ba .
.....u..5L=.D..
04f0 0b a8 d6 8a 9
5 08 af d5 ca f6 33

32 4a 46 9c a6 .
.........32JF..
0500 7b b4 92 13 3
3 da 5e 46 a2 da f4
76 12 7c 21 46 {
...3.^F...v.|!F
0510 66 a5 42 69 2
0 58 89 60 c8 05 10
de 3f 05 ac 97 f
.Bi X.`....?...
0520 6d e8
m
.
No. Time
Source
Destination
Protocol
Length Info
121 4.511176000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1300 http49
574 [PSH, ACK] Seq=
73158 Ack=1 Win=46
Len=1246
Frame 121: 1300 byt
es on wire (10400 b
its), 1300 bytes ca
ptured (10400 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.561106000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.561106000 s
econds
[Time delta fro
m previous captured
frame: 0.027530000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02753000
0 seconds]
[Time since ref
erence or first fra
me: 4.511176000 sec
onds]
Frame Number: 1
21
Frame Length: 1
300 bytes (10400 bi
ts)
Capture Length:

1300 bytes (10400

bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))

0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
286
Identification:
0xf1b4 (61876)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a84 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 73158, Ack: 1
, Len: 1246
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1246]
Sequence number
: 73158 (relativ
e sequence number)
[Next sequence
number: 74404 (r
elative sequence nu

mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x725
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2506]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 06 f1 b4 4
0 00 31 06 3a 84 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b c9 7f f3 9e
87 4e aa 50 18 .

..P..+.....N.P.
0030 00 2e 72 50 0
0 00 41 d9 5b 9a 09
2d 54 9e 0d a0 .
.rP..A.[..-T...
0040 55 62 b3 69 b
d db e7 ce 50 eb 0e
2b e2 86 b8 77 U
b.i....P..+...w
0050 04 aa 8e 11 a
5 1d cf 11 45 e4 0c
50 2a 41 63 1f .
.......E..P*Ac.
0060 9c 63 8e c2 d
a 03 00 99 78 60 9b
2c 51 e6 a1 89 .
c......x`.,Q...
0070 09 b9 e5 48 3
c 3e 5d a6 12 e2 03
50 cb 97 14 4c .
..H<>]....P...L
0080 5d ff fb 92 0
4 e7 8f f2 b0 20 59
81 ec 2a 50 59 ]
........ Y..*PY
0090 46 1b 30 3d 8
5 4c 0b e1 01 60 0c
3c ab 81 95 27 F
.0=.L...`.<...'
00a0 2c 01 86 15 7
8 f7 ec ff d0 3e 50
f0 66 91 a2 52 ,
...x....>P.f..R
00b0 5d 4e 32 34 2
c 0a b6 d2 4e ad 71
f8 42 6e e1 d8 ]
N24,...N.q.Bn..
00c0 9a 8f b5 4c f
e ec 77 b1 79 97 56
d7 e9 90 5a bb .
..L..w.y.V...Z.
00d0 67 87 11 17 0
7 28 d0 bb de 91 2c
8c 65 3e 49 47 g
....(....,.e>IG
00e0 4a c3 59 49 3
6 ec 82 eb 3d 7b 57
5c c5 af c4 57 J
.YI6...={W\...W
00f0 58 da 9c 52 d
c 2d bc 3a 27 24 59
08 92 18 0f f7 X
..R.-.:'$Y.....
0100 96 de 9b fd 3
8 52 58 5c b5 68 49
d1 a2 88 1a 3c .
...8RX\.hI....<
0110 bb 89 e9 96 4
8 05 28 c2 15 84 c8
49 57 23 8f 16 .
...H.(....IW#..
0120 96 5c 58 75 6
4 66 1a 8d 6b 2c b2
bd 6b 1b 37 ef .
\Xudf..k,..k.7.
0130 a4 25 13 66 6
0 a1 71 c8 a6 38 85
98 14 4c 5a 45 .
%.f`.q..8...LZE

0140 75 75 3b d2 c
8 44 4b 9d 88 e5 57
63 99 ec ec 62 u
u;..DK...Wc...b
0150 f6 d5 d8 ca d
1 15 7f 4a 20 8c e2
97 2e 12 69 50 .
......J .....iP
0160 7c e6 48 ab b
4 76 b4 46 84 e0 69
06 e9 32 2f 2b |
.H..v.F..i..2/+
0170 82 b8 bb 11 d
0 aa 2a 4d 66 38 e1
8d 02 6f b6 c8 .
.....*Mf8...o..
0180 af 56 66 71 b
4 68 f0 2c b5 ef b3
17 d5 83 38 bc .
Vfq.h.,......8.
0190 0d 44 2c 49 7
2 e3 d4 95 84 91 89
51 43 09 a9 1b .
D,Ir......QC...
01a0 47 64 da 0f 2
1 e5 ed df 0e df 0b
73 dc d3 1a 71 G
d..!......s...q
01b0 55 e9 5e 91 9
9 a6 4f f5 1c b6 a3
f5 66 e6 ff e2 U
.^...O.....f...
01c0 15 d5 3a f3 6
8 5b 16 93 fa 06 bd
55 f6 b5 6a 67 .
.:.h[.....U..jg
01d0 eb c5 56 0e 4
5 55 86 1c 44 69 85
ae cd b0 11 a3 .
.V.EU..Di......
01e0 7a 7f 19 ee a
0 69 a8 85 3d 5c 1e
7e 76 8f 3a d3 z
....i..=\.~v.:.
01f0 35 f2 c2 ac 4
f 2c 08 38 aa b4 a2
06 13 4b cd 81 5
...O,.8.....K..
0200 c7 c5 c2 8e 4
b 66 10 66 aa 8b eb
e3 ef ea fb 9b .
...Kf.f........
0210 ea b7 a2 f0 4
4 55 05 a4 c2 26 8f
99 4b 94 42 b5 .
...DU...&..K.B.
0220 1a 02 89 ff f
b 92 04 ec 8f f2 f7
29 57 83 0f 1a .
..........)W...
0230 60 5c e6 cb 0
0 3d 88 5c 0c 59 07
5c 0c 30 ab 81 `
\...=.\.Y.\.0..
0240 9a 20 6b 80 f
7 ad 70 0e 39 67 5a
59 18 90 67 bb .
k...p.9gZY..g.
0250 13 e8 30 c5 c

0 0c 08 79 7c 42 d0
a6 73 25 5d 40 .
.0....y|B..s%]@
0260 14 9e ea e1 4
3 ac 0a be dd 24 4b
df 77 8d b8 7b .
...C....$K.w..{
0270 9e d1 ee 78 4
2 a1 12 5f ca 46 1d
26 11 6a f7 43 .
..xB.._.F.&.j.C
0280 db b5 07 6b e
a cd 91 ca 90 ae 7f
de dd c2 50 d7 .
..k..........P.
0290 49 45 be 17 0
9 99 0d 09 c2 09 58
e4 45 5e 24 7b I
E........X.E^${
02a0 31 73 21 9a b
2 eb a1 f9 93 bf 6d
29 2a a8 14 c5 1
s!.......m)*...
02b0 15 43 8c 43 0
8 d6 41 61 b7 9e 21
9d 79 87 7d ad .
C.C..Aa..!.y.}.
02c0 75 ec b9 1b b
1 2d 95 b4 2d 6e 41
97 2d 44 68 eb u
....-..-nA.-Dh.
02d0 e7 66 5f 91 7
2 f7 87 28 24 3c 17
08 ae ed 00 53 .
f_.r..($<.....S
02e0 5b 40 a9 43 e
f 1a 22 e3 18 61 fd
fd 2a b7 76 8e [
@.C.."..a..*.v.
02f0 d2 aa 9c 34 8
d d8 7b 3d ec 58 10
30 d0 b2 00 40 .
..4..{=.X.0...@
0300 33 ab 41 e5 0
3 22 06 b6 e8 ac 35
5b 9c 8c a5 96 3
.A.."....5[....
0310 a1 27 61 84 1
c 71 de 57 15 8b a8
ac 97 98 8a d6 .
'a..q.W........
0320 f4 84 10 8b 4
5 ab 55 aa de 6b 3c
ad 31 ab 36 b9 .
...E.U..k<.1.6.
0330 35 ea 22 06 d
2 e2 6f 85 ce e0 28
74 60 b4 94 c0 5
."...o...(t`...
0340 e1 51 c2 e5 4
5 ca 88 79 42 41 0c
5b 86 b9 a8 d8 .
Q..E..yBA.[....
0350 9d e2 5e 9a a
a 32 fc 7b 53 57 3f
37 09 51 f1 d6 .
.^..2.{SW?7.Q..
0360 df c5 d7 b4 b
2 0c 97 0a b6 46 4c

f9 ab dd 42 8a .
........FL...B.
0370 2d 25 03 20 3
2 95 a8 dc 76 ba 86
55 80 8b 38 5a %. 2...v..U..8Z
0380 5a 34 03 15 8
9 f4 de 38 87 b3 f9
8e d4 79 7b 31 Z
4.....8.....y{1
0390 e5 98 fd ab b
3 fa fd 30 2c 71 52
e5 09 02 0c 31 .
......0,qR....1
03a0 8d a1 06 81 c
9 55 51 47 cc 65 a1
8c e4 f2 2b 95 .
....UQG.e....+.
03b0 af 23 3b 68 b
5 d6 c7 55 67 eb 7b
35 aa c8 30 17 .
#;h...Ug.{5..0.
03c0 41 c0 90 51 5
7 ff fb 92 04 e9 0f
f2 f8 2e d7 03 A
..QW...........
03d0 18 42 60 59 6
5 2a f0 3d e9 4c 0c
ac c1 5a 0c 61 .
B`Ye*.=.L...Z.a
03e0 09 81 77 a0 a
b 81 87 a1 70 63 7e
55 c9 9a 96 b6 .
.w.....pc~U....
03f0 66 96 9e 8d 0
d a4 bb 74 55 0c 06
55 41 8c 27 71 f
......tU..UA.'q
0400 63 c1 7f 1a 2
a 2e 3e af 68 90 b3
05 dd a8 c0 81 c
...*.>.h.......
0410 c6 a5 af f0 2
d 81 a2 61 87 0e 93
40 c3 38 67 38 .
...-..a...@.8g8
0420 68 c0 a3 8b 8
7 07 93 63 69 e2 9b
5a da ce 31 67 h
......ci..Z..1g
0430 ea 5f 5b bc c
f eb b6 e7 f5 9e 97
ad 39 ef 88 b9 .
_[.........9...
0440 cb 70 24 51 8
3 44 42 82 aa 33 55
cf ca 50 17 f8 .
p$Q.DB..3U..P..
0450 49 e1 74 32 5
5 00 71 a5 2b de e5
c0 c5 ba ca f8 I
.t2U.q.+.......
0460 bf 8e cc 66 e
e 03 c0 ef 5b 8d 76
a7 90 77 1a 21 .
..f....[.v..w.!
0470 e1 15 af 19 8
1 9a 6d be 34 96 05
62 83 0a 13 5d .

.....m.4..b...]
0480 88 41 a6 f7 1
a 50 67 86 b6 26 8b
13 34 d3 f2 6f .
A...Pg..&..4..o
0490 74 2a fc 2d 2
e 8c 8d 1a f2 9f 09
ed 3f 0f 31 3e t
*.-........?.1>
04a0 ff d7 2b 4d a
7 96 df 39 db 5a f0
65 b5 22 b1 eb .
.+M...9.Z.e."..
04b0 5b f1 d9 b1 3
6 2c b3 67 c8 45 00
2c 05 c9 4e 02 [
...6,.g.E.,..N.
04c0 c7 59 87 82 3
5 68 87 ae e3 44 36
73 6d c4 70 a5 .
Y..5h...D6sm.p.
04d0 e7 ee 11 11 6
9 4c 3c 6f b7 cc 6d
58 5c 50 81 ea .
...iL<o..mX\P..
04e0 73 01 c3 9f d
8 d2 05 c9 52 45 8e
91 b2 22 df bd s
.......RE..."..
04f0 1a 8d 70 36 a
d 2a ad 1a ea 23 1b
cb 53 c3 f1 f1 .
.p6.*...#..S...
0500 34 d3 11 cd 5
7 fd 55 7a d0 d3 ee
ca e6 8b 55 2d 4
...W.Uz......U0510 5d 6c ee e8
]
l..
No. Time
Source
Destination
Protocol
Length Info
122 4.511361000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=74404 Win=40005 Le
n=0
Frame 122: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:26:5

7.561291000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.561291000 s
econds
[Time delta fro
m previous captured
frame: 0.000185000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018500
0 seconds]
[Time since ref
erence or first fra
me: 4.511361000 sec
onds]
Frame Number: 1
22
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f44 (20292)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.

com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 74404
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 74404 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40005
[Calculated win
dow size: 40005]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 121]
[The RTT to
ACK the segment wa
s: 0.000185000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 44 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OD@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 84 d1 50 10 .
....P..N.+...P.
0030 9c 45 18 d4 0
0 00
.
E....
No. Time
Source
Destination
Protocol
Length Info
123 4.541178000
pc9.home
239.255.255.
250
SSDP
416 NOTIFY * HTT
P/1.1
Frame 123: 416 byte
s on wire (3328 bit
s), 416 bytes captu
red (3328 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.591108000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.591108000 s
econds
[Time delta fro
m previous captured
frame: 0.029817000
seconds]

[Time delta fro

m previous displaye
d frame: 0.02981700
0 seconds]
[Time since ref
erence or first fra
me: 4.541178000 sec
onds]
Frame Number: 1
23
Frame Length: 4
16 bytes (3328 bits
)
Capture Length:
416 bytes (3328 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: W
esternD_d0:f3:c2 (0
0:90:a9:d0:f3:c2),
Dst: IPv4mcast_7f:f
f:fa (01:00:5e:7f:f
f:fa)
Destination: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
Address: IP
v4mcast_7f:ff:fa (0
1:00:5e:7f:ff:fa)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Western
D_d0:f3:c2 (00:90:a
9:d0:f3:c2)
Address: We
sternD_d0:f3:c2 (00
:90:a9:d0:f3:c2)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: pc9.

home (192.168.1.13)
, Dst: 239.255.255.
250 (239.255.255.25
0)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
02
Identification:
0x442d (17453)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
Protocol: UDP (
17)
Header checksum
: 0xbf7e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc9.hom
e (192.168.1.13)
Destination: 23
9.255.255.250 (239.
255.255.250)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 3370
7 (33707), Dst Port
: ssdp (1900)
Source Port: 33
707 (33707)
Destination Por
t: ssdp (1900)
Length: 382
Checksum: 0x00b

3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
3]
Hypertext Transfer
Protocol
NOTIFY * HTTP/1
.1\r\n
[Expert Inf
o (Chat/Sequence):
NOTIFY * HTTP/1.1\r
\n]
[NOTIFY
* HTTP/1.1\r\n]
[Severi
ty level: Chat]
[Group:
Sequence]
Request Met
hod: NOTIFY
Request URI
:*
Request Ver
sion: HTTP/1.1
HOST: 239.255.2
55.250:1900\r\n
CACHE-CONTROL:
max-age=100\r\n
LOCATION: http:
//192.168.1.13:4915
3/nasdevice.xml\r\n
NT: urn:schemas
-microsoft-com:serv
ice:NULL:1\r\n
NTS: ssdp:alive
\r\n
SERVER: Linux/3
.2.26, UPnP/1.0, Po
rtable SDK for UPnP
devices/1.6.6\r\n
X-User-Agent: r
edsonic\r\n
USN: uuid:73656
761-7465-7375-636b0090a9d0f3c2::urn:s
chemas-microsoft-co
m:service:NULL:1\r\
n
\r\n
[Full request U
RI: http://239.255.
255.250:1900*]
0000 01 00 5e 7f f
f fa 00 90 a9 d0 f3
c2 08 00 45 00 .
.^...........E.
0010 01 92 44 2d 0
0 00 04 11 bf 7e c0
a8 01 0d ef ff .
.D-.....~......
0020 ff fa 83 ab 0
7 6c 01 7e 00 b3 4e
4f 54 49 46 59 .
....l.~..NOTIFY

0030 20 2a 20 48 5
4 54 50 2f 31 2e 31
0d 0a 48 4f 53
* HTTP/1.1..HOS
0040 54 3a 20 32 3
3 39 2e 32 35 35 2e
32 35 35 2e 32 T
: 239.255.255.2
0050 35 30 3a 31 3
9 30 30 0d 0a 43 41
43 48 45 2d 43 5
0:1900..CACHE-C
0060 4f 4e 54 52 4
f 4c 3a 20 6d 61 78
2d 61 67 65 3d O
NTROL: max-age=
0070 31 30 30 0d 0
a 4c 4f 43 41 54 49
4f 4e 3a 20 68 1
00..LOCATION: h
0080 74 74 70 3a 2
f 2f 31 39 32 2e 31
36 38 2e 31 2e t
tp://192.168.1.
0090 31 33 3a 34 3
9 31 35 33 2f 6e 61
73 64 65 76 69 1
3:49153/nasdevi
00a0 63 65 2e 78 6
d 6c 0d 0a 4e 54 3a
20 75 72 6e 3a c
e.xml..NT: urn:
00b0 73 63 68 65 6
d 61 73 2d 6d 69 63
72 6f 73 6f 66 s
chemas-microsof
00c0 74 2d 63 6f 6
d 3a 73 65 72 76 69
63 65 3a 4e 55 t
-com:service:NU
00d0 4c 4c 3a 31 0
d 0a 4e 54 53 3a 20
73 73 64 70 3a L
L:1..NTS: ssdp:
00e0 61 6c 69 76 6
5 0d 0a 53 45 52 56
45 52 3a 20 4c a
live..SERVER: L
00f0 69 6e 75 78 2
f 33 2e 32 2e 32 36
2c 20 55 50 6e i
nux/3.2.26, UPn
0100 50 2f 31 2e 3
0 2c 20 50 6f 72 74
61 62 6c 65 20 P
/1.0, Portable
0110 53 44 4b 20 6
6 6f 72 20 55 50 6e
50 20 64 65 76 S
DK for UPnP dev
0120 69 63 65 73 2
f 31 2e 36 2e 36 0d
0a 58 2d 55 73 i
ces/1.6.6..X-Us
0130 65 72 2d 41 6
7 65 6e 74 3a 20 72
65 64 73 6f 6e e
r-Agent: redson
0140 69 63 0d 0a 5

5 53 4e 3a 20 75 75
69 64 3a 37 33 i
c..USN: uuid:73
0150 36 35 36 37 3
6 31 2d 37 34 36 35
2d 37 33 37 35 6
56761-7465-7375
0160 2d 36 33 36 6
2 2d 30 30 39 30 61
39 64 30 66 33 636b-0090a9d0f3
0170 63 32 3a 3a 7
5 72 6e 3a 73 63 68
65 6d 61 73 2d c
2::urn:schemas0180 6d 69 63 72 6
f 73 6f 66 74 2d 63
6f 6d 3a 73 65 m
icrosoft-com:se
0190 72 76 69 63 6
5 3a 4e 55 4c 4c 3a
31 0d 0a 0d 0a r
vice:NULL:1....
No. Time
Source
Destination
Protocol
Length Info
124 4.628182000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=74404
Ack=1 Win=46 Len=1
260
Frame 124: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.678112000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.678112000 s
econds
[Time delta fro
m previous captured
frame: 0.087004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08700400
0 seconds]
[Time since ref

erence or first fra

me: 4.628182000 sec
onds]
Frame Number: 1
24
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1b5 (61877)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a75 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 74404, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:

0]
[TCP Segment Le
n: 1260]
Sequence number
: 74404 (relativ
e sequence number)
[Next sequence
number: 75664 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x6b4
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17

e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 b5 4
0 00 31 06 3a 75 4a
7c 0c 8a c0 a8 .
...@.1.:uJ|....
0020 01 0b 00 50 c
1 a6 2b c9 84 d1 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 6b 42 0
0 00 64 28 45 2f 97
ac 41 95 32 c8 .
.kB..d(E/..A.2.
0040 29 9a 72 e0 1
0 38 c8 e6 8a 95 a1
ea 32 15 47 ba )
.r..8......2.G.
0050 d6 ad 0e 3d e
6 d2 01 23 2b 79 20
af a7 76 51 19 .
..=...#+y ..vQ.
0060 9a 58 8b 62 2
3 33 2f d5 69 38 fd
14 4d fe 1d 9d .
X.b#3/.i8..M...
0070 ec ba 0c c8 8
d 53 d2 09 61 68 cd
29 35 29 59 79 .
....S..ah.)5)Yy
0080 fa bc 67 5e f
c 55 87 7f ad ff fb
92 04 ea 0f f2 .
.g^.U..........
0090 c6 41 57 03 0
c 2a e0 61 67 fa e0
61 e8 5c 0c a9 .
AW..*.ag..a.\..
00a0 13 58 0c 3d 0
b 81 86 a0 6b 81 87
a1 70 76 4a 7f .
X.=....k...pvJ.
00b0 ff ed 4f d2 a
4 f4 4d cc f3 14 f6
24 c3 a0 9f 09 .
.O...M....$....
00c0 23 9d c1 ed 7
b 9e e2 e6 c7 74 e9
e0 d9 31 f3 1e #
...{....t...1..
00d0 d6 96 f9 d4 1
5 d3 26 0e f7 1c 52
06 f5 2b 6e f0 .
.....&...R..+n.
00e0 20 a8 a0 a8 7
c 64 9c 26 2b cb 3c
b0 9d e4 50 75
...|d.&+.<...Pu
00f0 c0 a6 4c 72 b
a 52 da b5 0f ee 5b
5b e3 b3 aa 51 .
.Lr.R....[[...Q
0100 74 aa d3 ee e
3 7a ec 6d 44 7d fc
e3 05 cc 71 43 t
....z.mD}....qC
0110 43 53 e5 17 a
5 da 9a ea 4f 33 44
57 65 89 76 93 C

S......O3DWe.v.
0120 30 3a 7b 43 d
d 06 8e 4b 23 44 41
a9 7e 11 59 0a 0
:{C...K#DA.~.Y.
0130 a4 04 b5 fa 7
f ab c4 9a ce 30 9e
eb 11 be 37 2e .
........0....7.
0140 b7 0c 25 0b b
1 e5 8e 79 ab e0 ab
a2 89 24 1b 84 .
.%....y.....$..
0150 a2 7a 54 4f d
5 6b 5b de 8e c9 6b
bb e2 ee d6 56 .
zTO.k[...k....V
0160 67 b4 bd 36 d
3 83 a0 f3 8e 1d 22
d1 77 b5 e4 df g
..6......".w...
0170 14 71 26 32 4
d 40 2d 7a e1 94 bc
7e d9 74 14 3a .
q&2M@-z...~.t.:
0180 36 6a 87 77 4
d d2 b4 ac 4d 8e 4c
40 68 52 f4 31 6
j.wM...M.L@hR.1
0190 59 34 66 9a f
f 0d fb bc 49 95 ce
a1 17 57 fb dc Y
4f.....I....W..
01a0 2f e0 b6 6f 2
6 27 ca 8c d2 46 8d
08 4f 88 76 75 /
..o&'...F..O.vu
01b0 14 44 e5 a7 e
2 a1 9f f5 d4 1e 72
70 7b 56 f6 7e .
D........rp{V.~
01c0 bc 35 66 b5 6
e e6 e2 7e 25 bd 1e
86 86 d5 96 48 .
5f.n..~%......H
01d0 2c 1c 66 a6 e
9 d3 76 bd 55 72 1a
e2 e4 50 f6 aa ,
.f...v.Ur...P..
01e0 39 1c 7e 70 a
8 2c 1d 54 18 6d ea
06 58 f6 e1 51 9
.~p.,.T.m..X..Q
01f0 e7 97 0d b4 5
5 5f dc 25 fc af c9
aa f4 56 a9 bf .
...U_.%.....V..
0200 22 e6 b5 13 1
a a2 a2 31 a4 88 2f
00 78 f9 f1 90 "
......1../.x...
0210 a3 0f 50 5c 4
8 88 50 9a 07 cf ff
dc 56 ed b7 5e .
.P\H.P.....V..^
0220 d1 6d ce c7 a
3 b9 af 0e ad 21 e2
ff fb 92 04 e8 .
m.......!......

0230 8f f2 d3 23 d
6 83 0f 4a 52 61 e7
fa e0 3d e8 5c .
..#...JRa...=.\
0240 0c 40 e3 58 0
c 3d 0b 81 80 9c 6b
41 87 ad 70 c5 .
@.X.=....kA..p.
0250 72 4f 01 61 0
6 6a 1d ff 67 42 69
c4 e5 42 b6 0c r
O.a.j..gBi..B..
0260 d4 2c bc 26 5
0 96 d4 26 f2 44 05
9c 69 df 3c f0 .
,.&P..&.D..i.<.
0270 cf 93 5b 58 6
7 cc 3d 35 39 b8 c2
3b 1c f9 61 2f .
.[Xg.=59..;..a/
0280 d0 7a 39 45 4
5 8d 11 cd 0b b8 0f
13 7e 33 71 24 .
z9EE.......~3q$
0290 e0 24 48 9b 1
3 5b ff 1c dc 22 25
de 8f fb 4b f0 .
$H..[..."%...K.
02a0 5a 9e 9d 6f 4
3 da 19 2f b0 a8 1c
92 40 54 37 63 Z
..oC../....@T7c
02b0 a4 94 51 e4 6
d 97 ab 07 0e 41 13
9a 20 20 92 99 .
.Q.m....A.. ..
02c0 18 05 b9 ee 4
c b6 31 96 55 56 39
55 76 16 cd b7 .
...L.1.UV9Uv...
02d0 52 de e2 7f 7
6 4b af 92 da c5 65
2f f9 e6 21 41 R
...vK....e/..!A
02e0 97 ae b7 3e f
f 4e a0 f7 e0 22 c9
95 98 f0 af f6 .
..>.N..."......
02f0 f2 59 0b cb 8
f 8e ed e6 24 0e 08
ca 1a 02 ba d2 .
Y......$.......
0300 a0 91 83 06 4
2 24 5a 91 97 89 cc
ac b2 26 50 fc .
...B$Z......&P.
0310 9f 5b 74 0c 8
a f7 74 a1 94 f4 6a
44 20 50 cb b2 .
[t...t...jD P..
0320 27 ae 47 8d 7
2 a1 2c 77 18 7e 35
9b 77 87 aa dc '
.G.r.,w.~5.w...
0330 a7 a7 9b ed c
a 7a 4c 9a 35 8f a6
86 2f fe a4 99 .
....zL.5.../...
0340 57 15 0d 28 2

4 69 88 1c 9e 67 8d
43 44 26 a0 00 W
..($i...g.CD&..
0350 84 27 10 40 d
1 7e 52 5b b9 a7 72
7d bb 9a ad d3 .
'.@.~R[..r}....
0360 6c 61 d0 ec d
c 5f 32 b5 6d 44 98
1e dd 21 96 ce l
a..._2.mD...!..
0370 59 a1 46 d5 6
1 01 71 9f d6 60 d2
84 79 3d 91 b1 Y
.F.a.q..`..y=..
0380 60 e1 ab 60 6
4 19 bb d0 e1 a2 35
22 5c a3 ce 55 `
..`d.....5"\..U
0390 92 4d da 77 8
d b3 ca f6 b9 79 1b
c7 cd 37 db a3 .
M.w.....y...7..
03a0 c7 50 a8 81 0
3 c4 d6 75 b5 ea 96
8a 80 27 45 14 .
P.....u.....'E.
03b0 99 75 d3 71 b
a 44 54 77 1d b4 43
ff c2 5f 36 9c .
u.q.DTw..C.._6.
03c0 55 d4 23 52 c
4 d5 f5 fd f5 bf bd
cc ff ff fb 92 U
.#R............
03d0 04 e8 0f f2 e
5 31 56 03 38 42 60
57 a5 fa d0 3d .
....1V.8B`W...=
03e0 e8 4c 0c 0c b
7 56 0c 61 29 81 86
9c ab 01 8c 21 .
L...V.a)......!
03f0 70 52 4a d1 d
e 96 c4 5b 25 e1 03
37 82 12 41 cc p
RJ....[%..7..A.
0400 dd 98 b6 2c d
4 32 e5 da 40 22 6e
5e 8f d3 49 e7 .
..,.2..@"n^..I.
0410 de 96 69 7e f
d ba 94 37 ee 73 1b
92 e9 07 64 fb .
.i~...7.s....d.
0420 a7 93 be 87 b
7 13 87 6c 1b 2f 5e
ae 66 59 cb 4a .
......l./^.fY.J
0430 9a 08 e2 52 9
6 16 a5 5b 3f 5a 74
74 fe 3a a3 f4 .
..R...[?Ztt.:..
0440 e8 6d 9d 6c c
d 99 75 c4 44 8b 53
43 60 98 5c 48 .
m.l..u.D.SC`.\H
0450 ec fa 04 4a 0
d ad 50 9b 6e d2 91

85 ba 5e a9 ac .
..J..P.n....^..
0460 fe 19 46 3c c
8 24 bf ac 72 f0 42
8a 48 08 70 93 .
.F<.$..r.B.H.p.
0470 46 8f 61 8a a
c 8d 40 6a ba 7d 3e
5b 2d 2f d6 da F
.a...@j.}>[-/..
0480 ad 9d b6 eb f
5 f9 a8 e0 aa 46 5d
9c 0a 1e ef 89 .
........F].....
0490 8a 73 00 08 2
3 0c 45 91 f3 2a b1
d5 d2 bc 4f 13 .
s..#.E..*....O.
04a0 c4 5c 4f bd d
2 de f3 3e dc 93 02
d0 7f 6e dd 3d .
\O....>.....n.=
04b0 e1 8c ff 48 3
2 85 dc c6 97 5d 12
5f bc a4 03 74 .
..H2....]._...t
04c0 66 63 8f b9 b
2 f8 00 f4 f9 6f 34
55 93 b5 10 dc f
c.......o4U....
04d0 42 db 9c 96 c
4 67 1d 17 78 9e c5
af f3 88 1d 3e B
....g..x......>
04e0 44 20 09 ec 1
d f0 3c 90 e9 fc c2
15 28 0c 0c d4 D
....<.....(...
04f0 54 ea a5 2f 6
d f0 9d 43 77 c2 db
1f 10 cf 9f 3f T
../m..Cw......?
0500 aa 64 b2 62 7
1 3a 00 42 4a ad ad
44 17 50 43 fa .
d.bq:.BJ..D.PC.
0510 15 49 45 f0 8
b e9 9d 64 2d b2 88
30 07 cd 4e 23 .
IE....d-..0..N#
0520 e2 27
.
'
No. Time
Source
Destination
Protocol
Length Info
125 4.658182000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
460 http49
574 [PSH, ACK] Seq=
75664 Ack=1 Win=46
Len=406

Frame 125: 460 byte

s on wire (3680 bit
s), 460 bytes captu
red (3680 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.708112000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.708112000 s
econds
[Time delta fro
m previous captured
frame: 0.030000000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03000000
0 seconds]
[Time since ref
erence or first fra
me: 4.658182000 sec
onds]
Frame Number: 1
25
Frame Length: 4
60 bytes (3680 bits
)
Capture Length:
460 bytes (3680 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
46
Identification:
0xf1b6 (61878)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9

Protocol: TCP (
6)
Header checksum
: 0x3dca [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 75664, Ack: 1
, Len: 406
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 406]
Sequence number
: 75664 (relativ
e sequence number)
[Next sequence
number: 76070 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1

... = Push: Set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xaa2
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1666]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 be f1 b6 4
0 00 31 06 3d ca 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b c9 89 bd 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e aa 2c 0
0 00 a1 34 8c 2c b0
b5 70 b3 9e 22 .
..,...4.,..p.."
0040 48 93 b9 35 6
a 13 75 1b 53 39 c2
ea fe 6a ff de H
..5j.u.S9...j..
0050 d9 e3 80 d3 4
3 a7 14 61 61 3d df
a8 b9 65 0f 1a .
...C..aa=...e..
0060 3c 78 ab b8 7
8 3f e7 58 e7 8f e6
de 23 87 b9 6e <
x..x?.X....#..n
0070 6b e2 be e2 2
0 73 8c 0f 2d cb 75
0a 79 a7 e2 d9 k
... s..-.u.y...
0080 3d a8 26 ff f
b 92 04 eb 8f f2 ec
46 55 83 2f 42 =
.&........FU./B
0090 e0 64 65 fa b
0 63 0c 4c 0b 48 db
56 0c 3d 0b 89 .
de..c.L.H.V.=..

00a0 70 98 6b 01 8
7 ad 30 ea ca 53 6a
d6 45 45 d5 06 p
.k...0..Sj.EE..
00b0 c0 c2 22 c3 e
8 60 a6 59 b6 cd 5d
70 0d 6d 95 f3 .
."..`.Y..]p.m..
00c0 cb 74 62 26 f
3 c9 47 6f b6 d8 b9
89 04 ed 55 e6 .
tb&..Go......U.
00d0 a6 11 cc 95 f
5 a4 62 69 92 f8 4f
9f 42 46 ae 66 .
.....bi..O.BF.f
00e0 6a 7f b5 6c 8
e 62 db 0f 25 62 99
d9 2d cc ed 2b j
..l.b..%b..-..+
00f0 46 c4 49 18 2
0 36 2d ab 28 06 71
a2 4e 55 95 47 F
.I. 6-.(.q.NU.G
0100 b7 14 ce fd f
0 ba 3a 27 01 57 a9
d7 65 52 13 22 .
.....:'.W..eR."
0110 1a 43 aa 9e 9
7 02 1d 53 1a 55 56
d6 32 95 60 96 .
C.....S.UV.2.`.
0120 e4 fb aa ec b
2 a9 47 43 8d 3d 9d
4e c0 1a d1 c5 .
.....GC.=.N....
0130 5f 02 43 50 6
8 60 82 88 08 5a 9f
be 47 8c 45 70 _
.CPh`...Z..G.Ep
0140 e9 48 56 c4 9
7 17 c4 af 30 cb 37
77 cf ad 3e 3a .
HV.....0.7w..>:
0150 c5 ac 50 c3 8
6 01 a1 c8 48 fb 9f
12 a1 f7 1f 4a .
.P.....H......J
0160 37 a9 0e 4a 4
6 eb d9 f4 28 80 09
23 91 92 ab 0b 7
..JF...(..#....
0170 c2 4c 0f a2 f
a f2 11 3d 73 96 e0
1d 7a b6 90 c8 .
L.....=s...z...
0180 b6 53 98 db b
4 09 e1 d2 13 45 27
26 0a ad 4e c5 .
S.......E'&..N.
0190 fe d4 13 42 a
a 49 f3 fb aa 35 6d
3e d7 d4 7a 41 .
..B.I...5m>..zA
01a0 d6 17 50 94 c
f 63 ca cd 17 ef 59
c6 af 99 8d 81 .
.P..c....Y.....
01b0 9c a2 02 07 8

6 cb 71 82 26 96 0b
a3 4a ac 12 99 .
.....q.&...J...
01c0 64 69 3a df a
a 46 b1 ad ae 55 df
42
d
i:..F...U.B
No. Time
Source
Destination
Protocol
Length Info
126 4.658360000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=76070 Win=39588 Le
n=0
Frame 126: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.708290000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.708290000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 4.658360000 sec
onds]
Frame Number: 1
26
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype

:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab

le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f45 (20293)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 76070
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 76070 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .

... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39588
[Calculated win
dow size: 39588]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 125]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 45 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OE@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 8b 53 50 10 .
....P..N.+..SP.
0030 9a a4 18 d4 0
0 00
.
.....
No. Time
Source

Destination
Protocol
Length Info
127 4.774189000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=76070
Ack=1 Win=46 Len=1
260
Frame 127: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.824119000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.824119000 s
econds
[Time delta fro
m previous captured
frame: 0.115829000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11582900
0 seconds]
[Time since ref
erence or first fra
me: 4.774189000 sec
onds]
Frame Number: 1
27
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9

0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1b7 (61879)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a73 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 76070, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 76070 (relativ
e sequence number)
[Next sequence
number: 77330 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi

ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x49f
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 b7 4
0 00 31 06 3a 73 4a
7c 0c 8a c0 a8 .
...@.1.:sJ|....
0020 01 0b 00 50 c
1 a6 2b c9 8b 53 9e
87 4e aa 50 10 .
..P..+..S..N.P.
0030 00 2e 49 fb 0
0 00 51 44 04 88 36
85 73 62 a4 13 .
.I...QD..6.sb..
0040 e4 03 19 62 7
2 f0 74 e6 6d e6 b1
79 f0 63 fb aa .
..br.t.m..y.c..
0050 cd 86 51 8d 6
b 16 24 b5 ee da a9
6a 8e ce 94 bc .
.Q.k.$....j....
0060 e0 f5 64 8d 0
5 02 a4 8c 0d e6 e7
ad 52 09 b1 c4 .
.d.........R...

0070 cc 0b 8b a4 e
8 9e 56 c9 53 49 14
13 7a 0b bd a7 .
.....V.SI..z...
0080 20 ca 9b 3a 7
9 e2 52 87 c5 45 9c
e7 d0 b0 a9 ff
..:y.R..E......
0090 fb 92 04 ee 0
f f3 12 37 d5 83 0f
42 e0 5a 65 3a .
......7...B.Ze:
00a0 c0 61 ec 4c 0
c 64 c1 56 0c 61 09
81 8b 94 2b 00 .
a.L.d.V.a....+.
00b0 f7 bd 28 2d 9
8 72 dc d0 a4 bf 43
30 5e 35 da 84 .
.(-.r....C0^5..
00c0 5c 84 8b f1 0
9 6d 02 76 72 fd 68
90 00 31 fa 5e \
....m.vr.h..1.^
00d0 5c c7 8c 93 6
4 f6 81 66 bd c4 79
47 21 cc c9 48 \
...d..f..yG!..H
00e0 11 5f b0 dc f
1 82 81 aa ae 50 76
bc a1 90 df 26 .
_.......Pv....&
00f0 27 6e 48 48 7
0 7d 21 74 d7 5b 39
48 9e 96 6d 3a '
nHHp}!t.[9H..m:
0100 df 7c d3 ee 7
4 8b 9b 13 34 4d 1c
d0 11 13 c0 92 .
|..t...4M......
0110 d8 ae 26 16 3
e ab 3a f9 9f dc 41
ba 2b 28 e3 56 .
.&.>.:...A.+(.V
0120 02 42 b4 c5 0
f 01 b9 ca 3d 64 a0
8e d6 e7 1f d0 .
B......=d......
0130 19 11 42 8a 1
6 0c f4 6b fc 32 c6
87 68 90 6b 67 .
.B....k.2..h.kg
0140 b3 da f4 de e
c e5 f0 0e 0a d8 86
70 f8 10 4c 5a .
..........p..LZ
0150 e0 96 78 4f 3
b 74 15 ba 5b b9 fe
9f 8e 6b 9b ad .
.xO;t..[....k..
0160 ee 2f e7 ac 7
e 84 22 80 a9 d1 5a
18 e5 8b 0a a0 .
/..~."...Z.....
0170 63 f6 d1 50 8
f 52 3d 5f ef a8 ba
18 6c e5 f2 18 c
..P.R=_....l...
0180 b9 8f d0 a9 2

c 49 b9 89 e3 27 8c
04 b4 f8 7c 9b .
...,I...'....|.
0190 b6 d7 68 df 4
8 96 c4 6a 45 ae 8f
44 d5 b5 d2 8e .
.h.H..jE..D....
01a0 97 8d 90 22 5
c fb 61 28 a2 81 98
ea 82 94 17 53 .
.."\.a(.......S
01b0 79 03 76 93 9
6 9a f9 e2 ac a5 28
b6 c4 2e 50 af y
.v.......(...P.
01c0 29 fd f6 d4 8
0 11 70 f9 b6 3d 66
45 d4 51 32 15 )
.....p..=fE.Q2.
01d0 8a b4 58 37 a
d d7 41 c3 2c ba ce
ff e9 a5 c5 37 .
.X7..A.,......7
01e0 c2 21 03 08 9
2 10 e7 82 99 af 21
e1 16 5c 9c 59 .
!........!..\.Y
01f0 10 32 c6 82 7
d bc 49 1e a7 83 f7
1d a9 94 ad 92 .
2..}.I.........
0200 08 a7 1a 16 4
3 af 9a 62 85 1c 42
1c 55 9d 0a 7c .
...C..b..B.U..|
0210 f5 c4 25 46 5
9 a7 e3 98 0f bd b0
f9 f0 a3 55 4d .
.%FY.........UM
0220 4f 35 81 04 6
c 5b 50 40 61 c1 c9
aa 95 fb b1 45 O
5..l[P@a......E
0230 18 ff fb 92 0
4 eb 8f f3 05 2e d5
83 18 6a 60 60 .
............j``
0240 25 ca c0 61 e
b 4c 0b e0 cf 58 0c
3d 0b 81 8d 18 %
..a.L...X.=....
0250 2b 40 f7 a5 3
0 da 9a 7d 71 06 98
ad 37 59 5a 81 +
@..0..}q...7YZ.
0260 b0 07 1c 90 a
b 59 62 48 e5 09 f0
93 ad c5 5c 07 .
....YbH......\.
0270 97 ae e1 9e 5
a b3 6a 69 9e b1 97
9a e4 91 c6 33 .
...Z.ji.......3
0280 2a ad d5 a0 0
a f3 45 18 e4 82 4a
ae 40 bd 36 cb *
.....E...J.@.6.
0290 7a 68 9c b2 6
8 da d1 68 66 f1 db

f2 9a 57 81 97 z
h..h..hf....W..
02a0 88 29 50 b4 0
e 21 92 08 0a 11 3e
82 08 12 a5 35 .
)P..!....>....5
02b0 2c 1f 49 4d 2
2 b2 85 95 d9 ae 57
52 ae a5 a2 b3 ,
.IM".....WR....
02c0 02 eb 05 46 8
7 74 12 97 be 1f 94
cd 54 8b c7 66 .
..F.t......T..f
02d0 3e 10 d8 33 2
2 d5 50 18 86 b2 98
a5 2e d6 cb aa >
..3".P.........
02e0 55 67 8c 33 3
9 f7 e7 55 c1 31 b0
d3 d0 cd 21 26 U
g.39..U.1....!&
02f0 19 15 2a 14 9
e 60 15 01 b2 86 68
87 d1 63 11 7a .
.*..`....h..c.z
0300 1b a4 e8 26 9
9 a8 c1 88 16 02 31
14 65 72 69 64 .
..&......1.erid
0310 db f4 76 1a 4
0 cd 13 96 90 4d b1
02 91 69 5a 9a .
.v.@....M...iZ.
0320 4a f5 55 cb 5
a 5c f9 50 13 10 d9
a4 29 ed a5 f5 J
.U.Z\.P....)...
0330 55 21 1f ef d
7 e0 d6 0d 9f 65 b6
5a 9b b7 b1 01 U
!.......e.Z....
0340 9f 40 c3 06 0
5 58 54 12 a0 c4 9b
70 66 ad 04 d6 .
@...XT....pf...
0350 87 41 1b f9 e
4 85 b0 c0 13 1a e0
d3 92 2e 35 ca .
A............5.
0360 be c9 62 a6 1
6 a5 91 74 31 57 81
af 61 67 d7 62 .
.b....t1W..ag.b
0370 c8 a9 29 36 e
9 86 ad 68 14 70 48
a8 4c 01 a9 15 .
.)6...h.pH.L...
0380 56 cf a0 28 c
2 c8 80 48 68 39 d4
05 6b 09 af 2c V
..(...Hh9..k..,
0390 13 0d 63 36 3
f d3 cc ad ef 6d 0d
f4 21 cd 80 e7 .
.c6?....m..!...
03a0 f4 b7 d4 eb c
2 33 fe 52 59 75 9f
59 ba 39 1c f0 .

....3.RYu.Y.9..
03b0 92 7f ea 10 c
2 cf be 26 1c 54 4e
3b 75 a6 da b6 .
......&.TN;u...
03c0 9e e4 dd ec 7
e 3c f4 57 db 33 bb
c9 3f fb 42 7f .
...~<.W.3..?.B.
03d0 93 8b cc ff f
b 92 04 e9 0f f2 db
21 d7 03 0f 42 .
..........!...B
03e0 50 61 65 3a f
0 61 e6 4c 0b 68 6b
5e 0c 3d 87 01 P
ae:.a.L.hk^.=..
03f0 80 14 ab c1 8
7 8d 30 01 bc 6f e1
ae ef 4d a9 f9 .
.....0..o...M..
0400 7b 04 01 3a 0
6 42 84 f4 89 45 ea
77 45 9e 40 ec {
..:.B...E.wE.@.
0410 60 03 da 0f 1
b a5 60 c1 45 a0 73
09 4e dc f6 0c `
.....`.E.s.N...
0420 18 17 85 c7 3
5 81 e0 9c c1 2f 18
81 14 2a 65 ea .
...5..../...*e.
0430 79 c3 56 eb b
8 1d 9a 4b db 9c ae
3b 4c c1 e4 30 y
.V....K...;L..0
0440 f4 a1 c6 1a 4
9 5e 4a 64 59 c6 1c
eb 88 3d 4a 4c .
...I^JdY....=JL
0450 a1 87 ba 00 0
6 43 4b 15 11 cc 54
d7 1d b5 62 6f .
....CK...T...bo
0460 6a 2a aa e1 8
9 58 e8 45 22 35 30
b0 a9 d3 fd f0 j
*...X.E"50.....
0470 12 15 41 b4 6
5 22 13 8f d9 1a c4
a4 cd a7 6a ad .
.A.e"........j.
0480 f4 69 60 bc 9
2 52 a8 c1 43 94 74
ca e2 8e 55 12 .
i`..R..C.t...U.
0490 62 38 bd 57 7
f 37 73 2e d6 75 36
45 ab 06 46 e2 b
8.W.7s..u6E..F.
04a0 00 b7 df 57 1
2 09 1f 16 45 53 56
ec 6b d0 2a ba .
..W....ESV.k.*.
04b0 4c 2a 7d 12 c
e 20 c3 d8 f8 be 91
29 50 6b 40 7a L
*}.. .....)Pk@z

04c0 cd bb 21 07 1
d 16 50 02 99 73 b0
19 10 66 55 b6 .
.!...P..s...fU.
04d0 0b e7 ef 1c 4
f aa 35 a9 5b ed 46
b9 62 6e eb 14 .
...O.5.[.F.bn..
04e0 a1 74 35 aa f
5 39 3d f5 5a 70 8b
ba 40 08 45 09 .
t5..9=.Zp..@.E.
04f0 b1 9e 64 46 1
8 74 55 22 13 a9 1b
53 7d d6 f9 cd .
.dF.tU"...S}...
0500 ba f9 7e 89 6
b 5f b7 4e d7 11 ec
ba cd 45 16 1c .
.~.k_.N.....E..
0510 38 89 d2 33 b
8 90 6c b6 49 75 59
23 4d 01 06 23 8
..3..l.IuY#M..#
0520 1c 10
.
.
No. Time
Source
Destination
Protocol
Length Info
128 4.806187000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
895 http49
574 [PSH, ACK] Seq=
77330 Ack=1 Win=46
Len=841
Frame 128: 895 byte
s on wire (7160 bit
s), 895 bytes captu
red (7160 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.856117000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.856117000 s
econds
[Time delta fro
m previous captured
frame: 0.031998000
seconds]

[Time delta fro

m previous displaye
d frame: 0.03199800
0 seconds]
[Time since ref
erence or first fra
me: 4.806187000 sec
onds]
Frame Number: 1
28
Frame Length: 8
95 bytes (7160 bits
)
Capture Length:
895 bytes (7160 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
81
Identification:
0xf1b8 (61880)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c15 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 77330, Ack: 1
, Len: 841

Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 841]
Sequence number
: 77330 (relativ
e sequence number)
[Next sequence
number: 78171 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x214
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[Bytes in f
light: 2101]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 71 f1 b8 4
0 00 31 06 3c 15 4a
7c 0c 8a c0 a8 .
q..@.1.<.J|....
0020 01 0b 00 50 c
1 a6 2b c9 90 3f 9e
87 4e aa 50 18 .
..P..+..?..N.P.
0030 00 2e 21 41 0
0 00 81 8a e8 60 80
68 d8 65 10 7e .
.!A.....`.h.e.~
0040 02 a8 bc 9f 8
3 1c dd dc 45 30 80
b1 32 97 54 3a .
.......E0..2.T:
0050 12 b2 da 53 6
f 30 90 db 8f b8 b0
98 9f 6f e2 0c .
..So0.......o..
0060 6c c1 58 f7 9
3 3f e3 5f da df 14
ce f5 01 82 49 l
.X..?._.......I
0070 cc 1c 09 43 6
7 9e 28 58 f2 de be
e4 58 a1 7d f5 .
..Cg.(X....X.}.
0080 83 41 98 a5 7
5 ec 40 4c 24 44 ff
fb 92 04 ec 0f .
A..u.@L$D......
0090 f3 23 1f d6 8
3 0f 32 52 60 a4 7a
e0 61 e8 4a 0b .
#....2R`.z.a.J.
00a0 14 85 58 0c 3
d 69 41 77 21 ab 01
87 95 70 a6 2f .
.X.=iAw!....p./
00b0 b8 07 51 d7 2
e 66 94 20 85 0b d2
99 0c d3 98 67 .
.Q..f. .......g
00c0 ab 85 fe 7f 2
9 3c c3 04 6b cb 02
06 9a 6e 29 5f .
...)<..k....n)_
00d0 45 44 aa ad 0
2 7d b7 5e 0b 83 2e
d0 e5 ac 3e 37 E
D...}.^......>7
00e0 a2 7c 1f bb d
b 06 86 93 94 10 72
b1 eb 6e c8 8e .
|........r..n..
00f0 ac 62 9c cc 5
5 91 79 aa d3 de 4b
75 63 a9 73 b5 .
b..U.y...Kuc.s.
0100 7d 7f 6a 3e b
e be 9f ca bc 53 85

77 8c 81 cf 21 }
.j>.....S.w...!
0110 d2 6f b0 37 4
1 d7 69 a5 09 6f 59
e1 86 59 d4 e8 .
o.7A.i..oY..Y..
0120 05 80 02 2a a
a 3c d2 af 8d 93 22
7a e6 89 27 07 .
..*.<...."z..'.
0130 75 19 92 42 5
d 5d 74 8a 33 0c 51
ac 7a 52 00 a6 u
..B]]t.3.Q.zR..
0140 52 7c 0e 88 3
4 d7 46 f6 1e 6c 30
93 de 7e da d9 R
|..4.F..l0..~..
0150 f8 df cf 73 6
e ad 17 da f2 87 f5
62 b6 d1 4d 88 .
..sn......b..M.
0160 43 2c db cd e
d a9 17 a6 fa 88 7b
9c 6f 6d 3e 61 C
,........{.om>a
0170 40 0c ec 12 7
9 69 01 2c 2f 4b 75
0b 81 9b 3b 6f @
...yi.,/Ku...;o
0180 a9 0e 6b ca 6
1 91 25 5b 91 47 1a
7d 35 78 26 59 .
.k.a.%[.G.}5x&Y
0190 f2 4b 56 a2 1
8 57 10 ca 4f 88 83
9b 70 a6 de 43 .
KV..W..O...p..C
01a0 d3 58 c2 fc f
2 63 2b 45 3b f8 74
fe 9b 94 78 f8 .
X...c+E;.t...x.
01b0 19 a3 aa 7b c
0 4e 8a db 47 8a 1f
4b bb dc a7 74 .
..{.N..G..K...t
01c0 54 e1 5a dc d
3 cd 61 de b6 9a d1
5f 98 61 89 7a T
.Z...a...._.a.z
01d0 42 38 0b 98 4
4 08 c9 10 42 d3 04
01 63 c7 4b a8 B
8..D...B...c.K.
01e0 01 85 a3 28 a
3 3d 58 62 3d 20 0c
b6 c1 5b 11 71 .
..(.=Xb= ...[.q
01f0 33 f3 a9 c1 7
4 da d6 ec 80 15 f2
f5 74 7f b6 dc 3
...t.......t...
0200 41 c3 16 f1 7
8 55 d6 2d ff ce ab
5b 66 d2 ec 60 A
...xU.-...[f..`
0210 08 aa 90 c7 2
c b2 13 b7 a6 8d 47
8c 8d d2 c7 54 .

...,.....G....T
0220 dd 75 18 4e 8
0 e5 63 2b 42 de fb
c9 ff fb 92 04 .
u.N..c+B.......
0230 ed 0f f3 29 2
1 55 03 2f 7a 50 61
e8 6a b0 61 ea .
..)!U./zPa.j.a.
0240 5c 0a d8 8d 5
4 0c bd 69 41 75 10
aa 81 8c 2d 28 \
...T..iAu....-(
0250 8e a4 d8 a0 0
0 04 0c 43 08 50 46
c0 23 84 40 0c .
......C.PF.#.@.
0260 12 bc ee db 0
a 44 f3 40 d1 21 6c
61 8f 18 95 9c .
....D.@.!la....
0270 b8 e6 ce 50 4
a 72 86 a7 6b cc d7
af 37 0a ed 33 .
..PJr..k...7..3
0280 a1 df f7 26 c
4 a4 f0 14 ee 17 05
c6 a1 ef 94 3a .
..&...........:
0290 6b 19 31 51 4
c 5e 45 2c 6c d4 47
74 34 db a2 ae k
.1QL^E,l.Gt4...
02a0 6f fe 9e 94 d
2 df 54 4f 73 8a 1e
e6 b1 9c 67 a6 o
.....TOs.....g.
02b0 46 bd 3e c2 a
a 53 24 4c d3 40 a4
cd c1 36 06 c7 F
.>..S$L.@...6..
02c0 0e 0d 50 4c c
8 3a 1c 87 c1 a5 8c
37 ad 15 38 37 .
.PL.:.....7..87
02d0 9c a8 bc 32 6
b d7 18 3d 48 f4 32
d5 da 2c a5 ea .
..2k..=H.2..,..
02e0 16 26 bc 04 b
8 af b4 26 ab ef 0b
8b cd 83 f6 db .
&.....&........
02f0 86 86 ff 9d 7
f 8d e6 79 60 e2 eb
98 3f 10 32 18 .
......y`...?.2.
0300 c1 47 b8 4b 7
1 99 58 a3 72 ec a0
b1 ef 7e 5d cc .
G.Kq.X.r....~].
0310 5a 2a a0 c1 6
1 e3 72 56 8a 5c a1
41 8b 60 6e 16 Z
*..a.rV.\.A.`n.
0320 16 ac 50 f8 9
9 18 05 0a 2a 29 0b
63 3c f5 b3 37 .
.P.....*).c<..7

0330 b0 49 bc ba b
b 5d ac ce d5 d4 be
72 0a 8c c2 db .
I...].....r....
0340 2d 5e 8e 26 d
a 25 45 1b f9 cf 38
bb d1 72 87 17 ^.&.%E...8..r..
0350 46 4f ca 24 8
6 d7 cb 1f f9 27 a6
f7 17 57 96 98 F
O.$.....'...W..
0360 cc 03 49 78 3
2 02 44 92 18 a1 00
b2 98 8b d1 b8 .
.Ix2.D.........
0370 46 e6 d6 e8 c
9 05 53 ea 6c 55 ea
e2 59 5a 95
F
.....S.lU..YZ.
No. Time
Source
Destination
Protocol
Length Info
129 4.806367000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=78171 Win=39063 Le
n=0
Frame 129: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.856297000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.856297000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 4.806367000 sec
onds]

Frame Number: 1
29
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f46 (20294)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 78171
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se

quence number)
Acknowledgment
number: 78171 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39063
[Calculated win
dow size: 39063]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 128]
[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 46 4
0 00 80 06 00 00 c0

a8 01 0b 4a 7c .
(OF@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 93 88 50 10 .
....P..N.+...P.
0030 98 97 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
130 4.889190000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=78171
Ack=1 Win=46 Len=1
260
Frame 130: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.939120000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.939120000 s
econds
[Time delta fro
m previous captured
frame: 0.082823000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08282300
0 seconds]
[Time since ref
erence or first fra
me: 4.889190000 sec
onds]
Frame Number: 1
30
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]

[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)

.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1b9 (61881)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a71 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 78171, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 78171 (relativ
e sequence number)
[Next sequence
number: 79431 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)

Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x917
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 b9 4
0 00 31 06 3a 71 4a
7c 0c 8a c0 a8 .
...@.1.:qJ|....
0020 01 0b 00 50 c
1 a6 2b c9 93 88 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 91 76 0
0 00 6a 09 c4 18 6c
45 b4 52 08 15 .

..v..j...lE.R..
0040 69 59 e3 02 3
8 b6 cc 28 ba 80 26
24 9b 49 04 15 i
Y..8..(..&$.I..
0050 81 c4 ec 43 9
9 e2 45 47 43 6f 52
a0 8e 89 17 81 .
..C..EGCoR.....
0060 54 4a 03 20 4
e 41 c9 59 f7 3d ae
50 94 bc 20 e9 T
J. NA.Y.=.P.. .
0070 97 3e f8 73 e
3 6c ea 9c 24 a2 a7
44 29 51 9a 2a .
>.s.l..$..D)Q.*
0080 99 a1 ae 5a f
3 ff fb 92 04 ee 8f
f3 0d 21 d4 03 .
..Z.........!..
0090 4f 7a 50 63 0
8 6a 80 67 07 5c 0c
9c 8f 4c 0d 61 O
zPc.j.g.\...L.a
00a0 e9 41 8f 11 a
9 81 9c 3d 28 aa 41
1c 43 25 eb 65 .
A.....=(.A.C%.e
00b0 0e 7d c8 61 0
2 29 5f a7 ff 52 5a
0d 3c b5 4c c0 .
}.a.)_..RZ.<.L.
00c0 84 6f 8e 4a 4
4 09 8b 51 6d 96 0a
f0 de 22 53 f2 .
o.JD..Qm...."S.
00d0 83 33 a9 7e 2
0 da 55 e5 3c 63 b3
7f 07 c3 97 2e .
3.~ .U.<c......
00e0 9b f9 6e 06 4
0 fe c4 73 46 f7 b1
e3 79 20 28 e3 .
.n.@..sF...y (.
00f0 30 a9 0d 5a e
b b9 db 50 a6 bf f7
cd f3 af ac fc 0
..Z...P........
0100 7a 57 e6 39 f
5 49 43 76 1a 6d 8d
76 c3 a2 c8 d7 z
W.9.ICv.m.v....
0110 bd c2 5f b6 f
a 7a f6 7d 2d 01 3c
8a f0 0b e6 75 .
._..z.}-.<....u
0120 96 1c 48 58 b
1 2f 8c 22 e7 d3 c4
1c 57 1e 26 8e .
.HX./."....W.&.
0130 03 cb 75 e1 3
5 97 44 a2 06 7c ae
c3 cf ed 56 be .
.u.5.D..|....V.
0140 eb 53 d6 06 4
7 f4 4b 2d 9f af 4f
1d b7 7d f8 3e .
S..G.K-..O..}.>

0150 f0 db 5a fc b
6 5e cd fc de ae f1
c3 23 dc c2 2d .
.Z..^......#..0160 49 d7 0a ea 4
8 09 34 79 f6 33 ab
b6 7b b7 a1 56 I
...H.4y.3..{..V
0170 b3 bf f4 2b 6
9 76 cf 61 c0 47 08
85 50 cb ab 38 .
..+iv.a.G..P..8
0180 c4 05 8c b2 c
3 8c a6 39 63 10 6a
72 79 7c 71 93 .
......9c.jry|q.
0190 cf 59 97 65 5
2 33 a7 5e 06 b7 99
0e 57 c8 06 e4 .
Y.eR3.^....W...
01a0 03 14 22 8a 2
d da 8e 2a 6f 29 8e
e7 08 cb b7 ee .
.".-..*o)......
01b0 f1 b9 3e 7f c
f ce 6f bc da f9 d4
1c 10 63 25 5c .
.>...o......c%\
01c0 ba 10 55 1e b
a 7f e3 d9 ff a7 4b
a9 74 56 10 0d .
.U.......K.tV..
01d0 b1 a0 c0 b4 c
2 3d 19 68 94 28 0a
63 71 82 68 af .
....=.h.(.cq.h.
01e0 e8 79 ec 76 e
1 70 b9 99 73 13 5d
b3 69 64 ad a0 .
y.v.p..s.].id..
01f0 05 93 72 34 e
4 12 b7 cd cf 5f dc
ee ed fd ed 64 .
.r4....._.....d
0200 ce fb f5 e0 4
5 48 f7 af ec ea 50
c9 05 9a 51 c1 .
...EH....P...Q.
0210 ea 00 4d 8c 1
a 20 08 1c af 6e 49
e9 50 ce d2 49 .
.M.. ...nI.P..I
0220 4c 9a f8 8d a
4 de 84 ff fb 92 04
e6 8f f2 fd 21 L
..............!
0230 52 83 4f 5a 5
0 5e c4 ea 60 67 0f
4a 0b 58 85 4a R
.OZP^..`g.J.X.J
0240 0c e1 89 41 6
3 92 e9 81 9c bd 28
65 05 1a 23 04 .
..Ac.....(e..#.
0250 40 2a 18 03 6
c 6c c2 24 cb ec e2
c3 66 6f c0 ee @
*..ll.$....fo..
0260 ae c4 08 88 c

e f1 f6 bd 7f 50 ab
53 1c f8 4e 5e .
........P.S..N^
0270 e3 2d 14 62 f
2 04 05 5a ce 62 9f
b1 fe 94 b7 a4 .
-.b...Z.b......
0280 34 3b ee 4c 6
7 e3 59 a6 73 f3 bf
e7 10 1e 21 27 4
;.Lg.Y.s.....!'
0290 3f 4b cd a3 5
5 96 46 2a 18 49 79
c7 f0 c0 63 7a ?
K..U.F*.Iy...cz
02a0 5a b2 9c ca c
d 65 f1 f6 25 5c 3e
95 b9 29 70 04 Z
....e..%\>..)p.
02b0 10 22 98 5a 4
0 e0 6c 11 41 15 b5
a4 50 2b d1 ab .
".Z@.l.A...P+..
02c0 34 01 92 97 d
1 3a f9 6d 9f a3 32
3e 60 6f 7b d6 4
....:.m..2>`o{.
02d0 d2 5b b9 3b f
7 fd 7e ff 99 c6 49
cf cf 85 e1 32 .
[.;..~...I....2
02e0 cf e4 2c f2 f
e 77 e1 9f b9 a1 ef
0f 35 91 de d7 .
.,..w......5...
02f0 ad 9e a6 a7 d
8 26 62 08 fa c5 9f
ea 3a 2c cc d3 .
....&b.....:,..
0300 cf 2b ff 47 b
d 4e 7c d8 76 7d ec
4e 51 97 9d c9 .
+.G.N|.v}.NQ...
0310 02 15 00 85 5
5 21 e2 23 b5 18 29
4d e4 f4 04 92 .
...U!.#..)M....
0320 72 a8 f2 0b 8
e 66 bf 61 de 72 0e
b7 1e 93 2d 76 r
....f.a.r....-v
0330 a4 7e ea 7b 9
4 b0 a1 24 6b bd ae
37 f6 c1 af 22 .
~.{...$k..7..."
0340 b5 4c 79 94 2
2 1a fd f1 d8 6b 7f
43 9e ef b5 f9 .
Ly."....k.C....
0350 bf 1e 66 72 e
e f9 b7 1e a5 f4 df
c4 24 32 75 fe .
.fr........$2u.
0360 e6 41 c0 af 5
6 d9 fb d7 e8 f7 ff
fa 59 b3 9e 78 .
A..V.......Y..x
0370 ce 1f 70 f5 6
1 8a da 09 48 09 61

ac 42 4a ce 41 .
.p.a...H.a.BJ.A
0380 f5 0e 8b 5c 5
4 66 79 28 1d ba e4
ef 4d 9a 3b 07 .
..\Tfy(....M.;.
0390 c7 47 63 23 f
d 33 3f 3d 55 ff 33
3f 3b 6d ae be .
Gc#.3?=U.3?;m..
03a0 b4 bb d2 f8 5
d 36 90 f8 87 fe 5f
e4 70 fe 5d 0d .
...]6...._.p.].
03b0 5a ce f6 2c d
a 6f 32 34 38 6b 61
3e 14 d0 e3 3f Z
..,.o248ka>...?
03c0 15 fc b5 0d c
3 75 6b 46 05 ff fb
92 04 ec 8f f2 .
....ukF........
03d0 d4 23 54 03 2
f 5a 50 61 a4 5a 80
67 0f 4a 0c 55 .
#T./ZPa.Z.g.J.U
03e0 2b 54 0d 2c 6
b c9 93 0c ea 81 8c
3c e1 1b f0 a7 +
T.,k......<....
03f0 29 7d 1c 6c 2
1 b0 ab 85 e9 8a 3b
83 2d 0e 19 70 )
}.l!.....;.-..p
0400 d6 51 6d 5a 9
9 09 94 ea c9 e0 6e
78 f2 7c c4 04 .
QmZ......nx.|..
0410 4a 74 46 93 2
1 2a 31 ac 9d 1d 93
32 ba 3d 4a 94 J
tF.!*1....2.=J.
0420 0e 2e da ef f
7 d3 7e df 9f 45 16
75 58 fb 9d 2a .
.....~..E.uX..*
0430 49 63 dc a7 4
2 84 54 67 75 03 9e
ac 36 2c b5 8a I
c..B.Tgu...6,..
0440 b0 50 bc 05 2
c d2 26 c5 8c 8b 3c
22 f2 a5 4b 31 .
P..,.&...<"..K1
0450 c0 e9 86 ac b
4 0c 1f bf 69 dc 9a
84 00 00 a0 33 .
.......i......3
0460 03 0b 30 c9 7
7 34 c4 92 08 84 d2
38 b0 12 96 b8 .
.0.w4.....8....
0470 94 62 f7 23 2
b 1a 96 7b 95 7f b6
3b f2 28 a5 66 .
b.#+..{...;.(.f
0480 77 3f 32 18 1
b 2e 4b a5 0b d7 f7
3d 77 6c 73 99 w

?2...K....=wls.
0490 5c 9d b7 db 7
9 9d 2f 42 74 4c b5
ba a3 d5 80 b5 \
...y./BtL......
04a0 36 1d 18 7a 1
3 00 b0 b2 23 23 96
54 ed 21 d4 bb 6
..z....##.T.!..
04b0 d9 18 79 a2 5
7 91 53 ea 7c 3b f3
0c e0 c3 1c 34 .
.y.W.S.|;.....4
04c0 23 12 71 60 c
c cb 89 8a 56 e2 da
b1 a7 80 e1 96 #
.q`....V.......
04d0 a7 45 74 c6 d
9 6f e2 b7 2f f6 a4
5e c4 aa f5 e6 .
Et..o../..^....
04e0 bf d9 2b b5 7
2 6c 64 ef cd 35 47
82 7f 1f 6e 36 .
.+.rld..5G...n6
04f0 77 52 11 9f c
a 1a 8f 3e a6 9a 49
a5 92 09 2c 5c w
R.....>..I...,\
0500 40 64 34 67 d
a f5 59 c8 ad c8 f9
ee e6 a4 44 7b @
d4g..Y.......D{
0510 cf 78 6b 6d 8
1 3f fe 85 48 54 72
35 aa f2 57 73 .
xkm.?..HTr5..Ws
0520 79 27
y
'
No. Time
Source
Destination
Protocol
Length Info
131 4.891179000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=79431
Ack=1 Win=46 Len=1
260
Frame 131: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:26:5

7.941109000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.941109000 s
econds
[Time delta fro
m previous captured
frame: 0.001989000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00198900
0 seconds]
[Time since ref
erence or first fra
me: 4.891179000 sec
onds]
Frame Number: 1
31
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ba (61882)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a70 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)

Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 79431, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 79431 (relativ
e sequence number)
[Next sequence
number: 80691 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc

aling factor: -1 (u
nknown)]
Checksum: 0x99d
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ba 4
0 00 31 06 3a 70 4a
7c 0c 8a c0 a8 .
...@.1.:pJ|....
0020 01 0b 00 50 c
1 a6 2b c9 98 74 9e
87 4e aa 50 10 .
..P..+..t..N.P.
0030 00 2e 99 db 0
0 00 31 51 c4 f5 1d
1a 04 18 21 c1 .
.....1Q......!.
0040 f6 3b 53 96 5
e b2 45 44 22 15 c9
2d bc 1e 89 ea .
;S.^.ED"..-....
0050 12 50 e9 60 4
0 a0 0f d4 50 08 25
bb 4e b1 62 f4 .
P.`@...P.%.N.b.
0060 c9 e2 3f 78 e
e f6 dc 7c e6 b8 9a
2e 21 3c d7 95 .
.?x...|....!<..
0070 f5 ad 9b b1 c
b 86 6d bd 70 cd 44
b6 39 0b bb ff .
.....m.p.D.9...
0080 fb 92 04 e9 8
f f3 11 4c 55 03 0b
1a f2 61 23 8a .
......LU....a#.
0090 a0 62 0f 4a 0
c 04 85 4a 0d e1 69
41 70 8d e9 81 .
b.J...J..iAp...
00a0 9c 60 e0 4e d
f 8e a9 3f 7d 7f af
43 01 2a 8c 1c .
`.N...?}..C.*..
00b0 62 54 4c 62 5
9 99 32 4c d0 47 24
80 22 7f ad 23 b
TLbY.2L.G$."..#
00c0 23 99 3e 27 6
1 93 20 b1 ec ac f8
21 3f 5c d2 de #
.>'a. ....!?\..
00d0 94 a8 bb 47 9

6 a2 a6 74 ac 8f 53
20 c1 63 40 e7 .
..G...t..S .c@.
00e0 df 0c 63 c3 7
c 59 b1 65 30 fb 8d
92 7c 4f e3 f9 .
.c.|Y.e0...|O..
00f0 1c 31 49 66 9
6 d8 de f3 7f ab 40
83 13 b9 eb 58 .
1If......@....X
0100 8d 6f aa ff 2
1 f4 3c 04 65 9f ff
ac c4 11 26 0e .
o..!.<.e.....&.
0110 79 c1 0e ea 3
d b0 4c c7 d3 5a 34
c7 41 00 a5 69 y
...=.L..Z4.A..i
0120 e8 27 3c 41 b
c a6 66 00 50 c6 5d
ba 4a 2a f2 f7 .
'<A..f.P.].J*..
0130 ea 6a 71 9a 4
1 51 45 c5 02 c6 03
0d d9 6c 52 2d .
jq.AQE......lR0140 25 7e a5 b2 9
8 c5 27 bd d2 0a 4c
e7 af d6 d7 35 %
~....'...L....5
0150 66 f6 38 73 7
5 f9 ca 1e e5 67 3c
6a f3 b5 cf 38 f
.8su....g<j...8
0160 44 e3 ef 95 d
1 ff d7 ff ff d2 3c
04 ca 40 17 7c D
.........<..@.|
0170 32 20 c4 b5 1
8 b6 24 ac 69 c9 9b
36 e4 15 40 98 2
....$.i..6..@.
0180 de 6c b6 b4 e
9 8d 87 13 bb 81 6f
9f be db 70 af .
l........o...p.
0190 b6 8f 1b de c
5 a9 26 05 87 57 99
10 08 26 26 e9 .
.....&..W...&&.
01a0 8e b0 9d 2e 9
a 14 42 dd 99 32 85
30 ae 4e 97 82 .
.....B..2.0.N..
01b0 e5 1b 20 66 3
6 12 72 e9 69 6b 63
37 9a d1 45 35 .
. f6.r.ikc7..E5
01c0 3b 15 16 63 4
1 75 bf 3f 4c aa 30
a0 20 c5 00 53 ;
..cAu.?L.0. ..S
01d0 42 16 80 35 0
3 0c 10 88 46 86 3d
05 05 87 45 a8 B
..5....F.=...E.
01e0 4f 15 84 15 d
b 45 94 2d b3 4b 25

12 ac 69 29 e0 O
....E.-.K%..i).
01f0 28 11 dc 6c c
a ac d1 98 ea 09 57
14 36 52 19 ea (
..l......W.6R..
0200 76 f5 7b f2 f
0 d7 56 84 f3 e7 73
27 19 69 0f 55 v
.{...V...s'.i.U
0210 7d 12 f7 a4 b
1 a9 76 8b d6 35 db
23 e2 49 f5 4a }
.....v..5.#.I.J
0220 ff ff fb 92 0
4 e8 8f f2 dd 24 d0
03 79 7a 50 60 .
........$..yzP`
0230 25 5a 20 6b 4
f 4c 0b c4 91 40 0d
63 09 41 7f 15 %
Z kOL...@.c.A..
0240 a8 41 ad 45 3
0 f5 08 8a 9a d2 71
ca ff ae df 48 .
A.E0.....q....H
0250 10 61 8a d4 6
c 88 18 ca c0 c3 02
05 06 2c 90 c6 .
a..l........,..
0260 c0 60 a7 b9 6
4 1d 87 83 c3 e0 45
03 02 56 5a 72 .
`..d.....E..VZr
0270 08 b0 d2 49 0
c 79 ed 62 96 96 56
10 fa 64 b5 e7 .
..I.y.b..V..d..
0280 61 e6 78 e3 e
5 54 cd b7 50 c1 b4
49 91 bb 0e 05 a
.x..T..P..I....
0290 ba a1 84 07 0
a e6 10 28 45 c2 ef
34 bd 9c 77 36 .
......(E..4..w6
02a0 69 6b e2 1e 3
1 0f 5e ab 5e da be
3d 31 af 0c 2e i
k..1.^.^..=1...
02b0 47 f5 5d 18 0
0 c1 80 23 18 69 71
d9 c2 1e c1 e1 G
.]....#.iq.....
02c0 ab 87 10 00 1
9 18 7a 1b 16 01 85
48 35 ec 87 b3 .
.....z....H5...
02d0 70 83 64 bc f
3 d9 79 20 1d bd 99
58 77 97 22 8f p
.d...y ...Xw.".
02e0 29 52 59 ba 0
1 c4 aa 4a 12 93 94
f0 42 93 8c d6 )
RY....J....B...
02f0 ed 4c 4a e9 5
a a0 6e 3c f0 f0 f7
5b a5 33 5c 57 .

LJ.Z.n<...[.3\W
0300 6c d1 e0 39 5
3 53 ed 8b b1 88 c3
4f 3e d6 24 67 l
..9SS.....O>.$g
0310 f5 97 30 13 a
0 50 69 43 e3 64 30
d5 98 4c 41 a4 .
.0..PiC.d0..LA.
0320 e8 b2 cc 50 f
8 e7 9c 4c ca af 60
81 cc b1 fa 98 .
..P...L..`.....
0330 48 b8 bc a5 f
8 82 e3 53 0c b1 97
37 26 dd 84 21 H
......S...7&..!
0340 55 f9 30 c9 0
9 89 35 1a 43 94 ba
fe 98 b4 23 77 U
.0...5.C.....#w
0350 57 d7 c7 e5 0
b 6f 3c ea c8 ff 1d
59 de 5b cb 2e W
....o<....Y.[..
0360 ef bc fa d9 5
6 f9 4f 47 1e e1 8b
e7 55 4a 15 26 .
...V.OG....UJ.&
0370 15 02 32 3c f
3 28 20 0b 13 84 09
0d 1e 11 08 21 .
.2<.( ........!
0380 9a bb 0a bd d
a 7a da 53 01 61 8b
b1 c7 52 b5 d6 .
....z.S.a...R..
0390 97 ed 3d cb 7
1 e9 24 70 97 51 fc
4b f7 71 9c 0a .
.=.q.$p.Q.K.q..
03a0 95 42 9d 97 7
6 45 0e 40 96 6b bf
71 38 1e 92 59 .
B..vE.@.k.q8..Y
03b0 8b 80 f6 54 a
4 a2 7e e1 fa 4d e1
86 1a e6 1a d6 .
..T..~..M......
03c0 76 fc 0e ff f
b 92 04 ea 8f f3 0d
27 4f 83 98 7a v
..........'O..z
03d0 50 63 85 5a 0
0 6b 4f 4c 4b c0 93
3c 0d e5 e9 41 P
c.Z.kOLK..<...A
03e0 6f 12 e8 41 a
d 61 28 60 4e 5c 5c
fb ef 26 0b dd o
..A.a(`N\\..&..
03f0 ff d4 88 a6 0
c 71 96 1a 60 e6 80
08 05 97 a5 d1 .
....q..`.......
0400 84 5a 0a 22 2
0 0c eb 85 39 96 c6
54 c8 61 88 5d .
Z." ...9..T.a.]

0410 4b 11 a9 d9 b
d 46 e7 a9 33 96 36
8e e4 0e 48 04 K
....F..3.6...H.
0420 20 4e 4a 60 4
0 a1 a8 37 86 a4 36
33 35 7e 77 eb
NJ`@..7..635~w.
0430 97 eb a6 52 7
5 24 18 ef e2 7c 5f
da f6 81 03 ee .
..Ru$...|_.....
0440 9b b7 f7 93 7
6 8c 7c 17 46 ef ff
e5 e5 8a d4 dc .
...v.|.F.......
0450 00 92 80 40 3
2 10 a6 4f a5 11 d0
85 0f 51 72 57 .
..@2..O.....QrW
0460 1a 42 f8 e6 a
4 46 03 2c dc 77 1c
fb 37 18 19 74 .
B...F.,.w..7..t
0470 8c 89 17 00 e
8 6a 44 4e cb b6 59
a1 bd 9a 25 a7 .
....jDN..Y...%.
0480 cb 3d a6 ac 5
8 65 01 a8 f0 cc 1f
0f bc 5c f9 f5 .
=..Xe.......\..
0490 14 75 13 f9 f
0 04 b9 79 47 23 02
17 10 09 c0 7c .
u.....yG#.....|
04a0 fb 4e 5f d2 d
f f4 db ff 10 43 aa
ed 38 63 eb 0c .
N_......C..8c..
04b0 64 44 fb 80 d
6 a2 f5 0d 69 e1 a2
0d 3b c2 6a 54 d
D......i...;.jT
04c0 a1 6c 19 8f 0
c e4 58 8a dc c9 02
91 84 66 09 c9 .
l....X......f..
04d0 3a bd 21 ec 4
0 a4 1d 21 18 c1 d6
ac 2f 09 08 88 :
.!.@..!..../...
04e0 ba 25 6e 59 e
f 77 bd bd d2 68 95
72 e7 98 07 c3 .
%nY.w...h.r....
04f0 e2 43 85 e2 0
7 3c 30 18 58 7d 0a
1a 4e 04 33 1c .
C...<0.X}..N.3.
0500 ef a8 10 04 4
d f9 cf 90 fb b9 35
b1 b8 b2 62 24 .
...M.....5...b$
0510 50 f1 21 2f 7
c 1a f4 52 45 69 ac
eb 11 7e 99 23 P
.!/|..REi...~.#
0520 4b 0f

K
.
No. Time
Source
Destination
Protocol
Length Info
132 4.891292000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=80691 Win=38433 Le
n=0
Frame 132: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
7.941222000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615217.941222000 s
econds
[Time delta fro
m previous captured
frame: 0.000113000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00011300
0 seconds]
[Time since ref
erence or first fra
me: 4.891292000 sec
onds]
Frame Number: 1
32
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule

String: http || tcp

.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0

Identification:
0x4f47 (20295)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 80691
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 80691 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi

ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38433
[Calculated win
dow size: 38433]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 131]
[The RTT to
ACK the segment wa
s: 0.000113000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 47 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OG@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 9d 60 50 10 .
....P..N.+..`P.
0030 96 21 18 d4 0
0 00
.
!....
No. Time
Source
Destination
Protocol
Length Info
133 4.953194000

cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
455 http49
574 [PSH, ACK] Seq=
80691 Ack=1 Win=46
Len=401
Frame 133: 455 byte
s on wire (3640 bit
s), 455 bytes captu
red (3640 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.003124000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.003124000 s
econds
[Time delta fro
m previous captured
frame: 0.061902000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06190200
0 seconds]
[Time since ref
erence or first fra
me: 4.953194000 sec
onds]
Frame Number: 1
33
Frame Length: 4
55 bytes (3640 bits
)
Capture Length:
455 bytes (3640 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)

Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
41
Identification:
0xf1bb (61883)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se

t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3dca [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 80691, Ack: 1
, Len: 401
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 401]
Sequence number
: 80691 (relativ
e sequence number)
[Next sequence
number: 81092 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not

set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x3ec
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 401]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 b9 f1 bb 4
0 00 31 06 3d ca 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b c9 9d 60 9e
87 4e aa 50 18 .
..P..+..`..N.P.
0030 00 2e 3e c3 0
0 00 6b 6a d6 b8 19
4e 23 de 07 f4 .
.>...kj...N#...
0040 ac 6a d8 53 6
e 94 bd b0 a9 23 06
c0 13 22 7a 9f .
j.Sn....#..."z.
0050 9b b6 bd 66 a
f bd 7e e6 ff eb bb
a8 58 e1 f8 ea .
..f..~.....X...
0060 fb 5b af a6 9
b f8 84 58 8b a3 c2
4f 0d 9d 1c 95 .
[.....X...O....
0070 dc 4e 94 b5 4
6 19 d4 f4 e5 ff fb
90 04 ea 0f f3 .
N..F...........

0080 07 22 51 83 7
8 c2 50 5a 64 ba 20
6b 2f 4a 0b 9c .
"Q.x.PZd. k/J..
0090 6d 56 0c bd e
7 01 85 96 2a 81 87
a1 30 1a 41 51 m
V......*...0.AQ
00a0 ab 10 95 7d 6
0 46 03 45 98 6e 30
17 03 81 5c 89 .
..}`F.E.n0...\.
00b0 65 52 65 b2 2
b 14 d2 5d 9a 93 46
6b 9f 2e 4c 2d e
Re.+..]..Fk..L00c0 70 32 ac 55 b
a 16 68 6f de 8b 23
22 5b 16 38 81 p
2.U..ho..#"[.8.
00d0 c3 0b 80 ba 1
f 0d b4 bb cc 5b ac
52 5f c5 4b bb .
........[.R_.K.
00e0 6f b5 2a 4d 0
c 02 56 45 6a 1c e1
a5 60 ea d3 26 o
.*M..VEj...`..&
00f0 49 bb 56 46 0
2 0d 97 27 9a 02 87
49 c2 cb 73 1c I
.VF...'...I..s.
0100 52 5d 2c b8 7
b dc ca eb a5 f4 f8
89 49 ec 3c 19 R
],.{.......I.<.
0110 52 9e 49 69 8
0 fe d0 2e 5f 22 4c
43 55 64 e8 3d R
.Ii...._"LCUd.=
0120 6a a7 cd 8f c
b cb 23 59 e9 ed ad
5b 4c b6 95 df j
.....#Y...[L...
0130 bf 6d d6 19 5
8 91 91 b8 5b 56 7d
b5 d1 49 ad 2c .
m..X...[V}..I.,
0140 5f 4f af f5 7
7 cf 4f b3 d8 5d f8
50 ef 25 3b d7 _
O..w.O..].P.%;.
0150 3b 12 f8 3f 7
3 3a c7 39 66 2f 6f
b0 63 ff 9f ee ;
..?s:.9f/o.c...
0160 fb ef ee f9 7
c e9 ed 06 1a 4a a9
1c 25 eb 1a 7f .
...|....J..%...
0170 79 0d 1a 58 2
f 20 03 d3 f1 32 3c
8c 8a 44 ec 1d y
..X/ ...2<..D..
0180 63 8f 0f 40 b
0 f4 54 e6 91 8b b8
72 2a 7c ac 96 c
..@..T....r*|..
0190 63 6c f6 94 8

b 0e 38 69 eb a6 7e
b6 1a 0a 53 b8 c
l....8i..~...S.
01a0 68 09 ee fc e
5 7c 59 bd fc 66 db
b3 2d d3 c3 ea h
....|Y..f..-...
01b0 6b c1 ef 3f 7
9 f9 78 c9 c9 f6 ff
56 df 69 6d e3 k
..?y.x....V.im.
01c0 ff 1f f5 62 2
f 6c 15
.
..b/l.
No. Time
Source
Destination
Protocol
Length Info
134 5.031196000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=81092
Ack=1 Win=46 Len=1
260
Frame 134: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.081126000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.081126000 s
econds
[Time delta fro
m previous captured
frame: 0.078002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07800200
0 seconds]
[Time since ref
erence or first fra
me: 5.031196000 sec
onds]
Frame Number: 1
34
Frame Length: 1
314 bytes (10512 bi
ts)

Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1bc (61884)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a6e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 81092, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 81092 (relativ
e sequence number)
[Next sequence
number: 82352 (r

elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd6b
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1661]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 bc 4
0 00 31 06 3a 6e 4a
7c 0c 8a c0 a8 .
...@.1.:nJ|....
0020 01 0b 00 50 c
1 a6 2b c9 9e f1 9e

87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e d6 be 0
0 00 19 23 48 13 20
4f 0b c1 5d 70 .
......#H. O..]p
0040 79 12 68 ea 8
a 5a 1c 28 16 df 7f
5a c5 a1 6b 6f y
.h..Z.(...Z..ko
0050 ac d2 2d 12 0
a e6 9d da 16 f5 a8
ca cf 1a d6 d4 .
.-.............
0060 ea aa fd 73 5
5 37 ce 75 22 ec fe
8f ba 1d 9c a9 .
..sU7.u".......
0070 3e f2 d5 f2 f
f 6a b2 23 15 9c 86
e4 95 92 a8 5e >
....j.#.......^
0080 94 4b 5f 6b 2
c ca 25 c9 50 ff fb
92 04 eb 8f f3 .
K_k,.%.P.......
0090 14 3c 58 03 0
f 42 e0 61 c5 8b 10
3d e8 4c 0b e0 .
<X..B.a...=.L..
00a0 6b 60 0c 25 8
7 09 80 11 ac 41 83
21 29 a1 0a ec k
`.%.....A.!)...
00b0 77 7a eb 4a 1
e f3 a4 c1 92 49 82
8c 87 b8 1a 2d w
z.J.....I.....00c0 eb 88 b0 af 1
5 b0 ec 8e 2c e2 d7
a4 06 62 63 a5 .
.......,....bc.
00d0 34 06 04 42 7
b b8 b6 a3 85 20 7a
21 0c 0d 12 32 4
..B{.... z!...2
00e0 90 62 90 c6 3
b 1c 58 ca 28 71 64
98 ca e7 41 fb .
b..;.X.(qd...A.
00f0 b3 96 8a ce f
7 42 95 39 59 97 d9
86 d9 69 d0 ab .
....B.9Y....i..
0100 2e 9a 35 f4 c
6 3b 80 c9 30 b1 82
e9 38 29 7c c2 .
.5..;..0...8)|.
0110 8c e4 d3 6c 8
8 ca 12 be 58 a2 82
80 4a 2c 44 7b .
..l....X...J,D{
0120 86 99 9b 74 9
3 9b 14 7a b0 2d e6
24 ed 54 d5 c2 .
..t...z.-.$.T..
0130 e8 9d 7c 89 1
0 6c a9 28 9c 5a 4c
4b 5f 75 bc 7f .

.|..l.(.ZLK_u..
0140 4a ae 13 34 1
2 d3 e3 3b 51 f2 e4
9e 10 16 2e f7 J
..4...;Q.......
0150 00 14 92 66 6
2 67 25 e2 8e 92 bc
7a 02 2e 28 78 .
..fbg%....z..(x
0160 1b 2d de ed 8
e 7c 2a 5c 5c 8a d6
fb dd 0a 06 45 .
-...|*\\......E
0170 cf 64 35 ed 8
5 49 08 0d 26 08 b1
a0 0c 76 24 ca .
d5..I..&....v$.
0180 18 cb 02 cf 8
3 0a c2 a5 af 94 54
2a a4 6b 22 10 .
.........T*.k".
0190 74 89 06 ca f
5 7f 6c 2e b7 b5 c2
38 d5 ff 6c ef t
.....l....8..l.
01a0 d4 78 67 ac 3
6 73 32 e2 f0 c3 62
60 40 f2 0f 82 .
xg.6s2...b`@...
01b0 51 c6 fb de b
1 55 81 50 b1 93 42
28 8f 16 63 e3 Q
....U.P..B(..c.
01c0 83 09 32 21 1
4 c0 59 52 2b 7d e7
c4 55 c2 8d 51 .
.2!..YR+}..U..Q
01d0 15 7d 5f 00 7
1 08 12 04 c3 db 03
ba ce 91 75 d3 .
}_.q.........u.
01e0 ae 0d d5 8e 2
8 33 5e 94 ed 5e 51
83 12 2b 9b 22 .
...(3^..^Q..+."
01f0 61 67 93 a1 9
7 4b 36 c3 db cd 21
12 10 fa 97 54 a
g...K6...!....T
0200 3c 77 4f 31 a
9 59 58 e8 cc ad 75
8b c4 ee aa ad <
wO1.YX...u.....
0210 33 b3 7b bb f
5 d3 5b 9c f2 65 ba
34 ce 5a 50 b6 3
.{...[..e.4.ZP.
0220 56 f3 1e 7f c
6 62 16 f0 fb 66 86
ff fb 92 04 e8 V
....b...f......
0230 8f f2 ea 4c d
8 01 ef 12 f0 5f a8
cb 00 3d 05 5c .
..L....._...=.\
0240 0b cc 81 5c 0
c 31 69 41 6d 13 ab
c0 f4 99 28 d6 .
..\.1iAm.....(.

0250 c0 40 fa b7 3
3 f5 d4 29 84 50 eb
0a 20 09 d9 e6 .
@..3..).P.. ...
0260 7c cc 6c ac 5
5 2e b4 09 65 9a ff
47 4c 46 e6 0f |
.l.U...e..GLF..
0270 46 2b b1 13 3
2 83 6d 62 40 08 4b
76 70 cb 42 a9 F
+..2.mb@.Kvp.B.
0280 26 66 69 51 c
a a6 a1 d1 55 23 da
3b b5 49 ee 87 &
fiQ....U#.;.I..
0290 e8 03 b5 20 e
9 c6 a9 f7 83 c6 c4
88 8a d2 a3 03 .
.. ............
02a0 40 47 00 c8 6
c c0 32 41 11 53 58
44 7d ec 0d 55 @
G..l.2A.SXD}..U
02b0 45 3e 4d d1 4
9 34 78 69 86 5d 41
ce a9 7c 0a dd E
>M.I4xi.]A..|..
02c0 44 48 04 19 0
e 59 a0 e6 66 8e ca
c4 5f a3 6b a8 D
H...Y..f..._.k.
02d0 89 7d a1 57 4
c e8 db b0 21 0f 6f
f4 86 33 2c 04 .
}.WL...!.o..3,.
02e0 92 cd 7f 2e 6
5 ca c7 a9 ea 17 01
1f ae 79 ad 30 .
...e........y.0
02f0 93 87 05 4c d
2 3d f5 2b 92 4a 2c
4a 1e 2b 1b 20 .
..L.=.+.J,J.+.
0300 70 d2 9c b5 d
6 a6 fe d6 b1 32 a8
ec b9 ab 64 20 p
........2....d
0310 65 0c 01 11 0
4 6a 18 1a 4d d2 44
22 e8 41 c0 cc e
....j..M.D".A..
0320 84 44 af d3 8
5 5f 6a a2 1b 81 6d
a9 92 cb 00 e9 .
D..._j...m.....
0330 2d f7 92 aa e
5 82 3b 1a fe 8b bb
cc 92 6f fb 65 .....;......o.e
0340 a7 97 5a 8f c
d df 1c 7d 9d 74 0c
2f ac f4 57 ae .
.Z....}.t./..W.
0350 f4 d6 41 77 7
2 47 d4 74 5b e3 36
3d 61 cf 71 30 .
.AwrG.t[.6=a.q0
0360 e2 b7 e7 10 a

1 fe 4b f8 f2 b4 fe
ff ab fa ef ea .
.....K.........
0370 5a 24 24 95 0
2 02 10 2c 70 98 04
c1 33 47 8c 02 Z
$$....,p...3G..
0380 51 0c 2d eb 3
9 14 f6 a9 fe c9 ed
b1 0d 78 52 2f Q
.-.9........xR/
0390 0e cd 81 c3 1
e cd aa c6 48 36 82
da ab b5 21 8f .
.......H6....!.
03a0 25 5f 8b a7 4
7 8e b5 5a b8 ff f7
f5 99 38 54 81 %
_..G..Z.....8T.
03b0 22 a6 2c 8d 7
2 d9 ee 6d 08 62 16
d7 8f 46 59 73 "
.,.r..m.b...FYs
03c0 72 ef 71 6b d
1 4b b7 71 32 d0 ea
28 a5 ff fb 92 r
.qk.K.q2..(....
03d0 04 ec 0f f3 0
9 49 57 03 0c 12 f0
5c a5 6a e0 3d .
....IW....\.j.=
03e0 28 4c 0b 68 7
1 5a 0c bd 69 41 86
93 eb 01 84 ad (
L.hqZ..iA......
03f0 29 14 0a 8c 1
0 2a 9d 01 90 10 a0
04 80 ea 55 2a )
....*........U*
0400 d4 da 07 d4 e
9 26 28 d8 aa a6 bb
4b 91 37 7e 48 .
....&(....K.7~H
0410 0a a3 82 b2 6
3 9b 72 41 af 6c 4c
06 8b f3 59 a3 .
...c.rA.lL...Y.
0420 2a 6a a7 56 f
7 cd d6 86 5d 8d 02
b8 88 c3 0c 70 *
j.V....]......p
0430 c4 b7 7a 5a 6
5 04 38 75 16 bb 4c
72 c5 cb 1d 53 .
.zZe.8u..Lr...S
0440 50 8a 0c b5 e
c a2 14 79 33 35 a7
17 ba 5d dd 21 P
......y35...].!
0450 0d 3a c1 0b 1
2 62 06 c1 0a a5 f0
58 56 92 4a 41 .
:...b.....XV.JA
0460 59 db 83 81 b
5 aa 8d e1 0e fa 82
a4 1c 70 a6 d4 Y
............p..
0470 21 0e b3 8d 0
6 c2 1f ab 4e c4 71

7b 37 87 96 6d !
.......N.q{7..m
0480 3f d3 73 ad 6
f 6c b1 71 9c 5b 1f
f8 f1 35 7c eb ?
.s.ol.q.[...5|.
0490 34 f1 94 e2 a
1 a0 f2 64 5b 26 20
45 3d 2a 22 9f 4
......d[& E=*".
04a0 14 79 a7 8c 1
5 3e 52 a7 3e 50 65
f2 31 0a a8 d5 .
y...>R.>Pe.1...
04b0 7c 6c 86 1a 1
0 95 c0 74 04 4c 69
d2 b4 ed 6b 4f |
l.....t.Li...kO
04c0 80 d5 4c 19 1
d ae 3d ba 6b c5 cb
07 eb 39 cd 00 .
.L...=.k....9..
04d0 16 56 81 72 b
e b3 8f 85 ea 44 f0
48 4a 48 9f 63 .
V.r.....D.HJH.c
04e0 25 a2 e7 4b a
c a5 b2 5b a4 9d 96
ba 6a a4 83 b5 %
..K...[....j...
04f0 48 ae e7 a5 e
7 5a 9d 3e b5 4e b5
b6 7f e7 52 55 H
....Z.>.N....RU
0500 f7 ed 3f 84 3
5 7e 9d af 97 2a 1d
f4 fd 56 9b 6e .
.?.5~...*...V.n
0510 ef 18 7e e5 f
5 39 af ce c7 ff 2a
77 10 9e 63 92 .
.~..9....*w..c.
0520 be 4c
.
L
No. Time
Source
Destination
Protocol
Length Info
135 5.031377000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=82352 Win=38018 Le
n=0
Frame 135: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8

8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.081307000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.081307000 s
econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 5.031377000 sec
onds]
Frame Number: 1
35
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6

e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f48 (20296)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]

Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 82352
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 82352 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38018
[Calculated win
dow size: 38018]
[Window size sc
aling factor: -1 (u

nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 134]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 48 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OH@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 a3 dd 50 10 .
....P..N.+...P.
0030 94 82 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
136 5.101198000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=82352
Ack=1 Win=46 Len=1
260
Frame 136: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.151128000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615218.151128000 s
econds
[Time delta fro
m previous captured
frame: 0.069821000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06982100
0 seconds]
[Time since ref
erence or first fra
me: 5.101198000 sec
onds]
Frame Number: 1
36
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1bd (61885)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a6d [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]

[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 82352, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 82352 (relativ
e sequence number)
[Next sequence
number: 83612 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb0f
1 [validation disab
led]

[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 bd 4
0 00 31 06 3a 6d 4a
7c 0c 8a c0 a8 .
...@.1.:mJ|....
0020 01 0b 00 50 c
1 a6 2b c9 a3 dd 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e b0 f1 0
0 00 8f c4 60 3c 4d
2d c1 33 01 07 .
.......`<M-.3..
0040 59 76 55 72 4
e aa 8f ba 04 87 d2
ac a4 8a b1 a4 Y
vUrN...........
0050 d0 cd c9 81 4
c 49 81 f8 a6 75 d8
74 45 34 00 a6 .
...LI...u.tE4..
0060 1b 10 32 65 9
e 7a 42 e3 24 85 d9
d4 81 bb fb d8 .
.2e.zB.$.......
0070 c5 3a b3 e3 c
9 85 88 9e 53 12 74
e4 ef ea be 2f .
:......S.t..../
0080 2c 9d b5 ff f
b 92 04 ed 8f f2 f9
20 56 03 2f 7a ,
.......... V./z
0090 50 5a a4 0a c
0 3d 8b 4a 0c 7c 93
54 0c bd e9 41 P
Z...=.J.|.T...A
00a0 a2 98 aa 81 8
6 35 31 a9 97 27 e8
42 c2 3c 62 0d .
....51..'.B.<b.
00b0 c8 db bb 0d 9
d a0 7e 15 cb e0 78
b5 1b 86 5c 51 .
.....~...x...\Q
00c0 a0 fb 8b 25 1
1 c5 11 d1 a0 62 fc
ce 47 71 8d 1e .
..%.....b..Gq..
00d0 f7 6c af bd 0
2 5c d1 4b 4d 2c 5b
62 eb aa fc 7f .
l...\.KM,[b....
00e0 ad fc 47 9f 7
9 fe 1e fc 1c fc 7c

ce d3 e6 b8 e5 .
.G.y.....|.....
00f0 59 70 5c a7 5
5 ce c5 e9 0d 38 bb
8a ac 5c ca d2 Y
p\.U....8...\..
0100 d5 5c a1 e9 b
c 2c 3f ec b6 b4 a5
86 25 78 35 f2 .
\...,?.....%x5.
0110 ae 26 24 a6 f
a 0b 31 b8 3f 82 9e
10 61 b4 f2 18 .
&$...1.?...a...
0120 8c 9f 4f 2b 6
0 13 a1 d2 54 20 40
62 bc a9 54 74 .
.O+`...T @b..Tt
0130 da 13 42 98 a
e 79 96 16 d4 0f 81
40 7d a6 9b 9b .
.B..y.....@}...
0140 a2 b0 e7 75 c
a 1f 1b ef b8 e3 38
81 0a 36 bf b6 .
..u......8..6..
0150 33 e0 de fa b
4 81 46 99 50 9d 49
82 a4 bd 0a 2c 3
.....F.P.I....,
0160 76 f4 35 fa 1
5 7f cb 7d 27 8f 6c
4e ef 16 5a 06 v
.5....}'.lN..Z.
0170 f6 85 aa 2c 7
4 27 86 31 b7 8c 3a
d1 26 61 00 7d .
..,t'.1..:.&a.}
0180 b5 d9 8b 76 4
a 52 58 59 54 5a 2c
08 46 73 0e e1 .
..vJRXYTZ,.Fs..
0190 2c 9d c6 3c 4
9 5e b5 ac 77 90 03
8c bc 37 35 6a ,
..<I^..w....75j
01a0 0d ef 58 31 f
7 8d f7 b9 f4 81 02
36 fd ed 4d 78 .
.X1.......6..Mx
01b0 39 dd e3 60 3
a 3d b1 64 0b 9d a9
a4 4e a4 91 62 9
..`:=.d....N..b
01c0 31 ea 40 f7 b
8 db 14 d7 26 1d 29
7c 54 5d 94 79 1
.@.....&.)|T].y
01d0 54 7f 16 4b 4
0 28 00 95 c8 53 10
84 07 58 a0 c6 T
..K@(...S...X..
01e0 d9 27 81 d3 9
3 25 0b a1 3e 97 d1
5a f6 aa 06 17 .
'...%..>..Z....
01f0 2e cc c8 12 e
e 7a 7f 17 d9 57 df
29 1a 8d d0 b8 .

....z...W.)....
0200 e4 da 9d 32 b
c c8 c4 27 93 44 a3
20 43 0a 89 20 .
..2...'.D. C..
0210 80 cc 3f 36 a
9 14 89 d2 e2 4a 5a
b9 89 c9 08 98 .
.?6.....JZ.....
0220 3d 30 a6 a7 b
3 ff fb 92 04 e9 0f
f2 c5 27 d5 03 =
0...........'..
0230 2f 6a 50 5f 2
4 fa 90 61 8f 4a 0c
68 9d 50 0c bd /
jP_$..a.J.h.P..
0240 e9 41 94 13 a
9 c1 87 bd 28 db ff
bb fa d3 5e ce .
A......(.....^.
0250 a5 00 2f 9a 8
f 0b 46 38 d8 5e 05
2c 81 de 47 ad .
./...F8.^.,..G.
0260 e8 6f 32 f2 4
0 a9 de 6c bf 1b 79
4d 33 ed dd 58 .
o2.@..l..yM3..X
0270 86 7c 76 27 a
9 30 79 b3 fd bb 68
ef a0 82 4d 08 .
|v'.0y...h...M.
0280 5e a5 1b 1d 4
2 93 0f 23 7f df 7a
41 84 f5 e5 e9 ^
...B..#..zA....
0290 a9 35 ac 4b 4
6 28 94 1b 76 2a 84
9d b1 1e 70 af .
5.KF(..v*....p.
02a0 ab b6 f3 cd 2
3 e8 69 2a bd 61 60
86 34 d2 a2 04 .
...#.i*.a`.4...
02b0 a6 31 34 8c c
9 71 a1 2c 65 bf 0a
51 50 72 da db .
14..q.,e..QPr..
02c0 bc 22 0a b5 e
5 84 b8 4b d5 b1 8f
b2 95 14 b3 27 .
".....K.......'
02d0 e5 02 ce 95 b
b 15 08 42 3d e8 d4
ac 9a 2c 18 19 .
......B=....,..
02e0 9c 32 04 e2 4
f 9c 1e 50 24 cb 95
a8 31 19 38 8a .
2..O..P$...1.8.
02f0 48 94 53 55 8
8 b2 2f a0 9f 2d 33
d2 65 eb 37 4e H
.SU../..-3.e.7N
0300 89 b3 2c 32 d
5 64 d5 3d c4 3a bf
f7 3e ad 7f db .
.,2.d.=.:..>...

0310 fa 8b 98 88 6
3 be 46 b2 4d 87 fc
a4 14 88 7c fd .
...c.F.M.....|.
0320 37 83 75 a5 b
0 81 90 e7 ed 38 47
40 d3 79 d2 b8 7
.u......8G@.y..
0330 cb bd 50 e2 8
e 9c c0 bb 82 b9 5c
c6 64 58 21 0c .
.P.......\.dX!.
0340 d4 5e 04 36 3
6 4c 8b 47 0a c6 49
ac c0 50 66 88 .
^.66L.G..I..Pf.
0350 a5 3b 49 68 1
4 96 93 a9 14 de 81
af 41 d3 d6 7c .
;Ih........A..|
0360 f8 49 c2 47 d
9 14 6b 21 5d 5d 9f
d3 a5 56 a6 d4 .
I.G..k!]]...V..
0370 f6 45 bf fd 5
5 0b 06 04 9c 0b 0a
31 33 04 15 80 .
E..U......13...
0380 88 51 ad 68 0
a 01 32 cb 07 9c 80
69 75 c4 3a 34 .
Q.h..2....iu.:4
0390 ca 5f 94 95 8
a 97 91 d6 48 18 58
ee 18 47 60 78 .
_......H.X..G`x
03a0 29 ea 7f 0a 8
d 1a 15 2d d3 21 94
25 a6 c5 f0 69 )
......-.!.%...i
03b0 31 1b ac f2 8
9 d3 07 35 50 6a 83
1a e4 c3 ec 4e 1
......5Pj.....N
03c0 9a a9 2d 1e e
9 67 4d ff fb 92 04
e8 0f f2 cc 24 .
.-..gM........$
03d0 d4 03 38 82 5
0 58 e4 aa 70 65 ef
4a 0c fc b3 4c .
.8.PX..pe.J...L
03e0 0d 62 69 81 8
c 95 29 81 87 c9 30
56 f4 0d 92 c8 .
bi...)...0V....
03f0 dd 5b ba f7 5
1 fd 61 60 c8 84 61
54 01 04 21 81 .
[..Q.a`..aT..!.
0400 a7 8b 00 b8 4
1 71 f2 4a 34 86 ca
c3 e0 da 51 54 .
...Aq.J4.....QT
0410 a5 8b cc fc 7
5 b4 65 b1 3b 9a ba
ff c0 0f 83 e8 .
...u.e.;.......
0420 48 56 da 97 3

2 90 e4 58 bc 4d 84
a6 45 dc f2 46 H
V..2..X.M..E..F
0430 a6 0e 6a 70 5
b 11 a6 a2 e7 44 9d
9a 1b 2b dd 34 .
.jp[....D...+.4
0440 b3 13 cb 41 d
6 e8 65 16 a9 15 f5
ed 5d 69 ea af .
..A..e.....]i..
0450 fd 68 f4 b9 2
1 41 44 27 01 07 8c
69 40 02 83 80 .
h..!AD'...i@...
0460 30 98 9b f4 a
d 86 5d d0 d3 02 c5
fb a8 de d8 e2 0
.....].........
0470 57 ee 91 2e f
d ba 26 ac 3d f7 de
72 a3 61 49 0b W
.....&.=..r.aI.
0480 f5 29 4b 1d 5
9 bf 13 1d 21 fa 0f
32 00 98 36 24 .
)K.Y...!..2..6$
0490 17 88 79 17 3
2 1f 47 8c 92 58 68
69 67 0b f5 4e .
.y.2.G..Xhig..N
04a0 95 ec fa 59 8
1 f4 72 3d 16 75 11
8f a8 b9 7a ca .
..Y..r=.u....z.
04b0 df 47 b6 ab 6
d eb 0b 0c 16 18 31
23 51 21 5f 0b .
G..m.....1#Q!_.
04c0 32 2d 1d 08 9
0 93 97 11 07 59 d2
bf f3 57 aa bf 2
-.......Y...W..
04d0 97 f3 b0 de a
8 54 7e 8b 28 35 dc
a3 94 70 95 2b .
....T~.(5...p.+
04e0 d7 b3 6b 92 e
9 6d ab 1f 80 5a 22
4c 71 f0 c5 9b .
.k..m...Z"Lq...
04f0 5a c4 3b 79 a
d 23 fc 7a ad d3 78
bf c7 f8 9f 5a Z
.;y.#.z..x....Z
0500 f0 fe 71 97 8
f b9 98 d7 ca fd aa
a7 e5 7f ff d6 .
.q.............
0510 10 0e 2a 02 3
0 83 0a b0 c6 1b 9a
65 8f 53 0d 41 .
.*.0......e.S.A
0520 63 17
c
.
No.

Time

Source
Destination
Protocol
Length Info
137 5.177204000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=83612
Ack=1 Win=46 Len=1
260
Frame 137: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.227134000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.227134000 s
econds
[Time delta fro
m previous captured
frame: 0.076006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07600600
0 seconds]
[Time since ref
erence or first fra
me: 5.177204000 sec
onds]
Frame Number: 1
37
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1be (61886)
Flags: 0x02 (Do
n't Fragment)

0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a6c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 83612, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 83612 (relativ
e sequence number)
[Next sequence
number: 84872 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .

... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x5db
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 be 4
0 00 31 06 3a 6c 4a
7c 0c 8a c0 a8 .
...@.1.:lJ|....
0020 01 0b 00 50 c
1 a6 2b c9 a8 c9 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 5d b2 0
0 00 55 35 46 59 62
54 8a 8a dd 4b .
.]...U5FYbT...K
0040 86 02 58 e6 e
3 cc 25 34 20 1e 67
24 28 4c b1 f1 .
.X...%4 .g$(L..
0050 b2 33 d4 b8 9
2 70 80 0f a2 89 48
75 16 00 5f 04 .
3...p....Hu.._.
0060 18 c0 73 11 3
0 2e 14 8a 45 30 b5
84 da 91 24 ba .

.s.0...E0....$.
0070 25 92 b2 ee 8
2 69 a6 8f d1 3e f9
9d d9 ff fb 92 %
....i...>......
0080 04 e8 0f f2 e
b 2c d3 03 58 9a 60
5e 05 9a 50 6b .
....,..X.`^..Pk
0090 13 4c 0c 34 b
3 4a 0d 62 09 81 67
94 e9 41 9c 3d .
L.4.J.b..g..A.=
00a0 30 46 74 26 b
7 d1 f4 fd 22 02 80
12 c3 2a c1 c2 0
Ft&...."....*..
00b0 02 f3 8d 16 c
2 df 41 06 24 63 9d
12 24 45 25 a6 .
.....A.$c..$E%.
00c0 66 a3 93 16 e
2 0c e7 99 ca 98 cb
00 70 70 fa e8 f
...........pp..
00d0 c1 48 d1 67 4
4 7b 4b 88 2a c0 ca
11 c6 a5 01 d4 .
H.gD{K.*.......
00e0 52 04 d0 0c d
1 70 82 30 e8 26 0b
05 83 10 b8 8e R
....p.0.&......
00f0 85 c9 24 66 a
6 64 92 d6 ec 6f 4d
14 1b b3 a4 b9 .
.$f.d...oM.....
0100 bd 59 bd c7 a
d dc e7 ff a6 ad bf
e9 0a 0e 5f 25 .
Y............_%
0110 d1 31 12 cc 4
e f2 ff 95 84 76 90
c4 cf 05 28 d0 .
1..N....v....(.
0120 ab e7 e7 90 d
d d1 b9 8e 40 2d e5
dc d7 b9 7a 64 .
.......@-....zd
0130 b5 e1 b8 92 9
b c5 9d 9a 71 86 ae
0a b2 82 88 e4 .
.......q.......
0140 99 22 91 0c 0
1 d1 18 2c 2c 6b 1c
d3 e5 d9 30 38 .
".....,,k....08
0150 ce 2e c4 bb b
2 c5 ad 4d 99 26 b4
96 45 7a 94 7f .
......M.&..Ez..
0160 52 6e b6 40 e
4 63 68 f4 44 40 06
10 00 65 7a 66 R
n.@.ch.D@...ezf
0170 82 f3 03 0c 2
8 d5 4e c2 91 b5 88
74 0a dd 71 81 .
...(.N....t..q.

0180 34 9c 61 75 d
5 f6 1d 9b 5b e3 45
83 69 e3 70 da 4
.au....[.E.i.p.
0190 bb b4 ca 69 c
4 51 62 97 63 04 68
a4 5c 9d 36 2e .
..i.Qb.c.h.\.6.
01a0 81 5c 8b 62 2
2 8e 89 1a e4 ea 87
41 3e 71 39 89 .
\.b"......A>q9.
01b0 2e ec 98 af a
5 69 c3 74 52 33 26
5b 55 d7 9b ba .
....i.tR3&[U...
01c0 81 2d ef 46 d
9 dd f6 fe f4 55 11
04 10 15 01 0d .
-.F.....U......
01d0 07 18 31 2f 4
c fb 76 b7 22 4f 41
db 8f 50 08 07 .
.1/L.v."OA..P..
01e0 ce ea 34 41 1
3 bd 92 80 06 a5 ca
3b 25 60 d0 dc .
.4A.......;%`..
01f0 f5 9b 05 70 d
b 88 56 2e 61 12 b7
a6 6b 32 08 c5 .
..p..V.a...k2..
0200 fc 1b b8 2e d
2 fa af 96 0a ea 9e
d5 b8 92 38 d9 .
.............8.
0210 cb e6 2a 63 b
d c0 96 b0 e7 f2 df
fe 36 fb ff ff .
.*c........6...
0220 fb 92 04 eb 8
f f3 03 2c d2 83 58
9a 60 63 a5 8a .
......,..X.`c..
0230 30 6b 14 4c 0
b ac b1 4a 0d 62 69
81 7f 15 28 c1 0
k.L...J.bi...(.
0240 9c 4d 30 aa d
7 ff 95 26 9e 58 83
cd d6 1f d6 22 .
M0....&.X....."
0250 18 88 26 60 a
9 9f 1e 28 d4 cc 5b
65 ab 04 30 41 .
.&`...(..[e..0A
0260 7e e8 30 0f d
4 a5 94 be 96 75 4a
c1 29 69 a5 76 ~
.0......uJ.)i.v
0270 1f 89 ba 6b 3
0 c9 49 f9 10 ac 5c
c1 62 d8 99 32 .
..k0.I...\.b..2
0280 13 61 60 d9 0
1 4f 00 31 13 66 23
78 a8 29 62 7d .
a`..O.1.f#x.)b}
0290 23 71 d4 1e a

9 ab cb 86 0b 77 1e
52 52 2e ce aa #
q.......w.RR...
02a0 27 fa 92 7b 2
0 93 e6 52 2e f9 9b
fe 41 06 38 79 '
..{ ..R....A.8y
02b0 40 52 0a 43 8
2 82 11 25 d3 d8 5e
f3 3a 44 6b 22 @
R.C...%..^.:Dk"
02c0 d3 77 6d 27 9
c 37 6a 40 f1 10 9e
8a cf b7 82 6c .
wm'.7j@.......l
02d0 7e 24 75 29 8
b 45 15 82 e8 18 71
36 26 2c 8e 61 ~
$u).E....q6&,.a
02e0 0f 34 63 71 6
9 04 6c 24 10 24 c8
68 c3 24 26 86 .
4cqi.l$.$.h.$&.
02f0 c1 8e 11 27 5
a 45 d3 27 91 24 a7
1c dd 3a 90 2b .
..'ZE.'.$...:.+
0300 ab 51 49 26 4
8 b0 60 86 74 b3 af
d1 d6 c2 18 c8 .
QI&H.`.t.......
0310 29 c0 0b 19 5
6 a9 88 42 c8 16 29
7f ca 08 d1 91 )
...V..B..).....
0320 39 8a db 86 d
d bb 50 73 84 ed d1
48 27 17 40 d5 9
.....Ps...H'.@.
0330 20 48 1e 92 4
8 5c 69 c8 9c 71 2a
89 91 52 ab b8
H..H\i..q*..R..
0340 ed df f9 f7 4
4 9f 90 8c 20 67 d6
1e 9d b3 84 b9 .
...D... g......
0350 5b 27 bb ca d
6 6b 77 8f f5 af b9
db 77 79 ab 14 [
'...kw.....wy..
0360 7f ff aa d9 7
3 29 26 b0 ff af 55
fa 99 4e 50 51 .
...s)&...U..NPQ
0370 5a 51 1a a3 3
4 f0 c6 a6 6d 20 84
00 18 88 e8 56 Z
Q..4...m .....V
0380 8b 12 da 8c 1
6 1a 94 e1 46 2a 09
5f 68 12 f1 07 .
.......F*._h...
0390 65 12 fa 37 8
8 5a 96 70 80 e8 92
06 bc e1 5c 52 e
..7.Z.p......\R
03a0 05 54 58 d0 0
0 79 13 26 c6 91 74

52 a5 f2 e2 4a .
TX..y.&..tR...J
03b0 0c 22 5c 45 4
8 a0 92 0b 1f 26 88
18 bb 23 a9 9b .
"\EH....&...#..
03c0 48 ff fb 92 0
4 e9 8f f3 07 29 d2
83 59 c2 60 5d H
........)..Y.`]
03d0 45 7a 40 6b 1
3 4c 4c 18 b3 4a 0d
62 69 81 7f 96 E
z@k.LL..J.bi...
03e0 28 c1 ac 61 3
1 c9 7a 96 7a 03 78
01 5e b4 74 ee (
..a1.z.z.x.^.t.
03f0 e9 60 25 c1 7
1 12 68 44 b0 72 95
04 e2 e9 42 04 .
`%.q.hD.r....B.
0400 f8 e9 4a 5d 3
9 01 fb 63 b3 f9 be
3b 01 6c 2c 2c .
.J]9..c...;.l,,
0410 0f ee c4 3c 2
2 f6 38 26 2c ac 8c
e9 c9 a5 81 14 .
..<".8&,.......
0420 08 6e d5 ea e
a aa 73 4f d1 3e f8
d5 6d 4c b5 fa .
n....sO.>..mL..
0430 4b ba 6b 3f 1
a f4 ce f1 9f e9 7c
7f 9b e3 51 32 K
.k?......|...Q2
0440 78 08 4e 04 4
e b4 77 64 cf bb 97
20 7f a8 69 7a x
.N.N.wd... ..iz
0450 a4 21 36 bc 3
1 e5 b0 9e 6b 2d 4e
2a 9d 00 c8 e8 .
!6.1...k-N*....
0460 43 56 5e 34 1
e 02 83 a2 99 83 1a
bc 72 2c 30 4f C
V^4........r,0O
0470 2e 14 dd 3f b
a 12 f6 17 9e 19 9c
1a 46 e8 29 19 .
..?........F.).
0480 da b5 9d 8e 5
6 cb 1c bf b6 e5 d7
e7 4b 73 78 dc .
...V.......Ksx.
0490 a3 14 a7 64 5
e c4 36 a6 df 22 28
07 30 72 0f 9e .
..d^.6.."(.0r..
04a0 94 4d 6a 72 d
f db 47 c6 49 45 46
5f b4 07 c8 58 .
Mjr..G.IEF_...X
04b0 b3 14 8b c6 5
f 93 00 d0 e6 ea 90
0a 8c 15 99 50 .

..._..........P
04c0 85 4e 25 29 c
6 d2 1f c2 7f 77 8c
e8 d9 81 3b 06 .
N%).....w....;.
04d0 1a 42 14 34 2
7 d6 2f 6a f6 08 32
68 e1 34 70 da .
B.4'./j..2h.4p.
04e0 5e d1 bf 20 a
6 7f d8 4a 18 96 2e
38 60 00 0a 0a ^
.. ...J...8`...
04f0 2c 1b 56 e5 d
a c5 6d 8a a8 50 c1
4a a3 ce 34 e5 ,
.V...m..P.J..4.
0500 2d 1c 85 a7 4
a 7d 41 c3 1d 14 0a
12 5d 41 20 60 ...J}A.....]A `
0510 16 f5 25 c2 a
6 2b c6 a1 e0 af 4d
3f 5d 0f f9 87 .
.%..+....M?]...
0520 62 ed
b
.
No. Time
Source
Destination
Protocol
Length Info
138 5.177379000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=84872 Win=38115 Le
n=0
Frame 138: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.227309000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.227309000 s
econds
[Time delta fro
m previous captured
frame: 0.000175000

seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 5.177379000 sec
onds]
Frame Number: 1
38
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13

.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f49 (20297)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 84872
, Len: 0
Source Port: 49

574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 84872 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 137]
[The RTT to
ACK the segment wa

s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 49 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OI@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 ad b5 50 10 .
....P..N.+...P.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
139 5.177408000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
444 http49
574 [PSH, ACK] Seq=
84872 Ack=1 Win=46
Len=390
Frame 139: 444 byte
s on wire (3552 bit
s), 444 bytes captu
red (3552 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.227338000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.227338000 s
econds
[Time delta fro
m previous captured
frame: 0.000029000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00002900
0 seconds]
[Time since ref
erence or first fra
me: 5.177408000 sec
onds]
Frame Number: 1

39
Frame Length: 4
44 bytes (3552 bits
)
Capture Length:
444 bytes (3552 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
30
Identification:
0xf1bf (61887)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3dd1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 84872, Ack: 1
, Len: 390
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 390]
Sequence number

: 84872 (relativ
e sequence number)
[Next sequence
number: 85262 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf6f
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 390]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 ae f1 bf 4
0 00 31 06 3d d1 4a

7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b c9 ad b5 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e f6 ff 0
0 00 3f 2c 7d 27 94
2d d4 2b 9e 9c .
.....?,}'.-.+..
0040 24 09 80 fa c
a f2 d3 97 a2 bb c7
2c 3a e2 e3 95 $
..........,:...
0050 ab 23 2d eb d
9 b5 63 58 9a d6 ca
a3 c7 eb ab e6 .
#-...cX........
0060 db 3d ae e3 8
5 18 74 02 82 89 1a
3c 02 64 55 43 .
=....t....<.dUC
0070 b6 1b 78 68 a
e b1 76 ff fb 92 04
e9 0f f3 00 2a .
.xh..v........*
0080 d3 03 58 8a 6
0 5e 85 ca 80 61 ef
4c 0b 14 ab 5e .
.X.`^...a.L...^
0090 0c 31 89 81 7
2 14 ac 01 86 25 30
ff f4 ff d7 fd .
1..r....%0.....
00a0 6a 3a 03 11 b
9 0c 71 88 22 1b e3
84 65 ce 09 8e j
:....q."...e...
00b0 92 aa 58 b2 e
9 98 20 34 2b 6a 64
e4 48 69 83 69 .
.X... 4+jd.Hi.i
00c0 8a 16 0b 0b c
1 cb 46 2d 41 ad b2
cb 20 59 34 2c .
.....F-A... Y4,
00d0 4c d5 a3 31 3
8 da 15 16 42 86 da
94 9f 96 fb 59 L
..18...B......Y
00e0 42 00 c8 88 1
a 02 95 3e 0a 90 07
44 cc 0d 0a 24 B
......>...D...$
00f0 44 44 0c 69 2
9 63 49 3e 25 09 b4
56 d9 22 a7 74 D
D.i)cI>%..V.".t
0100 06 94 ac 3a c
f 7f 8b 28 ac 58 d7
b1 c3 a4 18 b0 .
..:...(.X......
0110 5a 5a f0 75 5
f 41 f4 46 39 28 89
e8 67 a6 6e 15 Z
Z.u_A.F9(..g.n.
0120 1f 54 b4 cf 1
d 74 7f c0 89 e0 f0
4a 03 02 f7 90 .

T...t.....J....
0130 2e 61 39 0e a
4 64 92 32 3c 51 47
fa 29 eb 7a 4a .
a9..d.2<QG.).zJ
0140 90 5a e5 52 4
0 e3 14 a5 15 73 2b
6b c2 aa 55 31 .
Z.R@....s+k..U1
0150 5f 9c 62 eb f
f 43 13 fc a7 b5 cc
a0 91 ed b8 35 _
.b..C.........5
0160 a5 c5 5f 4c 2
5 a9 2f 45 4a d5 93
92 8c 0a 35 8a .
._L%./EJ.....5.
0170 83 da 67 0a c
6 54 2d ab 73 c4 b8
05 cf 2c 85 22 .
.g..T-.s....,."
0180 a5 ba a0 b0 c
b e6 70 33 0a b9 a3
bd ca 25 7f 2f .
.....p3.....%./
0190 6c fb f3 f9 6
3 e1 eb 6b 59 b7 4e
c8 3b 4f 20 50 l
...c..kY.N.;O P
01a0 60 0e e4 0b 9
3 05 20 9b 22 13 ad
ab 62 9e 49 65 `
..... ."...b.Ie
01b0 76 b0 e0 7e 0
e 55 a0 87 fb 91 4a
ea
v
..~.U....J.
No. Time
Source
Destination
Protocol
Length Info
140 5.303443000
pc13.home
livebox.home
DNS
85 Standard que
ry 0xb8db PTR 13.1
.168.192.in-addr.ar
pa
Frame 140: 85 bytes
on wire (680 bits)
, 85 bytes captured
(680 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.353373000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615218.353373000 s
econds
[Time delta fro
m previous captured
frame: 0.126035000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12603500
0 seconds]
[Time since ref
erence or first fra
me: 5.303443000 sec
onds]
Frame Number: 1
40
Frame Length: 8
5 bytes (680 bits)
Capture Length:
85 bytes (680 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
1
Identification:
0x4f4a (20298)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4979
5 (49795), Dst Port
: domain (53)
Source Port: 49
795 (49795)

Destination Por
t: domain (53)
Length: 51
Checksum: 0x83a
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
4]
Domain Name System
(query)
[Response In: 1
41]
Transaction ID:
0xb8db
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
13.1.168.19
2.in-addr.arpa: typ
e PTR, class IN
Name: 1
3.1.168.192.in-addr
.arpa
[Name L
ength: 25]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.

0010 00 47 4f 4a 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
GOJ............
0020 01 01 c2 83 0
0 35 00 33 83 a1 b8
db 01 00 00 01 .
....5.3........
0030 00 00 00 00 0
0 00 02 31 33 01 31
03 31 36 38 03 .
......13.1.168.
0040 31 39 32 07 6
9 6e 2d 61 64 64 72
04 61 72 70 61 1
92.in-addr.arpa
0050 00 00 0c 00 0
1
.
....
No. Time
Source
Destination
Protocol
Length Info
141 5.308202000
livebox.home
pc13.home
DNS
107 Standard que
ry response 0xb8db
PTR pc9.home
Frame 141: 107 byte
s on wire (856 bits
), 107 bytes captur
ed (856 bits) on in
terface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.358132000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.358132000 s
econds
[Time delta fro
m previous captured
frame: 0.004759000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00475900
0 seconds]
[Time since ref
erence or first fra
me: 5.308202000 sec
onds]
Frame Number: 1
41

Frame Length: 1
07 bytes (856 bits)
Capture Length:
107 bytes (856 bit
s)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 9
3
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb733 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49795 (49795)
Source Port: do
main (53)
Destination Por
t: 49795 (49795)
Length: 73
Checksum: 0x592
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
4]
Domain Name System
(response)
[Request In: 14
0]
[Time: 0.004759

000 seconds]
Transaction ID:
0xb8db
Flags: 0x8580 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .1.. .
... .... = Authorit
ative: Server is an
authority for doma
in
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs:
0
Additional RRs:
0
Queries
13.1.168.19
2.in-addr.arpa: typ
e PTR, class IN
Name: 1
3.1.168.192.in-addr
.arpa
[Name L
ength: 25]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)

Answers
13.1.168.19
2.in-addr.arpa: typ
e PTR, class IN, pc
9.home
Name: 1
3.1.168.192.in-addr
.arpa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 0
Data le
ngth: 10
Domain
Name: pc9.home
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 5d 00 00 4
0 00 40 11 b7 33 c0
a8 01 01 c0 a8 .
]..@.@..3......
0020 01 0b 00 35 c
2 83 00 49 59 2d b8
db 85 80 00 01 .
..5...IY-......
0030 00 01 00 00 0
0 00 02 31 33 01 31
03 31 36 38 03 .
......13.1.168.
0040 31 39 32 07 6
9 6e 2d 61 64 64 72
04 61 72 70 61 1
92.in-addr.arpa
0050 00 00 0c 00 0
1 c0 0c 00 0c 00 01
00 00 00 00 00 .
...............
0060 0a 03 70 63 3
9 04 68 6f 6d 65 00
.
.pc9.home.
No. Time
Source
Destination
Protocol
Length Info
142 5.316206000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=85262
Ack=1 Win=46 Len=1
260
Frame 142: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.366136000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.366136000 s
econds
[Time delta fro
m previous captured
frame: 0.008004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00800400
0 seconds]
[Time since ref
erence or first fra
me: 5.316206000 sec
onds]
Frame Number: 1
42
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1c0 (61888)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a6a [validatio
n disabled]
[Good: Fals

e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 85262, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 85262 (relativ
e sequence number)
[Next sequence
number: 86522 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa88
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1650]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 c0 4
0 00 31 06 3a 6a 4a
7c 0c 8a c0 a8 .
...@.1.:jJ|....
0020 01 0b 00 50 c
1 a6 2b c9 af 3b 9e
87 4e aa 50 10 .
..P..+..;..N.P.
0030 00 2e a8 80 0
0 00 76 53 14 c0 65
94 15 b8 95 47 .
.....vS..e....G
0040 84 ea c1 4d 2
5 41 65 0a 32 f2 2d
cc 35 52 3f 94 .
..M%Ae.2.-.5R?.
0050 b9 47 50 a4 9
1 c7 eb f8 a6 ea 1c
cc 7e c5 3d 15 .
GP.........~.=.
0060 7a f7 96 b2 3
e bc 18 c2 94 18 2e
8c e1 37 72 30 z
...>........7r0
0070 aa 15 26 43 b
3 2b 99 d5 10 e4 b9
4e e5 bd ad 4b .
.&C.+.....N...K
0080 88 cd fb a0 f
5 a5 09 c6 57 3e 65
ce be 02 42 30 .
.......W>e...B0
0090 8d 02 84 ff f
b 92 04 ee 0f f3 1b
28 d6 83 2f 62 .
..........(../b
00a0 50 66 c4 aa f
0 61 29 4a 0a 94 7b
5e 0c 31 09 41 P
f...a)J..{^.1.A
00b0 7e 15 ab 81 8
6 19 30 bb d6 65 e5

2a d5 bd ad 48 ~
.....0..e.*...H
00c0 54 81 2a 20 0
1 0e 52 83 90 3d 1a
25 51 6e 05 4a T
.* ..R..=.%Qn.J
00d0 4d 8c 44 24 a
a 02 a1 cd 60 f4 ad
60 90 a8 e5 ba M
.D$....`..`....
00e0 8a 4a ca 82 5
0 d0 18 0d d2 a0 da
30 ab 86 47 e9 .
J..P......0..G.
00f0 92 9c 6c 6d a
a 0a a4 34 0f a1 a1
f3 41 00 20 7c .
.lm...4....A. |
0100 3e e2 c2 36 0
5 a4 8d ba f4 8a 9e
42 73 02 eb 9f >
..6.......Bs...
0110 32 e6 5f 09 2
1 19 97 21 86 9f 9e
8c fd 55 8e 65 2
._.!..!.....U.e
0120 4f e2 54 19 9
0 aa 65 4a 59 44 a2
16 0d 82 af f1 O
.T...eJYD......
0130 f6 87 21 46 5
0 dd 82 7d 19 2a b6
72 6d 22 65 4e .
.!FP..}.*.rm"eN
0140 c2 93 7a ba 3
b 4d 08 eb be 46 8f
28 11 c0 41 c5 .
.z.;M...F.(..A.
0150 05 11 56 51 8
a a2 6f 2b 84 b5 8b
b3 18 e8 88 74 .
.VQ..o+.......t
0160 77 a7 f5 51 6
1 63 24 81 f6 11 15
4a c7 c5 c0 0b w
..Qac$....J....
0170 17 6f d1 7b 4
4 4a d7 db ff 12 e8
5e 08 74 31 0c .
o.{DJ.....^.t1.
0180 7b 62 89 51 6
6 8e 44 b8 bb 63 1e
e9 e3 c8 9d 96 {
b.Qf.D..c......
0190 d8 27 4a bd 4
5 a8 ea c9 5e c1 6f
52 c8 89 39 15 .
'J.E...^.oR..9.
01a0 4b ba a6 1c f
1 b1 03 73 0d f9 34
59 a6 a5 52 69 K
......s..4Y..Ri
01b0 90 a9 e9 e7 a
b af df 57 ff 78 7d
9f 8e eb 03 24 .
......W.x}....$
01c0 42 17 60 a8 6
4 ea c6 b0 5c 00 2a
49 bc ec c2 1e B

.`.d...\.*I....
01d0 d2 cd 7e ef f
f fa bf 5d 5e 0e f9
b9 40 b7 cc fc .
.~....]^...@...
01e0 b4 fb 6b 6a 0
8 3f 96 4a b3 c9 14
66 15 ca 64 50 .
.kj.?.J...f..dP
01f0 f2 62 27 65 b
9 0f 51 be 24 b1 5c
98 4f d0 dc 8c .
b'e..Q.$.\.O...
0200 e4 e6 51 1c 6
a d5 f7 b0 6e f2 4c
30 66 16 66 6c .
.Q.j...n.L0f.fl
0210 83 35 e2 a2 6
0 92 d6 70 4a 0b 4c
9d 85 da 7f 91 .
5..`..pJ.L.....
0220 91 a8 73 42 e
2 4f 89 5f 21 71 6b
c7 b4 9f fa ff .
.sB.O._!qk.....
0230 ff df db ff f
8 ff fb 92 04 ed 8f
f3 2d 34 d7 03 .
...........-4..
0240 0f 2a e0 60 c
4 3a e0 3d 88 4a 0b
54 a9 58 0c bc .
*.`.:.=.J.T.X..
0250 a9 81 72 94 a
b 01 87 99 30 87 88
02 36 a0 dc b0 .
.r.....0...6...
0260 4e 42 bb 2f 1
a 57 3f ef 93 a6 fb
ae 8d 44 69 f0 N
B./.W?......Di.
0270 b6 5b 91 46 b
b 51 ce cc c8 70 ee
78 2a 51 99 2c .
[.F.Q...p.x*Q.,
0280 f5 4c 23 ce 5
5 da 86 0c 1d 42 8c
a4 94 44 91 02 .
L#.U....B...D..
0290 90 cc 44 14 1
4 d6 f9 cf 5c 9d a8
d5 d5 75 6e d3 .
.D.....\....un.
02a0 e6 af fc 78 9
4 bc 2e 63 d7 33 5b
ff 0e fd 9a 98 .
..x...c.3[.....
02b0 bd 04 c5 c2 c
a 73 9a 9f 7a 9e e6
39 8a d7 23 43 .
....s..z..9..#C
02c0 70 24 0e 71 0
c 3f a0 30 26 7d 8a
9d 0f 05 5a b0 p
$.q.?.0&}....Z.
02d0 c2 ec 7c ab 0
c d2 40 9a 47 92 66
82 12 64 65 12 .
.|...@.G.f..de.

02e0 97 42 d5 4e 5
4 33 8b 8b a2 54 e0
7b 08 db 3d a8 .
B.NT3...T.{..=.
02f0 f1 85 98 69 c
6 99 2c 1b 32 f8 09
86 2e 57 76 31 .
..i..,.2....Wv1
0300 a9 78 71 ef b
3 4a 5a dd 73 ac 54
49 f4 74 88 47 .
xq..JZ.s.TI.t.G
0310 9d 58 50 4c 3
4 0a 0b 01 59 1c 36
ff 79 ff 5a aa .
XPL4...Y.6.y.Z.
0320 0a 1e 75 10 6
4 c0 8a a1 56 d3 ed
5e 32 06 d8 ab .
.u.d...V..^2...
0330 43 97 49 36 4
6 47 89 46 52 b5 66
78 ab b4 3d 1d C
.I6FG.FR.fx..=.
0340 1e 19 84 be f
4 b7 42 48 0c 77 ef
99 62 89 a0 18 .
.....BH.w..b...
0350 96 06 67 0b 9
6 92 8a 63 6c 97 db
62 91 f8 a2 d6 .
.g....cl..b....
0360 f2 76 3a bc a
f 31 e1 f3 1b a7 89
28 d8 bb 41 61 .
v:..1.....(..Aa
0370 50 60 98 69 c
1 28 3c 40 36 5f cd
96 f6 a3 af ba P
`.i.(<@6_......
0380 a5 87 44 28 2
c 25 08 95 98 ce 92
cd 27 0a a8 31 .
.D(,%......'..1
0390 e9 c1 8c 81 2
a 02 a5 14 6e a8 20
1b e7 86 9b ce .
...*...n. .....
03a0 34 54 79 f4 2
9 81 16 c5 3c 45 30
89 39 ec de 12 4
Ty.)...<E0.9...
03b0 34 b6 18 da 6
a d8 f2 d7 d2 82 d9
87 39 cc 8a 73 4
...j.......9..s
03c0 ee 66 d9 5b 1
6 9b 6b ad ac bd 07
86 01 15 c5 5d .
f.[..k........]
03d0 01 a9 2e 51 a
1 40 48 ff fb 92 04
ed 8f f2 e7 1b .
..Q.@H.........
03e0 d5 03 4f 79 c
2 66 c6 ea 90 61 e6
5c 0b e0 b7 52 .
.Oy.f...a.\...R
03f0 0d 3d 09 81 8

7 96 aa 01 97 99 30
1b 73 3f d9 22 .
=........0.s?."
0400 ac 93 28 43 4
5 ea 17 c4 a8 12 a6
bc a5 b0 1b 43 .
.(CE..........C
0410 3b 45 51 e3 5
3 9c fe 3a 70 cd 3b
3e 36 c6 ae 8e ;
EQ.S..:p.;>6...
0420 e7 52 30 16 7
2 3e 83 00 b5 7f 40
6e 3c a2 04 74 .
R0.r>....@n<..t
0430 12 db be 5d 0
d 78 03 fb 7b 64 21
f1 f0 6f 69 5a .
..].x..{d!..oiZ
0440 0e 9b 34 ab 5
4 1f e7 88 10 cf d2
ed a3 cd 76 63 .
.4.T.........vc
0450 2d 40 10 5b a
8 d7 ff f3 fa a5 b5
2f 35 f8 f1 92 @.[......./5...
0460 b5 f3 aa 08 d
7 00 36 72 82 e7 1a
7a 0b 0a 05 5a .
.....6r...z...Z
0470 32 15 9b 11 7
b 84 94 ff ca 57 0f
57 22 b0 4a 25 2
...{....W.W".J%
0480 2e f3 9b 8d 3
c 86 2c 3c 68 ba 85
81 4a 0f 37 2d .
...<.,<h...J.70490 c1 62 b3 3b 8
b 74 79 ee cb 63 f2
9f c0 2a bc fb .
b.;.ty..c...*..
04a0 81 5d 6f 35 f
9 bd 33 6f 7d ef e7
59 bc 72 a0 21 .
]o5..3o}..Y.r.!
04b0 53 61 81 40 9
8 ab 0d c8 cb a4 3a
28 4a b5 1b 39 S
a.@......:(J..9
04c0 ed 4d 6d b9 4
a 90 44 18 d9 c6 87
86 2c 49 54 93 .
Mm.J.D.....,IT.
04d0 29 f4 9f 31 d
2 de 57 9c 27 63 f3
ad a6 24 22 40 )
..1..W.'c...$"@
04e0 ae 46 3a 6a 5
4 41 39 d6 13 c1 e9
99 09 80 ca 35 .
F:jTA9........5
04f0 dd e9 91 52 c
d b2 71 ed 36 4a 80
82 39 b2 07 2d .
..R..q.6J..9..0500 fa 93 39 bb 1
8 5c 9d 7b b3 69 af

6e b9 b6 be 5f .
.9..\.{.i.n..._
0510 94 77 62 ea 1
0 9f 0b 25 e5 1f 0f
03 43 82 26 24 .
wb....%....C.&$
0520 84 40
.
@
No. Time
Source
Destination
Protocol
Length Info
143 5.316377000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=86522 Win=40005 Le
n=0
Frame 143: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.366307000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.366307000 s
econds
[Time delta fro
m previous captured
frame: 0.000171000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017100
0 seconds]
[Time since ref
erence or first fra
me: 5.316377000 sec
onds]
Frame Number: 1
43
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor

ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =

Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f4c (20300)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 86522
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 86522 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .

... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40005
[Calculated win
dow size: 40005]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 142]
[The RTT to
ACK the segment wa
s: 0.000171000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 4c 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OL@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 b4 27 50 10 .
....P..N.+..'P.
0030 9c 45 18 d4 0
0 00
.
E....

No. Time
Source
Destination
Protocol
Length Info
144 5.389210000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=86522
Ack=1 Win=46 Len=1
260
Frame 144: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.439140000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.439140000 s
econds
[Time delta fro
m previous captured
frame: 0.072833000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07283300
0 seconds]
[Time since ref
erence or first fra
me: 5.389210000 sec
onds]
Frame Number: 1
44
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http

2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1c1 (61889)

Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a69 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 86522, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 86522 (relativ
e sequence number)
[Next sequence
number: 87782 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x91c
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 c1 4
0 00 31 06 3a 69 4a
7c 0c 8a c0 a8 .
...@.1.:iJ|....
0020 01 0b 00 50 c
1 a6 2b c9 b4 27 9e
87 4e aa 50 10 .
..P..+..'..N.P.
0030 00 2e 91 ca 0
0 00 c7 ae f2 22 f4
5d be a5 8a 19 .
........".]....
0040 00 9f 12 06 1
e 6f f4 ea 94 88 cc
02 e1 3a b8 14 .
....o.......:..
0050 69 64 f8 46 0
d 14 82 e5 61 09 16
99 3a bc c7 62 i
d.F....a...:..b
0060 7f 10 f5 16 c

6 18 f1 0c f1 c4 e7
55 9d 5e 59 71 .
..........U.^Yq
0070 16 1c 1a c5 5
c 4d fd 4c 36 e8 7b
c5 e0 ef 15 c5 .
...\M.L6.{.....
0080 6f fc 0c 53 e
e f5 a6 ef 18 b0 a8
48 80 ff fb 92 o
..S.......H....
0090 04 ea 0f f2 e
5 2a 54 83 0f 5a 60
5d 25 4a 80 65 .
....*T..Z`]%J.e
00a0 e8 4c 4c b4 9
f 50 0d 61 e9 41 94
96 a9 c1 97 a5 .
LL..P.a.A......
00b0 30 94 63 69 4
b d1 a8 54 55 f1 61
e3 6b 67 42 7d 0
.ciK..TU.a.kgB}
00c0 7f 44 b4 2c 6
9 88 61 8f a0 20 c0
a2 ec d4 70 04 .
D.,i.a.. ....p.
00d0 4e 6f 5d 03 8
f a0 9b 96 51 20 a0
1a 89 2b 23 b8 N
o].....Q ...+#.
00e0 ee 56 7c c4 8
2 00 90 fa 10 a4 42
bb 91 43 af de .
V|.......B..C..
00f0 75 2a 55 ae 9
c 4c cd 07 33 a5 ff
f7 5b 94 da c3 u
*U..L..3...[...
0100 56 04 02 23 c
1 43 61 50 a0 94 50
06 1a 15 59 87 V
..#.CaP..P...Y.
0110 9b ba a1 82 c
4 d6 b6 15 12 c2 de
74 19 d3 db d7 .
..........t....
0120 e9 75 01 80 0
d 04 31 90 e0 69 c6
71 6a 66 96 a0 .
u....1..i.qjf..
0130 b7 6c 29 f0 6
0 20 8d c1 25 a4 62
9d 3c 4a 90 11 .
l).` ..%.b.<J..
0140 58 99 8c 88 9
0 58 d5 80 c1 6e 31
3c 32 a0 88 6a X
....X...n1<2..j
0150 07 08 99 d4 c
d 18 b6 79 e5 c2 11
54 85 e9 22 ea .
......y...T..".
0160 64 e7 5d dd 5
6 be 93 21 ba cd 02
e3 81 73 06 b3 d
.].V..!.....s..
0170 61 be 35 74 b
2 a5 cf 39 bf a9 82

a2 21 b5 08 5e a
.5t...9....!..^
0180 76 22 64 1e d
a 21 24 54 35 f0 9e
43 d2 d1 8f 33 v
"d..!$T5..C...3
0190 54 f7 53 9e d
4 4c 1d 1d 58 8c 58
56 cf 10 59 61 T
.S..L..X.XV..Ya
01a0 2b 6a a1 0c 8
a dd 58 3f 1b d1 a3
c7 5e 28 15 68 +
j....X?....^(.h
01b0 c0 d1 15 0d 4
b 81 b0 73 25 53 b3
7d 57 17 69 7d .
...K..s%S.}W.i}
01c0 c2 cd 0e ba f
f b6 26 f8 0d 72 cc
94 5d ee fc ea .
.....&..r..]...
01d0 95 58 81 c6 c
4 ef 99 ba 83 43 8d
d0 84 6e 41 3a .
X.......C...nA:
01e0 1a 52 34 44 5
3 e5 52 6b cb a5 2b
fa 19 59 52 9a .
R4DS.Rk..+..YR.
01f0 5b 59 34 fb b
4 b5 df e0 71 a6 df
a9 8a 8a cb 7f [
Y4.....q.......
0200 8f 3e 79 f6 e
7 9b 52 f4 a1 0b 50
70 3e 89 16 3b .
>y...R...Pp>..;
0210 7f 6f 6c 20 8
7 74 c7 47 b3 bd f3
27 60 f5 9f b8 .
ol .t.G...'`...
0220 fb ea 25 cb b
8 8b cb c7 2d 25 cc
85 0a b7 47 ff .
.%.....-%....G.
0230 fb 92 04 e6 8
f f2 fd 27 d4 03 2f
7a 50 5f 64 2a .
......'../zP_d*
0240 70 65 8c 4a 0
b 18 9f 50 0d 3e 09
41 5a 18 69 c1 p
e.J...P.>.AZ.i.
0250 97 a1 30 20 c
e a4 88 40 38 2d 38
a9 51 18 50 20 .
.0 ...@8-8.Q.P
0260 e5 20 34 01 5
2 37 02 e0 2e 43 c9
40 41 8a e1 d9 .
4.R7...C.@A...
0270 1d a0 b6 be 4
3 8e 93 e0 db 52 e5
26 a6 10 e8 68 .
...C....R.&...h
0280 24 e3 71 b3 5
8 a1 72 cc 1e d5 22
07 6e 53 ac 1a $

.q.X.r...".nS..
0290 0d 42 0a 36 f
9 bb 96 14 23 f4 2b
b4 49 b9 e5 d5 .
B.6....#.+.I...
02a0 2d c7 d9 e0 f
a 05 4b 38 88 f2 f1
cb 01 4c 85 04 .....K8.....L..
02b0 2d d1 aa c7 a
a e4 3b a0 11 27 0a
61 c5 92 10 54 .....;..'.a...T
02c0 66 60 61 50 e
4 c8 0f 87 db 12 28
4e 2b 39 67 1b f
`aP......(N+9g.
02d0 1b ef 20 97 d
8 8d e5 4d 13 6f 79
6a 71 dd 12 2d .
. ....M.oyjq..02e0 85 4c 58 20 b
6 8d 23 66 35 11 f4
8d b1 77 1f 10 .
LX ..#f5....w..
02f0 1a 20 63 6d e
7 8d b7 5a 7d 67 58
d7 d4 28 40 48 .
cm...Z}gX..(@H
0300 68 06 24 13 0
6 96 14 22 13 3a 75
b2 28 b1 4e 03 h
.$....".:u.(.N.
0310 14 5d c8 37 4
5 31 15 56 5d fb b5
ad 00 a8 e6 23 .
].7E1.V]......#
0320 81 5e 51 c8 c
f 18 79 c4 cf 5e 6d
1d 3c e2 57 1a .
^Q...y..^m.<.W.
0330 6f 10 f0 f8 3
a e3 8b e8 8d ed 6f
54 31 57 6f 0e o
...:.....oT1Wo.
0340 90 8c b2 34 4
4 c9 0a b3 70 d5 4c
c2 28 2a 4a 88 .
..4D...p.L.(*J.
0350 dd 30 2c a5 4
9 b1 2c b5 36 77 2e
09 57 8d 56 c3 .
0,.I.,.6w..W.V.
0360 de 39 d3 9b 1
7 e3 1d bb aa d8 a7
13 4b 8b 1b 72 .
9..........K..r
0370 9a 40 d8 31 3
e 88 08 fc ec fa 19
62 95 d9 fc d2 .
@.1>......b....
0380 46 d1 11 05 1
a 81 d0 5b 20 4a 43
a1 81 d9 ac a8 F
......[ JC.....
0390 e1 13 17 eb 2
0 3a b2 38 ba b1 bd
7a 2f 46 47 2f .
... :.8...z/FG/

03a0 51 b5 88 51 3
3 29 70 be 47 4d 02
16 33 7b 47 cc Q
..Q3)p.GM..3{G.
03b0 48 b9 d3 53 8
6 3f a3 8d 73 87 d1
af ad c2 e6 c5 H
..S.?..s.......
03c0 49 2b 11 a8 5
0 5c f1 02 c9 12 1f
72 91 2e 0f 8b I
+..P\.....r....
03d0 ca ff fb 92 0
4 ee 0f f3 04 30 d3
83 58 5a 60 60 .
........0..XZ``
03e0 a5 7a 60 69 e
8 4c 0c a0 8b 4c 0d
61 e9 41 92 17 .
z`i.L...L.a.A..
03f0 29 41 97 a5 3
0 88 03 d6 7f e9 d2
bb 41 2f 2a d3 )
A..0.......A/*.
0400 89 a3 45 c0 6
3 ea f6 0d 81 5d ba
2b 90 74 52 96 .
.E.c....].+.tR.
0410 04 43 c7 67 e
4 15 6b 36 4c 69 1b
15 ac 43 59 5c .
C.g..k6Li...CY\
0420 7a e1 ac b4 d
4 00 2d d9 49 29 20
8d a0 2a 0c fe z
.....-.I) ..*..
0430 6d fe 12 5a f
2 8a bd b2 bb bf 6f
59 32 9f 6a 67 m
..Z......oY2.jg
0440 35 90 31 92 4
0 40 41 42 b2 e0 f9
d8 a8 20 1e 2c 5
.1.@@AB..... .,
0450 45 55 4d a2 f
4 39 9a 7d 34 50 8a
26 82 40 b8 cd E
UM..9.}4P.&.@..
0460 a8 9b c4 14 3
0 ca 2c 06 2a 2a d2
9d 43 66 03 38 .
...0.,.**..Cf.8
0470 20 c4 9c 99 4
b 11 ba 3b 9a dd d3
a8 4c 17 e6 aa
...K..;....L...
0480 10 e4 53 ad c
5 3e 61 2e 98 eb 1f
77 ac 59 4b 45 .
.S..>a....w.YKE
0490 62 b5 70 cc 1
3 d1 8b 6d e4 4b 69
93 5b 9c ad 68 b
.p....m.Ki.[..h
04a0 bd a3 af 90 6
d 9c 9e da ef df 5d
9c d9 a0 55 75 .
...m.....]...Uu
04b0 da 08 8a b0 c

a e9 b5 dd c8 bf 7c
c7 8f 56 13 04 .
.........|..V..
04c0 98 c6 86 30 f
f 80 09 8d 40 e7 7d
1d 99 7b 76 58 .
..0....@.}..{vX
04d0 00 a5 a4 cb d
5 83 c6 23 a1 35 e3
23 78 89 22 0a .
......#.5.#x.".
04e0 d5 e1 b0 f8 a
8 23 57 43 b5 cc 07
16 e8 e4 b6 89 .
....#WC........
04f0 30 c6 29 11 1
5 15 07 23 c2 83 8a
41 53 84 66 af 0
.)....#...AS.f.
0500 b4 7c 43 01 4
c 88 81 b6 86 85 82
f0 e0 96 03 5b .
|C.L..........[
0510 ae 5c cd 89 8
9 7e 8b 36 51 e6 ea
30 00 01 04 ce .
\...~.6Q..0....
0520 a8 43
.
C
No. Time
Source
Destination
Protocol
Length Info
145 5.413086000
pc13.home
livebox.home
DNS
88 Standard que
ry 0x7f80 PTR 250.
255.255.239.in-addr
.arpa
Frame 145: 88 bytes
on wire (704 bits)
, 88 bytes captured
(704 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.463016000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.463016000 s
econds
[Time delta fro
m previous captured

frame: 0.023876000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02387600
0 seconds]
[Time since ref
erence or first fra
me: 5.413086000 sec
onds]
Frame Number: 1
45
Frame Length: 8
8 bytes (704 bits)
Capture Length:
88 bytes (704 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11

), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
4
Identification:
0x4f4d (20301)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4979
5 (49795), Dst Port
: domain (53)
Source Port: 49
795 (49795)
Destination Por
t: domain (53)
Length: 54
Checksum: 0x83a
4 [validation disab
led]

[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
4]
Domain Name System
(query)
[Response In: 1
46]
Transaction ID:
0x7f80
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
250.255.255
.239.in-addr.arpa:
type PTR, class IN
Name: 2
50.255.255.239.in-a
ddr.arpa
[Name L
ength: 28]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 4a 4f 4d 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
JOM............
0020 01 01 c2 83 0
0 35 00 36 83 a4 7f

80 01 00 00 01 .
....5.6........
0030 00 00 00 00 0
0 00 03 32 35 30 03
32 35 35 03 32 .
......250.255.2
0040 35 35 03 32 3
3 39 07 69 6e 2d 61
64 64 72 04 61 5
5.239.in-addr.a
0050 72 70 61 00 0
0 0c 00 01
r
pa.....
No. Time
Source
Destination
Protocol
Length Info
146 5.455215000
livebox.home
pc13.home
DNS
145 Standard que
ry response 0x7f80
No such name
Frame 146: 145 byte
s on wire (1160 bit
s), 145 bytes captu
red (1160 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.505145000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.505145000 s
econds
[Time delta fro
m previous captured
frame: 0.042129000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04212900
0 seconds]
[Time since ref
erence or first fra
me: 5.455215000 sec
onds]
Frame Number: 1
46
Frame Length: 1
45 bytes (1160 bits
)
Capture Length:
145 bytes (1160 bi
ts)

[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
31
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb70d [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49795 (49795)
Source Port: do
main (53)
Destination Por
t: 49795 (49795)
Length: 111
Checksum: 0xe25
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
4]
Domain Name System
(response)
[Request In: 14
5]
[Time: 0.042129
000 seconds]
Transaction ID:
0x7f80
Flags: 0x8183 S
tandard query respo

nse, No such name

1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .0.. .
... .... = Authorit
ative: Server is no
t an authority for
domain
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0011 = Reply co
de: No such name (3
)
Questions: 1
Answer RRs: 0
Authority RRs:
1
Additional RRs:
0
Queries
250.255.255
.239.in-addr.arpa:
type PTR, class IN
Name: 2
50.255.255.239.in-a
ddr.arpa
[Name L
ength: 28]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Authoritative n
ameservers
239.in-addr
.arpa: type SOA, cl

ass IN, mname sns.d

ns.icann.org
Name: 2
39.in-addr.arpa
Type: S
OA (Start Of a zone
of Authority) (6)
Class:
IN (0x0001)
Time to
live: 1475
Data le
ngth: 45
Primary
name server: sns.d
ns.icann.org
Respons
ible authority's ma
ilbox: noc.dns.ican
n.org
Serial
Number: 2014101253
Refresh
Interval: 7200 (2
hours)
Retry I
nterval: 3600 (1 ho
ur)
Expire
limit: 604800 (7 da
ys)
Minimum
TTL: 3600 (1 hour)
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 83 00 00 4
0 00 40 11 b7 0d c0
a8 01 01 c0 a8 .
...@.@.........
0020 01 0b 00 35 c
2 83 00 6f e2 52 7f
80 81 83 00 01 .
..5...o.R......
0030 00 00 00 01 0
0 00 03 32 35 30 03
32 35 35 03 32 .
......250.255.2
0040 35 35 03 32 3
3 39 07 69 6e 2d 61
64 64 72 04 61 5
5.239.in-addr.a
0050 72 70 61 00 0
0 0c 00 01 c0 18 00
06 00 01 00 00 r
pa.............
0060 05 c3 00 2d 0
3 73 6e 73 03 64 6e
73 05 69 63 61 .
..-.sns.dns.ica
0070 6e 6e 03 6f 7
2 67 00 03 6e 6f 63
c0 3e 78 0c bf n
n.org..noc.>x..
0080 05 00 00 1c 2
0 00 00 0e 10 00 09
3a 80 00 00 0e .

... ......:....
0090 10
.
No. Time
Source
Destination
Protocol
Length Info
147 5.464210000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
880 http49
574 [PSH, ACK] Seq=
87782 Ack=1 Win=46
Len=826
Frame 147: 880 byte
s on wire (7040 bit
s), 880 bytes captu
red (7040 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.514140000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.514140000 s
econds
[Time delta fro
m previous captured
frame: 0.008995000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00899500
0 seconds]
[Time since ref
erence or first fra
me: 5.464210000 sec
onds]
Frame Number: 1
47
Frame Length: 8
80 bytes (7040 bits
)
Capture Length:
880 bytes (7040 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 8
66
Identification:
0xf1c2 (61890)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c1a [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 87782, Ack: 1
, Len: 826
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 826]
Sequence number
: 87782 (relativ
e sequence number)
[Next sequence
number: 88608 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .

... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe1e
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2086]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 62 f1 c2 4
0 00 31 06 3c 1a 4a
7c 0c 8a c0 a8 .
b..@.1.<.J|....
0020 01 0b 00 50 c
1 a6 2b c9 b9 13 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e e1 e7 0
0 00 77 2c 00 bc 95
71 13 15 3c 5b .
.....w,...q..<[
0040 88 75 88 a8 6
8 df 64 86 29 27 8c
75 43 14 55 c9 .
u..h.d.)'.uC.U.
0050 ee 96 c1 18 8

8 e0 18 68 85 94 e2
1e ab 5b ab 92 .
......h.....[..
0060 97 11 6b a8 5
0 a2 8a e7 09 49 5a
02 21 ff 0c 2d .
.k.P....IZ.!..0070 94 40 24 d8 5
d 38 70 f5 a3 e6 d9
91 92 1e 44 ed .
@$.]8p.......D.
0080 7a 5a 1d 6f 0
4 d2 d0 ff fb 92 04
e7 8f f2 b7 20 z
Z.o...........
0090 d3 83 2f 7a 5
0 5f 05 5a 50 65 e6
4c 0c 64 c7 48 .
./zP_.ZPe.L.d.H
00a0 0c bc cb 81 7
5 14 e9 01 a6 0d 30
c8 5c ea 53 58 .
...u.....0.\.SX
00b0 f9 c5 29 fe b
d 1b 54 59 43 00 a3
44 13 66 13 b8 .
.)...TYC..D.f..
00c0 b0 45 0a 95 2
3 dd d8 31 98 89 1d
b7 88 34 48 71 .
E..#..1.....4Hq
00d0 74 3d af 83 e
1 b8 36 3f 5f 4d d2
cd 86 5f 31 4a t
=....6?_M..._1J
00e0 a0 26 2e 45 0
3 67 52 20 24 64 db
7f 73 af b5 05 .
&.E.gR $d..s...
00f0 1d 28 24 c4 a
3 ee 53 97 85 66 c9
b0 23 c7 95 01 .
($...S..f..#...
0100 24 f1 a3 41 b
5 19 15 2e d3 24 e2
34 0a 80 16 b6 $
..A.....$.4....
0110 3f 26 d1 4f d
1 fe 90 40 83 26 64
e5 2a 16 4c 60 ?
&.O...@.&d.*.L`
0120 99 9a 76 29 2
2 ac 28 46 b5 9f c7
bc ee 42 62 24 .
.v)".(F.....Bb$
0130 8e a5 ad ad b
c 64 8e f1 4a 5f db
a7 15 2a 22 78 .
....d..J_...*"x
0140 8d ab 7b 5b 6
b e5 54 57 b3 c0 6a
75 56 8b a5 4a .
.{[k.TW..juV..J
0150 42 33 99 d0 2
d 22 52 09 96 7a 8b
33 51 6a f2 d2 B
3..-"R..z.3Qj..
0160 ea e8 f4 96 a
a d1 22 a9 8a 91 29

45 bb b6 92 43 .
....."...)E...C
0170 00 87 c6 70 2
0 ae 70 03 70 aa f6
ba 2c c5 97 0e .
..p .p.p...,...
0180 01 01 34 26 4
1 34 0c 65 b3 f1 f8
36 47 13 9a 12 .
.4&A4.e...6G...
0190 94 6b 7a f4 e
b 6c 76 43 58 94 82
9c 7a 35 d6 13 .
kz..lvCX...z5..
01a0 05 83 53 1d 8
b 5a da a5 54 f2 a6
95 4b 77 2d 5c .
.S..Z..T...Kw-\
01b0 e9 78 de fd f
d e1 a5 3c 98 69 52
64 6b 5d 46 93 .
x.....<.iRdk]F.
01c0 0c 96 47 fd a
8 42 83 16 68 e1 07
32 ad 0c 62 23 .
.G..B..h..2..b#
01d0 0c 74 38 b2 7
4 18 60 2a 2e a3 09
11 e2 ca 4f 8e .
t8.t.`*......O.
01e0 16 18 ce 9f e
6 1a e3 ab cb ea 3d
0a 1c 50 53 c4 .
.........=..PS.
01f0 99 7a 34 09 6
0 23 df 5e 90 df 41
71 da ee 3c 6d .
z4.`#.^..Aq..<m
0200 c9 0e ef 63 f
c 6f 3b ae b3 bb c9
bb 56 1d a0 d9 .
..c.o;.....V...
0210 d2 07 da 23 6
3 25 12 3c 5a 7c 55
67 80 e3 49 11 .
..#c%.<Z|Ug..I.
0220 ad c7 eb 56 7
a 83 d7 2c 48 ff fb
92 04 eb 0f f3 .
..Vz..,H.......
0230 1f 36 d1 03 4
f 1a e0 5f a4 8a 30
67 09 4a 0b 10 .
6..O.._..0g.J..
0240 c9 44 0d 3c a
b 81 58 12 28 c1 a7
a5 28 28 0b b1 .
D.<..X.(...((..
0250 ea 5a 66 25 8
3 01 99 c1 e0 a5 44
a1 91 36 0d 69 .
Zf%......D..6.i
0260 c5 16 4e 47 1
5 2a 98 2a 8d f5 bd
94 d0 33 57 62 .
.NG.*.*.....3Wb
0270 2f 19 69 32 3
8 3d 53 4b e6 87 f5
21 7f 01 2f 0a /

.i28=SK...!../.
0280 b8 57 a7 b4 e
3 d8 71 f3 12 5d c1
8f f1 bc ee ba .
W....q..]......
0290 bd af 89 ed 0
6 f6 82 1c 85 80 65
45 82 ca 42 ce .
.........eE..B.
02a0 07 c5 d8 5c 5
8 90 99 2f 0b ba e7
e4 4d 7a b2 1f .
..\X../....Mz..
02b0 d4 0c 16 65 4
5 1f 70 00 a2 46 44
99 0a c4 af 79 .
..eE.p..FD....y
02c0 89 06 31 25 2
0 80 90 83 c1 4a 13
cb 4c 88 b6 36 .
.1% ....J..L..6
02d0 46 e7 8c 7a 5
6 37 c6 1a 67 fd 10
92 99 34 df 02 F
..zV7..g....4..
02e0 af 23 2e e9 6
b 4d 98 71 22 c6 a3
da 46 f9 bd 73 .
#..kM.q"...F..s
02f0 1b 79 d5 ef 6
8 d1 f3 88 d7 11 c4
49 36 39 ae 73 .
y..h......I69.s
0300 c0 06 82 47 2
a 7b 55 6d b5 b6 3f
f4 a0 18 7c d3 .
..G*{Um..?...|.
0310 91 3a e1 cc c
7 21 e0 e0 56 94 e0
51 63 82 8b 95 .
:...!..V..Qc...
0320 90 28 93 89 3
1 11 22 b2 d3 62 17
e0 18 f3 87 45 .
(..1."..b.....E
0330 2c 9d 8c 44 e
1 4b 2e 3f 80 8a 11
13 5b a3 ab 2c ,
..D.K.?....[..,
0340 76 f7 92 e2 a
b e8 96 fc 15 9b 66
b6 ed 5e fd eb v
.........f..^..
0350 b7 65 cf e9 1
2 87 d5 0e 9e 15 30
60 04 80 48 02 .
e........0`..H.
0360 20 16 51 12 f
6 2d ab d3 32 da ac
7d 5d 0f b3 45
.Q..-..2..}]..E
No. Time
Source
Destination
Protocol
Length Info
148 5.464350000
pc13.home

cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=88608 Win=39483 Le
n=0
Frame 148: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.514280000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.514280000 s
econds
[Time delta fro
m previous captured
frame: 0.000140000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00014000
0 seconds]
[Time since ref
erence or first fra
me: 5.464350000 sec
onds]
Frame Number: 1
48
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90

:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f4f (20303)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =

More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 88608
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 88608 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set

.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39483
[Calculated win
dow size: 39483]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 147]
[The RTT to
ACK the segment wa
s: 0.000140000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 4f 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OO@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 bc 4d 50 10 .
....P..N.+..MP.
0030 9a 3b 18 d4 0
0 00
.
;....
No. Time
Source
Destination
Protocol
Length Info
149 5.516204000
pc13.home
livebox.home
DNS
86 Standard que
ry 0xc149 PTR 255.
1.168.192.in-addr.a
rpa
Frame 149: 86 bytes
on wire (688 bits)
, 86 bytes captured

(688 bits) on inte

rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.566134000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.566134000 s
econds
[Time delta fro
m previous captured
frame: 0.051854000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05185400
0 seconds]
[Time since ref
erence or first fra
me: 5.516204000 sec
onds]
Frame Number: 1
49
Frame Length: 8
6 bytes (688 bits)
Capture Length:
86 bytes (688 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
2
Identification:
0x4f50 (20304)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho

me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4979
5 (49795), Dst Port
: domain (53)
Source Port: 49
795 (49795)
Destination Por
t: domain (53)
Length: 52
Checksum: 0x83a
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
4]
Domain Name System
(query)
[Response In: 1
50]
Transaction ID:
0xc149
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
255.1.168.1
92.in-addr.arpa: ty
pe PTR, class IN
Name: 2
55.1.168.192.in-add
r.arpa

[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 48 4f 50 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
HOP............
0020 01 01 c2 83 0
0 35 00 34 83 a2 c1
49 01 00 00 01 .
....5.4...I....
0030 00 00 00 00 0
0 00 03 32 35 35 01
31 03 31 36 38 .
......255.1.168
0040 03 31 39 32 0
7 69 6e 2d 61 64 64
72 04 61 72 70 .
192.in-addr.arp
0050 61 00 00 0c 0
0 01
a
.....
No. Time
Source
Destination
Protocol
Length Info
150 5.524216000
livebox.home
pc13.home
DNS
86 Standard que
ry response 0xc149
No such name
Frame 150: 86 bytes
on wire (688 bits)
, 86 bytes captured
(688 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.574146000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.574146000 s
econds

[Time delta fro

m previous captured
frame: 0.008012000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00801200
0 seconds]
[Time since ref
erence or first fra
me: 5.524216000 sec
onds]
Frame Number: 1
50
Frame Length: 8
6 bytes (688 bits)
Capture Length:
86 bytes (688 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: live

box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
2
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb748 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49795 (49795)
Source Port: do
main (53)
Destination Por
t: 49795 (49795)
Length: 52

Checksum: 0xaff
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
4]
Domain Name System
(response)
[Request In: 14
9]
[Time: 0.008012
000 seconds]
Transaction ID:
0xc149
Flags: 0x8583 S
tandard query respo
nse, No such name
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .1.. .
... .... = Authorit
ative: Server is an
authority for doma
in
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0011 = Reply co
de: No such name (3
)
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries

255.1.168.1
92.in-addr.arpa: ty
pe PTR, class IN
Name: 2
55.1.168.192.in-add
r.arpa
[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 48 00 00 4
0 00 40 11 b7 48 c0
a8 01 01 c0 a8 .
H..@.@..H......
0020 01 0b 00 35 c
2 83 00 34 af f1 c1
49 85 83 00 01 .
..5...4...I....
0030 00 00 00 00 0
0 00 03 32 35 35 01
31 03 31 36 38 .
......255.1.168
0040 03 31 39 32 0
7 69 6e 2d 61 64 64
72 04 61 72 70 .
192.in-addr.arp
0050 61 00 00 0c 0
0 01
a
.....
No. Time
Source
Destination
Protocol
Length Info
151 5.544216000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=88608
Ack=1 Win=46 Len=1
260
Frame 151: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5

8.594146000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.594146000 s
econds
[Time delta fro
m previous captured
frame: 0.020000000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02000000
0 seconds]
[Time since ref
erence or first fra
me: 5.544216000 sec
onds]
Frame Number: 1
51
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1c3 (61891)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a67 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc

13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 88608, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 88608 (relativ
e sequence number)
[Next sequence
number: 89868 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u

nknown)]
Checksum: 0x471
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 c3 4
0 00 31 06 3a 67 4a
7c 0c 8a c0 a8 .
...@.1.:gJ|....
0020 01 0b 00 50 c
1 a6 2b c9 bc 4d 9e
87 4e aa 50 10 .
..P..+..M..N.P.
0030 00 2e 47 10 0
0 00 30 81 cd 08 13
23 00 48 51 95 .
.G...0....#.HQ.
0040 44 64 48 93 0
7 48 a4 0b 80 18 f0
2a 0d d2 58 d8 D
dH..H.....*..X.
0050 63 9c bd 13 d
c 62 9e 9d f6 7f 25
cf dc ad e0 c9 c
....b....%.....
0060 c3 72 28 89 2
3 72 70 e3 6a 70 6f
6f b5 db b5 2c .
r(.#rp.jpoo...,
0070 45 64 ce 76 d
6 de 47 93 57 de 31
6f bb d2 00 b2 E
d.v..G.W.1o....
0080 c3 a2 e1 a3 e
3 c3 24 09 8a a8 9b
45 66 90 91 12 .
.....$....Ef...
0090 65 ff fb 92 0
4 f1 0f f3 16 24 d0
83 4f 7a 50 65 e
........$..OzPe
00a0 24 8a 00 6b 0
f 4a 0b 7c 8f 42 0d
3d e9 41 8b 91 $
..k.J.|.B.=.A..
00b0 28 01 ac 31 2
8 02 7c 66 ae 83 0a
11 30 71 93 0d (
..1(.|f....0q..
00c0 1c 30 d8 60 8
8 a3 09 15 73 8a 80
8b dd 73 a3 dc .
0.`....s....s..
00d0 b1 9e bf 2c e
e 08 68 c2 dc 7b e3

10 e2 8f 4e be .
..,..h..{....N.
00e0 15 a2 d1 b7 f
e 0c ad 05 9d 0a 82
04 cd 0f f6 6d .
..............m
00f0 b2 9d 97 b1 5
b d5 88 95 bd b7 cb
e7 6d fe d6 9f .
...[.......m...
0100 bd 6d bd 3b 6
e 84 a8 c0 ca 08 0b
88 0e 9c 1e 28 .
m.;n..........(
0110 a1 67 34 d3 d
f 61 db 2c d3 ad bd
4f 22 62 1a 8a .
g4..a.,...O"b..
0120 07 1a 6e b7 8
8 b8 82 8a d8 05 58
42 d9 2b 2b 78 .
.n.......XB.++x
0130 9c 58 6e 18 7
4 e1 30 33 b9 33 95
68 6e 93 19 2c .
Xn.t.03.3.hn..,
0140 1f 05 b2 b5 a
5 29 27 49 35 d0 d3
66 d4 26 4a c0 .
....)'I5..f.&J.
0150 79 16 d4 6f d
c 38 f2 5e 06 f3 78
f8 f4 81 78 63 y
..o.8.^..x...xc
0160 c0 85 01 30 7
1 4e 2e 00 20 40 d6
e3 50 41 d0 18 .
..0qN.. @..PA..
0170 39 4a 95 f1 4
d c4 24 05 ed 1c 69
f6 30 c3 41 73 9
J..M.$...i.0.As
0180 d8 91 70 0b 9
6 03 99 e0 7a ab 85
c0 9a 99 60 e7 .
.p.....z.....`.
0190 32 17 07 00 e
f 3a d1 0c 31 d1 08
f6 a3 7c e7 1f 2
....:..1....|..
01a0 1b 0e 9b 46 8
8 ba e7 d4 41 15 10
31 08 4d cb a3 .
..F....A..1.M..
01b0 5b 14 b9 cf d
c e1 09 a3 98 81 41
80 5c 71 c3 04 [
.........A.\q..
01c0 94 31 44 db 1
c 73 62 09 e3 9c 9e
08 1f e8 d3 ff .
1D..sb.........
01d0 fe b5 c1 a4 9
0 b5 1d 8b a6 cb 92
b5 7c b1 17 dc .
...........|...
01e0 6e 0f 37 17 a
e d5 eb c8 24 c9 d0
ad 38 d5 2d d2 n

.7.....$...8.-.
01f0 29 15 6c 71 a
4 3f 21 b1 30 eb c5
04 04 33 5a 29 )
.lq.?!.0....3Z)
0200 ae 0f 12 48 8
8 73 35 dc c9 df d9
57 6d 93 bf 6e .
..H.s5....Wm..n
0210 23 70 fb d8 6
b bb 66 43 c6 65 c3
4a 78 b6 c4 e1 #
p..k.fC.e.Jx...
0220 70 3c f9 02 1
7 10 61 80 b0 41 44
d0 07 2e fd fe p
<....a..AD.....
0230 70 00 e9 ff f
b 92 04 ec 8f f2 fc
21 d0 83 58 7a p
..........!..Xz
0240 50 61 e4 aa 1
0 6f 0c 4a 0b 5c 83
52 0c 61 e9 41 P
a...o.J.\.R.a.A
0250 6d 10 aa 41 8
7 a5 28 c7 f5 38 fa
78 c3 47 47 4a m
..A..(..8.x.GGJ
0260 83 72 e5 ea d
9 5f d7 4c 98 2a a0
cd 66 18 c9 f3 .
r..._.L.*..f...
0270 24 c4 61 3a d
9 1b 1f 30 39 ab dc
a0 30 37 be 61 $
.a:...09...07.a
0280 f8 8a 24 11 0
a 91 a3 a0 70 6c 02
29 0a 98 41 2e .
.$.....pl.)..A.
0290 f5 09 de 15 3
2 33 24 32 17 58 a0
e8 f2 05 10 04 .
...23$2.X......
02a0 15 34 bb 04 e
1 73 73 ec 0c 4a 1c
11 ac 08 08 4d .
4...ss..J.....M
02b0 87 07 93 65 6
f f3 8a a8 9b fc 9d
43 0f 91 84 c6 .
..eo......C....
02c0 1b 29 73 29 4
e ba 7f 08 df 48 8a
df 15 11 a2 46 .
)s)N....H.....F
02d0 48 d0 54 36 0
3 a2 2d 19 09 24 ca
cb a8 52 aa 0a H
.T6..-..$...R..
02e0 db e3 2f b5 9
a ec 07 50 f9 50 31
69 65 49 d2 b3 .
./....P.P1ieI..
02f0 10 4f f3 f1 9
a 5d dd fe 7c 67 f8
dd 99 e1 e7 73 .
O...]..|g.....s

0300 e7 f9 7f b5 b
b 19 81 fb 52 40 a1
77 1f 0c 25 aa .
.......R@.w..%.
0310 8a d0 00 72 c
d 71 69 3d 1c fb 59
ad 6f 38 84 89 .
..r.qi=..Y.o8..
0320 76 63 03 a9 b
6 71 29 4f c6 35 c4
b0 d5 b4 7a 92 v
c...q)O.5....z.
0330 38 ca 0e 2a 2
6 82 62 1a 64 cd b4
58 46 eb c9 d8 8
..*&.b.d..XF...
0340 a3 58 c4 3a 8
e b6 ef ac ee 50 39
d0 ea a3 03 2d .
X.:.....P9....0350 2e 74 95 2b 3
1 04 ff 26 a6 89 77
f7 b9 e1 9d b1 .
t.+1..&..w.....
0360 bb 36 c1 6f b
9 af fb a7 fb 6e c3
4a 6c 1e e0 60 .
6.o.....n.Jl..`
0370 bd e2 77 b4 9
0 f3 0e c0 18 6d c4
e9 67 f2 66 7c .
.w......m..g.f|
0380 fb 65 55 33 4
9 69 dc 53 21 29 d4
5e 13 cc 18 4a .
eU3Ii.S!).^...J
0390 74 ea a1 98 1
6 91 4f 00 fc fb 12
7b 5d 3c d8 54 t
.....O....{]<.T
03a0 ec dc 01 da c
1 35 e3 12 9a 93 57
12 36 08 2c 79 .
....5....W.6.,y
03b0 4a 9c b4 90 e
1 5f c8 d4 fb 76 7a
80 c3 21 02 e5 J
...._...vz..!..
03c0 d2 f1 68 7d 2
4 c9 0f 16 63 c7 16
3c 2b 17 07 06 .
.h}$...c..<+...
03d0 dc 19 ad 6a a
4 ff fb 92 04 ef 8f
f3 2a 30 d8 03 .
..j........*0..
03e0 0f 32 60 61 0
5 3b 00 61 e3 4c 0c
48 e1 68 07 a4 .
2`a.;.a.L.H.h..
03f0 cb 81 8f 1c 6
c c0 f6 19 70 a4 2d
47 57 aa 8c 8a .
...l...p.-GW...
0400 44 f1 3a 89 3
1 ee a5 4f d9 f3 22
30 46 24 b4 04 D
.:.1..O.."0F$..
0410 e2 c4 81 ed 5

0 42 e7 46 4d bf a7
0d 84 1b 4c c5 .
...PB.FM.....L.
0420 80 0b 0d 60 9
a f1 89 59 49 ab 8c
36 08 28 27 65 .
..`...YI..6.('e
0430 2a 70 1d 24 3
8 54 fd 4c 29 ad b5
9f 4a 31 aa 9d *
p.$8T.L)...J1..
0440 3c 67 d4 99 7
d cf 33 65 8e 6d f5
0d a7 eb 6b ba <
g..}.3e.m....k.
0450 76 5a f7 7b f
7 e2 56 c7 df fc d5
dd ff ad 77 92 v
Z.{..V.......w.
0460 8d 14 93 82 8
1 22 29 ac 68 66 54
b1 26 12 8f cc .
....").hfT.&...
0470 9b 49 11 9e 6
0 fb 6e 70 35 a5 19
80 f3 fb db 44 .
I..`.np5......D
0480 e8 c7 2b 5d 7
1 51 0d 1b a9 46 19
07 b2 3d e6 30 .
.+]qQ...F...=.0
0490 95 31 bb fc 6
9 7f 13 b9 de f1 87
6a 3a db 8d af .
1..i......j:...
04a0 86 ad 5b 99 b
7 1b bb 2f 73 7e ce
ee db 99 b6 df .
.[..../s~......
04b0 2b ae cb 8d 6
d 8a 43 e8 72 c7 bc
ca fd df ec 91 +
...m.C.r.......
04c0 0d 44 e3 d2 e
0 68 86 95 39 0c 21
75 e3 20 da 33 .
D...h..9.!u. .3
04d0 68 c4 0b ba 0
8 88 d8 71 a9 20 67
9b 8d 49 b5 b5 h
......q. g..I..
04e0 58 db a4 e9 a
7 28 52 34 94 61 9c
f8 47 ec c6 12 X
....(R4.a..G...
04f0 aa 37 ef 86 b
f 8b f3 bd f2 5b 71
b7 cb b3 c0 9a .
7.......[q.....
0500 47 5b 36 e2 b
6 dd ee 7f d2 bb e7
cc df 1a f5 8b G
[6.............
0510 b4 8d 12 0b b
1 48 7c 38 fa d3 db
52 e8 79 5a 52 .
....H|8...R.yZR
0520 55 ae

U
.
No. Time
Source
Destination
Protocol
Length Info
152 5.611223000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
465 http49
574 [PSH, ACK] Seq=
89868 Ack=1 Win=46
Len=411
Frame 152: 465 byte
s on wire (3720 bit
s), 465 bytes captu
red (3720 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.661153000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.661153000 s
econds
[Time delta fro
m previous captured
frame: 0.067007000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06700700
0 seconds]
[Time since ref
erence or first fra
me: 5.611223000 sec
onds]
Frame Number: 1
52
Frame Length: 4
65 bytes (3720 bits
)
Capture Length:
465 bytes (3720 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule

String: http || tcp

.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
51

Identification:
0xf1c4 (61892)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3db7 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 89868, Ack: 1
, Len: 411
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 411]
Sequence number
: 89868 (relativ
e sequence number)
[Next sequence
number: 90279 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set

...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x786
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1671]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 c3 f1 c4 4
0 00 31 06 3d b7 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b c9 c1 39 9e
87 4e aa 50 18 .
..P..+..9..N.P.
0030 00 2e 78 65 0
0 00 02 b2 ae 9b 94
cc 82 3f aa 30 .
.xe.........?.0
0040 a9 25 48 68 1
7 c8 aa 81 ce 22 7e
2b 13 66 94 55 .
%Hh....."~+.f.U
0050 94 8c 46 ae e
0 8d 47 f4 89 c9 14
06 94 d7 be 72 .

.F...G........r
0060 0e 8e a2 b1 1
8 94 66 3d 2e a1 19
68 42 f9 fd b2 .
.....f=...hB...
0070 7f ee c5 4e f
f fb b4 fe c7 76 8b
5d f8 97 d6 ec .
..N.....v.]....
0080 d3 9f f6 3b 4
1 a2 a1 bc 08 4a 99
ff fb 92 04 e8 .
..;A....J......
0090 0f f2 c5 2f 5
b 01 e9 1a 60 60 86
0b 50 3d 23 4c .
../[...``..P=#L
00a0 4b fd 03 68 0
7 a4 cb 81 74 20 6d
00 c4 99 70 ee K
..h....t m...p.
00b0 12 2a d6 7f 4
2 c8 fa 43 d2 ac 84
e6 01 e4 68 13 .
*..B..C......h.
00c0 56 2b 82 21 8
2 c1 2c 26 80 c9 51
06 72 2a 43 76 V
+.!..,&..Q.r*Cv
00d0 6d a8 63 18 7
9 5b b2 f1 5d 43 5a
28 75 12 00 24 m
.c.y[..]CZ(u..$
00e0 23 75 44 88 4
9 31 81 21 15 24 49
19 a0 d4 42 29 #
uD.I1.!.$I...B)
00f0 98 7e 45 fe c
8 0f 9f d8 5f 03 71
68 f0 c4 f0 f3 .
~E....._.qh....
0100 e2 c6 12 02 4
1 9c 40 4a 93 d7 a2
2c b1 72 30 85 .
...A.@J...,.r0.
0110 78 00 d8 2a 4
1 60 21 04 99 0b 1f
69 e2 7a 78 24 x
..*A`!....i.zx$
0120 c3 22 2b 66 0
7 95 21 33 40 7c c0
bb ef f6 c4 d7 .
"+f..!3@|......
0130 0e 2e e5 5f 8
b 88 4e e3 62 2c 0b
dd 44 93 50 31 .
.._..N.b,..D.P1
0140 53 73 3c f0 0
9 64 32 da cf 26 89
2a 99 68 ab 92 S
s<..d2..&.*.h..
0150 9f ff fe c6 c
c ff 8c c4 8e cb 24
cc 8e 07 79 60 .
.........$...y`
0160 b4 3c 74 0c 0
d 13 16 70 58 8c a0
90 ca 89 8d 56 .
<t....pX......V

0170 55 df ae 01 e
8 38 80 c2 31 c5 96
3a a4 bf 1f eb U
....8..1..:....
0180 51 0f 70 3c 4
a f1 da 26 f3 b4 c0
dc 06 b8 3b ac Q
.p<J..&......;.
0190 66 18 3b c6 3
7 35 37 1c f2 ea da
6f 79 44 c6 0a f
.;.757....oyD..
01a0 28 ad 92 e3 4
8 ca 10 9f 3c fb 93
a9 e6 a7 7c 99 (
...H...<.....|.
01b0 bb eb 3e c1 4
7 cf f8 cc 91 4f 67
34 17 bf fd bd .
.>.G....Og4....
01c0 fe af 3f b4 0
5 96 c8 3f 8a c4 95
da 68 df 36 bc .
.?....?....h.6.
01d0 15
.
No. Time
Source
Destination
Protocol
Length Info
153 5.611411000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=90279 Win=39065 Le
n=0
Frame 153: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.661341000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.661341000 s
econds
[Time delta fro
m previous captured
frame: 0.000188000
seconds]
[Time delta fro

m previous displaye
d frame: 0.00018800
0 seconds]
[Time since ref
erence or first fra
me: 5.611411000 sec
onds]
Frame Number: 1
53
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124

-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f52 (20306)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 90279
, Len: 0
Source Port: 49
574 (49574)
Destination Por

t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 90279 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39065
[Calculated win
dow size: 39065]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 152]
[The RTT to
ACK the segment wa
s: 0.000188000 seco
nds]

0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 52 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OR@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 c2 d4 50 10 .
....P..N.+...P.
0030 98 99 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
154 5.666222000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=90279
Ack=1 Win=46 Len=1
260
Frame 154: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.716152000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.716152000 s
econds
[Time delta fro
m previous captured
frame: 0.054811000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05481100
0 seconds]
[Time since ref
erence or first fra
me: 5.666222000 sec
onds]
Frame Number: 1
54
Frame Length: 1

314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1c5 (61893)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a65 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 90279, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 90279 (relativ
e sequence number)

[Next sequence
number: 91539 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x45b
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 c5 4
0 00 31 06 3a 65 4a
7c 0c 8a c0 a8 .
...@.1.:eJ|....

0020 01 0b 00 50 c
1 a6 2b c9 c2 d4 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 45 b9 0
0 00 6e 28 90 82 76
82 64 2d 22 78 .
.E...n(..v.d-"x
0040 34 34 8d e3 5
0 73 99 d9 33 5f bf
6c 83 c0 b7 4f 4
4..Ps..3_.l...O
0050 8e 72 da 48 9
c dd bc 65 f3 18 d8
de 6e cd 7c 6b .
r.H...e....n.|k
0060 47 e9 29 33 d
d 05 9e 6a ec 4c 7a
f8 b9 36 5e cc G
.)3...j.Lz..6^.
0070 af 39 0f 2c f
e 9a be e6 e5 7b 9a
ec fa f5 ff 72 .
9.,.....{.....r
0080 bc d7 df 31 f
e bf cd 66 53 f4 6c
2c 03 06 82 8d .
..1...fS.l,....
0090 0a 1a ff fb 9
2 04 ec 0f f2 fd 41
59 03 09 32 e0 .
.........AY..2.
00a0 59 c7 0b 20 3
d 23 5c 0c 8c cb 60
07 bc cb 81 76 Y
.. =#\...`....v
00b0 1d 6c 00 f7 9
9 71 29 36 c6 83 45
9b 45 34 57 ea .
l...q)6..E.E4W.
00c0 5c 98 88 78 0
1 21 0b 37 4d 75 92
cf 10 ab 0f b9 \
..x.!.7Mu......
00d0 46 60 9b f6 d
a d5 6a 97 b2 9d 7b
60 1a f3 98 dc F
`....j...{`....
00e0 77 37 86 38 4
a e4 d7 a0 81 0d 0d
0f aa 62 75 ee w
7.8J........bu.
00f0 2b 79 4c 38 8
6 ce d9 15 b5 32 72
1a dd 9c b9 f4 +
yL8.....2r.....
0100 97 bd 28 aa e
d ed 73 b9 e5 df ca
02 16 3c 48 e0 .
.(...s......<H.
0110 a8 80 18 b4 4
e a0 db 42 91 64 21
26 d9 11 29 b4 .
...N..B.d!&..).
0120 71 5a db 0b 3
c 74 61 e3 8c 11 90
d2 fd 87 24 a6 q
Z..<ta.......$.
0130 4f 85 48 3c a

1 2d a7 18 50 18 f6
e9 e2 79 db bd O
.H<.-..P....y..
0140 24 9b 96 5b 8
2 67 a1 73 da a8 b0
97 b3 ce 3f 15 $
..[.g.s......?.
0150 d6 a8 25 7a c
4 b2 92 64 97 78 9d
46 3c 24 ca c9 .
.%z...d.x.F<$..
0160 89 b0 59 c8 f
8 de eb 3d 5e 4b 7c
67 7f f9 b9 05 .
.Y....=^K|g....
0170 ff f7 a2 91 6
a c1 a6 10 0a a5 98
8d 0d a5 4d 42 .
...j.........MB
0180 17 23 80 77 8
b 81 73 0e 24 29 89
38 51 6a 96 1a .
#.w..s.$).8Qj..
0190 28 8d 69 55 c
7 76 b5 0d 59 ba 09
98 f5 b8 3b b5 (
.iU.v..Y.....;.
01a0 2d c8 e7 c6 1
3 ab 37 ae 08 9c 62
4d db 3a 6d b5 .....7...bM.:m.
01b0 be 24 cf ac 0
d e3 54 8d 88 3a d6
b5 48 37 00 12 .
$....T..:..H7..
01c0 60 20 34 1b 0
0 94 b6 3c cb 66 9a
f4 01 42 47 94 `
4....<.f...BG.
01d0 1a 3b 63 2f b
3 5d 5f ad 69 2a 62
45 34 47 11 01 .
;c/.]_.i*bE4G..
01e0 d5 4e 25 20 a
c 6b e9 b3 b2 18 51
10 5a 9d 22 c1 .
N% .k....Q.Z.".
01f0 80 c5 14 8c 4
4 26 aa 5f 9b af 5f
51 96 a3 21 fe .
...D&._.._Q..!.
0200 de 86 e5 9c c
2 03 a5 ab 77 29 bd
8f 4d 23 d1 97 .
.......w)..M#..
0210 61 6d fa d7 b
2 ef 67 e2 16 58 ee
ef 06 d3 b1 7a a
m....g..X.....z
0220 e9 ff ef 7f 8
d ca ed 9b 78 f5 8f
25 6c 55 ca 50 .
.......x..%lU.P
0230 55 43 d8 12 f
f fb 90 04 ed 0f f3
30 3b 57 03 18 U
C.........0;W..
0240 32 e0 62 46 0
a e0 3f 0b 4c 0b c0

d1 5a 0c e0 cb 2
.bF..?.L...Z...
0250 81 5e 11 eb 8
0 fc 3d 28 14 53 4f
c8 f5 fd 2e 88 .
^....=(.SO.....
0260 c9 4c 71 43 e
1 40 20 29 fb 92 27
3c 07 07 46 9a .
LqC.@ )..'<..F.
0270 a1 15 60 c9 3
4 45 57 76 31 28 88
41 93 13 32 5a .
.`.4EWv1(.A..2Z
0280 7f 82 a4 13 9
2 ee 82 da c9 8a b9
2e de cb 83 ff .
...............
0290 c7 54 ee 1b 8
e 94 8d f2 c5 95 9f
bf cc 2c e3 cb .
T...........,..
02a0 a9 27 a4 28 d
9 cd 2b ac d6 5d 83
c7 54 74 08 68 .
'.(..+..]..Tt.h
02b0 50 80 36 e0 c
2 0c 91 14 a9 41 55
0f 2c ac eb fd P
.6......AU.,...
02c0 bd 69 78 34 5
8 18 25 1f 07 ca 23
a2 26 ae 51 16 .
ix4X.%...#.&.Q.
02d0 19 56 36 60 d
8 c9 80 bb 5e 75 f2
27 c9 e9 de 49 .
V6`....^u.'...I
02e0 79 4d 2e a7 c
b 78 48 61 17 3e e2
aa db df d9 b3 y
M...xHa.>......
02f0 57 ee c1 95 8
6 81 00 44 a0 f9 cb
13 07 86 dd 31 W
......D.......1
0300 97 57 59 91 2
c a2 bc ab 52 f1 68
65 4c f1 2d 33 .
WY.,...R.heL.-3
0310 15 a7 cc 5e b
c 0d c3 2b 45 e0 d0
07 1c 0a 65 df .
..^...+E.....e.
0320 d8 de a6 20 9
c 66 52 87 1c 00 44
86 6a 37 90 b0 .
.. .fR...D.j7..
0330 2c 36 fd 32 5
b b0 f4 52 fe 71 b2
c1 11 89 2d f9 ,
6.2[..R.q....-.
0340 53 60 7c a0 6
7 8e 7f e6 a9 27 6c
7d 03 f7 cd 75 S
`|.g....'l}...u
0350 fc 56 a9 4f e
6 ee 74 6a 02 05 07
d6 0a 86 10 69 .

V.O..tj.......i
0360 41 01 c2 dd 2
d e6 53 a9 05 44 d5
a7 c5 a5 2b fb A
...-.S..D....+.
0370 45 3c e9 29 f
3 17 8d 53 de b4 5e
0d 00 54 d5 37 E
<.)...S..^..T.7
0380 4d 6e 8a aa 4
f e0 32 26 90 42 02
86 d7 35 52 30 M
n..O.2&.B...5R0
0390 84 5f e2 34 1
7 3c 4d 6b 8e 25 d5
49 6d a6 d0 00 .
_.4.<Mk.%.Im...
03a0 32 aa da a4 e
c cb 9b 1f 81 f2 92
3c f4 b8 58 7a 2
..........<..Xz
03b0 a2 f0 ad 94 8
a 8a 5a 7a c8 29 92
79 ba 48 ac 1f .
.....Zz.).y.H..
03c0 53 33 df 50 4
2 ba 2d d6 7d 6b e0
dc ff 76 f8 fe S
3.PB.-.}k...v..
03d0 1d 32 dd a8 1
d ff fb 92 04 ec 8f
f3 13 35 56 03 .
2...........5V.
03e0 18 32 e0 63 0
5 0a c0 63 0f 4a 0c
24 d3 56 0c e1 .
2.c...c.J.$.V..
03f0 0b 81 82 99 6
a c1 8c 21 70 38 54
04 f9 bb c3 a5 .
...j..!p8T.....
0400 aa 52 22 c4 9
5 90 c9 14 48 54 4c
c2 00 86 25 c0 .
R".....HTL...%.
0410 55 21 d9 d6 1
c 24 60 a1 88 69 9c
80 6b 13 d0 c5 U
!...$`..i..k...
0420 a8 35 8c 51 3
d 8d 86 17 7e 39 6e
6e 8f 17 48 6c .
5.Q=...~9nn..Hl
0430 2b ca 3d 88 f
5 a8 d4 42 5c f2 84
17 27 97 8a 7b +
.=....B\...'..{
0440 b8 bb f0 98 d
e 6f 0b bd da 34 f4
9f b5 64 e1 b3 .
....o...4...d..
0450 f5 34 22 54 2
a 20 32 b0 ec 58 0e
c3 cf 7d 9f 6b .
4"T* 2..X...}.k
0460 db ec 4a 65 a
5 70 d6 24 00 98 73
18 6e 99 01 a8 .
.Je.p.$..s.n...

0470 58 aa 71 95 8
4 50 d2 07 ba e8 67
15 4d e6 85 56 X
.q..P....g.M..V
0480 dd 9b 12 b7 3
e 5f b9 8c e0 b4 ce
bd 3c e9 81 6b .
...>_......<..k
0490 6e ad 53 f1 6
3 62 55 34 1e fd 2d
2f ab c5 62 b3 n
.S.cbU4..-/..b.
04a0 70 61 6e 36 e
3 ee fb 79 f1 f1 49
fd a3 18 70 60 p
an6...y..I...p`
04b0 83 14 26 7b 8
8 ef 59 3a de 82 8b
eb 6a 95 4c 04 .
.&{..Y:....j.L.
04c0 20 18 00 47 8
1 de b6 0b 7c 97 ab
69 cc 15 2b ca
..G....|..i..+.
04d0 ab 4b f7 79 8
5 28 bd 88 0e cc 65
85 53 43 71 08 .
K.y.(....e.SCq.
04e0 b6 70 63 8d 7
a 79 e1 03 5a d5 ee
44 3e 94 e7 74 .
pc.zy..Z..D>..t
04f0 78 4b 0a 39 6
d aa c5 60 be 57 4e
51 fc 2b ee d1 x
K.9m..`.WNQ.+..
0500 3e 34 d5 3e 6
0 ca 09 94 5d 07 0a
99 55 ae be 5a >
4.>`...]...U..Z
0510 eb ee dc 9a 2
d 28 20 b0 34 e8 71
90 93 86 39 58 .
...-( .4.q...9X
0520 92 67
.
g
No. Time
Source
Destination
Protocol
Length Info
155 5.667212000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=91539
Ack=1 Win=46 Len=1
260
Frame 155: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.717142000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.717142000 s
econds
[Time delta fro
m previous captured
frame: 0.000990000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00099000
0 seconds]
[Time since ref
erence or first fra
me: 5.667212000 sec
onds]
Frame Number: 1
55
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1c6 (61894)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a64 [validatio
n disabled]
[Good: Fals

e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 91539, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 91539 (relativ
e sequence number)
[Next sequence
number: 92799 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x22f
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 c6 4
0 00 31 06 3a 64 4a
7c 0c 8a c0 a8 .
...@.1.:dJ|....
0020 01 0b 00 50 c
1 a6 2b c9 c7 c0 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 22 fd 0
0 00 80 1c 61 5c a5
a0 80 c2 44 4a .
.".....a\....DJ
0040 16 44 89 3c 3
c 36 1c 82 31 3f 1e
7a df 29 17 1b .
D.<<6..1?.z.)..
0050 35 33 61 6e 8
e fe 53 f6 c1 a1 c5
e9 f4 39 33 bc 5
3an..S......93.
0060 c2 28 51 85 4
2 21 e5 f9 39 34 ef
2a f1 0c fa e9 .
(Q.B!..94.*....
0070 e9 f7 f7 66 1
8 14 64 b1 3b 59 77
af 07 cd 66 90 .
..f..d.;Yw...f.
0080 bb b3 9e dc c
4 0a 70 aa 79 fc 3b
ff fb 92 04 e7 .
.....p.y.;.....
0090 8f f2 e2 2b d
5 03 38 5a 60 5e 64
6a a0 63 0f 4a .
..+..8Z`^dj.c.J
00a0 0b 54 95 54 0
c e1 e9 41 59 11 ea
81 8c 3d 28 da .
T.T...AY....=(.
00b0 57 0f bf 0b f
a 72 70 81 48 f2 17

2b 63 96 c0 47 W
....rp.H..+c..G
00c0 2f 10 be 98 4
0 c5 b1 74 14 c8 bb
74 2d 77 1f 0c /
...@..t...t-w..
00d0 96 c2 53 47 e
0 65 1e 93 56 7f 99
44 37 09 9f 64 .
.SG.e..V..D7..d
00e0 97 e6 a7 b8 3
d e0 f9 06 23 ca 38
9c 3b ce 8d ec .
...=...#.8.;...
00f0 28 fb 51 c3 a
7 2a c0 fb cb ed 7d
b7 6f 74 97 5f (
.Q..*....}.ot._
0100 fc f8 54 51 d
0 54 5d 49 5a 8d 0d
72 85 77 a4 64 .
.TQ.T]IZ..r.w.d
0110 af 58 50 e1 e
2 cf d7 c0 30 1c 71
9a 51 27 68 92 .
XP.....0.q.Q'h.
0120 86 2b cb 88 b
e a0 d6 90 cc 8f e2
42 75 10 fc 70 .
+.........Bu..p
0130 58 39 39 b7 7
8 aa 40 b6 9d 5c 34
d6 48 82 d3 91 X
99.x.@..\4.H...
0140 1b b0 13 49 7
7 f9 94 f2 6c d7 43
e6 6c 3c 59 e1 .
..Iw...l.C.l<Y.
0150 6b 52 f5 46 f
3 22 46 2e dd 5b 2d
4d f9 f9 91 de k
R.F."F..[-M....
0160 fb ea da fb c
e 3b 60 d1 2a 0d c4
95 8a b8 fb 69 .
....;`.*......i
0170 76 3d d4 4d 3
d 0e d4 5e 43 a9 8e
aa 30 40 2a 14 v
=.M=..^C...0@*.
0180 bf 95 bb a1 e
e 5a 4f 98 e9 48 48
94 65 af 9a 67 .
....ZO..HH.e..g
0190 88 6b 75 b0 d
5 58 76 11 75 e4 66
4d 5a d5 0a 58 .
ku..Xv.u.fMZ..X
01a0 b8 d3 19 d3 0
6 1a f6 aa 4c c0 f5
6f 00 b9 d1 fc .
.......L..o....
01b0 23 79 9b 3d e
3 c7 1f 29 c4 b9 de
63 d2 d1 a1 d7 #
y.=...)...c....
01c0 e6 5b ef 50 a
b f3 bc ea d7 de 7e
ab 1f 5b f8 83 .

[.P......~..[..
01d0 d4 12 e6 93 7
7 fd 55 75 97 88 44
e6 aa e2 77 8a .
...w.Uu..D...w.
01e0 cc 5c a4 55 1
5 7d d0 55 50 40 84
a4 93 84 3c 4c .
\.U.}.UP@....<L
01f0 a6 70 8b 58 5
d 6c e4 11 76 a2 ff
ba 6c 77 26 e8 .
p.X]l..v...lw&.
0200 af 58 24 c6 5
5 11 6a f4 c2 d4 e1
f3 ba bc 99 d1 .
X$.U.j.........
0210 f9 64 ff f0 3
b 50 6f 7b b8 db fd
fe 9f 99 ee df .
d..;Po{........
0220 b7 64 b1 3f 3
3 16 39 c7 14 0c 2c
83 f8 ff fb 92 .
d.?3.9...,.....
0230 04 f0 8f f3 3
a 2f 54 03 59 62 62
5e 65 1a 80 63 .
...:/T.Ybb^e..c
0240 0f 4a 0c a8 a
3 4e 0c e1 e9 41 7e
17 6a 01 8c 3d .
J...N...A~.j..=
0250 30 9d 9f 5e a
8 68 d6 00 23 a6 82
ee c1 ec ba 5a 0
..^.h..#......Z
0260 64 7a 08 22 2
a 32 62 19 0f 5c bd
8f fb 94 0f dc d
z."*2b..\......
0270 65 61 aa aa 5
7 fa 4e d7 f0 68 3a
78 1c 95 d1 49 e
a..W.N..h:x...I
0280 d6 c6 18 39 c
c a9 50 2c a0 f6 2b
cd c8 ef ce 5b .
..9..P,..+....[
0290 9e b3 6f 70 7
d f9 ff eb 69 11 b7
66 53 bd 5f ee .
.op}...i..fS._.
02a0 f9 ba d6 bf 5
5 ee 5f d6 fe f6 b2
cf bf f9 5c 31 .
...U._.......\1
02b0 07 3b 54 63 e
3 d2 91 80 e3 06 4c
41 65 ae 03 0a .
;Tc......LAe...
02c0 09 12 10 d1 2
4 cc 20 25 c0 8c c5
b3 24 49 3f 86 .
...$. %....$I?.
02d0 95 8b a0 d7 e
1 a7 e7 4f 14 76 09
6d a5 8f 2e 2e .
......O.v.m....

02e0 93 ce ff f3 0
8 2c 1c 39 ef e2 18
ed 6a 0d 26 7e .
....,.9....j.&~
02f0 49 f4 23 a9 6
c cc 88 3e 65 30 e9
ec ac d1 15 9d I
.#.l..>e0......
0300 e9 ab b9 04 3
d 5c 83 37 60 fb 76
74 3b 60 4d 1c .
...=\.7`.vt;`M.
0310 2e ed ab e8 4
3 a8 05 51 08 22 40
0b 20 99 55 9e .
...C..Q."@. .U.
0320 20 66 42 30 6
7 05 0a 32 22 65 af
38 82 a9 83 48
fB0g..2"e.8...H
0330 fa 2d 5a 8a c
d 94 cb 6c f5 3e 5c
6e ca 8d af f7 .
-Z....l.>\n....
0340 07 a5 b0 6f 2
8 01 46 23 4a 9c 37
b2 73 39 46 91 .
..o(.F#J.7.s9F.
0350 81 ad 1f ab 4
a 9d 58 b9 a9 a3 61
92 d5 ae b5 ac .
...J.X...a.....
0360 7f 9c 44 81 a
f 8a 7d df 5a c6 bc
43 b2 42 e3 39 .
.D...}.Z..C.B.9
0370 fd ff ff 4a 4
9 04 ce 39 a4 00 a8
6e 5e 0d b4 c9 .
..JI..9...n^...
0380 0d 03 82 e7 2
c f5 ec f0 0e c4 9b
6e eb f6 a3 41 .
...,......n...A
0390 9c 9a 85 d3 4
b 95 23 f6 de 4f 4b
71 74 16 f3 4a .
...K.#..OKqt..J
03a0 8c de 56 78 3
e 47 7c a4 79 58 b7
44 13 1a 66 42 .
.Vx>G|.yX.D..fB
03b0 10 04 f5 c8 3
3 11 89 7c 36 c9 05
9b 24 f3 b5 b9 .
...3..|6...$...
03c0 5a dc f5 55 a
a 9f 64 6f d4 94 1d
14 0a 27 1a ff Z
..U..do.....'..
03d0 fb 92 04 ea 0
f f2 cc 29 54 03 39
62 60 62 05 7a .
......)T.9b`b.z
03e0 70 67 18 4c 0
b b0 b1 50 0d 61 89
81 7e 95 ea 01 p
g.L...P.a..~...
03f0 9c 3d 30 3d d

d 4a a1 29 c0 a5 07
05 a2 7b 76 6e .
=0=.J.).....{vn
0400 4d 9b 32 95 a
2 9c 3e 42 83 3c 1e
5d 2d 26 5a 40 M
.2...>B.<.]-&Z@
0410 9d 2d 6d 6f 4
d 43 ce c6 2c 72 3d
2d ed 31 41 4c .
-moMC..,r=-.1AL
0420 fa 23 5d b0 b
0 fb 7f 70 d7 1e 85
3e d8 dc 9c 53 .
#]....p...>...S
0430 06 bb d4 dc d
b 3b 8d bf 67 86 e1
df 1e 8a ed da .
....;..g.......
0440 f6 df dd 22 7
d 5e 07 f5 b7 fa f0
b5 f1 2b af bc .
.."}^.......+..
0450 56 61 53 9c c
f ff fa 48 02 20 10
c8 1e 26 20 36 V
aS....H. ...& 6
0460 79 0e 05 be 9
d 00 8f 7b 95 95 2f
08 2e 8d 4a 69 y
......{../...Ji
0470 22 4d e4 08 d
9 87 2a bc 6c a9 be
8f c5 67 6e 3b "
M....*.l....gn;
0480 6f b3 93 86 6
c 25 2f be bf 22 2f
cd fe c7 e6 f1 o
...l%/.."/.....
0490 05 81 e8 c1 0
5 c3 28 10 80 aa c1
42 20 8b 17 2b .
.....(....B ..+
04a0 69 7c 9a 76 4
1 36 94 92 38 6b 7f
0e 72 ff 4b 3d i
|.vA6..8k..r.K=
04b0 57 f5 37 8e f
7 b2 da 08 02 0b 1e
63 06 23 1d 24 W
.7........c.#.$
04c0 96 16 0e 82 4
0 9a 98 42 53 8a af
24 26 3d 0c ea .
...@..BS..$&=..
04d0 c4 8e 91 67 2
0 4a a9 6e f0 4b 64
b5 62 f6 9e b6 .
..g J.n.Kd.b...
04e0 e8 d7 70 eb 7
5 82 2d e6 90 b4 83
c9 f7 50 7c ae .
.p.u.-......P|.
04f0 64 4d 0e 83 7
6 40 81 0f 44 ca e3
9e 54 1b 68 13 d
M..v@..D...T.h.
0500 15 9b 33 d6 6
0 75 d9 90 5b ba 92

9b a6 77 97 f4 .
.3.`u..[....w..
0510 06 0b ba 54 b
3 ed ef aa 6b 61 40
8b e4 0f 00 d4 .
..T....ka@.....
0520 f0 c3
.
.
No. Time
Source
Destination
Protocol
Length Info
156 5.667339000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=92799 Win=38435 Le
n=0
Frame 156: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.717269000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.717269000 s
econds
[Time delta fro
m previous captured
frame: 0.000127000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00012700
0 seconds]
[Time since ref
erence or first fra
me: 5.667339000 sec
onds]
Frame Number: 1
56
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor

ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =

Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f53 (20307)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 92799
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 92799 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .

... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38435
[Calculated win
dow size: 38435]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 155]
[The RTT to
ACK the segment wa
s: 0.000127000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 53 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OS@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 cc ac 50 10 .
....P..N.+...P.
0030 96 23 18 d4 0
0 00
.
#....

No. Time
Source
Destination
Protocol
Length Info
157 5.759496000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1301 http49
574 [PSH, ACK] Seq=
92799 Ack=1 Win=46
Len=1247
Frame 157: 1301 byt
es on wire (10408 b
its), 1301 bytes ca
ptured (10408 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.809426000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.809426000 s
econds
[Time delta fro
m previous captured
frame: 0.092157000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09215700
0 seconds]
[Time since ref
erence or first fra
me: 5.759496000 sec
onds]
Frame Number: 1
57
Frame Length: 1
301 bytes (10408 bi
ts)
Capture Length:
1301 bytes (10408
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http

2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
287
Identification:
0xf1c7 (61895)

Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a70 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 92799, Ack: 1
, Len: 1247
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1247]
Sequence number
: 92799 (relativ
e sequence number)
[Next sequence
number: 94046 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd40
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1247]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 07 f1 c7 4
0 00 31 06 3a 70 4a
7c 0c 8a c0 a8 .
...@.1.:pJ|....
0020 01 0b 00 50 c
1 a6 2b c9 cc ac 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e d4 0d 0
0 00 e8 28 0b 7a 68
06 5b 5c 04 04 .
......(.zh.[\..
0040 90 e5 2e cb c
7 52 68 b8 d4 19 67
26 7a ec 4a 1c .
....Rh...g&z.J.
0050 a9 0d e9 0a 7
c 45 e2 f3 b0 4c 0b
14 c6 6b 08 45 .
...|E...L...k.E
0060 3e 13 32 ed 0

7 c1 f0 3a 20 1e a0
d0 3c 09 2e 10 >
.2....: ...<...
0070 98 73 7e 06 4
4 c0 86 6f 0d 57 b3
8e 96 6b e0 61 .
s~.D..o.W...k.a
0080 3f f2 df fd f
3 ff fb 92 04 ec 8f
f2 fb 2c 54 03 ?
............,T.
0090 38 5a 60 5f e
5 da 70 63 2f 4c 0c
00 d5 50 0d 61 8
Z`_..pc/L...P.a
00a0 0b 81 82 16 2
a 01 9c c5 30 8d 81
df a3 5b 77 2c .
...*...0....[w,
00b0 0c a5 20 d2 1
1 45 06 db 55 dc 66
61 06 c4 0c 24 .
. ..E..U.fa...$
00c0 20 82 29 97 a
1 e6 2c 04 1b a8 e5
5c 19 a3 32 4b
.)...,....\..2K
00d0 b9 45 3b 53 e
5 42 80 40 f3 d4 55
51 e6 7a ad a8 .
E;S.B.@..UQ.z..
00e0 05 02 52 4c 6
b 35 3a 36 83 61 66
36 86 c5 03 14 .
.RLk5:6.af6....
00f0 98 08 2b dd 2
3 e9 b0 a5 5d 2d 17
dd 95 bb f5 9b .
.+.#...]-......
0100 14 a5 fc de c
6 7f 0a bb ff ff eb
c5 34 00 97 28 .
...........4..(
0110 e9 8c 24 40 f
c 13 24 e4 22 44 21
c9 24 ed 90 c8 .
.$@..$."D!.$...
0120 45 b1 a9 97 6
1 97 75 5a 22 50 88
7d a1 3f aa 41 E
...a.uZ"P.}.?.A
0130 7a bf 4b f1 b
b 36 05 6f 8b 71 c8
98 07 27 91 68 z
.K..6.o.q...'.h
0140 27 7a 12 9e a
a 9c 6c be 86 8c 6a
85 f0 8a 3e 8b '
z....l...j...>.
0150 fc d4 8c 99 5
4 62 b7 c5 ad 8c 69
ad a6 f9 a3 b9 .
...Tb....i.....
0160 6f b8 11 77 4
a 63 e3 10 f1 77 33
17 01 fc df fe o
..wJc...w3.....
0170 85 61 2e 2a e
3 30 89 58 c2 c5 57

1a 01 d8 c6 38 .
a.*.0.X..W....8
0180 74 1c 5b 7a 2
5 da 0b 44 1f d3 90
fa 8f 65 d4 be t
.[z%..D.....e..
0190 7d 15 d3 bb 1
e 88 64 cc 19 1d 6b
52 89 85 9a d4 }
.....d...kR....
01a0 ad 97 4b 21 5
2 64 c9 89 c1 25 15
cd 89 03 63 02 .
.K!Rd...%....c.
01b0 3c 82 91 75 2
8 5f 9e 5b 94 75 99
15 12 9c 95 d4 <
..u(_.[.u......
01c0 ee 92 dd 13 8
c 95 9f 3c d8 f7 b7
68 84 e5 4c 5d .
......<...h..L]
01d0 66 0a c2 23 7
a 48 06 18 08 f5 86
75 d1 ed c6 61 f
..#zH.....u...a
01e0 13 71 92 28 8
c 7a 1b 81 28 55 47
43 db 0c 46 4b .
q.(.z..(UGC..FK
01f0 c6 56 b8 cc 8
f f3 d5 30 58 3d 08
15 11 c3 91 e3 .
V.....0X=......
0200 44 03 dc 45 4
3 0b 50 07 91 47 e0
9a ca 56 9d 2b D
..EC.P..G...V.+
0210 95 b4 bb 9f 8
5 8a a8 4a f1 e7 02
c2 ce 33 94 89 .
......J.....3..
0220 dc 97 39 bd 9
7 d4 62 ff fb 92 04
eb 8f f2 ed 35 .
.9...b........5
0230 54 03 38 42 e
0 5e e6 9a 80 67 09
5c 0c 80 af 4e T
.8B.^...g.\...N
0240 0c e1 e9 81 7
c 95 ea 01 8c c5 30
7f ff b5 6f 7e .
...|.....0...o~
0250 70 99 3f d2 e
8 34 e6 1c dc 21 0b
97 6e d9 25 56 p
.?..4...!..n.%V
0260 2b 7e c4 68 c
a 1e cf e3 2d 19 2a
25 4e fc 5e 85 +
~.h....-.*%N.^.
0270 c4 a7 a3 a0 9
b bd 10 79 ed b9 e9
30 5a 39 51 e3 .
......y...0Z9Q.
0280 c5 6c b1 b4 9
f 8b b7 cd 72 f8 2f
de 40 be 17 1b .

l......r./.@...
0290 8d eb 7d ef f
f bc 5e 7c 05 a5 0c
39 4e 6b 02 c8 .
.}...^|...9Nk..
02a0 51 cd 08 13 b
a 32 d5 fb ea 31 6f
39 fe b0 bf 70 Q
....2...1o9...p
02b0 7c 9b fe 96 c
1 86 0c d0 eb 47 92
d4 12 14 10 d0 |
........G......
02c0 e8 3c 3c 0f c
7 57 82 c1 3d 1b c9
ce cb 23 44 ac .
<<..W..=....#D.
02d0 da 3a f3 32 5
c 60 71 02 91 49 b5
da 65 ac c5 a7 .
:.2\`q..I..e...
02e0 bb 5f a3 8a 4
e 0b 16 1e b9 90 09
a1 09 06 1f 0e .
_..N...........
02f0 1f 30 fb 5e 8
9 44 55 94 0b 29 68
e2 e1 77 85 e0 .
0.^.DU..)h..w..
0300 83 6a 71 05 3
e 92 28 f9 45 08 0a
36 4c 99 f9 44 .
jq.>.(.E..6L..D
0310 b0 12 d3 41 9
8 ad 72 67 3a 81 48
86 2a 99 9a 82 .
..A..rg:.H.*...
0320 6f 73 9b 04 6
6 3e 60 af b1 39 b3
4b 3c 68 6c d1 o
s..f>`..9.K<hl.
0330 7a e0 e2 04 0
9 58 c0 fa d2 76 46
34 9e ce 0b 4d z
....X...vF4...M
0340 1c 79 1b a7 8
3 a2 c7 d8 40 36 30
16 52 d4 66 67 .
y......@60.R.fg
0350 4d d5 1c 43 1
6 a7 30 55 f8 c8 9d
46 5a 8b d4 70 M
..C..0U...FZ..p
0360 a7 7d ee 53 1
9 99 53 ad c3 26 01
07 21 b9 31 19 .
}.S..S..&..!.1.
0370 a1 86 0b d1 e
a 53 a1 8e 6e 17 37
89 83 32 2b 34 .
....S..n.7..2+4
0380 14 51 27 82 b
3 1d a9 aa 3c 2e f5
e6 a1 c5 6e 59 .
Q'.....<.....nY
0390 c6 37 7c 53 7
5 97 14 cd 96 30 86
a6 68 3e a4 ca .
7|Su....0..h>..

03a0 53 2a c6 bd 6
a 9e 7e ce 46 4f ff
27 e7 4f 8f 4f S
*..j.~.FO.'.O.O
03b0 c8 f3 63 3b d
9 4c fe dc 19 91 62
bc 49 fc 34 2f .
.c;.L....b.I.4/
03c0 a8 7b 52 ce 0
9 f1 88 d2 21 ff fb
92 04 ea 8f f2 .
{R.....!.......
03d0 ff 2c 56 83 0
f 42 60 5f a4 8a d0
63 0f 4a 0b 94 .
,V..B`_...c.J..
03e0 6f 62 07 b1 2
7 01 72 8e ac 40 f7
a5 28 5b 5c ff o
b..'.r..@..([\.
03f0 c5 d0 69 93 5
8 f7 a0 58 3a c3 a0
94 a7 0b 15 58 .
.i.X..X:......X
0400 89 b1 3e d2 7
0 98 09 65 66 9a c1
5c b1 19 d3 cb .
.>.p..ef..\....
0410 b5 35 6e 17 8
a c9 9b 50 a0 0d 37
39 27 7c d6 e5 .
5n....P..79'|..
0420 9d b2 db 14 f
7 ad af 8a 09 63 59
a1 f2 a6 6f e5 .
........cY...o.
0430 da 8f fa 3d d
3 f0 2e de f5 d7 1d
55 cf e5 ee 86 .
..=.......U....
0440 7b a9 6c 3d 7
f de f0 69 9c ff b9
eb b2 0e f7 fd {
.l=...i........
0450 27 ed cc c5 0
3 fd aa e8 90 84 d0
44 6e 4f f6 bc '
..........DnO..
0460 e8 51 41 10 5
4 75 28 2e 96 13 f2
22 4a 68 10 19 .
QA.Tu(...."Jh..
0470 dc d9 ad 59 3
c f5 35 32 1c 9a 13
08 1c a1 8b c5 .
..Y<.52........
0480 ab e6 8c 55 b
8 51 be f1 1c 4d 44
f5 e2 81 53 f1 .
..U.Q...MD...S.
0490 d6 08 aa 11 2
6 84 0b 84 cb 34 90
34 38 1a 53 d7 .
...&....4.48.S.
04a0 12 d6 b0 68 2
b 3a 25 7e 22 4d 6a
7c b4 34 a3 40 .
..h+:%~"Mj|.4.@
04b0 ca 8f 44 bd a

c 2d 92 4e 8e 50 5e
12 54 29 89 24 .
.D..-.N.P^.T).$
04c0 c6 16 94 d6 4
b 78 32 85 18 c7 90
ed 21 16 78 e2 .
...Kx2.....!.x.
04d0 e6 dc f2 ac 1
9 c6 90 16 55 91 a4
1d 3a 10 3e 15 .
.......U...:.>.
04e0 66 a2 bb 4d 2
1 bd 84 57 fd c9 59
21 e8 49 e9 f4 f
..M!..W..Y!.I..
04f0 a5 4e 3c 95 1
e 37 70 d1 29 22 ab
01 07 4b 3c 8d .
N<..7p.)"...K<.
0500 ab 05 56 76 5
a 2e e4 b4 ed 60 ad
a5 89 4f 12 cf .
.VvZ....`...O..
0510 6f 57 53 f0 d
2
o
WS..
No. Time
Source
Destination
Protocol
Length Info
158 5.768228000
fe80::8a51:fbff
:fe19:2ffd ff02::1:
2
DHCPv
6 132 Solicit
XID: 0x3209c2 CID:
000300018851fb192ff
d
Frame 158: 132 byte
s on wire (1056 bit
s), 132 bytes captu
red (1056 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.818158000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.818158000 s
econds
[Time delta fro
m previous captured
frame: 0.008732000
seconds]
[Time delta fro
m previous displaye

d frame: 0.00873200
0 seconds]
[Time since ref
erence or first fra
me: 5.768228000 sec
onds]
Frame Number: 1
58
Frame Length: 1
32 bytes (1056 bits
)
Capture Length:
132 bytes (1056 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ipv6:ipv6.nxt:udp:
dhcpv6]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: H
ewlettP_19:2f:fd (8
8:51:fb:19:2f:fd),
Dst: IPv6mcast_01:0
0:02 (33:33:00:01:0
0:02)
Destination: IP
v6mcast_01:00:02 (3
3:33:00:01:00:02)
Address: IP
v6mcast_01:00:02 (3
3:33:00:01:00:02)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f
actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Hewlett
P_19:2f:fd (88:51:f
b:19:2f:fd)
Address: He
wlettP_19:2f:fd (88
:51:fb:19:2f:fd)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IPv6 (0x8
6dd)
Internet Protocol V
ersion 6, Src: fe80
::8a51:fbff:fe19:2f

fd (fe80::8a51:fbff
:fe19:2ffd), Dst: f
f02::1:2 (ff02::1:2
)
0110 .... = Ver
sion: 6
[0110 ....
= This field makes
the filter "ip.vers
ion == 6" possible:
6]
.... 0000 0000
.... .... .... ....
.... = Traffic cla
ss: 0x00000000
.... 0000 0
0.. .... .... ....
.... .... = Differe
ntiated Services Fi
eld: Default (0x000
00000)
.... .... .
.0. .... .... ....
.... .... = ECN-Cap
able Transport (ECT
): Not set
.... .... .
..0 .... .... ....
.... .... = ECN-CE:
Not set
.... .... ....
0000 0000 0000 0000
0000 = Flowlabel:
0x00000000
Payload length:
78
Next header: UD
P (17)
Hop limit: 1
Source: fe80::8
a51:fbff:fe19:2ffd
(fe80::8a51:fbff:fe
19:2ffd)
[Source SA MAC:
HewlettP_19:2f:fd
(88:51:fb:19:2f:fd)
]
Destination: ff
02::1:2 (ff02::1:2)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: dhcp
v6-client (546), Ds
t Port: dhcpv6-serv
er (547)
Source Port: dh
cpv6-client (546)
Destination Por
t: dhcpv6-server (5
47)
Length: 78
Checksum: 0x93c
c [validation disab
led]
[Good Check
sum: False]

[Bad Checks
um: False]
[Stream index:
5]
DHCPv6
Message type: S
olicit (1)
Transaction ID:
0x3209c2
Elapsed time
Option: Ela
psed time (8)
Length: 2
Value: ffff
Elapsed tim
e: 655350 ms
Client Identifi
er
Option: Cli
ent Identifier (1)
Length: 10
Value: 0003
00018851fb192ffd
DUID: 00030
0018851fb192ffd
DUID Type:
link-layer address
(3)
Hardware ty
pe: Ethernet (1)
Link-layer
address: 88:51:fb:1
9:2f:fd
Identity Associ
ation for Non-tempo
rary Address
Option: Ide
ntity Association f
or Non-temporary Ad
dress (3)
Length: 12
Value: 0000
0002000000000000000
0
IAID: 00000
002
T1: 0
T2: 0
Option Request
Option: Opt
ion Request (6)
Length: 12
Value: 000d
000c001700180027000
7
Requested O
ption code: Status
code (13)
Requested O
ption code: Server
unicast (12)
Requested O
ption code: DNS rec
ursive name server
(23)
Requested O
ption code: Domain
Search List (24)
Requested O

ption code: Fully Q

ualified Domain Nam
e (39)
Requested O
ption code: Prefere
nce (7)
Fully Qualified
Domain Name
Option: Ful
ly Qualified Domain
Name (39)
Length: 10
Value: 0108
4850453531423642
0000 0... =
Reserved: 0x00
.... .0.. =
N bit: Server shou
ld perform DNS upda
tes
.... ..0. =
O bit: Server has
not overridden clie
nt's S bit preferen
ce
.... ...1 =
S bit: Server shou
ld perform forward
DNS updates
Client FQDN
: HPE51B6B
0000 33 33 00 01 0
0 02 88 51 fb 19 2f
fd 86 dd 60 00 3
3.....Q../...`.
0010 00 00 00 4e 1
1 01 fe 80 00 00 00
00 00 00 8a 51 .
..N...........Q
0020 fb ff fe 19 2
f fd ff 02 00 00 00
00 00 00 00 00 .
.../...........
0030 00 00 00 01 0
0 02 02 22 02 23 00
4e 93 cc 01 32 .
......".#.N...2
0040 09 c2 00 08 0
0 02 ff ff 00 01 00
0a 00 03 00 01 .
...............
0050 88 51 fb 19 2
f fd 00 03 00 0c 00
00 00 02 00 00 .
Q../...........
0060 00 00 00 00 0
0 00 00 06 00 0c 00
0d 00 0c 00 17 .
...............
0070 00 18 00 27 0
0 07 00 27 00 0a 01
08 48 50 45 35 .
..'...'....HPE5
0080 31 42 36 42
1
B6B

No. Time
Source
Destination
Protocol
Length Info
159 5.877230000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=94046
Ack=1 Win=46 Len=1
260
Frame 159: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.927160000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.927160000 s
econds
[Time delta fro
m previous captured
frame: 0.109002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.10900200
0 seconds]
[Time since ref
erence or first fra
me: 5.877230000 sec
onds]
Frame Number: 1
59
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]

Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1c8 (61896)
Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a62 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 94046, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 94046 (relativ
e sequence number)
[Next sequence
number: 95306 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t

.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4e7
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2507]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 c8 4
0 00 31 06 3a 62 4a
7c 0c 8a c0 a8 .
...@.1.:bJ|....
0020 01 0b 00 50 c
1 a6 2b c9 d1 8b 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 4e 71 0
0 00 40 23 c4 4b 21
31 c6 f8 c9 9c .
.Nq..@#.K!1....
0040 ec 30 e4 2b 9
a 7e 12 90 54 c9 62
f2 c8 d9 58 71 .
0.+.~..T.b...Xq
0050 2c 43 b5 1f d
9 33 ad 1a 8d d5 f6
40 d0 65 33 54 ,
C...3.....@.e3T
0060 0e 00 31 4b 8
0 d2 31 89 00 9d 84

c4 2b 42 5c 48 .
.1K..1.....+B\H
0070 b6 47 6f 3a f
9 72 bb fc a0 5c e8
b2 94 60 13 0f .
Go:.r...\...`..
0080 c2 36 bd 8a 5
3 05 ac ba 55 ed df
4b ff fb 92 04 .
6..S...U..K....
0090 ed 0f f3 33 4
2 58 81 ef 1a e2 5f
83 eb 10 3d e6 .
..3BX...._...=.
00a0 4a 4c 04 8d 5
e 0c 3d 09 41 76 8e
6b c0 f7 a5 28 J
L..^.=.Av.k...(
00b0 75 fa 93 10 2
f 52 01 ae 62 12 ad
e7 ad d8 2a a9 u
.../R..b.....*.
00c0 cb 73 d0 48 3
2 a4 4b 07 23 26 44
10 d8 9c d4 0a .
s.H2.K.#&D.....
00d0 be 62 90 e4 b
a 5f bc d9 83 41 b3
53 17 aa 4d 8e .
b..._...A.S..M.
00e0 aa 32 93 6f f
c ac 90 52 2c e5 b6
15 37 25 20 57 .
2.o...R,...7% W
00f0 6c e9 eb 43 8
d f1 03 37 d7 d6 6b
ef 5d 63 c2 de l
..C...7..k.]c..
0100 a4 d4 fb 9d 7
3 42 a4 05 ae bd 9a
c1 57 b5 b7 fd .
...sB......W...
0110 7f 77 a7 fe c
a 9a 10 08 93 a7 c0
7a 26 c7 83 c5 .
w.........z&...
0120 ae 14 3d 0a 0
6 d2 1d 51 d1 b2 82
66 a6 7e 30 6a .
.=....Q...f.~0j
0130 94 bf 0d d9 c
4 6c 10 c5 34 39 49
20 a4 70 99 dd .
....l..49I .p..
0140 19 66 45 06 b
e c6 17 0a 8f 74 08
dc 2e 14 4b cf .
fE......t....K.
0150 75 ce 90 10 e
6 68 76 f6 37 7c bd
63 99 68 bd 2d u
....hv.7|.c.h.0160 de 3c bc 50 0
8 2c b0 e9 31 12 ce
20 73 d8 be 3b .
<.P.,..1.. s..;
0170 47 dd 4a 9a 7
8 30 e7 31 8b 14 c5
c1 e5 a9 ab da G

.J.x0.1........
0180 0a 1b 0e 7f 0
b de 40 64 23 2f fc
3b 7c 37 6f c2 .
.....@d#/.;|7o.
0190 7f 42 13 d1 f
4 73 21 ca f8 d5 51
29 b9 f8 7f e0 .
B...s!...Q)....
01a0 89 be f2 10 f
6 4d bc ef e5 80 99
90 ba 4f a8 04 .
....M.......O..
01b0 f2 76 bf 2a f
3 db 5d 93 37 d4 b3
fe d7 1f c3 c6 .
v.*..].7.......
01c0 2d f5 bf 8d 7
a 67 1e 16 2c 5d c8
3d 65 4b 20 be ...zg..,].=eK .
01d0 ff d3 ff ff a
2 48 d0 a8 a1 30 66
a8 91 88 18 23 .
....H...0f....#
01e0 0e ad 6b 48 1
a 22 4a 94 62 23 27
60 f0 54 d2 01 .
.kH."J.b#'`.T..
01f0 55 70 74 9f 8
7 12 a3 0b 7a d9 a4
b6 02 8a d3 31 U
pt.....z......1
0200 b2 83 f1 70 c
e 3d ab ed 75 e5 44
5b c2 51 e6 36 .
..p.=..u.D[.Q.6
0210 e1 bd ac ab 0
8 06 ef 68 6c f1 24
6c f9 d5 e7 f8 .
......hl.$l....
0220 54 a8 7d f3 0
f 25 08 8a 25 c1 a2
6d 2b 75 ff fb T
.}..%..%..m+u..
0230 92 04 ea 0f f
2 c2 23 55 03 38 4a
50 63 05 4a a0 .
.....#U.8JPc.J.
0240 63 0f 4c 0b c
0 97 52 0c e1 89 41
86 15 ea 41 8c c
.L...R...A...A.
0250 3d 30 68 4e d
9 2b af b2 a4 b5 10
02 0b 9c 84 21 =
0hN.+.........!
0260 52 91 5d 93 3
b 25 bd 63 8e 32 0c
15 10 51 74 b6 R
.].;%.c.2...Qt.
0270 8d 25 38 5d 0
f 92 d0 68 6b 1e 32
da 4b 69 77 6e .
%8]...hk.2.Kiwn
0280 1f 5c 70 f4 e
5 b6 14 c3 73 dc 13
08 67 b9 ca da .
\p.....s...g...

0290 75 45 83 68 c
8 0c ed 06 e0 ba f5
50 b7 c6 b5 b5 u
E.h.......P....
02a0 2d a5 9f e6 a
d 3e 3d e3 eb df 11
bc 2f 1d ad 3b ....>=...../..;
02b0 0c 5e b8 a3 6
a dc f7 3f 10 a5 e1
88 18 64 5d 81 .
^..j..?.....d].
02c0 04 93 8b 2d c
3 4f 67 48 e6 e7 2c
b2 51 23 82 26 .
..-.OgH..,.Q#.&
02d0 cb 0f 8f bd 2
3 74 a0 88 4f 41 ae
1b 66 93 ca 6c .
...#t..OA..f..l
02e0 72 09 5a d1 b
9 89 4b d0 ff d7 ce
6e 6a 2f 97 6f r
.Z...K....nj/.o
02f0 46 7a 0c 09 4
7 47 9c 78 03 01 10
bd 85 04 46 e7 F
z..GG.x......F.
0300 bb 25 55 c5 1
0 9a 62 1f ba 3a 8e
56 8a 51 16 94 .
%U...b..:.V.Q..
0310 ce a7 4c be b
4 ba d4 8a 2e c2 59
89 af 34 51 01 .
.L.......Y..4Q.
0320 34 f2 40 11 a
1 93 a5 8f 32 a8 a2
f0 f2 eb b6 bb 4
.@.....2.......
0330 a6 07 16 bb d
4 9b 29 3a a7 6f cb
dc d9 61 73 8c .
.....):.o...as.
0340 85 a9 45 60 2
c 5a a2 e2 97 64 c8
ce 13 c9 7b 50 .
.E`,Z...d....{P
0350 7e ea 13 8a 4
d 51 b8 e8 6c ab bc
c2 3d 1d cf dc ~
...MQ..l...=...
0360 26 ce b5 17 7
e 13 96 6b 0b 79 f5
b6 3c 3c 4b 6c &
...~..k.y..<<Kl
0370 d6 23 85 49 1
5 bd 0a 39 d8 ba 1c
08 7a 63 23 b2 .
#.I...9....zc#.
0380 f2 8a 00 65 0
9 1e 88 84 27 14 64
a5 9a 2a d1 8e .
..e....'.d..*..
0390 d1 c3 eb d4 4
2 9b 32 88 c2 64 35
48 75 c4 ad 66 .
...B.2..d5Hu..f
03a0 9a 5a 90 13 9

5 eb c1 4e 7d fc fb
83 f7 3b 84 14 .
Z.....N}....;..
03b0 ff 5b 27 36 1
f 15 eb 40 83 82 9b
49 1e 13 49 7c .
['6...@...I..I|
03c0 4d 7f 1c 2c 8
c f7 9a 9f 77 36 d2
87 fb 4b cf 3f M
..,....w6...K.?
03d0 ff fb 92 04 e
b 8f f2 fc 25 d4 83
58 7a 50 60 a5 .
.......%..XzP`.
03e0 3a 80 67 0f 4
c 0b e0 d5 52 0d 60
eb 81 85 95 ea :
.g.L...R.`.....
03f0 01 9c bd 30 a
c f1 f9 fd ff 5b 6f
f7 b5 8b 62 52 .
..0.....[o...bR
0400 30 00 52 22 e
6 1a 42 84 1e 59 84
fa 86 99 fb f4 0
.R"..B..Y......
0410 ee a6 83 d4 2
e 26 ad 6d 68 2b 55
35 3a 59 38 09 .
....&.mh+U5:Y8.
0420 1f 5d dc 99 9
3 d1 d8 57 94 58 59
82 93 ab 3b b9 .
].....W.XY...;.
0430 b6 18 02 5d 8
4 91 d6 9e 5c 60 0a
92 78 27 d0 24 .
..]....\`..x'.$
0440 3e 03 33 43 c
c 3a b4 d4 36 b2 0c
ff 4f 6f 4f a9 >
.3C.:..6...OoO.
0450 6a 1c 3b 83 e
e af 65 76 ff be 38
55 be 56 f1 65 j
.;...ev..8U.V.e
0460 e6 18 60 e5 2
d 1a 7c 77 14 a4 31
40 55 10 07 10 .
.`.-.|w..1@U...
0470 58 17 e5 97 0
c 69 08 4b 20 e2 33
30 ba a1 cb 92 X
....i.K .30....
0480 05 7c 99 15 d
d ba b6 37 4c 98 b1
4d 61 5d 3a ac .
|.....7L..Ma]:.
0490 ef b2 88 5c f
e 1a 81 7a 1c 80 18
0a 1a 36 41 70 .
..\...z.....6Ap
04a0 8e 71 ea 50 8
0 29 9b e9 0b 56 1d
1f b8 c1 46 be .
q.P.)...V....F.
04b0 c7 e2 9f 7c 1
a 77 cc d7 df df f9

63 ec ef f4 3f .
..|.w.....c...?
04c0 e6 1b 87 21 0
a 72 62 07 36 93 32
16 02 c6 73 59 .
..!.rb.6.2...sY
04d0 6e d8 f0 83 a
f f3 28 6f 09 78 d8
b2 95 25 2d 57 n
.....(o.x...%-W
04e0 6e 0a 91 6e 0
8 64 70 9d 5e 9b 55
d8 e7 b8 c2 ad n
..n.dp.^.U.....
04f0 81 79 5a 7b c
9 41 60 49 24 9a e1
e0 bc a8 bd 40 .
yZ{.A`I$......@
0500 e1 bb de 79 6
c fc 75 94 a1 e8 45
7b 1d ab 4e be .
..yl.u...E{..N.
0510 52 af d4 b8 e
b aa ff 42 be 9a 04
06 01 6c 3f 81 R
......B.....l?.
0520 31 8f
1
.
No. Time
Source
Destination
Protocol
Length Info
160 5.877405000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=95306 Win=38745 Le
n=0
Frame 160: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
8.927335000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615218.927335000 s
econds
[Time delta fro
m previous captured

frame: 0.000175000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 5.877405000 sec
onds]
Frame Number: 1
60
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: pc13

.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f54 (20308)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 95306
, Len: 0

Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 95306 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38745
[Calculated win
dow size: 38745]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 159]
[The RTT to

ACK the segment wa

s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 54 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OT@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 d6 77 50 10 .
....P..N.+..wP.
0030 97 59 18 d4 0
0 00
.
Y....
No. Time
Source
Destination
Protocol
Length Info
161 5.950234000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=95306
Ack=1 Win=46 Len=1
260
Frame 161: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.000164000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.000164000 s
econds
[Time delta fro
m previous captured
frame: 0.072829000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07282900
0 seconds]
[Time since ref
erence or first fra
me: 5.950234000 sec
onds]

Frame Number: 1
61
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes

Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1c9 (61897)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a61 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 95306, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]

Sequence number
: 95306 (relativ
e sequence number)
[Next sequence
number: 96566 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x7ee
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 c9 4

0 00 31 06 3a 61 4a
7c 0c 8a c0 a8 .
...@.1.:aJ|....
0020 01 0b 00 50 c
1 a6 2b c9 d6 77 9e
87 4e aa 50 10 .
..P..+..w..N.P.
0030 00 2e 7e ec 0
0 00 be c0 b7 d8 5f
86 28 4d 3a 90 .
.~......._.(M:.
0040 bf a5 55 89 8
9 15 2f 17 70 34 98
bd 3c e2 5e b3 .
.U.../.p4..<.^.
0050 ea 76 c1 28 e
6 30 48 d0 d6 e8 71
c6 41 45 a3 00 .
v.(.0H...q.AE..
0060 e0 d8 d6 ab 0
c 6f 57 c9 fb 6f 07
07 f2 9a b6 f8 .
....oW..o......
0070 84 44 a1 97 4
d 97 cc ee 9e 74 a6
ae d2 7f e7 2d .
D..M....t.....0080 d3 d9 93 d3 3
2 f2 ff fb 92 04 ea
0f f3 0f 35 54 .
...2.........5T
0090 03 38 4a e0 5
f a6 8a 70 67 0b 5c
0b f4 d1 4e 0d .
8J._..pg.\...N.
00a0 61 0b 81 69 9
a 69 c1 9c 2d 70 c2
28 34 c2 9f 3d a
..i.i..-p.(4..=
00b0 f7 a0 28 0a 2
8 04 a0 e5 92 1e a3
f9 43 0d 72 01 .
.(.(.......C.r.
00c0 d8 e1 98 4b 5
3 39 29 d4 68 a8 15
0c 31 b7 29 f5 .
..KS9).h...1.).
00d0 4f 55 58 e0 3
d 15 ac 46 0b d5 0b
bd 8d 54 b0 b7 O
UX.=..F.....T..
00e0 d6 61 d8 1d 8
9 ba e4 97 44 5c 36
b9 b3 e2 c9 28 .
a......D\6....(
00f0 10 56 db 91 e
9 14 1c 33 96 3d 34
ff 5f c3 6b fb .
V.....3.=4._.k.
0100 bc 7c 47 dd f
5 e0 ea b8 fa 89 5a
8c 91 78 19 49 .
|G.......Z..x.I
0110 6f 62 f4 96 c
0 2e 28 76 00 63 e1
2a cd 70 38 73 o
b....(v.c.*.p8s
0120 be 22 2e bb 2
d a7 30 aa 8a d0 30

48 5a 7e 06 1f .
"..-.0...0HZ~..
0130 2a 94 69 a5 6
9 3c 9e 39 24 e6 14
8a d3 72 55 7b *
.i.i<.9$....rU{
0140 04 19 8b f5 d
9 9c ac 69 eb d1 ac
d4 a9 2d 8a 59 .
......i.....-.Y
0150 f9 fc 57 2f b
b b5 21 3d da fd 77
58 b8 fe b5 d6 .
.W/..!=..wX....
0160 33 4f 5f a8 f
e 91 f7 5f 8b 39 7c
7c c1 e5 5e 85 3
O_...._.9||..^.
0170 2d be bd 3f e
9 2e 01 94 e0 81 0c
d1 39 c5 18 f4 ..?........9...
0180 33 74 a6 72 a
1 40 d2 c6 47 6b 00
12 e6 d6 00 9e 3
t.r.@..Gk......
0190 17 99 81 c2 5
f a5 f2 d0 5e b9 54
e5 46 c4 50 2c .
..._...^.T.F.P,
01a0 a2 1a bd 83 a
5 49 f0 44 18 66 b8
ef 93 95 85 e4 .
....I.D.f......
01b0 00 f8 83 bc a
1 e7 d2 e5 ca 11 f9
99 37 1e 7f a8 .
...........7...
01c0 34 fe 5c 67 5
2 3b c7 dd 73 e9 0b
15 f8 d3 a0 a2 4
.\gR;..s.......
01d0 8d 83 63 91 2
0 46 9d 35 61 46 58
09 b9 90 04 16 .
.c. F.5aFX.....
01e0 36 64 1a d9 6
1 15 10 a1 69 54 da
90 85 13 65 97 6
d..a...iT....e.
01f0 42 17 92 85 4
7 e1 f9 a4 d1 6c 29
75 49 5d e4 ca B
...G....l)uI]..
0200 ab 07 bb 20 c
6 b3 0e 83 ea cb 5c
3a 5c 73 82 a1 .
.. ......\:\s..
0210 2f c2 43 f8 9
4 d6 b2 62 04 0a e9
ca a4 25 a3 ec /
.C....b.....%..
0220 33 6b 39 56 7
5 53 87 32 ff fb 92
04 eb 0f f2 fe 3
k9VuS.2........
0230 2e d3 83 39 6
2 60 61 65 8a 70 67
0f 4c 0c 3c bd .

..9b`ae.pg.L.<.
0240 4e 0d 61 e9 8
1 89 96 29 c1 8c bd
30 63 52 bf ca N
.a....)...0cR..
0250 cd 3e b8 ae f
9 ff a9 3b 7e 55 b4
4a 87 8a 34 e0 .
>.....;~U.J..4.
0260 ae c1 cd 1e 3
b 2d 8f 31 77 1a 22
59 c0 bd 51 82 .
...;-.1w."Y..Q.
0270 18 6a 65 50 1
e cf 33 0b 84 27 ab
03 6a 72 87 dd .
jeP..3..'..jr..
0280 bc ca a2 ef b
b 26 e6 4d d2 8b a5
20 94 62 64 f7 .
....&.M... .bd.
0290 0e 4e 98 11 0
9 88 dc 87 90 6c c5
ee 1b c7 b3 96 .
N.......l......
02a0 81 ce 4d ab e
6 3d ed 86 31 d5 72
ab 5f e7 93 62 .
.M..=..1.r._..b
02b0 12 30 a1 0c 2
8 30 09 b2 61 f2 e1
d4 b0 50 32 27 .
0..(0..a....P2'
02c0 83 15 53 e6 4
b eb 09 4a 85 e5 53
52 65 90 cb 9a .
.S.K..J..SRe...
02d0 d8 99 77 65 1
2 94 52 6c 29 c1 43
38 e6 e1 0d c0 .
.we..Rl).C8....
02e0 14 d2 5d d0 a
d 38 3f 50 10 89 e3
4e dd 1d 1b 73 .
.]..8?P...N...s
02f0 f2 3c 19 ae 8
5 13 78 39 d7 5d b1
52 04 db be ed .
<....x9.].R....
0300 fe 27 df 97 7
8 b7 9e de 04 2d 7f
ea ff c5 45 cc .
'..x....-....E.
0310 22 80 2b fc 5
3 6f f5 27 aa 1e 87
5e 3d 82 39 a1 "
.+.So.'...^=.9.
0320 35 68 bf e1 5
b c6 80 96 00 86 21
cc a1 40 a8 11 5
h..[.....!..@..
0330 04 43 3e 40 9
0 cb 67 4b cc a3 ea
59 25 7a 5d da .
C>@..gK...Y%z].
0340 b0 53 58 b9 7
b f4 2a 04 87 27 c2
c8 13 7b 8c d4 .
SX.{.*..'...{..

0350 2d 19 6e aa b
d c2 6e a6 7a fe 5d
27 28 a2 c4 99 .n...n.z.]'(...
0360 b6 a6 bf fa 8
5 fd 2d 9b 78 f6 dc
95 85 fe 64 8b .
.....-.x.....d.
0370 99 31 61 74 1
0 b9 ff 7a d5 4c c1
ab 48 15 1a 24 .
1at...z.L..H..$
0380 27 e1 0f 6c 0
6 18 37 98 7d 63 45
b5 25 dc 4d 9d '
..l..7.}cE.%.M.
0390 4f 90 8c 1c 6
b 30 8b 68 a3 34 d0
7e 00 96 e9 c9 O
...k0.h.4.~....
03a0 4a 1e bb ff 3
6 9c ad 4e e9 b8 fc
6a 4c 63 c9 1c J
...6..N...jLc..
03b0 0d 82 73 af c
8 42 73 5b 59 02 3a
da 6d 2c 29 56 .
.s..Bs[Y.:.m,)V
03c0 63 91 d1 f0 f
9 7f 6f b7 2b 3f ff
fb 92 04 e7 0f c
.....o.+?......
03d0 f2 f9 35 53 8
3 58 5a e0 59 c5 9a
80 63 0b 4c 0c .
.5S.XZ.Y...c.L.
03e0 48 b3 4e 0c e
5 e9 81 84 96 69 c1
9c bd 30 a4 95 H
.N......i...0..
03f0 fe 83 c3 cb a
9 1f 5b e9 53 c5 ce
31 01 5c 00 24 .
.....[.S..1.\.$
0400 98 da ba 81 0
e 2d 18 0b f4 04 44
b1 e8 d1 ad 5a .
....-....D....Z
0410 28 48 49 8c 1
4 0d 08 b6 b9 5e 97
46 f4 95 a9 d5 (
HI......^.F....
0420 66 0c 3e 41 0
a d7 1c 5a 7e 4c 85
07 a5 54 75 c2 f
.>A...Z~L...Tu.
0430 14 b4 d8 b9 1
f ed b7 ec 08 8f 5a
1d 69 f8 9a 66 .
.........Z.i..f
0440 fa 89 07 db e
e 35 fd e1 fa 6a 98
f7 a4 7f fb a8 .
....5...j......
0450 16 8b 1c 19 c
f 7c 78 88 41 9f 46
67 22 98 02 61 .
....|x.A.Fg"..a
0460 40 46 18 18 d

0 b1 21 06 94 32 23
43 65 b2 24 48 @
F....!..2#Ce.$H
0470 f1 e2 8d fa c
9 09 c4 6a 1d 97 26
33 e1 0e d6 68 .
......j..&3...h
0480 92 0c 24 69 c
3 3b 63 5c 18 14 6a
e2 a0 4e d9 dc .
.$i.;c\..j..N..
0490 ab 04 f0 9b 0
c 2a 0a d3 6a ef 8d
62 75 cb 35 da .
....*..j..bu.5.
04a0 fd 20 49 bd f
8 0c 7f 16 8d 9f 8a
ef fd ff fd 2f .
I............/
04b0 bf f3 1d 6e 5
5 06 be bf fd 68 20
0b 12 63 0e 2a .
..nU....h ..c.*
04c0 30 42 0a cf 1
a 65 07 8a 01 89 52
a4 70 ce e8 b2 0
B...e....R.p...
04d0 5e 77 5e 10 6
e 03 27 ed a7 39 85
c2 be 20 df 54 ^
w^.n.'..9... .T
04e0 70 9c 68 5c a
3 5d 4c a9 76 37 12
31 13 3f 30 d8 p
.h\.]L.v7.1.?0.
04f0 52 3b 5e 4c 1
9 11 b5 b7 22 1b ad
58 fc 61 4b d6 R
;^L...."..X.aK.
0500 0e af b8 5f 7
f 10 b1 e0 40 ff c3
fa a6 31 fe 2b .
.._....@....1.+
0510 07 51 61 fb c
5 bd 3d 4a 4b 70 c6
06 89 c8 64 62 .
Qa...=JKp....db
0520 2c 20
,
No. Time
Source
Destination
Protocol
Length Info
162 6.018238000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=96566
Ack=1 Win=46 Len=1
260
Frame 162: 1314 byt
es on wire (10512 b

its), 1314 bytes ca

ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.068168000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.068168000 s
econds
[Time delta fro
m previous captured
frame: 0.068004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06800400
0 seconds]
[Time since ref
erence or first fra
me: 6.018238000 sec
onds]
Frame Number: 1
62
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ca (61898)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum

: 0x3a60 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 96566, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 96566 (relativ
e sequence number)
[Next sequence
number: 97826 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4d9
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ca 4
0 00 31 06 3a 60 4a
7c 0c 8a c0 a8 .
...@.1.:`J|....
0020 01 0b 00 50 c
1 a6 2b c9 db 63 9e
87 4e aa 50 10 .
..P..+..c..N.P.
0030 00 2e 4d 91 0
0 00 85 86 0c 42 32
98 88 e2 c1 5d .
.M......B2....]
0040 56 1a 96 a5 6
f 57 18 28 a0 01 31
39 3d e4 65 59 V
...oW.(..19=.eY
0050 10 b9 e6 7c f
9 60 e8 ba b6 25 3f
10 6e 73 97 98 .
..|.`...%?.ns..
0060 40 44 e8 de 9
a 64 a0 d6 47 0a f5
65 8f 45 4e 4e @
D...d..G..e.ENN
0070 28 1d 39 51 d
b 66 44 95 48 22 83
29 6e b3 8f d3 (
.9Q.fD.H".)n...
0080 ff fb 92 04 e
7 8f f2 d8 2e d3 83
38 5a 60 5e a5 .
..........8Z`^.
0090 9a 70 67 2f 4
c 0c 58 bb 4e 0d 61
e9 81 78 16 69 .
pg/L.X.N.a..x.i
00a0 c1 9c bd 30 2
e 9b 48 31 17 29 ae
d5 56 6d a5 83 .

..0..H1.)..Vm..
00b0 42 8f 25 31 6
0 1d 45 2c 66 ca 06
63 30 94 04 8a B
.%1`.E,f..c0...
00c0 d0 0e 67 38 0
a 02 06 78 86 87 b3
2a aa ce 54 3d .
.g8...x...*..T=
00d0 6e 66 f5 5f c
e ab ab 14 bd 9e 0c
c2 73 04 81 84 n
f._........s...
00e0 05 e2 b4 46 6
2 29 78 88 3d c6 59
8a 08 91 51 53 .
..Fb)x.=.Y...QS
00f0 98 10 4f bb 1
2 35 99 3b 6b 1b d4
e6 66 bc ad a6 .
.O..5.;k...f...
0100 4c dc 92 6a c
e 12 95 57 f6 d4 08
0c 42 49 98 00 L
..j...W....BI..
0110 dc 60 63 cc f
0 03 80 a7 32 b6 4e
57 79 97 a8 b9 .
`c.....2.NWy...
0120 43 72 c9 c6 1
d f1 b1 ce a7 24 08
20 21 04 eb 53 C
r.......$. !..S
0130 c3 6d ee 17 e
e e1 3d da 64 13 db
c6 1b 79 0e 4b .
m....=.d....y.K
0140 f3 d6 0b 29 8
2 f5 58 e7 e0 28 9e
6b 3b 94 de 75 .
..)..X..(.k;..u
0150 57 3f 02 97 8
9 9d a9 52 be 4c 35
3c f8 bc f2 cf W
?.....R.L5<....
0160 bf fc 19 1c 9
3 64 21 85 0e 6f 74
d4 54 18 0c 58 .
....d!..ot.T..X
0170 8b 06 30 e8 5
a 10 a9 46 b1 1e 33
99 12 d6 1e 6c .
.0.Z..F..3....l
0180 23 b0 52 ec 2
0 db f0 dc cb c5 0c
48 67 99 12 db #
.R. ......Hg...
0190 26 01 f1 2d d
8 78 28 a2 b6 9f 01
ab 7b 88 e8 c0 &
..-.x(.....{...
01a0 9e 69 ba f0 3
f a8 ba 2d 4d 18 f5
a3 06 29 56 ab .
i..?..-M....)V.
01b0 ab 37 a5 77 c
6 ab 4f db d3 7f e6
04 9f 35 9c a1 .
7.w..O......5..

01c0 ce 84 2c 61 c
9 f3 9f 6d 7a ea 42
40 06 21 89 74 .
.,a...mz.B@.!.t
01d0 50 bc 99 d0 8
5 0d 3b 36 31 e2 88
87 66 a2 c5 53 P
.....;61...f..S
01e0 94 78 40 28 7
0 b0 13 73 22 f3 93
8b 49 60 27 b2 .
x@(p..s"...I`'.
01f0 9d a5 af 66 5
d 7a 03 ac bc d1 eb
3d d4 8f d3 5f .
..f]z.....=..._
0200 f9 6b a9 88 f
0 64 0a 6f 90 58 85
61 fc c4 13 4e .
k...d.o.X.a...N
0210 b8 c1 8a 4b 2
6 f1 b8 40 4a 47 50
63 6c d9 ca a7 .
..K&..@JGPcl...
0220 c7 a4 ff fb 9
2 04 e9 0f f2 ee 2c
53 83 58 6a 60 .
.........,S.Xj`
0230 5c 25 8a 70 6
b 2d 4c 0c 5c af 4c
0c e9 e9 81 72 \
%.pk-L.\.L....r
0240 13 e9 81 ad 3
d 28 ca fa 85 f8 8f
fe 9c 73 e6 ea .
...=(.......s..
0250 2e 61 82 61 c
a 50 5c 35 c2 06 0d
48 ad 00 9d c2 .
a.a.P\5...H....
0260 12 89 b5 22 0
8 a3 c7 c0 c8 36 dc
05 ac 4b e8 72 .
..".....6...K.r
0270 6e 0b 02 8c 1
7 1b 07 38 a3 cf a6
30 1d 67 fd dc n
......8...0.g..
0280 a7 c5 a8 17 0
d cb 3f 99 75 53 1b
63 99 57 7a a2 .
.....?.uS.c.Wz.
0290 9c 69 b6 a4 d
d a2 ce 94 fe d2 6f
f3 d5 05 9b 3f .
i........o....?
02a0 92 95 f0 b1 4
8 d8 c7 ce 21 1c 51
05 ab 18 db ed .
...H...!.Q.....
02b0 51 da 01 0c 0
5 2d 30 f8 4d b1 2a
16 22 85 a7 38 Q
....-0.M.*."..8
02c0 cb b2 6c 95 9
c 54 aa d6 ac b2 27
25 09 b0 c4 69 .
.l..T....'%...i
02d0 ac ac 78 8c 6

2 3c fb e1 2d 5e 4e
dc 03 10 81 d9 .
.x.b<..-^N.....
02e0 4b 25 9a a0 8
0 3a 24 7c 43 c4 3a
2b 71 c7 56 90 K
%...:$|C.:+q.V.
02f0 98 d9 55 0c 0
b 2d b0 67 cb 7d 99
25 b4 9a 95 b3 .
.U..-.g.}.%....
0300 09 41 95 b0 f
2 10 b1 0b f8 b0 9f
65 fd 8a 0b 30 .
A.........e...0
0310 60 a0 56 2b 2
2 82 a6 ea bb 5e 66
ae b1 59 99 71 `
.V+"....^f..Y.q
0320 57 63 c3 46 b
8 d3 48 2c bb e4 f7
41 6d fa f9 68 W
c.F..H,...Am..h
0330 14 11 29 6c 6
5 de af 01 c4 25 cd
ad 25 04 42 22 .
.)le....%..%.B"
0340 50 30 66 ae 9
b 2c 38 32 1d 15 c1
ae 2c f7 f1 52 P
0f..,82....,..R
0350 f3 d6 9e ee 8
7 df bc b8 6d 16 51
ad 8a 6b 4a dd .
.......m.Q..kJ.
0360 cb 4f 52 3e d
d 4e 43 39 4e ff f4
55 10 58 05 7a .
OR>.NC9N..U.X.z
0370 4a 88 88 42 4
a 43 9b 27 2e 83 82
e4 19 c0 cb 3c J
..BJC.'.......<
0380 c2 d5 b8 e4 f
b ad 35 30 aa d0 e5
6a 9d 8d 30 a6 .
.....50...j..0.
0390 89 3c 18 5c 0
a d5 e2 e1 6f 87 35
22 ae 6f 14 8c .
<.\....o.5".o..
03a0 b7 ff 73 33 8
d 65 cf d4 31 27 42
4e 81 70 48 5d .
.s3.e..1'BN.pH]
03b0 0e 6b d4 f1 c
1 1c 54 d1 fd e8 a9
30 42 ff 42 93 .
k....T....0B.B.
03c0 90 c8 ff fb f
f fb 92 04 eb 0f f3
10 34 53 83 58 .
...........4S.X
03d0 5a e0 62 45 7
a 60 67 4f 4c 0b 78
a5 54 0c e1 29 Z
.bEz`gOL.x.T..)
03e0 81 74 96 2a 8
1 8c 31 30 57 bf 0f

92 19 3d 8b 9e .
t.*..10W....=..
03f0 cf 99 e3 91 2
8 7f 13 ba 1c 4a b3
88 39 8e b8 ba .
...(....J..9...
0400 e4 7a a1 b6 5
9 72 c6 ac 61 67 70
bb c8 d0 14 3e .
z..Yr..agp....>
0410 bc fd a7 ef 4
0 f3 ac b0 e0 c1 f8
df 2b 8f f9 0a .
...@.......+...
0420 b6 d8 a5 fe 0
8 a6 f7 d3 b7 d6 42
7f b7 cb b0 e6 .
.........B.....
0430 af 7f 16 28 0
4 10 08 04 43 c3 83
01 f3 02 01 85 .
..(....C.......
0440 d8 17 7f ff 8
c 11 b0 1c 41 96 1c
82 58 e7 0f 04 .
.......A...X...
0450 e0 07 a4 b3 3
0 ed 1e e7 98 ef 8f
00 d4 7f 1d 36 .
...0..........6
0460 bd 35 de a2 5
8 de 3c b2 60 24 b7
00 85 e3 81 90 .
5..X.<.`$......
0470 2a 8e 98 e3 3
2 2d 88 56 44 e9 d3
65 eb ce 32 bc *
...2-.VD..e..2.
0480 88 56 8f 74 2
0 4a d7 af 11 cf 92
50 06 8c ce ac .
V.t J.....P....
0490 3b 76 2f c2 3
e 00 67 a0 15 6d 72
da bf f1 57 f5 ;
v/.>.g..mr...W.
04a0 a0 3f fb db 7
f e9 c3 be df f8 33
99 62 4e 6c 80 .
?........3.bNl.
04b0 30 38 4b e7 3
3 d0 d1 be 71 38 ae
05 dc 79 2b ce 0
8K.3...q8...y+.
04c0 2d 95 8d ea 7
8 eb a4 cc 47 a8 96
f5 84 66 17 47 ...x...G....f.G
04d0 83 f5 6b c7 3
6 26 88 d2 8d 50 e2
35 8d 30 e5 53 .
.k.6&...P.5.0.S
04e0 61 0b 99 91 b
e b5 59 55 65 4c 54
d5 42 84 87 50 a
.....YUeLT.B..P
04f0 ba 7b 71 c5 a
8 54 15 30 c0 75 d3
01 53 10 ca 5b .

{q..T.0.u..S..[
0500 96 19 50 ad 0
e 80 01 76 74 10 d2
fb c6 f6 79 fb .
.P....vt.....y.
0510 95 d4 e5 aa 0
f d5 18 99 9a 81 74
1b 65 be e1 0b .
.........t.e...
0520 57 54
W
T
No. Time
Source
Destination
Protocol
Length Info
163 6.018421000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=97826 Win=38745 Le
n=0
Frame 163: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.068351000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.068351000 s
econds
[Time delta fro
m previous captured
frame: 0.000183000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018300
0 seconds]
[Time since ref
erence or first fra
me: 6.018421000 sec
onds]
Frame Number: 1
63
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)

[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f55 (20309)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 97826
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 97826 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001

0000 = Flags: 0x010

(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38745
[Calculated win
dow size: 38745]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 162]
[The RTT to
ACK the segment wa
s: 0.000183000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 55 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OU@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 e0 4f 50 10 .
....P..N.+..OP.
0030 97 59 18 d4 0

0 00
.
Y....
No. Time
Source
Destination
Protocol
Length Info
164 6.024231000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
459 http49
574 [PSH, ACK] Seq=
97826 Ack=1 Win=46
Len=405
Frame 164: 459 byte
s on wire (3672 bit
s), 459 bytes captu
red (3672 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.074161000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.074161000 s
econds
[Time delta fro
m previous captured
frame: 0.005810000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00581000
0 seconds]
[Time since ref
erence or first fra
me: 6.024231000 sec
onds]
Frame Number: 1
64
Frame Length: 4
59 bytes (3672 bits
)
Capture Length:
459 bytes (3672 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4

45
Identification:
0xf1cb (61899)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3db6 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 97826, Ack: 1
, Len: 405
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 405]
Sequence number
: 97826 (relativ
e sequence number)
[Next sequence
number: 98231 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x6dd
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 405]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 bd f1 cb 4
0 00 31 06 3d b6 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b c9 e0 4f 9e
87 4e aa 50 18 .
..P..+..O..N.P.
0030 00 2e 6d d6 0
0 00 4a 2d af 0e 2d
01 eb 6c 51 2e .
.m...J-..-..lQ.
0040 6c b8 8d 8d 6
c ef 1a 81 31 ee 48
d6 ae dd 92 07 l
...l...1.H.....
0050 e9 91 dd 55 f
c e3 dd 6c f1 73 32

ff fa da d7 fe .
..U...l.s2.....
0060 1f ad ed 1e e
a 57 2d 3e ec fe f6
fe 49 75 7e 07 .
....W->....Iu~.
0070 39 e2 8a 61 e
d a1 7e 79 c7 f8 ff
fb 92 04 eb 0f 9
..a..~y........
0080 f2 d9 25 56 0
3 2f 4a 50 59 e5 1b
00 61 ec 4a 0c .
.%V./JPY...a.J.
0090 f0 89 5e 07 b
c c9 49 9a 94 ac 40
f7 a5 30 1b 73 .
.^...I...@..0.s
00a0 fe 9f 49 58 0
6 7d ef 01 83 14 b4
24 b5 20 81 ab .
.IX.}.....$. ..
00b0 3c 55 ca 17 d
7 44 ab ca 78 b1 a0
22 5e c2 80 d7 <
U...D..x.."^...
00c0 3c 58 d3 3b 8
5 67 ec f2 68 c3 47
6d b0 57 77 f5 <
X.;.g..h.Gm.Ww.
00d0 34 bd 4b f2 e
a 73 ce 3d f5 64 6f
6a 4a ff 8d 7f 4
.K..s.=.dojJ...
00e0 76 c4 8e fb 9
9 d7 3d 63 9b f7 fa
28 ff 8f bd 7b v
.....=c...(...{
00f0 64 6a 8b fc 9
b 13 e8 a8 57 7a bd
77 ef c0 fd 6d d
j......Wz.w...m
0100 e2 87 fb 2b 6
c e7 dc 4a 68 28 18
44 eb 2c 86 46 .
..+l..Jh(.D.,.F
0110 b0 51 84 ac 9
9 53 21 09 d3 5d 89
fc 83 ce 23 95 .
Q...S!..]....#.
0120 69 08 ea 8c 9
1 81 95 34 75 65 92
83 40 92 8b 40 i
......4ue..@..@
0130 ff 89 bc 55 b
c 6c a4 3c e9 0d 11
7d 54 5c 51 a6 .
..U.l.<...}T\Q.
0140 0f 2e 4a b6 0
e 6a 2a 86 96 0a a8
19 4b 09 28 24 .
.J..j*.....K.($
0150 05 69 91 50 9
8 0c 34 55 40 67 42
45 9a 0a 8c 0c .
i.P..4U@gBE....
0160 96 2d ed c5 9
a a2 6b 53 fa 42 43
70 7a c6 b0 7e .

-....kS.BCpz..~
0170 0f 30 cf 24 e
5 f0 65 2f 41 5e 82
16 6a 77 6a 62 .
0.$..e/A^..jwjb
0180 4d 57 2e c1 1
5 a9 c9 23 1a ca 68
ea d2 6e a1 0a M
W.....#..h..n..
0190 8c a6 c4 25 d
5 9a 53 59 ec de df
ea 76 e5 fe dd .
..%..SY....v...
01a0 16 ef 4e d6 1
7 1e 65 cd 1a eb 4f
85 6e b2 74 4a .
.N...e...O.n.tJ
01b0 0a 80 8e 9a 3
c 13 88 96 81 d2 4f
74 88 76 c6 11 .
...<.....Ot.v..
01c0 63 72 29 24 b
c 89 e9 9a 7b 05 51
c
r)$....{.Q
No. Time
Source
Destination
Protocol
Length Info
165 6.071237000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=98231
Ack=1 Win=46 Len=1
260
Frame 165: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.121167000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.121167000 s
econds
[Time delta fro
m previous captured
frame: 0.047006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04700600

0 seconds]
[Time since ref
erence or first fra
me: 6.071237000 sec
onds]
Frame Number: 1
65
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),

Dst: pc13.home (192

.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1cc (61900)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a5e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 98231, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por

t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 98231 (relativ
e sequence number)
[Next sequence
number: 99491 (r
elative sequence nu
mber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x234
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1665]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 cc 4
0 00 31 06 3a 5e 4a
7c 0c 8a c0 a8 .
...@.1.:^J|....
0020 01 0b 00 50 c
1 a6 2b c9 e1 e4 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 23 47 0
0 00 48 a5 e7 05 af
72 8c 03 4c 42 .
.#G..H....r..LB
0040 37 30 79 ef b
6 44 b0 30 08 f5 11
e4 77 86 a9 9d 7
0y..D.0....w...
0050 6e e8 97 16 b
d 28 93 10 4b 61 d4
cb 57 b4 3b 10 n
....(..Ka..W.;.
0060 ea 8a 44 cf 6
a 0b 22 8a 44 28 32
47 3a d9 b9 14 .
.D.j.".D(2G:...
0070 4a 1f cf 9d b
f ed 4c 6f d5 ed fa
f7 bb 29 66 35 J
.....Lo.....)f5
0080 67 1c 5b 3c 6
d 98 e8 ff fb 92 04
e8 0f f2 e2 1f g
.[<m...........
0090 59 81 ec 42 5
2 5f 64 7b 20 3d e6
4a 4c 58 8f 60 Y
..BR_d{ =.JLX.`
00a0 0c 3d 09 41 8
2 11 ac 00 f7 b1 28
54 62 4e af 4d .
=.A......(TbN.M
00b0 56 ff ea 24 a
0 c0 e0 21 2e 40 3c
ab 88 06 56 12 V
..$...!.@<...V.
00c0 15 bc 93 b2 e
1 10 88 ac e4 3a 8c
64 58 4e f4 3d .
........:.dXN.=
00d0 49 01 c5 1a 6
5 25 33 f5 33 39 1c
b3 68 94 1d 06 I
...e%3.39..h...
00e0 1c b0 55 02 3
a 15 8d 96 5c fc f7
bc e1 f7 32 53 .
.U.:...\.....2S
00f0 d1 d7 a6 f6 c
a ed 3d ca ac 0a 04
5f e2 e8 e4 5b .
.....=...._...[
0100 c6 73 8c de c
e ef ee d9 65 0d 2f
df f9 ff fd 06 .
s......e./.....
0110 22 65 06 71 1

c a2 83 51 8b 34 62
a0 d5 cd 80 59 "
e.q...Q.4b....Y
0120 6b c6 0c 09 2
d 96 71 50 29 c4 ac
af 7c 2d d5 86 k
...-.qP)...|-..
0130 e0 68 2d 8f 3
e 31 46 f6 4f 4f 2c
78 5b 97 76 1d .
h-.>1F.OO,x[.v.
0140 ee 36 c2 ee 1
3 8b da d1 69 e4 14
26 2a e1 53 32 .
6......i..&*.S2
0150 af 34 9e b1 2
d 1e 77 ba dc d4 d7
6a 83 6c da 97 .
4..-.w....j.l..
0160 d4 b5 c6 65 2
4 a2 82 e4 8a bc 48
86 3e 1d 3c e9 .
..e$.....H.>.<.
0170 44 57 58 89 a
1 8d 36 24 28 40 8c
03 70 be e5 86 D
WX...6$(@..p...
0180 e7 3b 38 aa 7
2 0a 85 8e 71 df 85
a6 18 26 2e ad .
;8.r...q....&..
0190 1c d5 46 cd 0
0 b5 c8 12 57 c7 e6
2c c1 0e 72 88 .
.F.....W..,..r.
01a0 86 62 a7 bb a
7 17 b6 36 37 05 c6
16 a2 3d 5c aa .
b.....67....=\.
01b0 b3 a7 f1 23 e
3 cf 8c 66 26 3e 2b
07 5e 92 ec 26 .
..#...f&>+.^..&
01c0 e1 41 1c 18 0
b 85 c5 cb ec 4b 54
c1 92 a7 5b f5 .
A.......KT...[.
01d0 2a 0b 21 1b 3
f a2 01 0a 6f a9 0f
19 c5 ac 83 47 *
.!.?...o......G
01e0 e2 61 9a 00 2
6 83 b6 7a 17 62 4d
26 88 3b 92 ac .
a..&..z.bM&.;..
01f0 21 6a da cc e
3 cc 8d f8 79 34 c4
95 49 b0 48 dd !
j......y4..I.H.
0200 da 39 65 0d e
9 20 5c b1 2d 28 2b
12 8e 86 6a 8f .
9e.. \.-(+...j.
0210 d0 04 22 e4 7
6 d5 2f 35 73 c6 21
f8 67 b1 a5 3f .
.".v./5s.!.g..?
0220 f4 da de 9f 3
5 61 74 fd 71 ff fb

92 04 e7 8f f2 .
...5at.q.......
0230 cf 2c 56 03 0
f 4a 60 5b 24 5a c0
63 0c 4a 4c 74 .
,V..J`[$Z.c.JLt
0240 a3 54 0c e1 e
9 41 76 12 ea 81 8c
bd 28 d6 18 2b .
T...Av.....(..+
0250 a9 46 43 cd 5
b dc a3 d2 1e b4 04
0c b0 c0 f7 1c .
FC.[...........
0260 20 8a 4d 85 2
3 91 d4 44 4a 4c 85
68 11 e4 b1 8b
.M.#..DJL.h....
0270 fb 20 bc a0 b
3 11 b8 cc 46 92 51
11 78 24 32 69 .
......F.Q.x$2i
0280 86 e5 2c 7e b
9 7b 61 e3 24 84 fd
5a f7 6d a8 f6 .
.,~.{a.$..Z.m..
0290 c8 2f 21 bb 7
2 88 a4 50 bb b4 36
86 17 3a ea 2e .
/!.r..P..6..:..
02a0 6d 9c ea ed e
a 97 0f 68 d5 0d 0e
03 9c 08 86 58 m
......h.......X
02b0 63 56 22 af a
0 5e bd 65 d7 10 82
32 42 44 98 9b c
V"..^.e...2BD..
02c0 01 c5 e6 05 5
6 75 00 b8 5b 56 94
42 f2 57 24 00 .
...Vu..[V.B.W$.
02d0 55 ae 12 4e 0
1 b3 2e 89 44 90 e9
25 9b 87 63 d2 U
..N....D..%..c.
02e0 8a 77 e5 7f c
f 52 cc 5f 69 75 b1
38 0e 8d 56 d3 .
w...R._iu.8..V.
02f0 d6 19 9d 3a 7
9 8c e8 76 b7 6f 3c
7a b7 50 f7 e2 .
..:y..v.o<z.P..
0300 43 b4 ca 47 a
d b1 b5 d1 d3 ef f7
9a 56 74 f8 b0 C
..G........Vt..
0310 f0 33 b0 8d 1
d 37 ca 3e af a4 42
28 ea 20 c0 cb .
3...7.>..B(. ..
0320 56 65 8c 17 0
d 82 c3 00 cd 50 93
03 85 c4 21 c8 V
e.......P....!.
0330 58 45 e5 0a 6
6 0d 41 fc 8c 5e 64
0e 82 ad 6b ad X

E..f.A..^d...k.
0340 ca e5 68 79 c
7 b1 8c c5 f5 f1 21
ea 22 11 59 1c .
.hy......!.".Y.
0350 97 64 4e 32 4
0 b5 2b c4 40 26 cd
51 69 12 b2 d2 .
dN2@.+.@&.Qi...
0360 fb e3 99 a9 9
e 43 90 94 7c 36 f7
25 f7 dc a5 8d .
....C..|6.%....
0370 cc 09 ed 95 f
7 f4 d5 12 34 00 81
93 d8 40 02 ce .
.......4....@..
0380 ae 22 98 14 1
0 e4 c1 58 5a 70 c4
89 14 3c c2 f2 .
".....XZp...<..
0390 3f 0b e8 4d 7
4 34 ba 4d 36 c7 17
a6 75 e3 74 d3 ?
..Mt4.M6...u.t.
03a0 4e eb 7b 6b 3
a cd 02 d5 65 46 18
9c 62 34 38 dc N
.{k:...eF..b48.
03b0 c3 4a 13 4e 3
b 4f dc 26 c8 22 f7
aa 9f d8 16 df .
J.N;O.&."......
03c0 4a a7 5b f3 f
2 4c fb ce b4 64 78
ff fb 92 04 eb J
.[..L...dx.....
03d0 0f f3 24 2b d
4 03 38 62 60 5d e4
ba 90 63 2f 4a .
.$+..8b`]...c/J
03e0 0c 4c af 50 0
d 61 89 81 71 96 aa
41 9c a5 30 26 .
L.P.a..q..A..0&
03f0 a3 2e 84 9d 8
7 52 6c f3 15 6f e9
31 03 80 c3 8a .
....Rl..o.1....
0400 2d d9 84 73 8
2 34 92 6a 05 ac 2e
62 63 8a 26 3b ..s.4.j...bc.&;
0410 60 97 82 01 2
5 b2 52 6c e7 67 67
1c 65 a0 fb c5 `
...%.Rl.gg.e...
0420 9e f7 b7 ac a
2 62 04 d6 71 36 8d
4f 8b 30 c0 2b .
....b..q6.O.0.+
0430 ae c6 d7 44 a
3 1a 94 f0 80 cd 75
3a 26 93 e5 52 .
..D......u:&..R
0440 be c7 59 be 2
7 cd b7 4c eb e6 f9
ff cd f7 3d f7 .
.Y.'..L......=.

0450 bf 98 90 4d b
5 22 73 4a 57 2c f3
77 5c b4 8e 07 .
..M."sJW,.w\...
0460 14 6c e2 44 3
1 fa 20 81 a0 1b f1
c3 9d 61 61 99 .
l.D1. ......aa.
0470 98 a2 48 30 4
c c1 45 a6 66 65 fe
91 47 68 d6 8a .
.H0L.E.fe..Gh..
0480 7b c3 d7 5f 5
8 55 74 da 77 ea 53
cc 53 29 be fb {
.._XUt.w.S.S)..
0490 23 61 79 1b 3
4 05 4e 16 19 90 67
0f 24 3e 16 9b #
ay.4.N...g.$>..
04a0 b9 b4 4e 94 1
6 e2 ae ba 62 5c 39
f7 48 33 9b eb .
.N.....b\9.H3..
04b0 d0 2c 33 0f e
1 46 85 28 ff af d6
d3 92 44 c6 45 .
,3..F.(.....D.E
04c0 64 08 29 9a c
c 89 e4 42 f5 62 5f
25 50 0c f8 8e d
.)....B.b_%P...
04d0 a5 e3 89 54 0
3 92 bd 99 e6 33 01
46 a1 d9 4b e5 .
..T.....3.F..K.
04e0 5f 2a 3a 7a f
9 4a 94 c2 73 05 01
b0 a4 38 0c 96 _
*:z.J..s....8..
04f0 17 12 8c 5a 8
9 7a 06 ce 45 1d 4a
69 20 46 51 79 .
..Z.z..E.Ji FQy
0500 25 f9 ed 6d a
0 9d aa 6a d9 b9 71
8b 10 aa 39 0f %
..m...j..q...9.
0510 24 43 d3 fa 1
5 2f a9 90 18 18 5c
0c ac 10 88 be $
C.../....\.....
0520 86 d8
.
.
No. Time
Source
Destination
Protocol
Length Info
166 6.071415000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack

=99491 Win=38328 Le
n=0
Frame 166: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.121345000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.121345000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 6.071415000 sec
onds]
Frame Number: 1
66
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f56 (20310)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1

28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 99491
, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 99491 (r
elative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t

.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38328
[Calculated win
dow size: 38328]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 165]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 56 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OV@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 e6 d0 50 10 .
....P..N.+...P.
0030 95 b8 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
167 6.211244000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=99491
Ack=1 Win=46 Len=1
260
Frame 167: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8

8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.261174000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.261174000 s
econds
[Time delta fro
m previous captured
frame: 0.139829000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13982900
0 seconds]
[Time since ref
erence or first fra
me: 6.211244000 sec
onds]
Frame Number: 1
67
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco

m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1cd (61901)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a5d [validatio
n disabled]
[Good: Fals
e]
[Bad: False

]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 99491, Ack: 1
, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 99491 (relativ
e sequence number)
[Next sequence
number: 100751 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set

Window size val

ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf28
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 cd 4
0 00 31 06 3a 5d 4a
7c 0c 8a c0 a8 .
...@.1.:]J|....
0020 01 0b 00 50 c
1 a6 2b c9 e6 d0 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e f2 8d 0
0 00 b2 f3 30 90 56
a3 92 01 18 72 .
.......0.V....r
0040 05 9a 5e 65 3
8 66 60 a6 e3 f2 c8
f2 f0 6e 6b 8e .
.^e8f`......nk.
0050 16 dd 18 fd b
8 8b 7f 2b a5 c6 61
61 33 ca 09 e8 .
......+..aa3...
0060 5e a6 ec 45 3
5 53 0e d2 6c d2 68
9d 5d d7 d5 d8 ^
..E5S..l.h.]...
0070 b3 23 bf 27 c
b af 8c 67 c2 ae 77
ac 79 b3 5f 8f .
#.'...g..w.y._.
0080 8b ff fb 92 0
4 e9 0f f3 00 2b d4
03 38 4a 60 62 .
........+..8J`b
0090 85 8a 80 67 2
f 4c 0b ac af 50 0c
e1 69 81 65 95 .
..g/L...P..i.e.
00a0 ea 41 8c 35 3
0 eb 1f fb 4f ea 98
12 fb 91 b7 fa .
A.50...O.......
00b0 c5 11 14 88 5
5 85 b0 7c 8e 17 6a
02 46 b2 ca 92 .
...U..|..j.F...

00c0 02 a1 86 18 2
3 90 0f 8a 06 61 6f
aa 90 aa 30 fd .
...#....ao...0.
00d0 48 f2 7a 3a d
3 ae fa f3 94 d6 af
03 d3 63 8c 71 H
.z:.........c.q
00e0 1e e7 37 60 4
c 81 7a c8 0c 51 1e
06 92 14 9c 8a .
.7`L.z..Q......
00f0 e5 03 33 2d 4
3 2b 7b 0d 38 89 5b
e5 fe 93 ee a2 .
.3-C+{.8.[.....
0100 2a 0a 25 dc 4
9 0d 40 89 56 21 c4
3d 61 f0 00 63 *
.%.I.@.V!.=a..c
0110 07 04 95 50 0
8 b1 be 12 48 74 c0
ab 48 63 14 d2 .
..P....Ht..Hc..
0120 0d 78 00 84 c
a b7 45 cb b2 cd 10
64 a8 93 ec e2 .
x....E....d....
0130 db 50 67 65 5
7 c9 19 93 f5 fd 8f
51 65 a6 e8 be .
PgeW......Qe...
0140 6f ea d4 6d a
1 73 f5 15 c0 42 28
05 0b 2b 17 3c o
..m.s...B(..+.<
0150 46 ca a4 7c b
8 8c 8a ea 13 c4 24
7e e5 64 8a eb F
..|......$~.d..
0160 90 fa ab 99 8
f 5f fe f2 9d 4d c8
75 9b fd 61 88 .
...._...M.u..a.
0170 04 ac c1 c5 0
5 32 30 df 90 5c 0b
7c 23 22 ac 1d .
....20..\.|#"..
0180 08 1c c0 5d 0
2 30 4d 70 e5 4e 89
d6 24 52 3f 13 .
..].0Mp.N..$R?.
0190 47 ea 58 76 b
2 2f ba d9 c5 35 5f
f5 00 22 85 7c G
.Xv./...5_..".|
01a0 c8 d0 43 48 3
8 e2 40 6a 12 c9 0e
81 d8 47 99 91 .
.CH8.@j.....G..
01b0 c4 f0 7f 09 e
2 bc 7d 12 09 9a 3a
f6 2c 68 18 a5 .
.....}...:.,h..
01c0 9e 44 eb 3a b
2 fa 4f 9d 28 3a 45
59 d1 c7 7d 7a .
D.:..O.(:EY..}z
01d0 d5 64 e9 fe 6

7 7c 55 10 fb c4 ca
ac 43 24 34 45 .
d..g|U.....C$4E
01e0 fa f6 95 08 6
0 0b 6c fe 03 4e 86
59 c0 0f 17 9e .
...`.l..N.Y....
01f0 1f 80 51 d5 4
7 d4 94 25 aa 51 5c
70 12 82 d5 7a .
.Q.G..%.Q\p...z
0200 75 f4 9d 94 9
c 96 cd c8 ac 61 a6
5f e8 87 3c 5b u
........a._..<[
0210 13 13 44 ba 1
6 65 8b 49 43 10 94
5a df 41 b3 83 .
.D..e.IC..Z.A..
0220 91 05 a2 ff f
b 92 04 eb 0f f3 1a
2f 54 03 59 7a .
........../T.Yz
0230 60 5d 45 7a 7
0 67 2b 4c 0c 1c d1
4e 0d 65 0b 81 `
]Ezpg+L...N.e..
0240 87 95 e9 81 8
c c5 30 95 a9 36 83
eb 45 ba d1 75 .
.....0..6..E..u
0250 d5 f9 ab 7c c
5 4b 9c cd 2c 20 55
c8 79 1a 04 c4 .
..|.K.., U.y...
0260 1a 4c 19 16 4
f 65 31 03 06 b0 44
65 0c 84 61 59 .
L..Oe1...De..aY
0270 50 b3 73 72 5
5 29 99 ca 42 d2 5b
f9 b8 79 5a 72 P
.srU)..B.[..yZr
0280 af 6d a3 33 b
c 2e 51 90 05 8b c3
18 c1 4e 3e 43 .
m.3..Q......N>C
0290 70 d0 02 c5 0
f 68 05 bd 92 23 22
4f 5a 9d 7d 32 p
....h...#"OZ.}2
02a0 bd 0b b9 27 d
c fb a9 36 33 f5 4e
57 f1 7c 57 cf .
..'...63.NW.|W.
02b0 1a 07 3e ca 2
a 60 a6 60 a6 d2 40
6a 45 ba 14 30 .
.>.*`.`..@jE..0
02c0 ab 1c 44 c4 8
d 3c 63 e3 2b 90 dc
50 4a 4e b6 e9 .
.D..<c.+..PJN..
02d0 3c 0a 6f e3 5
2 d5 e0 c2 e1 cb 6b
4a 77 05 f4 d2 <
.o.R.....kJw...
02e0 7b 2b c9 e8 6
a 6f 25 fb 4f 44 2a

19 df 5f 5c 97 {
+..jo%.OD*.._\.
02f0 00 c1 0c 77 0
a 03 cb 75 2c 4c 5f
5a 7e 5a 7b e9 .
..w...u,L_Z~Z{.
0300 47 31 5a ed d
e 56 73 49 3d ff b0
ec fe f2 a1 bf G
1Z..VsI=.......
0310 df fb 6b 4b f
a d0 02 06 08 82 aa
10 7f 29 7b 0c .
.kK.........){.
0320 a2 77 65 2c f
d 1e 4c 84 cc a4 05
ff 73 1a c8 d1 .
we,..L.....s...
0330 65 d3 b0 97 4
b 18 dc fa 6e 42 aa
c5 1b 58 72 97 e
...K...nB...Xr.
0340 27 c1 ab da c
e 20 b6 10 e5 47 ec
d4 61 3c 4e 9d '
.... ...G..a<N.
0350 4d 93 85 db 3
7 48 5c 96 d6 91 b1
2d 65 de 74 af M
...7H\....-e.t.
0360 a6 eb 59 b3 f
b 6d f3 88 1f fd 4c
03 83 65 cc de .
.Y..m....L..e..
0370 16 3f eb 75 4
a 6e 06 3d 40 00 78
b3 90 91 80 d4 .
?.uJn.=@.x.....
0380 06 44 d3 f8 2
0 80 b5 e1 45 9c 02
c4 46 03 3e 5c .
D.. ...E...F.>\
0390 6e 59 44 4e e
e 55 1f 18 25 b8 c6
a7 b0 f6 ed 3d n
YDN.U..%......=
03a0 63 56 23 8f 8
4 56 b5 67 9b 0d e5
cb f7 86 80 b0 c
V#..V.g........
03b0 7a 82 78 0c 0
2 b1 35 c2 87 04 4a
23 c9 9d b3 08 z
.x...5...J#....
03c0 82 2c 28 e6 e
5 ff fb 92 04 e8 0f
f3 03 34 d3 83 .
,(..........4..
03d0 39 6a e0 5f a
6 9a 70 67 0b 5c 0c
08 d3 50 0c e5 9
j._..pg.\...P..
03e0 2b 81 7c 95 e
9 c1 8c 3d 30 9d cf
9b 9f e1 7e 6a +
.|....=0.....~j
03f0 63 e7 fa d7 1
f 4f 6d ac d2 8c 86
29 c1 53 47 45 c

....Om....).SGE
0400 35 ce 06 d0 5
6 04 b8 a8 23 1b 51
63 14 f4 43 27 5
...V...#.Qc..C'
0410 2b 90 f2 c0 5
3 b1 69 7d e6 02 be
19 bc 34 92 d2 +
...S.i}.....4..
0420 0a 8c c9 bf 8
3 ad e7 8b 12 fc 6c
10 8b 08 b5 e8 .
.........l.....
0430 2d 1a eb b5 a
2 66 19 b0 41 90 c5
b6 23 41 b1 fd ....f..A...#A..
0440 cc 86 b2 ae c
a 7a 92 f6 bb 95 1d
9c ea b4 97 ef .
....z..........
0450 d9 7b 7d fd c
7 9c fe 76 b7 44 d6
40 03 d8 58 80 .
{}....v.D.@..X.
0460 b1 23 cb 9e c
5 b8 a6 cc ab 1a 2a
d2 94 f9 19 33 .
#........*....3
0470 ad f2 d9 2c 0
1 2f a5 a7 5f 4f 1b
02 90 c1 2f 95 .
..,./.._O..../.
0480 3e d3 3e 57 6
b 3d 28 8c bf 42 b0
46 2d 70 f1 96 >
.>Wk=(..B.F-p..
0490 d3 6c db 59 6
8 84 23 d7 7c 54 a9
85 e7 ad 43 fe .
l.Yh.#.|T....C.
04a0 51 c3 f5 34 9
f 93 5b d4 23 bf d6
e3 12 42 ca de Q
..4..[.#....B..
04b0 79 df a9 5b 0
4 10 05 4b 40 70 3e
c2 cd 8a 04 ac y
..[...K@p>.....
04c0 60 14 45 02 4
7 e3 19 81 1d 62 d2
ab b7 93 aa ee `
.E.G....b......
04d0 6d dc a5 42 7
2 4e 21 73 db 7d ed
98 91 14 16 ff m
..BrN!s.}......
04e0 ee 32 f8 5a f
1 d4 ec c2 20 90 74
67 96 52 b6 2b .
2.Z.... .tg.R.+
04f0 d8 63 44 c0 9
0 31 31 76 e4 db 1c
99 8d 9d d1 ee .
cD..11v........
0500 bf ad 69 b9 8
1 3b d6 18 df 22 57
53 cf c9 5b 33 .
.i..;..."WS..[3

0510 5d 69 86 74 2
9 95 56 02 3e 74 c6
08 cb 82 a3 38 ]
i.t).V.>t.....8
0520 e5 13
.
.
No. Time
Source
Destination
Protocol
Length Info
168 6.219243000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
878 http49
574 [PSH, ACK] Seq=
100751 Ack=1 Win=46
Len=824
Frame 168: 878 byte
s on wire (7024 bit
s), 878 bytes captu
red (7024 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.269173000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.269173000 s
econds
[Time delta fro
m previous captured
frame: 0.007999000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00799900
0 seconds]
[Time since ref
erence or first fra
me: 6.219243000 sec
onds]
Frame Number: 1
68
Frame Length: 8
78 bytes (7024 bits
)
Capture Length:
878 bytes (7024 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]

[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
64
Identification:
0xf1ce (61902)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c10 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 100751, Ack:
1, Len: 824
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 824]
Sequence number
: 100751 (relati
ve sequence number)
[Next sequence
number: 101575 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes

.... 0000 0001

1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4c4
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2084]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 60 f1 ce 4
0 00 31 06 3c 10 4a
7c 0c 8a c0 a8 .
`..@.1.<.J|....
0020 01 0b 00 50 c
1 a6 2b c9 eb bc 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 4c 4c 0
0 00 57 6c 14 c9 86
63 2b 59 53 42 .
.LL..Wl...c+YSB
0040 1b 98 e8 f3 b

5 e5 cb 0b 06 bb b0
dc 95 fb b7 79 .
..............y
0050 ca ad 4d 6f a
d 79 f3 dc 02 cb 56
21 0d 85 c5 61 .
.Mo.y....V!...a
0060 ed 79 5a 41 f
0 f9 5b a4 e8 fa 75
df bf ac 82 24 .
yZA..[...u....$
0070 9c cd 62 6a 9
6 da e7 d7 cd a3 74
ff fb 92 04 e7 .
.bj......t.....
0080 0f f2 ff 35 5
4 03 59 42 e0 5f a6
9a 70 67 0b 5c .
..5T.YB._..pg.\
0090 0b 48 b3 50 0
c e5 29 81 77 92 69
81 9c bd 28 0c .
H.P..).w.i...(.
00a0 4d ce 69 ef 2
9 51 7f 0e 35 21 00
1a 41 54 85 ba M
.i.)Q..5!..AT..
00b0 ac 33 e6 c6 2
b 7b 55 00 95 21 82
d2 d3 42 28 9d .
3..+{U..!...B(.
00c0 e4 4c ec 5b b
6 86 2d c9 2c a1 f9
2b 66 a9 11 4f .
L.[..-.,..+f..O
00d0 38 b4 7b 0e a
2 96 f2 74 48 c9 ac
59 a1 92 dd 2e 8
.{....tH..Y....
00e0 9c 8d 6c ba b
a 7d d2 cd 30 83 ad
6b af ac 4f 7d .
.l..}..0..k..O}
00f0 78 6c f9 ab 7
d 7f ee 3f eb 55 ff
c0 88 9b c5 a8 x
l..}..?.U......
0100 41 a7 fa f2 2
d a0 61 92 85 c6 64
a9 b0 80 1c 74 A
...-.a...d....t
0110 9a a3 30 34 6
8 90 d9 85 18 04 92
6e d7 46 15 66 .
.04h......n.F.f
0120 8c 64 46 14 9
a 05 ea 55 3d 6c 5e
1a a1 63 f8 af .
dF....U=l^..c..
0130 86 29 ca bf 7
d 8b 45 aa 96 88 60
c0 ed 92 08 05 .
)..}.E...`.....
0140 f1 e4 85 1c 1
6 70 07 0d c9 47 ac
f8 3c 6b 6d 63 .
....p...G..<kmc
0150 58 85 f9 40 2
2 d5 1e 26 5f b9 6c

b5 67 7c 9c 63 X
..@"..&_.l.g|.c
0160 bf 39 88 34 b
9 fe 9d 5f d6 8c 82
02 c7 20 2e d9 .
9.4..._..... ..
0170 ea 02 03 01 d
5 bd 84 d3 2c 1b 71
30 00 18 e4 3b .
.......,.q0...;
0180 32 c9 cb d6 4
9 b4 54 0c f2 51 8e
81 1e 66 d3 17 2
...I.T..Q...f..
0190 58 a5 c7 e1 a
e 42 77 56 bb cf 63
f2 08 5a b5 6a X
....BwV..c..Z.j
01a0 29 61 69 6e 4
a 8c 47 5b c9 ca 97
57 46 b2 0c f7 )
ainJ.G[...WF...
01b0 72 8b 36 e0 c
3 a6 ff 5f 42 2f 5a
b2 6f f8 5a f0 r
.6...._B/Z.o.Z.
01c0 ab 4f f1 34 d
4 92 51 ec 70 53 ed
a9 6e 00 d4 22 .
O.4..Q.pS..n.."
01d0 04 06 1c 51 c
0 2e 60 85 1a 90 2e
58 31 db 24 be .
..Q..`....X1.$.
01e0 21 20 82 54 9
b 2a 90 b8 61 81 aa
65 d1 ff 40 b6 !
.T.*..a..e..@.
01f0 7e f3 42 65 1
0 ab ab e9 9a d9 c2
fc 16 d6 b7 91 ~
.Be............
0200 b0 ba c4 29 7
c 73 5c f0 ef 48 f1
80 51 17 04 de .
..)|s\..H..Q...
0210 99 b9 b1 85 7
5 26 71 05 c7 c3 eb
51 74 ff fb 90 .
...u&q....Qt...
0220 04 ea 0f f2 e
5 2c d4 03 59 5a 60
5e c5 8a 70 63 .
....,..YZ`^..pc
0230 4f 4c 0c 90 b
d 4e 0d 65 69 81 8b
96 69 c1 9c bd O
L...N.ei...i...
0240 30 c5 f3 35 c
9 cd ea f3 88 dc cb
5b bb 7d 6a 28 0
..5.......[.}j(
0250 14 04 28 b1 7
b 4e 40 07 1c 45 46
52 0a 55 82 34 .
.(.{N@..EFR.U.4
0260 61 e1 c4 49 9
1 9e 0e 31 f3 66 06
51 b9 b3 bf 55 a

..I...1.f.Q...U
0270 38 84 1c f2 c
a de db 6f 52 24 c2
37 52 4a fd 4e 8
......oR$.7RJ.N
0280 e4 e1 28 cc 7
7 2c 44 0f 23 94 07
50 09 a0 b6 3c .
.(.w,D.#..P...<
0290 11 08 ae 54 3
b 44 d9 b5 e2 d4 64
e6 20 91 12 f2 .
..T;D....d. ...
02a0 bf e6 37 dd 7
d ae d7 40 04 55 a3
e9 60 a2 10 06 .
.7.}..@.U..`...
02b0 19 40 5c 11 d
b 3a 9a e6 a0 53 58
30 8b 18 4b 4b .
@\..:...SX0..KK
02c0 04 06 39 19 4
2 68 82 b7 55 41 69
db 86 b1 55 46 .
.9.Bh..UAi...UF
02d0 67 23 8d b3 2
c ae b6 26 4f 9e 35
df 17 97 3f 91 g
#..,..&O.5...?.
02e0 e4 cf f8 a6 d
f 6a 83 47 b3 87 32
c1 52 ff 00 e1 .
....j.G..2.R...
02f0 cc 45 7d 9a 2
2 b6 05 9f 79 54 d7
66 e5 a5 9f 9b .
E}."...yT.f....
0300 cc 2a ba 59 2
2 f5 1b 63 ce 1c 55
5f fa e1 d1 94 .
*.Y"..c..U_....
0310 30 74 cc 06 5
5 08 d5 b6 28 09 82
99 45 5d c4 6d 0
t..U...(...E].m
0320 23 58 20 26 8
2 c3 83 26 b2 e1 62
a5 0f b2 93 97 #
X &...&..b.....
0330 be ee fc db c
4 af ec c9 27 63 ae
0d 2d ee 2e 89 .
.......'c..-...
0340 6e e0 98 6c 7
d 22 1e 74 6e 36 8e
e5 6a b2 ed ed n
..l}".tn6..j...
0350 2a 76 38 d5 b
6 75 12 6b 6a 1b 25
e9 a6 af 8c ea *
v8..u.kj.%.....
0360 da dc b4 ff 3
0 a8 e8 d6 50 98 7c
81 9e 85
.
...0...P.|...
No. Time
Source
Destination

Protocol
Length Info
169 6.219413000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=101575 Win=38430 L
en=0
Frame 169: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.269343000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.269343000 s
econds
[Time delta fro
m previous captured
frame: 0.000170000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017000
0 seconds]
[Time since ref
erence or first fra
me: 6.219413000 sec
onds]
Frame Number: 1
69
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17

:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f57 (20311)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 10157
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 101575 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .

... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 168]
[The RTT to
ACK the segment wa
s: 0.000170000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 57 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OW@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 ee f4 50 10 .
....P..N.+...P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
170 6.224239000
Netgear_2e:1a:0
9
Broadcast
HomePlug
AV 60 MAC Manag
ement, Get Bridge I
nformations Confirm

ation
Frame 170: 60 bytes
on wire (480 bits)
, 60 bytes captured
(480 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.274169000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.274169000 s
econds
[Time delta fro
m previous captured
frame: 0.004826000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00482600
0 seconds]
[Time since ref
erence or first fra
me: 6.224239000 sec
onds]
Frame Number: 1
70
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:homeplug-av]
[Coloring Rule
Name: Broadcast]
[Coloring Rule
String: eth[0] & 1]
Ethernet II, Src: N
etgear_2e:1a:09 (20
:0c:c8:2e:1a:09), D
st: Broadcast (ff:f
f:ff:ff:ff:ff)
Destination: Br
oadcast (ff:ff:ff:f
f:ff:ff)
Address: Br
oadcast (ff:ff:ff:f
f:ff:ff)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f

actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Netgear
_2e:1a:09 (20:0c:c8
:2e:1a:09)
Address: Ne
tgear_2e:1a:09 (20:
0c:c8:2e:1a:09)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: Homeplug
AV (0x88e1)
HomePlug AV protoco
l
MAC Management
Header
.... ...1 =
Version: 1.1 (1)
Type: Get B
ridge Informations
Confirmation (0x602
1)
.... ..
01 = LSB: Confirm (
0x01)
.... .0
0. = MSB: STA - Cen
tral Coordinator (0
x00)
Fragmentati
on Info: 0x0000
.... 00
00 = Fragment count
:0
0000 ..
.. = Fragment index
:0
Fragmen
t Sequence number:
0
Get Bridge Info
rmations Confirmati
on
Bridging: T
rue
Bridge Term
inal Equipement Ide
ntifier: 5
Number of s
tations: 4
Bridged Des
tination Address: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1)
Bridged Des
tination Address: A
pple_86:da:3d (04:e
5:36:86:da:3d)

Bridged Des
tination Address: H
onHaiPr_be:71:b9 (8
4:4b:f5:be:71:b9)
Bridged Des
tination Address: H
onHaiPr_c9:0e:4a (0
0:1f:3a:c9:0e:4a)
0000 ff ff ff ff f
f ff 20 0c c8 2e 1a
09 88 e1 01 21 .
..... ........!
0010 60 00 00 01 0
5 04 90 01 3b d0 17
e1 04 e5 36 86 `
.......;.....6.
0020 da 3d 84 4b f
5 be 71 b9 00 1f 3a
c9 0e 4a 00 00 .
=.K..q...:..J..
0030 00 00 00 00 0
0 00 00 00 00 00 00
00
.
...........
No. Time
Source
Destination
Protocol
Length Info
171 6.288249000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=10157
5 Ack=1 Win=46 Len=
1260
Frame 171: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.338179000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.338179000 s
econds
[Time delta fro
m previous captured
frame: 0.064010000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06401000

0 seconds]
[Time since ref
erence or first fra
me: 6.288249000 sec
onds]
Frame Number: 1
71
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),

Dst: pc13.home (192

.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1cf (61903)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a5b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 101575, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por

t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 101575 (relati
ve sequence number)
[Next sequence
number: 102835 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x94d
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 cf 4
0 00 31 06 3a 5b 4a
7c 0c 8a c0 a8 .
...@.1.:[J|....
0020 01 0b 00 50 c
1 a6 2b c9 ee f4 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 94 d7 0
0 00 0b 20 11 90 b9
11 95 91 3f ab .
...... ......?.
0040 0e d0 53 39 e
f 78 37 80 ea 7d 88
51 de 98 3a 9f .
.S9.x7..}.Q..:.
0050 41 37 0d c1 6
0 89 55 34 05 52 b1
89 f4 90 07 0c A
7..`.U4.R......
0060 89 16 d4 34 8
2 84 1e 7a 35 66 4e
36 95 e2 60 cc .
..4...z5fN6..`.
0070 6f bd 55 86 3
0 01 48 07 8d 07 41
c8 80 30 72 7c o
.U.0.H...A..0r|
0080 7d c5 54 8f 1
7 b3 ff fb 92 04 e7
0f f2 f3 2e d4 }
.T.............
0090 03 59 6a 60 5
d a5 8a 80 67 2b 4c
0c 28 b1 50 0d .
Yj`]...g+L.(.P.
00a0 65 89 81 81 1
6 2a 01 8c bd 30 aa
b7 ff fd 9f 58 e
....*...0.....X
00b0 7c 2c 40 64 c
6 be f0 97 c9 90 bd
91 95 f6 ff b2 |
,@d............
00c0 99 ac 21 94 a
d 44 9c e6 33 13 09
7c 4c 09 82 89 .
.!..D..3..|L...
00d0 96 45 72 7a 2
3 63 95 64 ce 87 a7
38 5e 18 3e 78 .
Erz#c.d...8^.>x
00e0 92 3e 81 7f b
7 4a c2 79 1c 10 d9
d4 df 39 3f 9d .
>...J.y.....9?.
00f0 6a d5 85 ec 0
0 8d 03 c6 81 b0 71
67 0a 3d c6 98 j
.........qg.=..
0100 e1 82 15 2d 1
e df f9 0f ff ff 40
c4 cb a9 5d a9 .
..-......@...].
0110 81 32 90 ea 9

4 33 91 41 e2 90 44
32 58 1c 3e cb .
2...3.A..D2X.>.
0120 67 28 16 fd 2
4 b2 25 2b 8f 5c a6
ab a9 56 52 8c g
(..$.%+.\...VR.
0130 54 aa 1b 17 5
2 32 13 6f 32 e5 0c
66 32 d1 6b 92 T
...R2.o2..f2.k.
0140 0a af 25 cd 5
3 59 4e 74 f1 31 47
57 30 14 26 97 .
.%.SYNt.1GW0.&.
0150 dd 68 3f 97 4
2 de 80 fe 42 28 4e
94 56 18 68 f3 .
h?.B...B(N.V.h.
0160 ed 71 90 b8 1
1 eb 53 65 41 fc 1f
65 e0 e3 8d 00 .
q....SeA..e....
0170 07 20 54 c5 c
b 6c 8b e1 f9 7b 66
5e c7 86 10 9c .
T..l...{f^....
0180 37 a0 cc 15 9
6 a2 d8 c4 c0 d8 c2
b8 4b b7 3d 81 7
...........K.=.
0190 1a 22 bb 22 4
8 3c cc 17 80 d8 41
7b 92 26 61 a2 .
"."H<....A{.&a.
01a0 27 57 5d b6 6
9 1f 9d a5 51 4e 32
6a a7 45 43 81 '
W].i...QN2j.EC.
01b0 52 62 8e 58 4
e 81 40 fa 4d 37 78
be 5c d2 de 41 R
b.XN.@.M7x.\..A
01c0 53 8f 52 a0 0
1 74 56 8e 06 1b 3c
04 62 6d 62 e1 S
.R..tV...<.bmb.
01d0 30 fa 53 34 9
5 c4 04 d5 1e 40 19
10 53 28 b7 b3 0
.S4.....@..S(..
01e0 1b e9 32 61 1
5 ca 18 a7 b6 2b 9f
a4 50 a6 cd bb .
.2a.....+..P...
01f0 c5 1d 46 93 6
f 75 17 6c 19 4b cd
c4 c9 12 ca eb .
.F.ou.l.K......
0200 90 26 b9 e6 9
0 29 28 df f6 fd 77
3f bf ed bf f9 .
&...)(...w?....
0210 fd b7 71 fb f
d d6 2c ea cd f6 5b
8f 6a d6 9e cc .
.q...,...[.j...
0220 eb d1 9b 00 5
b 1d 7c 81 ff fb 92

04 e7 0f f2 b6 .
...[.|.........
0230 23 57 03 0f 3
2 50 59 e4 8a d0 61
ec 4a 0c b4 8d #
W..2PY...a.J...
0240 5e 0c e0 c9 4
1 9c 11 ab 81 97 a5
28 f1 c3 2d bf ^
...A......(..-.
0250 fc 0a 7a 60 0
6 f7 87 d4 c9 5c 02
70 c5 25 c4 d3 .
.z`.....\.p.%..
0260 9f cb b6 28 1
1 81 7a 9c 15 95 ba
53 4d 65 6b e8 .
..(..z....SMek.
0270 47 8e 07 16 d
1 16 14 50 d5 fb 09
d7 a9 69 dd 56 G
......P.....i.V
0280 72 1a 77 a8 8
8 74 1d 4f 3f 99 2a
cd f6 f9 ec bf r
.w..t.O?.*.....
0290 3f ed 72 5e 5
a be ff 78 a9 9d d3
b4 99 95 8a 9b ?
.r^Z..x........
02a0 a6 b5 7f 5b b
5 39 6a 6e 82 9e ce
ef 7e bc 96 be .
..[.9jn....~...
02b0 45 66 3b e8 2
2 0b 17 8a 72 16 02
32 d2 7a 21 c4 E
f;."...r..2.z!.
02c0 af 4c a1 a1 f
7 75 6b 73 28 76 6f
71 64 1a 32 8a .
L...uks(voqd.2.
02d0 fc 56 23 4c 7
8 07 e5 3a 39 4d 73
5a ad a2 d7 e8 .
V#Lx..:9MsZ....
02e0 dc 7f 2f c7 d
a f3 79 fa f7 be c9
b2 48 bb 91 0c .
./...y.....H...
02f0 e3 bd b3 4d 9
4 d1 bf 34 f2 91 b8
b8 24 c0 8c d6 .
..M...4....$...
0300 53 42 f9 5f 8
f 68 f9 53 79 be 81
d3 7e df be fa S
B._.h.Sy...~...
0310 60 19 51 a7 d
2 a8 6b b6 b5 9e 6b
2a 77 31 c0 af `
.Q...k...k*w1..
0320 35 54 70 2c f
b 53 c6 52 17 09 3c
e3 1c a3 28 52 5
Tp,.S.R..<...(R
0330 f6 3b 70 ea c
f 36 f5 3d fb 72 e5
a9 de 2d bc df .

;p..6.=.r...-..
0340 3b ff 96 c7 2
9 7d d5 2b c9 4e 94
4a 5e 85 32 a7 ;
...)}.+.N.J^.2.
0350 cf 17 67 15 a
9 f4 93 69 60 de f3
5e 33 ee 37 96 .
.g....i`..^3.7.
0360 f6 bd f3 3a 5
4 ce ef be 4d f9 5f
98 ef da 00 40 .
..:T...M._....@
0370 63 98 1c b3 3
7 37 0e 6d 0b 5a 88
a8 71 8c 33 d5 c
...77.m.Z..q.3.
0380 16 20 8a cf 6
4 50 96 c8 a1 f4 d6
af 36 1b b4 f6 .
..dP......6...
0390 6d f6 bb e1 4
7 53 a6 05 0e 30 70
66 05 1f 17 1d m
...GS...0pf....
03a0 61 e8 8e d3 6
3 49 3f 7a 38 85 65
e1 2d a1 85 8e a
...cI?z8.e.-...
03b0 be 63 c6 d9 a
2 8f 6b 80 0d 16 ad
e3 85 86 07 1c .
c....k.........
03c0 b6 6a d0 59 0
b 32 22 35 ec 44 ff
fb 92 04 e7 0f .
j.Y.2"5.D......
03d0 f2 e5 1f 59 0
1 ef 1a 52 5c 44 7b
10 3d 88 4a 4b .
..Y...R\D{.=.JK
03e0 74 61 62 07 b
c c7 09 74 8d ec 00
f7 a4 e1 ed 7d t
ab....t.......}
03f0 ea 3d 4f 58 0
2 c7 d2 19 60 24 66
a9 65 7d 43 4b .
=OX....`$f.e}CK
0400 b9 b2 34 80 d
6 20 e4 70 58 ba 91
01 26 12 e7 5a .
.4.. .pX...&..Z
0410 f9 17 05 a9 6
2 39 ec d3 12 1e 61
62 0b 01 e1 40 .
...b9....ab...@
0420 9c 73 56 ed a
7 50 4a 57 2b a7 e5
66 4a fa f3 30 .
sV..PJW+..fJ..0
0430 cb 74 71 0e 5
d fd 73 71 4d 87 70
73 0e 1c 87 54 .
tq.].sqM.ps...T
0440 92 cf 1a 22 3
b 73 f6 d1 7b 89 29
ee e5 9e cd e8 .
..";s..{.).....

0450 f4 ef e7 68 e
b 32 54 3f 87 11 9c
2a 71 80 6c 0c .
..h.2T?...*q.l.
0460 67 88 c8 56 d
3 f0 e0 02 5e 29 d2
6d 92 0d 8a 41 g
..V....^).m...A
0470 41 92 94 c3 f
b 69 10 1b 40 9b 8f
bf 19 ac 84 ba A
....i..@.......
0480 b7 76 92 9d 6
1 60 fb 08 82 02 b2
66 96 6d 0c 43 .
v..a`.....f.m.C
0490 14 86 b4 a8 8
9 07 4d 53 d2 c8 4b
c9 b9 f9 6b 6d .
.....MS..K...km
04a0 6c 91 25 7d 6
9 55 27 f7 29 94 bd
44 4b 87 9f 0a l
.%}iU'.)..DK...
04b0 09 9f ad 0d b
b 67 b7 f4 98 28 07
ea 83 48 52 10 .
....g...(...HR.
04c0 61 20 0f 0a 0
a 88 45 8f 3d e0 68
10 9d a8 06 4d a
....E.=.h....M
04d0 fa 6e 8c d2 6
d f7 8b b2 48 2d 33
e5 6f 8b d9 93 .
n..m...H-3.o...
04e0 70 5b d1 ba b
6 3f 18 8f 33 10 64
44 4f e3 2c 90 p
[...?..3.dDO.,.
04f0 cf 58 70 de d
a e7 ae de 79 53 5a
d5 5f 63 da 3d .
Xp.....ySZ._c.=
0500 fe e4 8b fd 2
7 08 16 06 4f 07 46
1d 71 13 69 0f .
...'...O.F.q.i.
0510 a6 a4 05 4f 5
a d1 f3 9f ff df e8
2a 27 32 64 c2 .
..OZ......*'2d.
0520 e6 04
.
.
No. Time
Source
Destination
Protocol
Length Info
172 6.368253000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1299 http49
574 [PSH, ACK] Seq=

102835 Ack=1 Win=46

Len=1245
Frame 172: 1299 byt
es on wire (10392 b
its), 1299 bytes ca
ptured (10392 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.418183000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.418183000 s
econds
[Time delta fro
m previous captured
frame: 0.080004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08000400
0 seconds]
[Time since ref
erence or first fra
me: 6.368253000 sec
onds]
Frame Number: 1
72
Frame Length: 1
299 bytes (10392 bi
ts)
Capture Length:
1299 bytes (10392
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
285
Identification:
0xf1d0 (61904)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a69 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 102835, Ack:
1, Len: 1245
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1245]
Sequence number
: 102835 (relati
ve sequence number)
[Next sequence
number: 104080 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc4b
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2505]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 05 f1 d0 4
0 00 31 06 3a 69 4a
7c 0c 8a c0 a8 .
...@.1.:iJ|....
0020 01 0b 00 50 c
1 a6 2b c9 f3 e0 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e c4 b0 0
0 00 80 84 8f 11 87
12 82 84 69 6e .
.............in
0040 fc be 09 11 0
2 93 af 97 14 7c 58
56 60 59 86 c7 .
........|XV`Y..
0050 5d 9c f6 3b 1
3 f7 da 07 a7 71 7b
05 84 2a 38 1a ]
..;.....q{..*8.
0060 59 af 60 9c 4
7 68 b0 6a c4 78 54
54 73 9d 85 27 Y
.`.Gh.j.xTTs..'
0070 0f de ad 3a 9
3 3b d1 f7 45 f6 04
23 51 33 5a 07 .
..:.;..E..#Q3Z.
0080 ff fb 92 04 e
d 0f f3 0d 27 d6 03
38 42 50 61 65 .
.......'..8BPae
0090 8a b0 61 eb 4
c 0c 64 b3 52 0c e1

29 81 8b 92 aa .
.a.L.d.R..)....
00a0 41 9c 3d 28 9
9 8f bf 3f 3e 73 0b
3f 7f f3 48 3b A
.=(...?>s.?..H;
00b0 b3 89 ce 70 3
4 00 ce f8 05 b1 2e
e2 da 37 14 b2 .
..p4........7..
00c0 05 3c 60 2c e
5 01 92 66 7c fd c0
31 18 e4 3f 65 .
<`,...f|..1..?e
00d0 2c b6 d1 65 3
9 bf ed f4 3f 45 2b
98 6e b4 ba 68 ,
..e9...?E+.n..h
00e0 82 10 0e 38 7
4 86 38 29 b8 34 41
78 38 66 6f c0 .
..8t.8).4Ax8fo.
00f0 d0 2d 64 cb a
9 ac f6 cd 4d 36 d9
cf b5 68 0b 82 .
-d.....M6...h..
0100 e0 41 38 84 7
a 50 2c c2 a0 24 9c
2f 4d 5e 93 40 .
A8.zP,..$./M^.@
0110 87 54 a1 83 3
0 d0 ed 04 07 8f ce
c3 81 87 3a 76 .
T..0.........:v
0120 d6 18 55 43 e
6 56 86 9f 19 13 4d
ec eb 3b 50 a5 .
.UC.V....M..;P.
0130 d9 39 28 6f f
2 95 b6 0b 54 b6 a0
85 55 73 33 58 .
9(o....T...Us3X
0140 1d 61 96 ac a
9 11 c0 51 c4 df 49
84 22 8e 8b 55 .
a.....Q..I."..U
0150 59 a8 ca 6a c
7 fe b4 b3 ca 4b c3
55 fb 0b 75 fb Y
..j.....K.U..u.
0160 7d d5 67 74 0
9 c0 e1 b3 05 93 4d
b3 ad 64 9f a4 }
.gt......M..d..
0170 68 0a 0c bc 6
2 68 09 1a 3a 09 58
cc 0e 5b 27 29 h
...bh..:.X..[')
0180 b3 16 61 5b c
2 00 b6 5f d6 50 4e
38 ad 78 12 79 .
.a[..._.PN8.x.y
0190 de 4b 29 0c 9
a dc 2a 43 62 2f 4b
a8 94 4a d5 6e .
K)...*Cb/K..J.n
01a0 0f 58 0c 7a 8
0 ea 05 2c a7 85 0e
c5 56 9e 6d a9 .

X.z...,....V.m.
01b0 61 8a 5a bb c
d 77 af fe b5 af 13
51 f5 7a ef 18 a
.Z..w.....Q.z..
01c0 df ce 60 b0 5
1 97 44 6d 16 cb 61
3f a6 31 25 36 .
.`.Q.Dm..a?.1%6
01d0 67 96 98 a0 0
7 19 78 54 41 a2 00
ad 06 24 5b 46 g
.....xTA....$[F
01e0 6e 2e ac 81 a
9 83 49 03 35 a2 27
cb 69 a7 29 1e n
.....I.5.'.i.).
01f0 04 61 a7 89 5
3 72 52 8b 36 6b 72
08 94 c3 b6 bb .
a..SrR.6kr.....
0200 9e 71 6c ab c
0 f6 c8 23 13 a3 dd
c8 3e 32 25 d5 .
ql....#....>2%.
0210 3c 90 86 3b d
a f4 8d bf 50 f7 08
ac ad b9 8b eb <
..;....P.......
0220 d7 17 ff fb 9
2 04 e7 8f f2 df 25
54 83 58 62 52 .
.........%T.XbR
0230 5f a5 2a 90 6
3 0b 4c 0c 44 bd 50
0c e1 29 81 70 _
.*.c.L.D.P..).p
0240 95 aa 41 8c 3
d 30 a2 da f9 6e fb
8e 7d 8e 5c 28 .
.A.=0...n..}.\(
0250 f4 de 53 48 1
4 e0 80 4c e4 59 a8
0b 14 ae 9e 8e .
.SH...L.Y......
0260 98 97 aa c5 9
0 63 18 ef 51 c5 77
43 83 81 08 f4 .
....c..Q.wC....
0270 62 75 8e 35 8
9 a5 0a 97 c3 59 d2
49 1a 0c b2 b5 b
u.5.....Y.I....
0280 c7 49 e4 c3 9
5 17 53 6d 6f 6b c6
9d a2 46 53 3f .
I....Smok...FS?
0290 a4 72 ef a9 f
6 98 74 cf 49 5e 67
33 ef 5f c2 89 .
r....t.I^g3._..
02a0 f2 ff 59 d5 a
9 be f6 96 d6 7d 7f
fe 5d 24 c2 e7 .
.Y......}..]$..
02b0 0e a5 9f 58 8
1 49 88 50 62 1b 98
b0 07 04 89 a5 .
..X.I.Pb.......

02c0 2c 69 46 b9 c
0 e2 aa 86 95 f5 9c
7e 80 87 91 3b ,
iF........~...;
02d0 6b 1a 41 57 9
1 76 10 ad 2f f5 37
26 57 c3 83 2a k
.AW.v../.7&W..*
02e0 c3 af 43 21 b
7 5f 3d d2 4e fd d6
4b 3c 11 01 62 .
.C!._=.N..K<..b
02f0 86 17 41 68 6
c 82 c9 08 43 94 50
a7 0e 27 be 7c .
.Ahl...C.P..'.|
0300 ab ce c6 1d 9
7 2c 88 b4 49 57 99
f2 cb eb 65 42 .
....,..IW....eB
0310 86 85 9e 38 0
5 44 a0 00 a6 08 4f
92 5e 18 da 39 .
..8.D....O.^..9
0320 6c a8 ca 08 9
6 b4 15 83 6c b3 30
36 8f f5 78 4b l
.......l.06..xK
0330 f7 92 85 c3 d
1 cd ca 62 0b be 11
8d c8 29 7f f2 .
......b.....)..
0340 f1 78 0a 41 1
6 92 66 42 5d 74 47
0a 07 d6 14 23 .
x.A..fB]tG....#
0350 79 82 64 43 5
1 c2 ca 26 ba 48 2b
a6 59 5a 09 3b y
.dCQ..&.H+.YZ.;
0360 d2 79 c5 75 2
5 af 34 d1 4a bd fd
35 33 14 2a 8a .
y.u%.4.J..53.*.
0370 64 aa 65 ca 6
7 e8 6f 92 7a 2c d6
c0 2e 2f f7 82 d
.e.g.o.z,.../..
0380 a3 60 89 18 4
4 ef 4e 06 c2 25 14
9a bc b6 96 eb .
`..D.N..%......
0390 bb 49 4b ea a
4 a1 55 f7 52 d8 70
a5 f8 e7 53 98 .
IK...U.R.p...S.
03a0 7e b0 cc 4d 0
4 a8 d0 c1 94 0d e1
ec 34 1b 28 e9 ~
..M........4.(.
03b0 79 66 03 02 b
5 99 e6 71 f1 ea 5b
9c 4a 99 ba 8d y
f.....q..[.J...
03c0 96 b6 9d 52 f
f fb 92 04 e9 8f f3
15 34 53 83 58 .
..R........4S.X
03d0 5a e0 60 05 d

a 80 67 0f 4c 0b 78
d3 4e 0d 60 eb Z
.`...g.L.x.N.`.
03e0 81 70 17 aa 0
1 9c b5 30 0d 52 9f
ad 26 a8 f2 9f .
p.....0.R..&...
03f0 ce f4 eb 30 8
8 6a c9 20 a5 60 e5
8d 71 52 e2 98 .
..0.j. .`..qR..
0400 ed 25 4b a9 0
d 31 c9 39 4b b2 fa
4f 28 f1 a8 8c .
%K..1.9K..O(...
0410 c4 a6 e3 a8 d
8 51 6a 23 24 84 56
8e 07 15 19 8c .
....Qj#$.V.....
0420 5e 97 97 0d c
f a6 26 02 78 9c 1c
d4 ce 8d 33 44 ^
.....&.x.....3D
0430 c8 a0 d2 38 c
6 05 41 6e 1f 9c 7e
37 29 9b b9 35 .
..8..An..~7)..5
0440 64 d7 4e e6 9
7 36 64 d2 b1 ba d6
60 a6 ac d8 f6 d
.N..6d....`....
0450 05 73 4e 3c c
6 4d 32 8d 08 83 3a
48 cd 80 3c 80 .
sN<.M2...:H..<.
0460 13 d4 cb a9 1
2 10 32 6e 0e a5 81
17 d4 b8 ba b0 .
.....2n........
0470 e1 20 83 aa d
4 a4 78 48 a6 96 6b
ad 35 20 bb 1d .
....xH..k.5 ..
0480 4e 09 ff ac d
d da 7d 37 ac 42 13
89 fa 23 da 80 N
.....}7.B...#..
0490 58 ba 14 2f 2
8 1a 48 c9 1f 82 b1
b8 e4 3b 65 fd X
../(.H......;e.
04a0 3c 75 1f d8 7
a 27 dd a0 9f cc 31
7a 3e 97 99 b8 <
u..z'....1z>...
04b0 d8 13 e8 a3 3
5 88 c6 22 ff 08 88
58 3b 5f 6c e7 .
...5.."...X;_l.
04c0 cb a9 6c 4c 8
8 82 ad 22 c9 a4 9d
2a 89 06 35 32 .
.lL..."...*..52
04d0 f7 55 69 cc c
5 de 97 47 2c e5 40
84 14 74 d9 6d .
Ui....G,.@..t.m
04e0 5e 35 3a 18 a
4 b8 ac 53 c6 6f 8b

11 e9 c2 8d 92 ^
5:....S.o......
04f0 7c 11 a3 a2 9
3 ae 12 cc 2b 16 d4
7c 6f fd 62 aa |
.......+..|o.b.
0500 dd d7 53 db 7
f 1f 34 bf cf cd 33
3c a3 ac 48 e5 .
.S...4...3<..H.
0510 39 b4 2a
9
.*
No. Time
Source
Destination
Protocol
Length Info
173 6.368441000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=104080 Win=37803 L
en=0
Frame 173: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.418371000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.418371000 s
econds
[Time delta fro
m previous captured
frame: 0.000188000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018800
0 seconds]
[Time since ref
erence or first fra
me: 6.368441000 sec
onds]
Frame Number: 1
73
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f58 (20312)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 10408
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 104080 (
relative ack number
)
Header Length:

20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37803
[Calculated win
dow size: 37803]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 172]
[The RTT to
ACK the segment wa
s: 0.000188000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 58 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OX@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
c9 f8 bd 50 10 .

....P..N.+...P.
0030 93 ab 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
174 6.498260000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=10408
0 Ack=1 Win=46 Len=
1260
Frame 174: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.548190000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.548190000 s
econds
[Time delta fro
m previous captured
frame: 0.129819000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12981900
0 seconds]
[Time since ref
erence or first fra
me: 6.498260000 sec
onds]
Frame Number: 1
74
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]

[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00

)
Total Length: 1
300
Identification:
0xf1d1 (61905)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a59 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 104080, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 104080 (relati
ve sequence number)
[Next sequence
number: 105340 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)

000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa44
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 d1 4
0 00 31 06 3a 59 4a
7c 0c 8a c0 a8 .
...@.1.:YJ|....
0020 01 0b 00 50 c
1 a6 2b c9 f8 bd 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e a4 40 0
0 00 57 26 12 26 1d
cc 58 d7 4c aa .
..@..W&.&..X.L.
0040 30 5a 64 0d 3
2 0e 72 5a d8 60 5b
b4 08 b3 9d 51 0
Zd.2.rZ.`[....Q

0050 d4 16 de 56 f
f 4b 60 18 0d cd 80
5b 9c ef b8 0c .
..V.K`....[....
0060 be 45 2e f8 2
4 14 0c 35 56 68 0e
ef 93 cb 4d ae .
E..$..5Vh....M.
0070 71 71 3c 21 5
f d5 23 66 1b 8d 2a
e1 bc d3 e3 e4 q
q<!_.#f..*.....
0080 c0 c6 25 d6 3
f f1 fc 90 33 ff fb
92 04 eb 0f f3 .
.%.?...3.......
0090 18 33 d3 03 3
8 6a e0 62 c5 9a 70
67 31 4c 0b a8 .
3..8j.b..pg1L..
00a0 b1 4e 0d 61 6
9 81 7c 96 6a 01 8c
bd 30 bf 8b c0 .
N.ai.|.j...0...
00b0 19 22 8b 56 e
6 ec 45 14 24 48 91
27 0a 4b a1 22 .
".V..E.$H.'.K."
00c0 09 18 6d 97 c
1 8f c4 8a 02 30 88
45 52 3b 93 56 .
.m......0.ER;.V
00d0 2f 01 83 97 1
9 94 44 dc 97 c5 f5
7e 5b b5 bc 1a /
.....D....~[...
00e0 22 63 c2 a5 d
a a0 5e 6a d7 b6 b0
49 a3 71 3b 69 "
c....^j...I.q;i
00f0 de d0 f4 b8 1
c 78 9f 47 1a fd 27
4c 20 ed 13 6f .
....x.G..'L ..o
0100 e3 4b 4d 63 f
c ab 6d e7 d7 ff fa
5b 1e 9e 91 2c .
KMc..m....[...,
0110 70 b1 97 86 1
1 2b ee a8 54 79 a9
1e 60 17 00 84 p
....+..Ty..`...
0120 1d b2 ca 98 2
c 9d 38 c1 49 d7 92
b3 80 96 66 0e .
...,.8.I.....f.
0130 ab 98 c7 1c f
2 3a a8 9d ac 1a d4
33 3b 16 78 71 .
....:.....3;.xq
0140 dd c7 ea 9e 4
1 49 40 23 26 7f 38
8b 97 ba 9e d0 .
...AI@#&.8.....
0150 59 23 94 f1 b
1 6b a5 13 70 67 cc
36 cb f7 b4 c5 Y
#...k..pg.6....
0160 62 ff 83 62 6

b f5 ad ff f1 f7 0e
9b d7 cb 43 9c b
..bk.........C.
0170 26 2c b1 3c 7
1 eb 68 53 7d 02 a2
9b e9 a2 58 10 &
,.<q.hS}.....X.
0180 84 2c 10 90 f
6 b3 91 0c 2c c3 34
89 50 51 b3 03 .
,......,.4.PQ..
0190 49 01 2a 88 8
d 91 29 c8 e4 3c dc
d2 ce 9a 5f 63 I
.*...)..<...._c
01a0 5a 6c 97 64 1
6 35 09 51 1f 61 19
32 b0 5a 09 f4 Z
l.d.5.Q.a.2.Z..
01b0 ad b2 80 f0 c
5 a1 8c 96 48 f3 c8
82 5c a1 d3 40 .
.......H...\..@
01c0 a6 b3 1f ff d
4 2f 31 a9 3f ff f8
b8 d6 7e 33 2d .
..../1.?....~301d0 5c c0 49 6d b
d 8e bf 4e aa 07 05
0e 88 2c c4 c3 \
.Im...N.....,..
01e0 13 38 80 12 f
4 0a 79 38 cc 30 f5
ba fc 96 56 fb .
8....y8.0....V.
01f0 ca cd 9f 94 9
d 02 2a 55 20 9e 8e
e0 cd 31 a5 83 .
.....*U ....1..
0200 fd ea 71 e4 1
8 e3 90 89 56 bb 66
87 52 cd 66 e3 .
.q.....V.f.R.f.
0210 4e 20 40 8f 2
b 11 41 c6 9a d1 48
8a 17 14 5e 67 N
@.+.A...H...^g
0220 49 4f 8f c3 3
6 91 91 55 25 bd 26
ff fb 92 04 e8 I
O..6..U%.&.....
0230 8f f2 f1 2b d
3 83 38 7a 60 5f a5
8a 70 67 0f 4c .
..+..8z`_..pg.L
0240 0c 34 af 4c 0
d 65 e9 81 7c 96 69
c1 9c 3d 30 9e .
4.L.e..|.i..=0.
0250 6e a2 6c d1 1
d 69 bb b3 a9 f6 63
34 3e 6a b3 01 n
.l..i....c4>j..
0260 40 71 0a 6c 2
8 50 1a d3 ed 0b 58
29 a0 ce ec 1e @
q.l(P....X)....
0270 15 0a 95 09 2
9 5c bc 8d d4 ec da

4e d9 7f 56 5a .
...)\.....N..VZ
0280 e8 94 c9 5a b
6 4c f1 39 df 8b 34
57 4b 3e d0 a6 .
..Z.L.9..4WK>..
0290 e0 36 20 98 3
5 d9 96 e4 3f 55 bb
de 8e 82 6c f7 .
6 .5...?U....l.
02a0 e1 6a 14 d1 6
6 bf 9f 3b fe 44 21
35 ed 5d ff bf .
j..f..;.D!5.]..
02b0 e9 26 bf ef b
5 3a 8b 8f 56 28 1b
7f 14 6d 4b 2a .
&...:..V(...mK*
02c0 14 cb cc 8b c
0 d4 1a 91 ac 09 a8
ea 8e 12 44 d6 .
.............D.
02d0 db 02 61 48 9
c c4 02 b1 77 40 e8
de 76 e5 66 c4 .
.aH....w@..v.f.
02e0 b3 72 b7 1a b
f 04 32 8c 24 76 36
c5 a4 dd 9f b3 .
r....2.$v6.....
02f0 72 5f 7a 85 d
9 9c 90 5f b5 e0 24
03 95 96 40 70 r
_z...._..$...@p
0300 4f 98 3b 2b 4
b c3 00 bc 2f 6d 5b
4a c5 39 55 f2 O
.;+K.../m[J.9U.
0310 70 89 fc f1 1
5 ff 37 99 99 fb da
b4 d6 30 c6 ee p
.....7......0..
0320 70 d8 c5 d3 f
0 52 70 2c b1 02 71
ab 46 05 09 f2 p
....Rp,..q.F...
0330 a8 00 7b 18 e
c 00 38 fa 34 8e cf
74 36 cd eb 38 .
.{...8.4..t6..8
0340 48 0a 54 ab 7
5 b8 4a 4d 76 f7 bb
8c b5 a8 6d 8b H
.T.u.JMv.....m.
0350 44 e1 39 26 2
6 ea 0e c2 41 14 99
c6 b1 96 a7 3e D
.9&&...A......>
0360 83 32 9f 25 4
f 51 49 7a 2d 3a 9f
59 70 df a9 3a .
2.%OQIz-:.Yp..:
0370 d3 fb b9 c3 0
f f5 d5 2a 8d 0a 2e
10 bd 01 3e 05 .
......*......>.
0380 bb 24 1a 6c 4
8 38 a6 34 9a d6 7e
01 06 73 61 02 .

$.lH8.4..~..sa.
0390 1c 3f 4a a0 1
7 13 ff 22 b7 a6 14
e7 5b 80 1f 9a .
?J...."....[...
03a0 f0 12 f1 af 6
2 cf 85 88 ff ee 0d
2f 24 46 b4 54 .
...b....../$F.T
03b0 b2 a3 e7 ff 2
3 bc 90 c7 fe b1 56
31 77 3a 45 df .
...#.....V1w:E.
03c0 fd 78 f3 62 f
1 6c f2 d6 f9 d5 75
37 f9 ff fb 92 .
x.b.l....u7....
03d0 04 e8 0f f3 0
c 34 d3 83 58 82 e0
60 85 9a 60 63 .
....4..X..`..`c
03e0 0f 4c 0b bc d
7 4e 0c e1 0b 81 65
1a a9 c1 87 b5 .
L...N....e.....
03f0 70 64 5c 40 b
5 bb a7 ce e9 5d e8
5f f4 28 98 36 p
d\@.....]._.(.6
0400 01 88 16 69 4
3 1a 60 e6 10 88 70
f4 87 0a 11 47 .
..iC.`...p....G
0410 c6 68 77 4c 7
2 12 6a 23 de 8b c3
0b 7f e1 53 b1 .
hwLr.j#......S.
0420 07 8d 6f 50 d
e 9f cd e6 9c e5 cb
33 0a 9a 06 cf .
.oP.......3....
0430 57 99 d6 a0 9
b d1 92 4b 50 bf c9
cc 62 db e6 ce W
......KP...b...
0440 0c 5d 49 6f 0
6 ba c7 5e 1b 55 ec
74 c6 fd 3f 81 .
]Io...^.U.t..?.
0450 3f fe 02 b0 8
c bf b8 4b fd 6e fe
51 1c 41 2a 9b ?
......K.n.Q.A*.
0460 6a 9a b3 85 1
6 04 10 1d 6c 24 c6
06 04 7e 4c 31 j
.......l$...~L1
0470 dc 9d 24 eb d
a e1 80 e7 31 a9 aa
06 e4 c5 2f 3d .
.$.....1...../=
0480 53 d0 cc 21 e
a 8d 6a d6 d3 0d 16
ec d6 b9 84 e5 S
..!..j.........
0490 ea b0 2c 28 6
8 5c 23 d6 40 68 b0
5a 5d 00 64 8e .
.,(h\#.@h.Z].d.

04a0 28 dd d7 f1 8
0 c8 56 9a 0c ae eb
3a 2b d0 d3 05 (
.....V....:+...
04b0 7e 68 6b fc 7
1 fa 63 35 d6 a7 33
fe 84 21 19 54 ~
hk.q.c5..3..!.T
04c0 c1 38 f5 48 d
9 54 18 90 70 4b 48
46 53 ca d7 01 .
8.H.T..pKHFS...
04d0 e0 44 9e 43 3
c 39 63 0f 1f aa 5b
2a b7 17 4f d6 .
D.C<9c...[*..O.
04e0 a7 65 9e 46 a
1 97 e5 dc 8d 50 de
dc 15 95 56 39 .
e.F.....P....V9
04f0 d1 32 3b 4e a
8 43 54 ba 82 b3 27
72 b0 27 99 31 .
2;N.CT...'r.'.1
0500 5a a3 cf 6d 6
1 40 c7 a2 65 20 7b
7f 92 ee bd c4 Z
..ma@..e {.....
0510 3a df 32 79 4
e 63 9a 79 ff af fc
82 5a 08 02 30 :
.2yNc.y....Z..0
0520 c2 32
.
2
No. Time
Source
Destination
Protocol
Length Info
175 6.516256000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
874 http49
574 [PSH, ACK] Seq=
105340 Ack=1 Win=46
Len=820
Frame 175: 874 byte
s on wire (6992 bit
s), 874 bytes captu
red (6992 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.566186000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615219.566186000 s
econds
[Time delta fro
m previous captured
frame: 0.017996000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01799600
0 seconds]
[Time since ref
erence or first fra
me: 6.516256000 sec
onds]
Frame Number: 1
75
Frame Length: 8
74 bytes (6992 bits
)
Capture Length:
874 bytes (6992 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
60
Identification:
0xf1d2 (61906)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3c10 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]

[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 105340, Ack:
1, Len: 820
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 820]
Sequence number
: 105340 (relati
ve sequence number)
[Next sequence
number: 106160 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe2c
a [validation disab
led]

[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2080]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5c f1 d2 4
0 00 31 06 3c 10 4a
7c 0c 8a c0 a8 .
\..@.1.<.J|....
0020 01 0b 00 50 c
1 a6 2b c9 fd a9 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e e2 ca 0
0 00 44 13 c4 60 c2
b6 e4 68 26 a7 .
.....D..`...h&.
0040 8f 8d 16 5f 5
d 77 e5 25 05 23 94
32 fa cf 43 8f .
.._]w.%.#.2..C.
0050 f9 46 2e 4a 2
0 7b 57 f5 ef 93 42
c5 d3 fa e5 94 .
F.J {W...B.....
0060 c4 d2 35 b0 b
2 00 b4 d0 66 6a 13
0a b7 29 b5 fc .
.5.....fj...)..
0070 e8 d0 bf c9 f
7 74 f7 cc e6 5e d6
d4 7f ec 0d 3f .
....t...^.....?
0080 b8 28 24 ff f
b 92 04 ea 0f f3 11
2c d3 03 58 7a .
($........,..Xz
0090 60 5e a5 7a 5
0 6b 0f 4c 0c 18 d5
4e 0c e1 0b 81 `
^.zPk.L...N....
00a0 7c 97 69 41 9
c ad 30 8d 8d 46 bf
ff fa fe 86 40 |
.iA..0..F.....@
00b0 17 11 87 0a e
8 2a 04 5e 76 57 fa
d3 71 d8 82 28 .
....*.^vW..q..(
00c0 d0 3e 85 81 5
6 3b ca 0f 05 6d e2
e5 de 57 0f 20 .
>..V;...m...W.
00d0 30 53 7b cd 2
6 8b a6 ef ab f1 66
5d 8f 5f f9 51 0
S{.&.....f]._.Q
00e0 35 fe 59 59 2
6 b9 47 d7 fe cd 29

71 ea 2a ed d7 5
.YY&.G...)q.*..
00f0 d9 ce 65 fc a
6 39 d3 8d 68 58 2c
70 1f 04 00 09 .
.e..9..hX,p....
0100 0f 13 44 bb c
8 20 ff a5 4e e9 83
40 0b 06 70 1c .
.D.. ..N..@..p.
0110 a3 cb d8 98 7
c 18 63 d2 c4 e4 04
d2 75 f0 a1 57 .
...|.c.....u..W
0120 22 04 55 cd 5
2 c0 ae 60 8e ce a3
4a c2 4c 38 4d "
.U.R..`...J.L8M
0130 5a 48 5f da 6
5 2c 4a 69 ed 62 1a
87 60 9b 23 c0 Z
H_.e,Ji.b..`.#.
0140 1c 15 54 c7 0
3 8e 5b 94 d3 6c 66
50 2e 9a 1b 9d .
.T...[..lfP....
0150 92 8d ad cc c
0 f7 34 1b 11 18 11
05 c2 66 4a 81 .
.....4......fJ.
0160 80 a3 d4 28 0
1 65 7a d2 f6 bd 48
57 ff ff fa 5e .
..(.ez...HW...^
0170 31 95 85 4d 1
8 4b 94 19 92 b1 04
d2 4c 36 e0 f2 1
..M.K......L6..
0180 9d a2 ec 98 2
a 45 85 5c c9 0a 35
e0 ce ee 0c 68 .
...*E.\..5....h
0190 f4 ac ba 91 4
b b8 76 b9 86 14 81
ed 5a 70 d3 76 .
...K.v.....Zp.v
01a0 1e 93 3d cc 3
6 d5 a1 c4 49 cb 59
66 5a ac 10 e2 .
.=.6...I.YfZ...
01b0 da 9e 54 a6 b
4 d5 a5 a3 14 9a 11
09 40 41 50 99 .
.T.........@AP.
01c0 d3 42 c1 53 c
1 a0 68 a8 05 a3 dc
b1 f7 92 21 7b .
B.S..h.......!{
01d0 8f 3f ff eb 2
c 04 e2 12 f9 2c d0
c5 23 3a 09 d3 .
?..,....,..#:..
01e0 3c b9 8d bb 5
1 68 72 3f 32 9b 65
41 38 4c 68 29 <
...Qhr?2.eA8Lh)
01f0 11 91 5f b9 c
4 4f 9a 6a 3d c2 0a
00 42 00 4d b2 .

._..O.j=...B.M.
0200 06 10 12 20 2
8 9a 15 57 d4 90 61
08 ae 3e 6d 43 .
.. (..W..a..>mC
0210 14 6e 6c 49 4
9 ff 3c cb df 58 bc
c8 07 c1 00 c0 .
nlII.<..X......
0220 20 00 0c 39 c
f ff fb 92 04 e8 8f
f2 d4 2e d4 83
..9............
0230 38 4a 60 5b 8
5 8a a0 61 ec 4c 0c
a8 b1 54 0c 3d 8
J`[...a.L...T.=
0240 09 81 93 16 a
b 41 87 a5 30 7b 3b
ee 0c 69 d7 46 .
....A..0{;..i.F
0250 c7 3d 43 3f f
f dd e3 cb 01 38 8c
6a 6c 11 ad a4 .
=C?.....8.jl...
0260 ab e3 18 41 8
4 7c 5e 30 98 1f 90
05 0d 8d f2 b2 .
..A.|^0........
0270 65 62 18 ac 7
b 76 c7 8a f5 7a 17
89 31 c0 d0 80 e
b..{v...z..1...
0280 7e 82 81 53 c
9 94 d9 c1 18 8d 25
04 03 e4 a1 7c ~
..S......%....|
0290 4c 9d cc 2a c
2 c8 09 0e 10 11 dc
df 32 e1 f2 6f L
..*........2..o
02a0 40 7c 10 38 2
0 12 18 0f 98 87 ef
59 f0 23 ae 7f @
|.8 ......Y.#..
02b0 97 ff f3 ff 2
f f5 fc 60 1b c1 4a
35 87 f0 68 0e .
.../..`..J5..h.
02c0 f5 66 d4 da 1
d 00 82 a8 27 68 ca
0b 13 24 dc c9 .
f......'h...$..
02d0 85 26 c9 79 3
b 29 98 16 28 98 d1
b0 88 3b 0f 24 .
&.y;)..(....;.$
02e0 d1 65 ec cd 0
0 4f a6 8d 41 fb b6
31 cf 2d 0a 03 .
e...O..A..1.-..
02f0 c8 5b e9 a2 f
3 ce 03 3e b1 c5 89
24 99 dd 6c b8 .
[.....>...$..l.
0300 59 69 2e cb f
4 0e 8b 13 fd e9 9a
af a7 58 2e c1 Y
i...........X..

0310 82 5a 94 ea 6
2 07 10 e5 2e 85 e5
90 08 44 80 54 .
Z..b........D.T
0320 ca e1 46 5f 4
8 a8 b3 24 c8 63 ac
b2 24 27 90 a5 .
.F_H..$.c..$'..
0330 d1 54 b9 a4 8
9 10 ab 03 26 16 30
ac 16 84 11 68 .
T......&.0....h
0340 7c a2 4e 50 3
4 35 b3 33 c3 35 76
37 b2 01 26 24 |
.NP45.3.5v7..&$
0350 41 01 0e 05 4
f 3c ed 45 87 a9 79
c5 be eb 20 44 A
...O<.E..y... D
0360 ad e1 f6 90 c
7 ff ff ae 41 35
.
.......A5
No. Time
Source
Destination
Protocol
Length Info
176 6.516434000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=106160 Win=38430 L
en=0
Frame 176: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.566364000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.566364000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]

[Time since ref

erence or first fra
me: 6.516434000 sec
onds]
Frame Number: 1
76
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f59 (20313)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 10616
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]

[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 106160 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 175]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1

7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 59 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(OY@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 00 dd 50 10 .
....P..N.+...P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
177 6.519937000
pc13.home
livebox.home
DNS
132 Standard que
ry 0x997e PTR d.f.
f.2.9.1.e.f.f.f.b.f
.1.5.a.8.0.0.0.0.0.
0.0.0.0.0.0.0.0.8.e
.f.ip6.arpa
Frame 177: 132 byte
s on wire (1056 bit
s), 132 bytes captu
red (1056 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.569867000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.569867000 s
econds
[Time delta fro
m previous captured
frame: 0.003503000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00350300
0 seconds]
[Time since ref
erence or first fra
me: 6.519937000 sec
onds]
Frame Number: 1
77
Frame Length: 1
32 bytes (1056 bits

)
Capture Length:
132 bytes (1056 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
18
Identification:
0x4f5a (20314)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4980
5 (49805), Dst Port
: domain (53)
Source Port: 49
805 (49805)
Destination Por
t: domain (53)
Length: 98
Checksum: 0x83d
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
6]
Domain Name System
(query)
[Response In: 1
78]
Transaction ID:
0x997e
Flags: 0x0100 S

tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
d.f.f.2.9.1
.e.f.f.f.b.f.1.5.a.
8.0.0.0.0.0.0.0.0.0
.0.0.0.0.8.e.f.ip6.
arpa: type PTR, cla
ss IN
Name: d
.f.f.2.9.1.e.f.f.f.
b.f.1.5.a.8.0.0.0.0
.0.0.0.0.0.0.0.0.0.
8.e.f.ip6.arpa
[Name L
ength: 72]
[Label
Count: 34]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 76 4f 5a 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
vOZ............
0020 01 01 c2 8d 0
0 35 00 62 83 d0 99
7e 01 00 00 01 .
....5.b...~....
0030 00 00 00 00 0
0 00 01 64 01 66 01
66 01 32 01 39 .
......d.f.f.2.9
0040 01 31 01 65 0
1 66 01 66 01 66 01

62 01 66 01 31 .
1.e.f.f.f.b.f.1
0050 01 35 01 61 0
1 38 01 30 01 30 01
30 01 30 01 30 .
5.a.8.0.0.0.0.0
0060 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 30 .
0.0.0.0.0.0.0.0
0070 01 38 01 65 0
1 66 03 69 70 36 04
61 72 70 61 00 .
8.e.f.ip6.arpa.
0080 00 0c 00 01
.
...
No. Time
Source
Destination
Protocol
Length Info
178 6.565260000
livebox.home
pc13.home
DNS
167 Standard que
ry response 0x997e
No such name
Frame 178: 167 byte
s on wire (1336 bit
s), 167 bytes captu
red (1336 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.615190000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.615190000 s
econds
[Time delta fro
m previous captured
frame: 0.045323000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04532300
0 seconds]
[Time since ref
erence or first fra
me: 6.565260000 sec
onds]
Frame Number: 1
78
Frame Length: 1
67 bytes (1336 bits

)
Capture Length:
167 bytes (1336 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
53
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb6f7 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49805 (49805)
Source Port: do
main (53)
Destination Por
t: 49805 (49805)
Length: 133
Checksum: 0xa85
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
6]
Domain Name System
(response)
[Request In: 17
7]
[Time: 0.045323
000 seconds]

Transaction ID:
0x997e
Flags: 0x8583 S
tandard query respo
nse, No such name
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .1.. .
... .... = Authorit
ative: Server is an
authority for doma
in
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0011 = Reply co
de: No such name (3
)
Questions: 1
Answer RRs: 0
Authority RRs:
1
Additional RRs:
0
Queries
d.f.f.2.9.1
.e.f.f.f.b.f.1.5.a.
8.0.0.0.0.0.0.0.0.0
.0.0.0.0.8.e.f.ip6.
arpa: type PTR, cla
ss IN
Name: d
.f.f.2.9.1.e.f.f.f.
b.f.1.5.a.8.0.0.0.0
.0.0.0.0.0.0.0.0.0.
8.e.f.ip6.arpa
[Name L
ength: 72]
[Label
Count: 34]

Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Authoritative n
ameservers
8.e.f.ip6.a
rpa: type SOA, clas
s IN, mname 8.e.f.i
p6.arpa
Name: 8
.e.f.ip6.arpa
Type: S
OA (Start Of a zone
of Authority) (6)
Class:
IN (0x0001)
Time to
live: 86400
Data le
ngth: 23
Primary
name server: 8.e.f
.ip6.arpa
Respons
ible authority's ma
ilbox: <Root>
Serial
Number: 0
Refresh
Interval: 28800 (8
hours)
Retry I
nterval: 7200 (2 ho
urs)
Expire
limit: 604800 (7 da
ys)
Minimum
TTL: 86400 (1 day)
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 99 00 00 4
0 00 40 11 b6 f7 c0
a8 01 01 c0 a8 .
...@.@.........
0020 01 0b 00 35 c
2 8d 00 85 a8 5f 99
7e 85 83 00 01 .
..5....._.~....
0030 00 00 00 01 0
0 00 01 64 01 66 01
66 01 32 01 39 .
......d.f.f.2.9
0040 01 31 01 65 0
1 66 01 66 01 66 01
62 01 66 01 31 .
1.e.f.f.f.b.f.1
0050 01 35 01 61 0
1 38 01 30 01 30 01
30 01 30 01 30 .
5.a.8.0.0.0.0.0
0060 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 30 .

0.0.0.0.0.0.0.0
0070 01 38 01 65 0
1 66 03 69 70 36 04
61 72 70 61 00 .
8.e.f.ip6.arpa.
0080 00 0c 00 01 c
0 46 00 06 00 01 00
01 51 80 00 17 .
....F......Q...
0090 c0 46 00 00 0
0 00 00 00 00 70 80
00 00 1c 20 00 .
F.......p.... .
00a0 09 3a 80 00 0
1 51 80
.
:...Q.
No. Time
Source
Destination
Protocol
Length Info
179 6.571254000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=10616
0 Ack=1 Win=46 Len=
1260
Frame 179: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.621184000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.621184000 s
econds
[Time delta fro
m previous captured
frame: 0.005994000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00599400
0 seconds]
[Time since ref
erence or first fra
me: 6.571254000 sec
onds]
Frame Number: 1
79
Frame Length: 1

314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1d3 (61907)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a57 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 106160, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 106160 (relati
ve sequence number)

[Next sequence
number: 107420 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa13
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 d3 4
0 00 31 06 3a 57 4a
7c 0c 8a c0 a8 .
...@.1.:WJ|....

0020 01 0b 00 50 c
1 a6 2b ca 00 dd 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e a1 30 0
0 00 2a bd 67 aa 65
31 4e 56 a2 e3 .
..0..*.g.e1NV..
0040 c9 e1 fb 98 3
2 d8 0f ce ce 54 85
0f 46 d0 d5 a7 .
...2....T..F...
0050 67 26 c4 ea 5
3 a1 45 cf 7e 46 b6
a7 3e 98 ea 36 g
&..S.E.~F..>..6
0060 72 b7 3c dd 9
5 a7 be 53 a0 d1 54
84 88 e4 32 7a r
.<....S..T...2z
0070 56 3d ac ca 9
9 5c d8 e2 e5 cf f2
8b 95 43 e5 6b V
=...\.......C.k
0080 ff c9 4b e1 7
7 77 dc f2 d4 bf fe
9f e8 b8 d6 ca .
.K.ww..........
0090 b1 46 70 ff f
b 92 04 e7 8f f2 fa
27 d7 83 0f 4a .
Fp........'...J
00a0 50 60 64 7a f
0 61 e9 4a 0a c0 85
66 07 a4 c9 41 P
`dz.a.J...f...A
00b0 6f 14 ac c0 f
4 99 30 00 c3 d6 08
6e 16 2e 4c aa o
.....0....n..L.
00c0 95 26 ef 3c 8
c e5 9c df 8b ad 2e
f0 d0 79 18 d2 .
&.<.........y..
00d0 72 a0 6a ba f
c cc 39 39 bd ad 4b
5d 75 0f db e0 r
.j...99..K]u...
00e0 bc c2 ad da 0
f 14 1c 79 61 c8 54
f3 61 65 e0 95 .
......ya.T.ae..
00f0 35 04 4a 61 6
2 a0 fc 46 54 e0 90
1b 3a a0 a1 27 5
.Jab..FT...:..'
0100 02 51 40 65 a
8 8a b0 94 a0 25 73
af 0c 9f 33 24 .
Q@e.....%s...3$
0110 4f 79 e1 5d 2
b be bd 49 7d 8b 68
bd ab 12 50 5d O
y.]+..I}.h...P]
0120 0f a0 d4 02 f
9 20 a6 50 2c b1 2a
cd 28 06 cc 21 .
.... .P,.*.(..!
0130 40 19 37 02 1

0 b0 89 1a 83 8d 52
dd 45 9c c0 4e @
.7.......R.E..N
0140 34 8b 52 8b 3
1 87 6a 5d 95 b6 5d
9e c8 56 a2 29 4
.R.1.j]..]..V.)
0150 88 ca 63 ed 6
9 35 ba 0e 8a b2 53
ba d1 92 8b 27 .
.c.i5....S....'
0160 43 ba a2 e9 f
2 bb 1f 2e 76 65 31
64 42 fa 6e e4 C
.......ve1dB.n.
0170 75 e6 df 1c c
f 68 e6 7d 9d 50 67
da 8b e4 23 a0 u
....h.}.Pg...#.
0180 a2 3f 20 20 9
d 12 f6 c5 4b 13 3b
70 d9 59 5d b5 .
? ....K.;p.Y].
0190 8b cf dc 5f 0
3 d1 30 59 a6 35 6a
b5 5c 39 67 ad .
.._..0Y.5j.\9g.
01a0 7e ac 7c e2 d
b 2e 4f 5e b2 e4 23
1b 28 ca e2 02 ~
.|...O^..#.(...
01b0 5c 58 82 60 2
6 b9 1c 8b ad 04 46
fe 5a 7f e7 6d \
X.`&.....F.Z..m
01c0 24 e9 e4 5f e
7 77 2e 7f 01 11 a9
fa fd 9b 96 cb $
.._.w..........
01d0 2f 4f 99 dc 6
3 c3 c8 5e d3 2b 51
11 b5 23 bc 51 /
O..c..^.+Q..#.Q
01e0 bd 2a 1c 01 7
2 c7 b2 dd d0 72 08
a2 75 5b 04 6c .
*..r....r..u[.l
01f0 9e 0e 8f 27 4
4 a4 46 04 bf 66 e9
49 42 53 4b dd .
..'D.F..f.IBSK.
0200 74 e9 e8 43 2
6 07 a0 b4 aa 95 91
51 42 66 6c 3c t
..C&......QBfl<
0210 b0 b6 e3 4a 1
d 6b 43 26 74 1c ed
2e b7 7f ef 58 .
..J.kC&t......X
0220 d5 05 4f 0a 8
c 40 ae d7 91 ba 1d
49 18 c1 71 51 .
.O..@.....I..qQ
0230 8c 67 2a 2e c
5 ff fb 92 04 ed 8f
f3 26 4d d9 03 .
g*.........&M..
0240 0c 1a f0 5e 4
4 5b 30 61 88 4a 0c

1d 45 64 07 a4 .
..^D[0a.J..Ed..
0250 4b c9 8e 25 a
c 80 f6 0d 78 30 eb
eb 9e 4c 32 cb K
..%....x0...L2.
0260 39 1a 1b e8 5
8 04 4f 2b 13 11 6b
0f 44 91 bd 5f 9
...X.O+..k.D.._
0270 12 3b 87 1a 1
b 18 ba 44 64 3b 65
bc 57 ae 4d 50 .
;.....Dd;e.W.MP
0280 19 e0 d5 8a 7
c b6 c4 ac f1 a1 5d
ea 1e 29 4e 50 .
...|.....]..)NP
0290 80 2e 11 9a 4
c 86 04 6b 6a 57 5b
84 20 51 5a 5b .
...L..kjW[. QZ[
02a0 78 fb b8 1b 5
3 68 3d ea 6b d2 27
fc 6b 15 44 84 x
...Sh=.k.'.k.D.
02b0 d6 2a 56 dd 9
9 f6 39 05 94 a7 d6
79 eb d1 b3 a9 .
*V...9....y....
02c0 55 94 51 37 c
7 92 5f d8 a2 f2 66
ec f6 2e a8 67 U
.Q7.._...f....g
02d0 3a d3 48 98 0
a d0 d5 51 cd 40 8b
78 ce da 71 38 :
.H....Q.@.x..q8
02e0 40 79 3b 24 2
6 c9 d1 d1 6e a3 8d
b7 ec 2f 25 32 @
y;$&...n..../%2
02f0 0c c2 cc 74 6
b b5 c7 52 a8 8e 0b
66 7f 7e 21 be .
..tk..R...f.~!.
0300 e6 cb f7 d8 7
6 cd f9 9c bd 69 f3
97 3c 99 11 c8 .
...v....i..<...
0310 6a 8f ba c5 b
9 8d 0b 8b 0d 9e 36
63 4a 6d 27 bd j
.........6cJm'.
0320 6a 4b 96 44 9
1 17 41 0f 21 86 4a
21 37 a2 56 63 j
K.D..A.!.J!7.Vc
0330 3a 01 44 71 a
6 95 6c 95 12 6a c4
56 2f bd 59 6d :
.Dq..l..j.V/.Ym
0340 47 43 89 13 1
3 5a 13 d7 17 77 53
26 43 95 40 5e G
C...Z...wS&C.@^
0350 e7 96 49 82 2
0 d0 c0 47 44 50 c0
ec ca 14 1c 53 .

.I. ..GDP.....S
0360 20 65 07 cd d
d 4a 4a c9 d6 ad 9b
f3 d3 5d 7f 8d
e...JJ......]..
0370 a6 9c b9 e4 d
2 3b 28 59 66 99 a6
5a ba 90 8b 8d .
....;(Yf..Z....
0380 aa f6 f1 fb d
5 4b 72 cc 09 58 42
21 e5 3b ab b5 .
....Kr..XB!.;..
0390 5d 2c 0c b0 b
0 22 27 2d 1b 98 13
a6 25 1c fc 8a ]
,..."'-....%...
03a0 85 f9 56 99 2
3 41 82 e9 bf 71 de
cd 16 8d 43 12 .
.V.#A...q....C.
03b0 35 04 50 51 5
5 e0 a7 0e ed 6c 55
e6 99 28 e9 bf 5
.PQU....lU..(..
03c0 af bc e6 7e 7
d fc 6f f9 a6 ac 22
c1 7a 0b 3e 19 .
..~}.o...".z.>.
03d0 75 6e 01 2d 4
3 5a c1 ff fb 92 04
e8 8f f2 f0 27 u
n.-CZ.........'
03e0 58 83 0c 42 5
0 5b c6 1b 20 61 e8
4c 0c 80 c1 5e X
..BP[.. a.L...^
03f0 0c 3c c9 81 8
4 98 ac 00 f7 a1 30
8c b5 6e 49 73 .
<........0..nIs
0400 f8 6e 8b 11 5
b 91 46 96 e6 80 41
63 3d 8c da 8a .
n..[.F...Ac=...
0410 3c f9 a6 ec a
2 28 92 82 f1 f4 49
b2 d2 2b 4f 5b <
....(....I..+O[
0420 d4 12 59 79 a
b ec 31 37 67 de 47
5a 5f a2 27 33 .
.Yy..17g.GZ_.'3
0430 17 53 8a 12 8
3 5d c2 cf 0f 6f 13
9b 47 88 82 08 .
S...]...o..G...
0440 93 4f b6 ae 2
5 aa 62 aa a9 16 da
3e fd 6f e2 b6 .
O..%.b....>.o..
0450 bf be ea ff a
f db 9e 3f ff 81 98
be f1 fd 8e 77 .
......?.......w
0460 fa 97 48 a8 4
0 43 1c 69 76 1a 0b
1f 57 97 9b 46 .
.H.@C.iv...W..F

0470 f2 5c 92 24 a
3 25 89 d5 e5 8b 75
c1 aa ae 57 af .
\.$.%....u...W.
0480 62 ee 57 9b 3
b c3 13 ad c3 80 c5
33 86 f3 43 09 b
.W.;......3..C.
0490 0e 0f 1e 78 a
0 d1 45 36 df 22 19
e0 e3 42 57 59 .
..x..E6."...BWY
04a0 4e 3a e9 74 6
9 d1 6f a4 a7 9e 2b
9f fb 9f 89 a6 N
:.ti.o...+.....
04b0 b4 4a f5 a9 9
5 f4 7f 1b 65 8b 9b
60 9c 8e 2b 55 .
J......e..`..+U
04c0 48 d0 25 e8 3
8 44 5c 03 31 40 4b
05 c1 16 d4 55 H
.%.8D\.1@K....U
04d0 9a 87 49 44 b
8 18 90 cf a2 21 c1
13 f0 20 21 2f .
.ID.....!... !/
04e0 38 81 b7 99 e
6 e3 46 59 7b 65 83
a7 06 38 ce 96 8
.....FY{e...8..
04f0 c1 c3 53 e4 3
1 31 10 82 28 97 3c
e9 95 a4 6f 47 .
.S.11..(.<...oG
0500 ce 98 ec 5a a
6 ff 87 cb 5c ad 44
3f 65 53 e7 ef .
..Z....\.D?eS..
0510 87 d7 3f df c
7 7b e7 89 99 99 fb
8b d5 cb 25 c6 .
.?..{........%.
0520 c5 09
.
.
No. Time
Source
Destination
Protocol
Length Info
180 6.597248000
pc13.home
livebox.home
DNS
132 Standard que
ry 0xe6de PTR 2.0.
0.0.1.0.0.0.0.0.0.0
.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.2.0.f
.f.ip6.arpa
Frame 180: 132 byte
s on wire (1056 bit
s), 132 bytes captu
red (1056 bits) on

interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.647178000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.647178000 s
econds
[Time delta fro
m previous captured
frame: 0.025994000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02599400
0 seconds]
[Time since ref
erence or first fra
me: 6.597248000 sec
onds]
Frame Number: 1
80
Frame Length: 1
32 bytes (1056 bits
)
Capture Length:
132 bytes (1056 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
18
Identification:
0x4f5c (20316)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho

me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4980
5 (49805), Dst Port
: domain (53)
Source Port: 49
805 (49805)
Destination Por
t: domain (53)
Length: 98
Checksum: 0x83d
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
6]
Domain Name System
(query)
[Response In: 1
81]
Transaction ID:
0xe6de
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
2.0.0.0.1.0
.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0
.0.0.0.2.0.f.f.ip6.
arpa: type PTR, cla
ss IN

Name: 2
.0.0.0.1.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0
.0.0.0.0.0.0.0.0.2.
0.f.f.ip6.arpa
[Name L
ength: 72]
[Label
Count: 34]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 76 4f 5c 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
vO\............
0020 01 01 c2 8d 0
0 35 00 62 83 d0 e6
de 01 00 00 01 .
....5.b........
0030 00 00 00 00 0
0 00 01 32 01 30 01
30 01 30 01 31 .
......2.0.0.0.1
0040 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 30 .
0.0.0.0.0.0.0.0
0050 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 30 .
0.0.0.0.0.0.0.0
0060 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 32 .
0.0.0.0.0.0.0.2
0070 01 30 01 66 0
1 66 03 69 70 36 04
61 72 70 61 00 .
0.f.f.ip6.arpa.
0080 00 0c 00 01
.
...
No. Time
Source
Destination
Protocol
Length Info
181 6.635556000
livebox.home
pc13.home
DNS
202 Standard que
ry response 0xe6de
No such name
Frame 181: 202 byte
s on wire (1616 bit
s), 202 bytes captu
red (1616 bits) on

interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.685486000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.685486000 s
econds
[Time delta fro
m previous captured
frame: 0.038308000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03830800
0 seconds]
[Time since ref
erence or first fra
me: 6.635556000 sec
onds]
Frame Number: 1
81
Frame Length: 2
02 bytes (1616 bits
)
Capture Length:
202 bytes (1616 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
88
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb6d4 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]

Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49805 (49805)
Source Port: do
main (53)
Destination Por
t: 49805 (49805)
Length: 168
Checksum: 0x244
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
6]
Domain Name System
(response)
[Request In: 18
0]
[Time: 0.038308
000 seconds]
Transaction ID:
0xe6de
Flags: 0x8183 S
tandard query respo
nse, No such name
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .0.. .
... .... = Authorit
ative: Server is no
t an authority for
domain
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe

r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0011 = Reply co
de: No such name (3
)
Questions: 1
Answer RRs: 0
Authority RRs:
1
Additional RRs:
0
Queries
2.0.0.0.1.0
.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0
.0.0.0.2.0.f.f.ip6.
arpa: type PTR, cla
ss IN
Name: 2
.0.0.0.1.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0
.0.0.0.0.0.0.0.0.2.
0.f.f.ip6.arpa
[Name L
ength: 72]
[Label
Count: 34]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Authoritative n
ameservers
ip6.arpa: t
ype SOA, class IN,
mname b.ip6-servers
.arpa
Name: i
p6.arpa
Type: S
OA (Start Of a zone
of Authority) (6)
Class:
IN (0x0001)
Time to
live: 1973
Data le
ngth: 58
Primary
name server: b.ip6
-servers.arpa
Respons
ible authority's ma
ilbox: hostmaster.i
cann.org
Serial
Number: 2014062581
Refresh
Interval: 1800 (30
minutes)
Retry I
nterval: 900 (15 mi

nutes)
Expire
limit: 604800 (7 da
ys)
Minimum
TTL: 3600 (1 hour)
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 bc 00 00 4
0 00 40 11 b6 d4 c0
a8 01 01 c0 a8 .
...@.@.........
0020 01 0b 00 35 c
2 8d 00 a8 24 41 e6
de 81 83 00 01 .
..5....$A......
0030 00 00 00 01 0
0 00 01 32 01 30 01
30 01 30 01 31 .
......2.0.0.0.1
0040 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 30 .
0.0.0.0.0.0.0.0
0050 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 30 .
0.0.0.0.0.0.0.0
0060 01 30 01 30 0
1 30 01 30 01 30 01
30 01 30 01 32 .
0.0.0.0.0.0.0.2
0070 01 30 01 66 0
1 66 03 69 70 36 04
61 72 70 61 00 .
0.f.f.ip6.arpa.
0080 00 0c 00 01 c
0 4c 00 06 00 01 00
00 07 b5 00 3a .
....L.........:
0090 01 62 0b 69 7
0 36 2d 73 65 72 76
65 72 73 c0 50 .
b.ip6-servers.P
00a0 0a 68 6f 73 7
4 6d 61 73 74 65 72
05 69 63 61 6e .
hostmaster.ican
00b0 6e 03 6f 72 6
7 00 78 0c 27 f5 00
00 07 08 00 00 n
.org.x.'.......
00c0 03 84 00 09 3
a 80 00 00 0e 10
.
...:.....
No. Time
Source
Destination
Protocol
Length Info
182 6.664265000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home

TCP
1306 http49
574 [PSH, ACK] Seq=
107420 Ack=1 Win=46
Len=1252
Frame 182: 1306 byt
es on wire (10448 b
its), 1306 bytes ca
ptured (10448 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.714195000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.714195000 s
econds
[Time delta fro
m previous captured
frame: 0.028709000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02870900
0 seconds]
[Time since ref
erence or first fra
me: 6.664265000 sec
onds]
Frame Number: 1
82
Frame Length: 1
306 bytes (10448 bi
ts)
Capture Length:
1306 bytes (10448
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
292
Identification:
0xf1d4 (61908)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a5e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 107420, Ack:
1, Len: 1252
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1252]
Sequence number
: 107420 (relati
ve sequence number)
[Next sequence
number: 108672 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x496
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2512]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0c f1 d4 4
0 00 31 06 3a 5e 4a
7c 0c 8a c0 a8 .
...@.1.:^J|....
0020 01 0b 00 50 c
1 a6 2b ca 05 c9 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 49 61 0
0 00 ca 5d ad 99 9f
28 0a 01 b8 4c .
.Ia...]...(...L
0040 40 74 1f 24 e
0 c8 09 90 71 22 91
e5 81 31 04 80 @
t.$....q"...1..
0050 35 31 1f f3 5
7 4d 4f 51 d1 5c 5b
e1 49 02 36 a5 5
1..WMOQ.\[.I.6.
0060 77 e0 d8 e4 0
e f9 1b 9d cc 45 1d
81 e8 f5 03 87 w
........E......
0070 d9 9a 1a f4 4
c 41 d3 d7 f4 eb cc
df d2 2f 10 37 .
...LA......./.7
0080 81 f5 8a c8 9
a 9e 39 73 a4 1a 45
61 35 ff fb 92 .

.....9s..Ea5...
0090 04 e8 0f f2 f
4 2b 57 83 0f 32 60
59 c8 5b 10 61 .
....+W..2`Y.[.a
00a0 88 5c 0c 59 0
1 5c 0c 3d 0b 81 8f
a0 2b c0 f6 2d .
\.Y.\.=....+..00b0 70 65 0e 3d d
e 2d ad 6e aa ce 81
38 32 02 4a 80 p
e.=.-.n...82.J.
00c0 3f 49 83 e2 2
5 74 84 2b c8 d2 b2
51 f0 fa 14 3a ?
I..%t.+...Q...:
00d0 66 8b db 59 a
b c6 fb 62 36 f5 06
77 2b e2 da bc f
..Y...b6..w+...
00e0 07 3c ca f8 9
1 90 a4 8f 80 ec 18
b9 65 1e e2 81 .
<..........e...
00f0 f3 b8 fa 24 a
1 86 47 f2 d5 ca 48
d7 e6 b8 88 89 .
..$..G...H.....
0100 f1 fc 5d 73 f
f 17 17 b7 7c 47 1a
f1 12 9f d2 d4 .
.]s....|G......
0110 77 57 08 32 a
7 23 48 a4 fe ea 11
e4 0c 14 20 d6 w
W.2.#H....... .
0120 04 b8 d0 1f 4
1 1b 25 ea 21 7e 3a
93 89 b5 1d 18 .
...A.%.!~:.....
0130 cf 89 19 32 f
9 56 db 56 d7 b5 80
a5 99 a4 d1 ac .
..2.V.V........
0140 8a f6 2c 4d b
b cd a4 cb a0 87 54
33 19 bf b4 65 .
.,M......T3...e
0150 29 33 2c d8 a
3 ac 1f 79 ba ec ab
35 e9 13 f6 29 )
3,....y...5...)
0160 d6 3c df 23 4
5 8d f8 1c a9 9d 6f
d8 ef b1 eb 6f .
<.#E.....o....o
0170 1b 73 5c b2 d
7 f7 bf 47 72 4e a7
60 c4 ca 57 fc .
s\....GrN.`..W.
0180 18 c9 20 95 1
a bc 4d 85 7d 91 6c
58 ec a7 16 a9 .
. ...M.}.lX....
0190 19 2b 09 5c f
6 7f 5c ea f3 6e ba
79 bc cb 20 30 .
+.\..\..n.y.. 0

01a0 7f 94 f1 d9 9
8 87 80 12 86 63 d2
b3 2a 1c 3d c5 .
........c..*.=.
01b0 69 61 1d 24 d
6 77 57 cf 79 39 ce
75 ff 5e 19 ef i
a.$.wW.y9.u.^..
01c0 55 3d 0f ba 7
0 50 24 6e 20 58 b1
7a 5e 44 bc 44 U
=..pP$n X.z^D.D
01d0 05 0b 13 63 8
e 22 21 93 cf 58 1d
5a 29 1c 91 e4 .
..c."!..X.Z)...
01e0 21 71 20 b4 c
d 26 b2 94 b8 2b 62
bb 93 ca 7b c1 !
q ..&...+b...{.
01f0 3a 76 b2 cf 0
0 f2 73 62 6b 60 a2
6f 57 10 e4 d0 :
v....sbk`.oW...
0200 a5 ba d1 54 d
2 c9 91 66 44 8b 1e
e9 37 13 54 b5 .
..T...fD...7.T.
0210 62 31 e4 f2 7
6 1f f0 fa dc aa 6c
41 bd ff 45 4f b
1..v.....lA..EO
0220 da fb d5 ac 6
5 3e 13 e8 d8 f2 8a
e0 cd 5d 38 ff .
...e>.......]8.
0230 fb 92 04 e7 8
f f2 d4 2f d7 81 ef
42 60 5f c8 bb .
....../...B`_..
0240 00 3d e8 5c 0
b d0 8d 5c 07 bd 29
49 89 17 ab c1 .
=.\...\..)I....
0250 87 a5 30 6f e
a 4e 37 fb 48 7e 83
b0 0e a2 66 b8 .
.0o.N7.H~....f.
0260 3b 5e 0a 32 f
f d7 89 e4 aa a3 22
32 94 5e 52 ac ;
^.2......"2.^R.
0270 f4 42 9c 21 4
1 79 47 7f 6d 78 7b
03 7b 98 2a 70 .
B.!AyG.mx{.{.*p
0280 c5 60 1e 69 6
9 16 49 34 c6 fe 91
ad 52 82 66 83 .
`.ii.I4....R.f.
0290 bd b6 fb 5e 7
6 b8 df b8 bc 79 a2
0b 01 b9 02 84 .
..^v....y......
02a0 2b 50 a0 b1 f
4 39 ab 44 90 a2 22
82 49 d2 85 dd +
P...9.D..".I...
02b0 b9 bb fa 95 5

1 cc 67 40 15 22 69
54 a2 a3 2e e2 .
...Q.g@."iT....
02c0 0c 3e ab d1 9
5 2f 56 3e b2 9a 89
d8 61 a1 90 b9 .
>.../V>....a...
02d0 3b 09 8f e6 0
a b8 bd 61 97 6d af
4d ab 2a 70 e1 ;
......a.m.M.*p.
02e0 db 25 83 41 4
3 e6 55 6e ae 30 b4
08 83 47 7d ec .
%.AC.Un.0...G}.
02f0 fc de e4 e3 6
3 9a 49 e6 2b ff fa
99 f6 e2 2a f3 .
...c.I.+.....*.
0300 54 55 29 5b 2
7 4d 15 70 aa 81 27
90 14 7e d8 6a T
U)['M.p..'..~.j
0310 91 3c 0d 53 4
8 11 8b 89 b2 72 9e
c4 41 da 4d 03 .
<.SH....r..A.M.
0320 16 32 a9 17 2
9 d8 0d 58 cf ad 39
a5 1b 34 92 f4 .
2..)..X..9..4..
0330 79 f1 1f 4d 1
4 c6 f2 d9 9a ed a2
41 44 b1 b6 e1 y
..M.......AD...
0340 00 08 80 70 e
e e8 6e 1c 08 d2 30
06 03 81 c0 d4 .
..p..n...0.....
0350 49 88 87 e6 e
4 7f 6d 0b 3d 43 3c
57 cd 7f b5 46 I
.....m.=C<W...F
0360 9f ae a6 b0 1
1 52 2b 34 d2 b2 22
71 38 8c e1 04 .
....R+4.."q8...
0370 3d 76 ac 96 4
7 af a2 83 09 96 38
22 cb ae 24 db =
v..G.....8"..$.
0380 55 02 74 b5 3
7 d9 6e 4a 59 56 11
b3 e7 68 7d a3 U
.t.7.nJYV...h}.
0390 d9 d1 ba 74 2
4 eb 87 ca 65 6e a0
9b 58 a6 14 2f .
..t$...en..X../
03a0 96 de e1 eb 8
9 e6 c2 31 20 5e 6a
c8 55 7a 90 a0 .
......1 ^j.Uz..
03b0 3b ca 3a 5c 8
e be 6e 6d 6c 99 ea
d5 5a 21 2b fe ;
.:\..nml...Z!+.
03c0 53 f9 aa e7 b
b bb ff d5 23 e3 da

3a 6a fa bc 91 S
.......#..:j...
03d0 64 ff fb 92 0
4 e9 0f f2 cf 23 d7
03 0f 42 52 5a d
........#...BRZ
03e0 65 4b 00 3d e
6 4c 0b a8 e1 5a 0c
31 0b 81 99 1c e
K.=.L...Z.1....
03f0 2b 80 f7 a1 7
0 b9 2f f7 ba fd bf
ff 44 d0 d7 c5 +
...p./.....D...
0400 4c c1 9c e6 0
7 1b 49 85 4d 4c 58
41 4d 19 9d a6 L
.....I.MLXAM...
0410 52 a1 77 02 3
3 9c 13 e3 2f f5 2d
98 66 c4 5b c9 R
.w.3.../.-.f.[.
0420 17 51 36 c1 c
9 f0 3e 48 9a ce 7d
ba 27 64 36 3d .
Q6...>H..}.'d6=
0430 92 6b 48 08 6
0 bb 20 33 6a d5 92
67 cd b9 ed f5 .
kH.`. 3j..g....
0440 71 77 01 4d 8
8 9c 7f 01 01 54 e3
0e 0e 1d 66 50 q
w.M.....T....fP
0450 44 96 16 65 2
1 33 4f 4b ae be 43
4e 22 c8 20 60 D
..e!3OK..CN". `
0460 60 15 99 4a 0
b e4 5d 74 4d 80 25
8e bc 2b c8 15 `
..J..]tM.%..+..
0470 43 2b 58 fc f
c 82 70 99 61 11 d4
81 d3 0e 20 b1 C
+X...p.a..... .
0480 c5 49 63 7d f
7 e6 15 27 74 13 1e
c8 2a 20 24 63 .
Ic}...'t...* $c
0490 44 88 22 38 5
4 70 88 0c 28 55 61
ec ac 3d 28 e8 D
."8Tp..(Ua..=(.
04a0 52 3b 5d 1d 0
c a8 47 3a d3 42 19
52 7a 55 8f 18 R
;]...G:.B.RzU..
04b0 b5 37 af 5d 6
8 ad ab b8 c5 9a 14
d5 d0 3a 88 38 .
7.]h........:.8
04c0 00 d7 47 1d a
6 92 bb 9e 14 8d 7c
16 00 61 88 fc .
.G.......|..a..
04d0 ca a9 b0 a2 8
9 09 c9 8d 30 c9 44
ed f1 24 f1 1d .

.......0.D..$..
04e0 d2 04 0f 24 f
5 af 23 26 66 99 84
d4 7a e2 f1 d3 .
..$..#&f...z...
04f0 f5 b9 00 b9 5
c 32 2b 0d 84 67 63
59 7b 75 9b 5f .
...\2+..gcY{u._
0500 c3 22 c7 30 8
4 0a 09 5a 32 5a e2
47 41 b1 65 af .
".0...Z2Z.GA.e.
0510 13 31 0b 7e 4
4 5b ee 73 3b 11
.
1.~D[.s;.
No. Time
Source
Destination
Protocol
Length Info
183 6.664463000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=108672 Win=37802 L
en=0
Frame 183: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.714393000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.714393000 s
econds
[Time delta fro
m previous captured
frame: 0.000198000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00019800
0 seconds]
[Time since ref
erence or first fra
me: 6.664463000 sec
onds]
Frame Number: 1
83
Frame Length: 5

4 bytes (432 bits)

Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: Not-

ECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f5e (20318)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 10867
2, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 108672 (

relative ack number

)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37802
[Calculated win
dow size: 37802]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 182]
[The RTT to
ACK the segment wa
s: 0.000198000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 5e 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O^@.........J|

0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 0a ad 50 10 .
....P..N.+...P.
0030 93 aa 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
184 6.782273000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=10867
2 Ack=1 Win=46 Len=
1260
Frame 184: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.832203000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.832203000 s
econds
[Time delta fro
m previous captured
frame: 0.117810000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11781000
0 seconds]
[Time since ref
erence or first fra
me: 6.782273000 sec
onds]
Frame Number: 1
84
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]

[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1d5 (61909)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a55 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 108672, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 108672 (relati
ve sequence number)
[Next sequence
number: 109932 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes

.... 0000 0001

0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x0b6
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 d5 4
0 00 31 06 3a 55 4a
7c 0c 8a c0 a8 .
...@.1.:UJ|....
0020 01 0b 00 50 c
1 a6 2b ca 0a ad 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 0b 6d 0
0 00 b2 3c ba 08 92
f9 c0 20 41 59 .
..m...<..... AY
0040 07 c6 56 e8 8

2 f6 5f 90 bb 2b fa
0a 84 f3 d6 ea .
.V..._..+......
0050 3d 57 c4 4e 4
0 a1 d4 fe 0b 2c 79
10 df 69 2b 35 =
W.N@....,y..i+5
0060 e9 d9 a1 8a 5
c 06 46 8b 06 1e fd
e6 29 33 a2 0e .
...\.F.....)3..
0070 f2 44 38 5b f
f 4f f2 73 a6 d8 df
23 e5 f7 bf ff .
D8[.O.s...#....
0080 cd e5 7c fa 5
f 38 c7 f0 80 27 02
bc 86 e7 87 ff .
.|._8...'......
0090 fb 92 04 ec 0
f f3 0d 44 d6 83 0c
42 e0 5f 05 2a .
......D...B._.*
00a0 e0 61 e9 4c 0
c 45 1b 58 0c 30 ab
81 70 95 2b 81 .
a.L.E.X.0..p.+.
00b0 87 a5 30 a9 d
f eb 5d da 66 03 96
9a 4a d2 f4 0a .
.0...].f...J...
00c0 12 2c 94 4c f
a a3 5e 4e 32 b2 54
4d 89 86 8c 55 .
,.L..^N2.TM...U
00d0 c3 93 83 de 3
0 5d c2 a2 dd 5d 8d
65 67 29 54 b7 .
...0]...].eg)T.
00e0 a2 38 52 93 e
e 01 c5 a6 9b 91 2f
e5 ad 62 b6 4f .
8R......./..b.O
00f0 1f 07 48 83 7
a 27 95 b9 3c c8 ba
9a 50 fc 56 e6 .
.H.z'..<...P.V.
0100 54 d7 15 bb e
3 bf 3e c7 ce 30 e5
74 21 27 7d 81 T
.....>..0.t!'}.
0110 0d 7f 23 6b 1
1 df 4b fa 5b 86 4e
64 2b 84 c4 82 .
.#k..K.[.Nd+...
0120 91 43 c8 dd 4
8 1d 61 8f 1a 2f 9f
0d 00 64 f9 5c .
C..H.a../...d.\
0130 4a 8b a5 53 2
8 eb 01 5c 97 58 99
58 46 7e 5c a4 J
..S(..\.X.XF~\.
0140 0d cb cd d6 e
c 60 73 4c 05 08 86
8f f1 4a 48 51 .
....`sL.....JHQ
0150 20 11 34 e1 0
5 09 0b dc 2d 7f f1

51 5d 96 95 3b
.4.....-..Q]..;
0160 53 6b c2 f2 3
1 d5 a5 2c 15 8b f0
12 c3 a3 e5 82 S
k..1..,........
0170 8d 75 77 2f 9
5 45 da 59 45 20 64
85 81 90 04 f0 .
uw/.E.YE d.....
0180 f4 a4 95 f0 5
0 f0 84 3c 6e 2b 61
15 19 7c e5 35 .
...P..<n+a..|.5
0190 97 0a 17 cd d
3 c0 5b 47 b2 d2 5b
3f de 1d 08 1a .
.....[G..[?....
01a0 88 cd 8a 59 6
5 21 4f 5c 1c 38 29
1e fd 1c ca 45 .
..Ye!O\.8)....E
01b0 13 22 51 00 8
1 7a 60 3b 50 62 37
bf fd 99 c7 1b .
"Q..z`;Pb7.....
01c0 41 3e 66 4f 8
6 d4 5f f7 dc 11 c9
f5 f8 d3 6a fc A
>fO.._.......j.
01d0 6d b6 a1 3b f
5 7f fe f3 df a5 99
58 14 6f 10 11 m
..;.......X.o..
01e0 d9 14 3c 40 7
c a9 c9 1b 46 80 b3
0e 55 23 23 70 .
.<@|...F...U##p
01f0 f3 d4 58 b9 b
a 92 03 7e 6b 1e 68
84 ed 1c 1d 7d .
.X....~k.h....}
0200 2b 4b b7 50 2
6 e9 26 b1 eb 8a e9
64 bd 54 a6 c7 +
K.P&.&....d.T..
0210 9b 77 35 63 6
8 ba 9a 70 0a 06 1f
02 93 72 63 9c .
w5ch..p.....rc.
0220 50 f2 45 11 5
b 2e 93 4a e2 c6 56
2c f3 23 0f dd P
.E.[..J..V,.#..
0230 42 ff fb 92 0
4 eb 8f f2 f2 35 d6
03 2f 32 e0 5e B
........5../2.^
0240 66 6a e0 61 8
b 5c 0c 14 cb 58 0c
31 0b 81 89 14 f
j.a.\...X.1....
0250 eb 40 f7 a5 3
1 f5 af f4 57 55 ac
88 87 19 6b 64 .
@..1...WU....kd
0260 a5 5d 2f 6b 3
0 a3 8a 05 87 47 f6
e5 90 13 07 fb .

]/k0....G......
0270 34 5b 8f 4b 2
a 4d 5b ab 6e fe 2b
ec 9a df 97 a5 4
[.K*M[.n.+.....
0280 89 f9 45 72 c
3 b6 75 fa b2 c6 ae
9c 5b 2b 8e 2a .
.Er..u.....[+.*
0290 90 3e 7d 3d 6
b 2e 76 3b ff d7 a3
22 00 75 0a 39 .
>}=k.v;...".u.9
02a0 52 6e 2c c1 7
4 92 33 39 01 b4 93
d7 0f b6 b1 ad R
n,.t.39........
02b0 ee 48 49 5a 7
f a1 fd 4d 02 51 80
42 bc 5a cc 75 .
HIZ...M.Q.B.Z.u
02c0 aa b4 b8 f8 f
d 00 0d 0a 1c ae 9b
cb 74 cf 1b 1b .
...........t...
02d0 14 6a f6 cb e
d 89 b1 eb f3 f1 8d
f2 d4 f8 2b e9 .
j............+.
02e0 2c 38 ba 30 0
4 65 7e 06 9a 86 e3
31 f9 10 57 39 ,
8.0.e~....1..W9
02f0 3f a5 a5 99 4
c ff fc dc 75 94 73
85 d3 ba d8 ac ?
...L...u.s.....
0300 a8 ca 94 c1 1
2 90 a6 09 69 5b 21
52 d5 6a ea ed .
.......i[!R.j..
0310 d8 a3 f4 25 8
0 32 a0 d5 61 69 14
b7 64 8e 57 b4 .
..%.2..ai..d.W.
0320 1a 29 14 a5 6
b ee 1b 1e 14 b2 51
2c a4 86 ab d2 .
)..k.....Q,....
0330 50 65 97 35 b
9 8a f4 95 b0 ad 05
e4 7e 94 27 ad P
e.5........~.'.
0340 ce e1 f4 7a 7
c ee 1a e4 0f af 59
47 45 0b 17 9a .
..z|.....YGE...
0350 eb 99 1f 4b 7
f bd fe ff 3b 0b ca
30 69 46 b9 cb .
..K....;..0iF..
0360 02 d4 2a 86 3
5 05 1d 73 dc a2 6d
89 c5 f5 32 eb .
.*.5..s..m...2.
0370 11 73 17 fd 9
f ad 69 03 05 89 ae
16 36 9d c5 b2 .
s....i.....6...

0380 1e db 59 7f 2
3 22 21 cc 37 ea 55
13 92 cb e0 89 .
.Y.#"!.7.U.....
0390 0e 50 14 17 0
5 4b a5 b2 3a f3 11
0c 69 e9 a9 a3 .
P...K..:...i...
03a0 b4 73 60 66 6
d c3 08 24 25 25 1f
d8 31 f4 7e 3a .
s`fm..$%%..1.~:
03b0 66 a5 72 c6 5
0 87 db 5d be 6b 32
d8 ee 87 b6 84 f
.r.P..].k2.....
03c0 ec ce 07 48 1
6 56 60 38 20 2a 1a
39 24 f6 32 65 .
..H.V`8 *.9$.2e
03d0 44 c1 b7 ff f
b 92 04 ea 8f f2 d7
23 d6 83 0f 4a D
..........#...J
03e0 50 5c e4 fa e
0 63 0c 4a 0b 78 a7
58 0c 3c c9 81 P
\...c.J.x.X.<..
03f0 91 14 ab 40 f
c 31 30 8c 62 bd 35
db 55 19 cd ff .
..@.10.b.5.U...
0400 e9 64 0b d2 c
4 4d 84 04 0e 8c 4e
06 85 57 20 9d .
d...M....N..W .
0410 99 bc 24 0a f
3 e4 9a 42 8b b7 cb
a5 73 97 de 58 .
.$....B....s..X
0420 16 20 ca dd 2
2 4f b7 c3 d5 da 68
ba db e2 b2 28 .
.."O....h....(
0430 d3 f8 05 35 4
6 ff 27 f2 4e de 54
90 fc e8 e2 38 .
..5F.'.N.T....8
0440 56 ba ae 5f b
1 56 ff 0d a8 c7 61
09 6c 7d ef f6 V
.._.V....a.l}..
0450 ef b7 a9 7c f
d e1 43 6b 4b ab b1
14 37 4b bd 84 .
..|..CkK...7K..
0460 fa 2a a8 32 4
2 18 45 0c ab 10 30
6c 9a bb 00 30 .
*.2B.E...0l...0
0470 86 87 4b 8a 6
a 8d b8 6d 38 cf 9c
ae e1 c2 ad a0 .
.K.j..m8.......
0480 31 29 db 5a e
0 ca 8e 77 ca 2a e5
4a 24 58 93 8c 1
).Z...w.*.J$X..
0490 10 f8 07 85 0

b 1d 58 80 60 a3 b0
c8 0f 92 8a 42 .
.....X.`......B
04a0 1a 7a 85 b6 7
7 27 4f e2 0c 82 56
4f 9a 89 c2 2c .
z..w'O...VO...,
04b0 24 b3 45 57 2
e e8 81 c2 a4 cf b6
5c a3 76 74 af $
.EW.......\.vt.
04c0 82 78 21 47 f
1 2f 10 a4 f9 da 37
ce 4d 91 4b b8 .
x!G./....7.M.K.
04d0 c5 bd 0f b9 c
3 01 f4 48 8b cc 92
3f 89 01 89 47 .
......H...?...G
04e0 0e 2a b6 8b d
c 24 5c dd a5 ab 2f
a5 04 4f a1 a0 .
*...$\.../..O..
04f0 aa 14 1d 73 9
1 61 b5 e8 01 20 4b
17 a6 ef 98 cf .
..s.a... K.....
0500 1f 55 8b 94 2
0 68 90 00 22 08 21
21 84 35 e3 16 .
U.. h..".!!.5..
0510 00 64 63 4a 1
2 eb 77 fa 2b 49 d4
ea 44 02 05 b7 .
dcJ..w.+I..D...
0520 c5 f7
.
.
No. Time
Source
Destination
Protocol
Length Info
185 6.813268000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
467 http49
574 [PSH, ACK] Seq=
109932 Ack=1 Win=46
Len=413
Frame 185: 467 byte
s on wire (3736 bit
s), 467 bytes captu
red (3736 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.863198000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.863198000 s
econds
[Time delta fro
m previous captured
frame: 0.030995000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03099500
0 seconds]
[Time since ref
erence or first fra
me: 6.813268000 sec
onds]
Frame Number: 1
85
Frame Length: 4
67 bytes (3736 bits
)
Capture Length:
467 bytes (3736 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
53
Identification:
0xf1d6 (61910)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3da3 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.

11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 109932, Ack:
1, Len: 413
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 413]
Sequence number
: 109932 (relati
ve sequence number)
[Next sequence
number: 110345 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0x127
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1673]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 c5 f1 d6 4
0 00 31 06 3d a3 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b ca 0f 99 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 12 72 0
0 00 56 31 a2 44 a3
03 50 05 2b 17 .
..r..V1.D..P.+.
0040 46 82 32 10 3
3 31 3c a9 e8 9e d3
23 92 3d aa ca F
.2.31<....#.=..
0050 1c d6 eb 8f 1
e 27 6e 65 70 28 b2
00 70 52 1d 20 .
....'nep(..pR.
0060 22 0e d8 3d 1
e c5 c4 e1 2c db b4
7a a9 d5 f1 a2 "
..=....,..z....
0070 9d 07 41 d0 f
0 94 02 69 4c 28 08
29 06 83 e5 43 .
.A....iL(.)...C
0080 f9 54 be 7e d
2 4d 74 db 87 79 ff
fb 92 04 ed 8f .
T.~.Mt..y......
0090 f3 38 2c d5 8
3 18 32 60 60 47 0a
d0 3d e9 5c 0b .
8,...2``G..=.\.
00a0 bc b5 58 0c 3
d 09 81 67 94 6b 80
f7 a5 28 55 80 .
.X.=..g.k...(U.
00b0 03 13 cb 4d 3
1 3b b5 fa 49 4a 8f
c9 55 61 63 25 .
..M1;..IJ..Uac%
00c0 bc 52 ac 14 e
e 31 03 45 98 e5 7b
0d a8 dd 6d 79 .
R...1.E..{...my
00d0 1d eb c5 7d 5
f c8 f5 ee a6 56 2d
8f 18 92 38 58 .

..}_....V-...8X
00e0 ec 7b 49 34 9
a 02 2d e3 42 86 2a
1d 74 08 d9 55 .
{I4..-.B.*.t..U
00f0 23 3a ac 4f 2
c db a7 bb 48 bc 29
85 84 af 72 a2 #
:.O,...H.)...r.
0100 56 a9 44 d8 e
1 71 22 8d 13 36 94
df b9 65 14 36 V
.D..q"..6...e.6
0110 58 6a 72 19 f
2 fe f0 ac 69 7f f5
ac 0a 09 18 40 X
jr.....i......@
0120 20 4e c4 95 a
e 21 6a 64 48 d7 8d
4e 2c 53 fa 5a
N...!jdH..N,S.Z
0130 a5 68 c4 27 9
6 a2 3b 24 76 83 44
e3 40 4e 77 21 .
h.'..;$v.D.@Nw!
0140 1b e5 26 14 e
8 41 28 7b 3f 15 56
30 0d ea 5d 54 .
.&..A({?.V0..]T
0150 d0 f0 31 4d 7
5 3b 2d 8c e1 6f 49
fd 82 5f 5c 35 .
.1Mu;-..oI.._\5
0160 27 ff cb 7e b
1 13 cf 86 ee 7f 3d
18 e4 9f ec cd '
..~......=.....
0170 d7 ef f3 31 c
a 5b ff e0 6f 84 07
47 cd 40 aa 79 .
..1.[..o..G.@.y
0180 c9 5d 74 49 3
9 03 be 0c 67 51 0f
d9 e0 86 93 64 .
]tI9...gQ.....d
0190 bf 2d 8c db 8
6 ff 14 ae 4f b3 50
46 25 a0 e5 3a .
-......O.PF%..:
01a0 2a e2 6b 61 c
3 83 a6 cd 78 86 b1
3f 7b 55 b1 19 *
.ka....x..?{U..
01b0 a7 6f f1 91 0
5 9e 7a d4 11 b8 09
12 4f 89 73 05 .
o....z.....O.s.
01c0 28 3d 11 b5 5
2 65 a9 d4 9a c7 e4
1c a4 d3 2d d6 (
=..Re........-.
01d0 fe 9c d2
.
..
No. Time
Source
Destination

Protocol
Length Info
186 6.813445000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=110345 Win=38430 L
en=0
Frame 186: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.863375000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.863375000 s
econds
[Time delta fro
m previous captured
frame: 0.000177000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017700
0 seconds]
[Time since ref
erence or first fra
me: 6.813445000 sec
onds]
Frame Number: 1
86
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17

:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f5f (20319)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 11034
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 110345 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .

... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 185]
[The RTT to
ACK the segment wa
s: 0.000177000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 5f 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O_@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 11 36 50 10 .
....P..N.+..6P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
187 6.912276000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=11034

5 Ack=1 Win=46 Len=

1260
Frame 187: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.962206000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.962206000 s
econds
[Time delta fro
m previous captured
frame: 0.098831000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09883100
0 seconds]
[Time since ref
erence or first fra
me: 6.912276000 sec
onds]
Frame Number: 1
87
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1d7 (61911)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a53 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 110345, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 110345 (relati
ve sequence number)
[Next sequence
number: 111605 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf60
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 d7 4
0 00 31 06 3a 53 4a
7c 0c 8a c0 a8 .
...@.1.:SJ|....
0020 01 0b 00 50 c
1 a6 2b ca 11 36 9e
87 4e aa 50 10 .
..P..+..6..N.P.
0030 00 2e f6 03 0
0 00 8c af c1 e6 ac
1c 00 a1 8b 19 .
...............
0040 30 d0 7d fc 0
7 41 76 ee 3b 58 c0
6c b9 55 28 94 0
.}..Av.;X.l.U(.
0050 e7 97 5a e4 0
8 a5 18 39 01 41 f3
de 4e d5 35 f9 .
.Z....9.A..N.5.
0060 f2 48 c1 cf e
3 10 df 45 b5 1e 23
9e 63 85 d5 ea .
H.....E..#.c...
0070 17 a5 d3 bf 1
e 7b a9 f3 59 8e ef
77 b2 c7 88 d9 .
....{..Y..w....
0080 90 bf fb 6b 3
6 2b ed af 10 df ef
d1 d7 fc b9 ff .
..k6+..........
0090 fb 92 04 ed 0
f f3 32 2a 56 03 0c

32 60 62 e5 1a .
.....2*V..2`b..
00a0 e0 61 e9 4a 0
b c8 7b 5c 0c 31 09
49 65 14 6b c1 .
a.J..{\.1.Ie.k.
00b0 87 99 28 bf d
3 d2 f5 bf 9c 98 83
c1 0d 58 69 23 .
.(..........Xi#
00c0 0b cd e3 8d d
b 08 9f cd 10 6c 4f
50 f3 0a 3e 75 .
........lOP..>u
00d0 25 69 97 2c c
9 7e ed 2a bd cf b5
c6 ee aa 58 b7 %
i.,.~.*......X.
00e0 9a 3b 4c 6b 6
7 b7 ee 3a f9 79 21
b6 35 e1 22 68 .
;Lkg..:.y!.5."h
00f0 69 e0 74 b8 0
0 2e 76 b1 7c 81 a0
95 f2 2c 53 72 i
.t...v.|....,Sr
0100 55 b8 a7 b9 0
9 5c 9b cd a4 ba ee
5d d9 36 6e 69 U
....\.....].6ni
0110 45 9b 8a 24 9
0 28 25 ad 16 3c 00
8c 04 ca 0c 0b E
..$.(%..<......
0120 6b 52 25 3f 4
b 15 13 9c 03 6b a9
a1 a2 ec 60 79 k
R%?K....k....`y
0130 99 8d 47 ad 4
b 9d aa af 6a fb df
ee 90 6f 41 9e .
.G.K...j....oA.
0140 3f e7 7b 7e 7
3 dd b1 28 6d 99 ad
45 49 1b 19 a8 ?
.{~s..(m..EI...
0150 a7 a2 ab 7d 6
f f4 6d 05 a3 14 3d
ce 0b 4e f5 7d .
..}o.m...=..N.}
0160 2f b1 da fe 5
6 b9 6e 97 b5 d4 8a
ab b3 5f 67 51 /
...V.n......_gQ
0170 7a fa 97 b9 4
9 4a 1c 81 36 15 aa
51 44 4f 94 28 z
...IJ..6..QDO.(
0180 81 35 59 68 3
1 3e 39 02 e5 b2 90
0f 40 c6 da 24 .
5Yh1>9.....@..$
0190 6f 35 1d 73 e
4 ab 1a 04 6d 06 6e
48 f8 2d 60 bd o
5.s....m.nH.-`.
01a0 63 53 4e aa d
0 47 b1 07 c6 b2 a4
6e 10 72 57 bc c

SN..G.....n.rW.
01b0 47 fb 55 31 7
7 7f e1 ff f4 7b 36
be de 9e d7 32 G
.U1w....{6....2
01c0 9f e2 ba 7e f
5 f2 ec e8 5b a2 dd
ee 86 4d f9 dc .
..~....[....M..
01d0 a9 be 28 5e 3
a 56 94 41 a6 80 a0
29 6f 2c 08 84 .
.(^:V.A...)o,..
01e0 6c 00 1a c8 5
b a0 d0 93 d1 82 da
f0 df cb f6 1c l
...[...........
01f0 46 b6 23 6d d
8 16 1b fa 78 5b 59
6c 7e 75 a9 df F
.#m....x[Yl~u..
0200 88 26 3a 14 f
1 67 6b 20 53 32 a9
04 19 08 85 46 .
&:..gk S2.....F
0210 b7 47 29 d7 4
4 56 7d ed ff 5e b5
55 2b df c6 0b .
G).DV}..^.U+...
0220 54 e5 41 db 2
7 ab 4a d6 39 93 c1
d4 a8 bd 65 46 T
.A.'.J.9.....eF
0230 e6 ff fb 92 0
4 eb 8f f2 f6 1d 57
03 0c 42 52 59 .
.........W..BRY
0240 44 5a f0 3d e
9 4a 0c 85 6b 5a 0c
24 4d c9 7e 90 D
Z.=.J..kZ.$M.~.
0250 2b 80 f6 21 2
9 6b bc 4a 83 44 60
1c 42 c2 5f 85 +
..!)k.J.D`.B._.
0260 62 64 ce 8a 0
8 d2 1e 60 02 aa 2d
4d c5 1c 74 29 b
d.....`..-M..t)
0270 d3 1e a5 48 3
e 8c 88 77 02 89 7d
97 4d 30 1a 92 .
..H>..w..}.M0..
0280 7f 4c 45 2b d
b aa eb 3b 88 11 7d
c9 cb 72 3e 0c .
LE+...;..}..r>.
0290 6e a9 66 c6 3
4 b3 89 00 77 dc ef
b8 c1 6d 74 32 n
.f.4...w....mt2
02a0 05 d2 85 18 2
2 45 2b 5e f6 88 87
b8 38 a9 99 25 .
..."E+^....8..%
02b0 e4 ac 46 59 0
f 68 5e 22 08 98 5e
0e 0b ba 8a 84 .
.FY.h^"..^.....

02c0 e1 21 6b b4 6
6 06 ec 18 a3 ee 39
9e 79 3b 81 65 .
!k.f.....9.y;.e
02d0 e3 be 95 89 9
f d2 dc a8 64 27 8b
b1 39 63 9a 2c .
.......d'..9c.,
02e0 cd 0f 6c cf 4
f c5 2d 42 ee ce 2b
8a cf 6f d6 30 .
.l.O.-B..+..o.0
02f0 d8 89 e1 dc 5
c 58 69 40 eb 00 4c
a5 b5 56 eb 44 .
...\Xi@..L..V.D
0300 58 72 a7 ac 5
4 ec 48 e5 22 f6 01
49 df 17 66 d8 X
r..T.H."..I..f.
0310 ad 36 9d ca f
4 97 43 b4 0f e2 ac
4f 4c d2 da 97 .
6....C....OL...
0320 07 dc ec 40 c
d 83 14 a3 9c f9 55
f8 0e 31 53 11 .
..@......U..1S.
0330 b4 7c 63 bf 4
b 76 c6 28 25 87 dc
c9 96 08 b4 80 .
|c.Kv.(%.......
0340 fb a6 71 89 2
d 01 95 ea d7 07 57
42 5e 6e 78 d0 .
.q.-.....WB^nx.
0350 f4 28 7f 87 f
1 7d cd 54 7f 47 01
b0 03 09 17 76 .
(...}.T.G.....v
0360 d5 95 09 b9 0
7 ac 7b 5e 31 69 3b
12 4c a7 5d f5 .
.....{^1i;.L.].
0370 08 44 2e 8a 1
1 08 6c 53 ed 35 5d
93 05 0b 17 08 .
D....lS.5].....
0380 70 c4 d3 8d 3
4 25 92 8f 92 15 50
8d 41 74 30 13 p
...4%....P.At0.
0390 88 90 c0 55 2
6 77 65 ce e2 d6 1d
61 ad 5d fd 57 .
..U&we....a.].W
03a0 21 63 a9 4d 9
2 85 e2 04 76 93 6e
6a 82 57 31 a5 !
c.M....v.nj.W1.
03b0 46 1b 97 d2 a
3 24 0d 1f d1 9a ce
dc cd fb e6 19 F
....$..........
03c0 13 88 d8 93 6
a ad 91 95 8b ad af
3c 2d ad 8d 7e .
...j......<-..~
03d0 7a c5 1e ff f

b 90 04 ec 8f f2 fb
3c 56 03 0c 2a z
..........<V..*
03e0 e0 5b 04 4a d
0 3d e9 4a 0c 18 83
56 0c 3d 89 41 .
[.J.=.J...V.=.A
03f0 96 15 eb 00 f
7 ad 30 48 d1 51 62
d5 8f 98 e8 ef .
.....0H.Qb.....
0400 74 64 30 c8 c
4 f4 fb 09 3d bf 57
cc 99 7e 52 aa t
d0.....=.W..~R.
0410 80 78 8d 53 0
1 70 7c 8d c8 52 b8
e5 aa 78 ae eb .
x.S.p|..R...x..
0420 57 aa ac ae b
4 84 9c 8a 91 8d 56
c0 eb 8a de da W
.........V.....
0430 e8 ed ac f6 b
4 a4 9a c2 5f 4c 85
ce 66 ce d8 7b .
......._L..f..{
0440 1b 14 16 2c 0
7 5a 61 28 85 5b 69
c5 b5 94 21 bd .
..,.Za(.[i...!.
0450 ef e7 b2 d8 f
3 49 22 cd ab ea 4f
45 d5 bf 80 c1 .
....I"...OE....
0460 c1 b1 13 8e 8
6 4d 9c 70 41 ee d1
ca 78 ab 0d 17 .
....M.pA...x...
0470 f1 43 ed 1a 7
a 01 15 cd 39 34 33
b6 b0 5f ad fa .
C..z...943.._..
0480 28 28 a8 6c 8
2 3f 9c 1b 6c f5 92
c6 21 87 ef 45 (
(.l.?..l...!..E
0490 3c 10 3c 9f f
9 63 3a 37 eb f2 f8
1b 43 a5 de 3e <
.<..c:7....C..>
04a0 43 31 b8 28 5
0 e2 cb 29 2c d7 7b
9f 56 35 64 2f C
1.(P..),.{.V5d/
04b0 3a 95 0e 5d c
f f7 a9 02 16 5e 45
b7 6d c7 20 74 :
..].....^E.m. t
04c0 50 19 73 09 1
8 9a 26 35 25 85 55
af 36 10 c8 34 P
.s...&5%.U.6..4
04d0 f0 dd 22 ed 9
d 88 13 66 7a 63 1c
26 e3 77 60 db .
."....fzc.&.w`.
04e0 f5 19 e4 b3 8
a 18 2e 9a 3e d9 8f

e8 79 d6 82 61 .
.......>...y..a
04f0 23 f5 1f aa e
7 f5 97 e4 83 1f ac
fc ba d9 bc d5 #
...............
0500 f9 bd 85 8f 2
c 12 2d 4a 54 76 9a
fe 13 d3 eb 4a .
...,.-JTv.....J
0510 d6 a0 a3 d4 b
6 fd 1e c9 cb fa b4
2a 7e 11 48 e6 .
..........*~.H.
0520 80 d2
.
.
No. Time
Source
Destination
Protocol
Length Info
188 6.915270000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=11160
5 Ack=1 Win=46 Len=
1260
Frame 188: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.965200000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.965200000 s
econds
[Time delta fro
m previous captured
frame: 0.002994000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00299400
0 seconds]
[Time since ref
erence or first fra
me: 6.915270000 sec
onds]
Frame Number: 1
88

Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0

0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1d8 (61912)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a52 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 111605, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 111605 (relati

ve sequence number)
[Next sequence
number: 112865 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd67
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 d8 4
0 00 31 06 3a 52 4a
7c 0c 8a c0 a8 .

...@.1.:RJ|....
0020 01 0b 00 50 c
1 a6 2b ca 16 22 9e
87 4e aa 50 10 .
..P..+.."..N.P.
0030 00 2e d6 73 0
0 00 3d dc 99 2a 9a
18 12 c9 8e 93 .
..s..=..*......
0040 d2 ed 2b 08 f
a 32 cc c0 de 80 a3
ab 6e 4b cd 20 .
.+..2......nK.
0050 18 f0 d4 86 d
4 d1 b6 f4 34 10 10
46 0d 49 e2 0b .
.......4..F.I..
0060 1a 26 c8 0d e
5 18 45 da 07 06 18
54 66 5c b6 34 .
&....E....Tf\.4
0070 1b 3c 6f fd 5
f 63 7b 0e c9 bd 08
b9 8d 7a d8 a7 .
<o._c{......z..
0080 6a 53 2f 36 e
e 8f ff 4c ff fb 92
04 ea 8f f3 15 j
S/6...L........
0090 2b d5 03 2f 4
2 60 5b 84 aa b0 61
eb 4a 0c 50 a7 +
../B`[...a.J.P.
00a0 52 0c bc c9 8
1 6e 11 ea 81 8c 31
28 64 c5 54 1e R
....n....1(d.T.
00b0 63 4d 28 45 4
4 8b d4 ee b8 91 f8
04 d8 8f 80 d1 c
M(ED...........
00c0 ca 9d 64 17 0
f 16 ff 73 70 4c 5f
29 b9 fa 76 ed .
.d....spL_)..v.
00d0 2d c6 d5 f9 d
7 32 fc c8 f4 99 c1
d7 4a 16 b5 31 ....2......J..1
00e0 ce 81 1e 00 e
1 0e 69 37 06 16 e5
23 58 f5 bb 50 .
.....i7...#X..P
00f0 7f b8 a7 fe d
b ef ee 64 f4 b0 98
6a d3 7f 18 94 .
......d...j....
0100 2e 8e bb fd a
c fa 36 57 a7 ae 10
0c 34 4a 10 25 .
.....6W....4J.%
0110 49 cc b0 2a 7
c 33 c1 10 50 b4 68
af 1c 37 14 25 I
..*|3..P.h..7.%
0120 ec f9 09 b3 c
0 e8 78 ac 86 7c c2
7c 82 a2 99 3f .
.....x..|.|...?

0130 cf 56 4b 0e a
2 39 c0 4e 77 5d b4
c8 35 11 22 63 .
VK..9.Nw]..5."c
0140 41 df 2a 9a 9
0 80 98 e4 50 ba e5
b6 c6 07 da 13 A
.*.....P.......
0150 ee c7 3f 4b 7
b 36 05 81 21 d0 23
3a c5 b4 58 cb .
.?K{6..!.#:..X.
0160 5a 4b 7f b8 a
f b3 91 7f ff d0 e4
91 38 73 0e 3a Z
K..........8s.:
0170 10 d3 d0 d1 4
2 30 da 83 3a cd c4
f6 39 64 78 a0 .
...B0..:...9dx.
0180 34 6b 4c 26 c
f c4 31 45 28 78 f3
bd 5d 9b fc b9 4
kL&..1E(x..]...
0190 c7 9f 80 68 a
6 1c 88 a5 95 db 6c
ab df 07 dd 17 .
..h......l.....
01a0 69 be ba 4d e
0 5d 9d c7 a5 28 c7
8e cf 36 9c f1 i
..M.]...(...6..
01b0 88 ba c9 b7 b
f aa ff e9 3f 8b aa
7f de 46 8b 97 .
.......?....F..
01c0 14 86 e1 ff b
e 4a ed dc b1 6f aa
df 53 e8 65 24 .
....J...o..S.e$
01d0 43 89 46 29 8
a 33 17 81 c8 13 05
85 22 93 c0 01 C
.F).3......"...
01e0 1d 98 c5 81 a
2 ec 50 d4 48 4c 07
11 68 72 15 49 .
.....P.HL..hr.I
01f0 23 74 ad 65 0
c 3a f5 26 62 f2 e4
b0 82 e3 d4 75 #
t.e.:.&b......u
0200 75 13 ca 82 6
a 6a 00 08 a2 c2 36
68 16 a5 0e 50 u
...jj....6h...P
0210 6a 2b 43 1e 9
8 c8 2e 43 22 70 9b
49 bf 9f 29 ed j
+C....C"p.I..).
0220 be 92 ae 67 8
8 ff f8 d3 27 d0 ff
fb 92 04 eb 0f .
..g....'.......
0230 f2 bd 29 d4 8
3 2f 42 60 5e 25 7a
90 67 0b 4c 0c .
.)../B`^%z.g.L.
0240 04 a5 50 0c b

d 29 81 90 95 ea 01
9c 3d 30 59 b6 .
.P..)......=0Y.
0250 6f a1 74 a5 5
a ff 57 fd 6d 34 a2
6b 31 81 98 d4 o
.t.Z.W.m4.k1...
0260 a3 63 53 89 8
c 0e 51 2c 03 78 ff
d0 2b 55 b6 c2 .
cS...Q,.x..+U..
0270 72 0d 3d 1f b
9 d8 06 a4 5f 05 5d
8c 94 98 2b b8 r
.=....._.]...+.
0280 3f 72 a6 86 b
f 64 84 a4 3b 02 37
f7 dd 13 44 47 ?
r...d..;.7...DG
0290 95 0c a5 f2 a
c 2d 38 c8 2b 54 62
05 d8 2c 5e 03 .
....-8.+Tb..,^.
02a0 7d f5 ff 2f e
4 5f 36 f9 5c fb d9
f4 80 11 49 65 }
../._6.\.....Ie
02b0 84 e2 b0 82 f
7 f2 cd 9a 52 16 bb
5b ff b3 d7 09 .
.......R..[....
02c0 2f 42 4f 82 c
8 d4 c4 02 0a 88 31
68 67 18 37 89 /
BO.......1hg.7.
02d0 22 8f 62 7b 0
4 ce 0c 77 14 76 c9
4b 6b 5b 23 c6 "
.b{...w.v.Kk[#.
02e0 78 0b ca 48 3
4 9f 03 c8 d6 63 9f
57 73 dc 91 33 x
..H4....c.Ws..3
02f0 88 18 cd b4 b
c e1 0b 3f 6c 4c 11
b1 5c 67 3f f6 .
......?lL..\g?.
0300 bb 38 f0 b5 0
f 09 e1 27 ad 2b 5e
5d 3f fb f9 ff .
8.....'.+^]?...
0310 a3 46 e7 bb 6
7 79 75 74 d7 08 0b
01 fe 8e 93 55 .
F..gyut.......U
0320 41 4b a0 e0 3
5 97 b6 24 1c f8 dd
7c a3 6d 50 40 A
K..5..$...|.mP@
0330 5a 57 eb 28 8
4 ca e3 9c 94 3d df
0c 34 cb 12 3b Z
W.(.....=..4..;
0340 90 10 b3 3f 6
b c6 8f 28 d0 14 38
82 c3 b9 61 6b .
..?k..(..8...ak
0350 2c 92 43 a6 d
b 61 59 5f ae ff 77

93 f5 74 e5 1b ,
.C..aY_..w..t..
0360 32 54 e4 b6 d
3 ed 6e 6a ee 04 fe
d6 af d5 6f d1 2
T....nj......o.
0370 ff 2f b0 8f 6
5 fd 2e 93 75 8f 21
a9 14 9b 48 cc .
/..e...u.!...H.
0380 72 7d 06 d3 a
b a3 0c 67 15 45 b7
2e b6 9f c5 2c r
}.....g.E.....,
0390 cb 49 2d 14 6
e 5a 4a 43 d4 5f d5
d8 81 17 5f 5e .
I-.nZJC._...._^
03a0 df 1e db a4 5
f 4d 62 07 cd 76 d6
cf 50 2a 22 94 .
..._Mb..v..P*".
03b0 c7 ba 86 6d 4
8 22 86 d0 b6 c4 35
95 0e 17 15 11 .
..mH"....5.....
03c0 bd a2 05 d2 7
1 96 a8 85 14 5d 5c
49 ff fb 92 04 .
...q....]\I....
03d0 ed 0f f3 33 3
5 d3 83 38 42 e0 66
85 7a 60 63 2c .
..35..8B.f.z`c,
03e0 4c 0b 40 91 5
4 0c 3d e9 41 64 11
ea 41 8c 3d 28 L
.@.T.=.Ad..A.=(
03f0 50 a3 44 c6 5
8 44 c0 20 c8 4f c6
30 b3 09 18 dc P
.D.XD. .O.0....
0400 0e b6 d1 14 b
d b2 f8 5d bc a0 b0
f4 f0 d2 ac d2 .
......]........
0410 4f ca e0 19 5
5 fc e9 35 24 92 ed
29 32 03 0e 1c O
...U..5$..)2...
0420 14 78 89 23 2
1 5c 2d 97 df c9 12
c9 5a a0 f3 1d .
x.#!\-.....Z...
0430 cd f5 3a 71 d
e 4c 0f dc a6 27 02
3d 63 35 c0 84 .
.:q.L...'.=c5..
0440 86 d6 e1 72 c
a 3b 17 13 2c a1 23
fc fc 72 8f b6 .
..r.;..,.#..r..
0450 aa 11 38 cd b
7 54 c7 15 81 43 8a
90 b2 04 85 20 .
.8..T...C.....
0460 6b 86 55 0a 5
f a9 a2 ba 97 2d 09
62 7f 9a 84 6d k

.U._....-.b...m
0470 44 af 51 b3 8
e 1c 66 5d 3c fb 34
54 26 71 17 22 D
.Q...f]<.4T&q."
0480 f3 fa a6 34 a
4 fd 6d a8 ef 74 ee
bb 7f bb 2b 0f .
..4..m..t....+.
0490 17 81 b6 a2 6
b 3c da 50 24 ea a5
e0 35 b1 40 e8 .
...k<.P$...5.@.
04a0 f3 05 97 0a a
4 41 8b 3d ea 3c f3
aa 8a 14 72 6e .
....A.=.<....rn
04b0 44 a8 d5 cf 1
e 2a e8 b1 14 c5 08
3c cb 78 dc 47 D
....*.....<.x.G
04c0 94 eb 58 04 1
f 76 12 fa b3 d7 52
92 53 6a f5 d9 .
.X..v....R.Sj..
04d0 ce 61 2d fa 9
3 5d 8c f2 e4 84 f0
96 1c 1e ab d4 .
a-..]..........
04e0 b7 8b 9a 63 3
f ed c2 4c ef c6 c4
d2 46 fb fe df .
..c?..L....F...
04f0 cf 1f 2d 61 e
e e0 cb a5 97 bc 69
ce 2a f0 ed e8 .
.-a......i.*...
0500 6a 52 83 ac 6
8 b3 f4 d2 46 58 d9
59 69 e3 1a 2e j
R..h...FX.Yi...
0510 64 92 54 6b 1
4 cf a0 5e 85 22 b3
53 30 5c d0 62 d
.Tk...^.".S0\.b
0520 ec d1
.
.
No. Time
Source
Destination
Protocol
Length Info
189 6.915411000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=112865 Win=37800 L
en=0
Frame 189: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte

rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:26:5
9.965341000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615219.965341000 s
econds
[Time delta fro
m previous captured
frame: 0.000141000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00014100
0 seconds]
[Time since ref
erence or first fra
me: 6.915411000 sec
onds]
Frame Number: 1
89
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f60 (20320)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals

e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 11286
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 112865 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37800

[Calculated win
dow size: 37800]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 188]
[The RTT to
ACK the segment wa
s: 0.000141000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 60 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O`@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 1b 0e 50 10 .
....P..N.+...P.
0030 93 a8 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
190 6.960275000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
469 http49
574 [PSH, ACK] Seq=
112865 Ack=1 Win=46
Len=415
Frame 190: 469 byte
s on wire (3752 bit
s), 469 bytes captu
red (3752 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0

0.010205000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.010205000 s
econds
[Time delta fro
m previous captured
frame: 0.044864000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04486400
0 seconds]
[Time since ref
erence or first fra
me: 6.960275000 sec
onds]
Frame Number: 1
90
Frame Length: 4
69 bytes (3752 bits
)
Capture Length:
469 bytes (3752 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
55
Identification:
0xf1d9 (61913)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d9e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc

13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 112865, Ack:
1, Len: 415
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 415]
Sequence number
: 112865 (relati
ve sequence number)
[Next sequence
number: 113280 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u

nknown)]
Checksum: 0xf3c
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 415]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 c7 f1 d9 4
0 00 31 06 3d 9e 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b ca 1b 0e 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e f3 cb 0
0 00 14 3e ac e4 78
44 4e 13 56 f2 .
......>..xDN.V.
0040 3e 22 d3 0a 7
5 c1 7d 6e 56 a5 4d
d7 2c 31 80 e3 >
"..u.}nV.M.,1..
0050 09 48 1f 90 7
8 5b 09 c3 a7 07 1a
16 a4 1f b8 f7 .
H..x[..........
0060 1b 58 ee 93 9
4 90 e6 3d 07 c7 99
78 ea 69 72 0f .
X.....=...x.ir.
0070 28 e7 fa 6b 5
f 56 7a 7a f5 3d 37
53 56 af a8 f2 (
..k_Vzz.=7SV...
0080 cc 3f ff fb 9
2 04 ec 0f f3 0f 23
d6 03 0f 7a 50 .
?........#...zP
0090 63 24 6a b0 3
f 09 4a 0b 5c 8b 58
0c 31 69 41 74 c
$j.?.J.\.X.1iAt
00a0 12 2b 00 fc 3
d 28 86 83 bc ed 60
31 88 21 0a 8e .
+..=(....`1.!..
00b0 42 20 1c 51 b
0 04 f1 c6 8a 16 86
0e 86 06 d9 23 B
.Q...........#
00c0 68 75 24 f1 3
5 9f c9 a8 3f 1b 8e
9f 58 58 5f 26 h
u$.5...?...XX_&
00d0 08 95 25 f2 d
e 9e d3 7a ea 78 6d

4f 5a fe 4b 38 .
.%....z.xmOZ.K8
00e0 78 79 6e 86 c
1 9a 0c 5a 3c a6 66
f2 b9 c6 48 2b x
yn....Z<.f...H+
00f0 32 a2 52 06 6
8 76 c8 09 f6 b7 fd
1e 84 0e f6 c1 2
.R.hv..........
0100 af 4b 37 7d 0
8 05 33 a4 8c 59 43
7e c5 41 44 2c .
K7}..3..YC~.AD,
0110 0c 79 41 10 9
3 05 31 e3 64 e2 40
4e 82 6e 00 ff .
yA...1.d.@N.n..
0120 62 9c 11 f2 f
6 15 88 d1 39 2e 81
a9 8e ce 82 6b b
.......9......k
0130 c6 1b 8e 05 1
9 ec 08 2d 6d 79 4c
da 78 4a 54 8a .
......-myL.xJT.
0140 1d 04 c8 d4 9
5 4c f1 d0 c0 6f 4c
c4 e8 74 23 1c .
....L...oL..t#.
0150 29 d6 4a e5 1
4 46 0c a2 d3 69 a3
a9 06 aa f9 74 )
.J..F...i.....t
0160 82 68 fb b2 d
0 7e 92 9d 8d b5 4f
a5 15 27 28 dc .
h...~....O..'(.
0170 c0 41 44 22 1
b c6 80 0a 04 a4 ad
24 02 33 97 88 .
AD".......$.3..
0180 e4 80 72 25 6
1 0b ea 95 00 19 13
34 ea f2 0e 70 .
.r%a......4...p
0190 55 9e 53 b8 e
c bb 17 d0 98 57 61
34 71 d0 b8 d6 U
.S......Wa4q...
01a0 2b 71 a2 12 b
c 26 5e af 86 05 a0
9f ae 2b ee ee +
q...&^......+..
01b0 3e 59 b7 1d 9
6 31 2a 6b c9 fd 5b
ac ee 64 d7 5f >
Y...1*k..[..d._
01c0 ce e9 47 79 d
7 85 af 1e 6f fe d9
a3 6d 60 83 bb .
.Gy....o...m`..
01d0 c1 af 98 7a d
1
.
..z.
No. Time
Source

Destination
Protocol
Length Info
191 7.052278000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=11328
0 Ack=1 Win=46 Len=
1260
Frame 191: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.102208000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.102208000 s
econds
[Time delta fro
m previous captured
frame: 0.092003000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09200300
0 seconds]
[Time since ref
erence or first fra
me: 7.052278000 sec
onds]
Frame Number: 1
91
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9

0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1da (61914)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a50 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 113280, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 113280 (relati
ve sequence number)
[Next sequence
number: 114540 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi

ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x54b
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1675]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 da 4
0 00 31 06 3a 50 4a
7c 0c 8a c0 a8 .
...@.1.:PJ|....
0020 01 0b 00 50 c
1 a6 2b ca 1c ad 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 54 b8 0
0 00 75 40 d2 99 6c
07 92 3d b9 77 .
.T...u@..l..=.w
0040 c0 4c 04 ee 6
e b2 ad c9 6a 51 79
43 ce 14 13 34 .
L..n...jQyC...4
0050 6d c8 bc ef a
f fc 96 11 6d 30 49
74 1d 22 c9 72 m
.......m0It.".r
0060 56 b2 cd 9d 9
8 01 80 c3 8e 49 69
41 d2 5c 92 06 V
........IiA.\..

0070 1a a5 f0 ac e
3 b0 e6 9c 3c 6d 2d
51 9b 5f b9 b6 .
.......<m-Q._..
0080 1e 56 e1 9f e
8 ff fb 92 04 ec 8f
f2 d1 29 54 03 .
V...........)T.
0090 2f 42 60 5f 4
4 7a 80 63 0f 4a 0d
18 d3 48 0d 3d /
B`_Dz.c.J...H.=
00a0 ab 81 9f 16 6
9 01 9d 3d 30 d6 5b
1f 09 2b 52 d2 .
...i..=0.[..+R.
00b0 39 40 2f b9 f
5 b3 91 69 03 95 44
31 74 c2 a7 02 9
@/....i..D1t...
00c0 07 a7 5a 50 3
c 36 79 17 1a a2 32
84 7c 97 98 1c .
.ZP<6y...2.|...
00d0 a9 0b 6e f6 3
4 66 8e a8 24 50 5d
1d 69 87 9a e4 .
.n.4f..$P].i...
00e0 5d d9 a4 5b b
2 c9 6b c6 04 52 4e
33 c2 f1 12 1b ]
..[..k..RN3....
00f0 34 36 b4 bd 0
e c9 bb 5f e5 9c 6d
a1 bf 2e ee f3 4
6....._..m.....
0100 3e 55 57 fe d
5 df c6 fd 35 ff cb
64 fc 5b 40 f6 >
UW.....5..d.[@.
0110 08 02 5c 02 8
1 9e f0 2c 80 64 26
2b e6 a8 00 f1 .
.\....,.d&+....
0120 50 03 02 02 a
8 dc 28 c4 33 97 21
f9 64 a1 45 e8 P
.....(.3.!.d.E.
0130 7e dc 24 a4 4
b 88 f3 0a 68 78 ad
2e 3f 25 e5 99 ~
.$.K...hx..?%..
0140 b4 01 33 13 1
c 56 e5 39 c5 b3 60
c1 9f 25 3e 5b .
.3..V.9..`..%>[
0150 37 d6 9a 33 0
3 54 4e 5f 57 dd a9
af 1f d9 a3 da 7
..3.TN_W.......
0160 da df ff 7e 2
6 2c e8 6e fa ff ba
2f fe 96 68 44 .
..~&,.n.../..hD
0170 31 6a 01 96 1
4 50 15 63 2a 8b 0c
85 ae 28 e9 f2 1
j...P.c*....(..
0180 e4 62 54 63 9

f 23 1c 14 e0 02 81
1c 31 7a db aa .
bTc.#......1z..
0190 5c 5c 78 5e 7
f 82 a9 a0 57 92 9a
ea f7 91 46 e6 \
\x^....W.....F.
01a0 5e 55 8a 28 c
4 00 39 68 99 91 f5
13 7d 0e 68 ca ^
U.(..9h....}.h.
01b0 72 d6 3d a9 6
4 15 e0 3c 7b 22 d7
4c ef ef 1e 4f r
.=.d..<{".L...O
01c0 ff ef ad ff a
2 ce 4d 6e ac f7 a7
ab 5a 5e 84 d2 .
.....Mn....Z^..
01d0 17 a4 da fc 1
8 58 10 84 af 3e 80
31 6a 4f 36 60 .
....X...>.1jO6`
01e0 1d f6 e9 2b 1
c d4 3c e8 8b e2 16
94 72 35 f2 a3 .
..+..<.....r5..
01f0 cb 52 d2 fa 9
e ab d9 14 2d fa 8e
d3 97 36 5b 36 .
R......-....6[6
0200 57 dd 5e a9 c
a 98 71 3b 86 87 42
62 b7 44 a0 35 W
.^...q;..Bb.D.5
0210 bc e5 2d 1f 1
4 de 62 53 31 ef 0f
38 ac d1 3c 7f .
.-...bS1..8..<.
0220 bf e1 c4 d7 f
9 78 c9 ff fb 92 04
e6 8f f2 d9 2c .
....x.........,
0230 53 03 38 5a 6
0 5a 65 8a 60 67 2f
4c 0b c0 a3 4a S
.8Z`Ze.`g/L...J
0240 0c e1 e9 41 7
c 95 e9 41 8c bd 30
9f fc 30 b1 cb .
..A|..A..0..0..
0250 58 18 eb 8b 5
6 fa 97 e0 32 41 53
11 f8 16 48 50 X
...V...2AS...HP
0260 b1 02 6f 6a f
5 66 b2 d3 d9 fd 3c
23 87 37 e3 02 .
.oj.f....<#.7..
0270 1d c2 c9 d1 1
a 47 0c 34 54 28 b7
8d ab 30 1c c6 .
....G.4T(...0..
0280 e1 e9 98 91 7
a 2c 47 ca 76 26 32
c1 52 04 1d b3 .
...z,G.v&2.R...
0290 9f 2e 13 29 1
6 bb 8a ce dc b3 29

1b ae 0f 0c dd .
..)......).....
02a0 65 e4 ae 7b 7
b 7f ab 6a 35 7c 0f
d5 bf 5b c3 56 e
..{{..j5|...[.V
02b0 e7 0c 95 d6 3
0 e7 ff fa 20 44 17
0e 44 ca 90 a3 .
...0... D..D...
02c0 60 a8 cc 40 1
c c9 0a 6c 98 5d 01
52 9e c0 7c a3 `
..@...l.].R..|.
02d0 0f c0 4d b9 8
f d5 b8 88 a4 54 93
44 80 4f 20 4e .
.M......T.D.O N
02e0 6f e6 44 2d 9
5 94 7c 8b 19 a8 3e
73 03 f3 62 83 o
.D-..|...>s..b.
02f0 8a 05 67 4d 2
0 50 71 65 5c ba c2
5c ab 76 35 37 .
.gM Pqe\..\.v57
0300 d7 85 9b 8a 3
4 94 29 bc 54 d9 19
30 89 fb a9 28 .
...4.).T..0...(
0310 95 94 27 ac a
7 55 e5 1c 46 62 3a
22 e0 2b b5 1a .
.'..U..Fb:".+..
0320 65 d1 b5 e4 d
f b3 80 72 ad ca 19
2c 51 ba 24 9c e
......r...,Q.$.
0330 6e ad ab b1 f
7 93 52 8e 7c cc f5
e2 ff 30 03 e1 n
.....R.|....0..
0340 8b d7 9c 25 9
c d6 1a 44 bd a6 2a
39 fd 2a ed 8f .
..%...D..*9.*..
0350 29 9f 5b ed 9
c a7 e7 b1 c6 33 c7
1d 39 8b c9 cb )
.[......3..9...
0360 ce 67 ff 19 7
9 62 2b 7b 0e ff 1f
f2 4e ef f9 0b .
g..yb+{....N...
0370 67 f8 23 d4 d
5 55 40 75 0b ba 09
29 98 14 02 30 g
.#..U@u...)...0
0380 04 3d 08 1e 0
7 c5 f9 0e 3c 06 f9
dc 8c 3f 96 0a .
=......<....?..
0390 e5 32 18 98 3
1 15 04 1e 69 4f e6
15 a2 44 c2 3a .
2..1...iO...D.:
03a0 8c 4a 97 d6 8
7 fc b7 a0 dc ec fb
60 aa eb 65 71 .

J.........`..eq
03b0 93 23 9b 73 1
7 99 98 be 7a 76 ac
3c f9 e0 74 06 .
#.s....zv.<..t.
03c0 64 08 3c e8 5
d aa aa 6c 7b ff fb
92 04 ec 0f f3 d
.<.]..l{.......
03d0 2a 2e d2 83 3
8 7a 60 62 05 7a 50
67 2f 4c 0b e0 *
...8z`b.zPg/L..
03e0 b1 50 0c bd 0
9 81 74 92 2b 01 8c
31 29 4f 9a 5b .
P....t.+..1)O.[
03f0 d5 64 d2 3a 2
b bd 72 49 28 51 57
d1 70 b9 54 10 .
d.:+.rI(QW.p.T.
0400 2b 23 81 62 0
a 70 15 59 e2 96 36
e3 d4 2e 9a 9c +
#.b.p.Y..6.....
0410 9b 9f 30 bd 7
8 c7 02 2a 9b 2f 9d
79 91 01 6b 18 .
.0.x..*./.y..k.
0420 b7 83 2a 59 9
5 c5 2d 6b 12 36 e2
aa 32 d5 51 df .
.*Y..-k.6..2.Q.
0430 2d 97 f8 a5 d
5 b9 58 1a a2 d1 a5
eb 46 c5 95 db .....X.....F...
0440 55 68 62 6f 5
a 2f 9d 8f b5 5f b3
7f 5d ff ff b4 U
hboZ/..._..]...
0450 df dd 98 0a f
1 f6 25 40 95 61 38
44 b0 8f 4b 08 .
.....%@.a8D..K.
0460 d4 a1 c2 cb a
f 0e ce 11 5c 2b 34
9d d6 77 98 6b .
.......\+4..w.k
0470 1a a6 24 51 2
1 84 3b 3e 35 0e cc
23 0a 61 1e 16 .
.$Q!.;>5..#.a..
0480 44 7f af 0e f
c 87 2b 5d a9 13 a7
58 25 11 bc 69 D
.....+]...X%..i
0490 c3 81 68 a8 a
d 8e 2e 5d b1 33 98
20 13 9f 50 7c .
.h....].3. ..P|
04a0 a5 4d 7b 96 f
1 7d 4c 77 cc d8 7c
ca e5 06 00 c4 .
M{..}Lw..|.....
04b0 e2 08 69 aa c
8 4a 31 76 e4 a6 60
71 b8 31 a0 ed .
.i..J1v..`q.1..

04c0 40 b0 be 8c 8
8 b2 f2 1a ef f9 61
4e d5 6c d9 c2 @
.........aN.l..
04d0 d2 d3 47 7b a
d e8 3e a2 b2 10 ec
9f cd 94 59 ed .
.G{..>.......Y.
04e0 b1 1d 08 7d b
d dc 2d 27 8a 51 45
e4 d2 3b 9a 5a .
..}..-'.QE..;.Z
04f0 6f 86 72 0a 0
0 0a e7 85 d9 16 32
03 15 d0 53 60 o
.r.......2...S`
0500 64 08 0f 43 3
2 06 b4 82 60 49 f5
d3 4c 9a df 66 d
..C2...`I..L..f
0510 51 2a 44 1c 4
8 78 13 c0 73 39 cb
f9 d0 89 eb 93 Q
*D.Hx..s9......
0520 fc c3
.
.
No. Time
Source
Destination
Protocol
Length Info
192 7.052456000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=114540 Win=41580 L
en=0
Frame 192: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.102386000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.102386000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]

[Time delta fro

m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 7.052456000 sec
onds]
Frame Number: 1
92
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11

), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f61 (20321)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 11454
0, Len: 0
Source Port: 49
574 (49574)

Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 114540 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41580
[Calculated win
dow size: 41580]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 191]
[The RTT to
ACK the segment wa

s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 61 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Oa@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 21 99 50 10 .
....P..N.+.!.P.
0030 a2 6c 18 d4 0
0 00
.
l....
No. Time
Source
Destination
Protocol
Length Info
193 7.126283000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=11454
0 Ack=1 Win=46 Len=
1260
Frame 193: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.176213000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.176213000 s
econds
[Time delta fro
m previous captured
frame: 0.073827000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07382700
0 seconds]
[Time since ref
erence or first fra
me: 7.126283000 sec
onds]
Frame Number: 1

93
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1db (61915)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a4f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 114540, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number

: 114540 (relati
ve sequence number)
[Next sequence
number: 115800 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc58
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 db 4
0 00 31 06 3a 4f 4a

7c 0c 8a c0 a8 .
...@.1.:OJ|....
0020 01 0b 00 50 c
1 a6 2b ca 21 99 9e
87 4e aa 50 10 .
..P..+.!...N.P.
0030 00 2e c5 8b 0
0 00 00 ea 90 45 83
f3 64 40 32 f6 .
........E..d@2.
0040 ed 66 4c 81 0
5 66 db 1d 3a 33 b3
2b 6a 07 f9 c0 .
fL..f..:3.+j...
0050 65 d7 ce 56 a
c b0 bf 9c 72 ad 45
dc 55 42 b2 1b e
..V....r.E.UB..
0060 af f0 8f cf 5
f ef 5c bf f2 b0 bf
ce 89 22 8b 18 .
..._.\......"..
0070 e7 5e 4d 11 7
9 57 29 c9 9c 7a 0f
30 c3 e6 49 ff .
^M.yW)..z.0..I.
0080 fb 92 04 e9 0
f f2 f3 25 55 03 0f
62 50 5a c4 3a .
......%U..bPZ.:
0090 e0 61 ec 4a 4
b c8 b3 5e 07 b0 69
81 84 17 6c 00 .
a.JK..^..i...l.
00a0 f7 99 30 ac 1
d 1a 4c b2 12 e3 e4
a8 4f 9f 24 f6 .
.0...L.....O.$.
00b0 24 98 5d 8b 0
e 5e a2 64 8a 6a e9
46 e1 2c bf c0 $
.]..^.d.j.F.,..
00c0 85 b8 55 c6 6
2 40 85 4f 2d c6 9b
a6 34 11 fe 3e .
.U.b@.O-...4..>
00d0 a7 37 3b df 9
c 59 63 0a db 1d af
e1 1f 93 93 7b .
7;..Yc........{
00e0 67 af ae 58 a
2 d5 99 3d 6f 93 32
29 cb ae ca 82 g
..X...=o.2)....
00f0 84 86 ac e8 5
a 02 74 3a 55 a3 0b
d2 64 eb 1e a5 .
...Z.t:U...d...
0100 32 d5 30 54 7
a 8c 14 58 09 06 08
46 1b 0d 91 0a 2
.0Tz..X...F....
0110 d5 41 db 77 0
a c0 d2 27 ea 39 0b
1d 15 d9 c2 7d .
A.w...'.9.....}
0120 57 5d 49 79 e
a bd d9 4c 4f ae f0
f5 5a 6d 72 d5 W

]Iy...LO...Zmr.
0130 97 28 1c 5a 1
9 b9 84 14 48 61 e3
be 82 ab 3d 0a .
(.Z....Ha....=.
0140 df 35 b4 11 7
4 a5 85 16 a5 89 24
fb a1 1f ce 99 .
5..t.....$.....
0150 46 fb 4d e9 6
7 ff 4b d2 47 0f fa
dc 48 d3 1e 6e F
.M.g.K.G...H..n
0160 1b d0 92 d1 7
b 4f cf b9 b4 8e ee
ef b9 0f e5 43 .
...{O.........C
0170 a4 60 87 3a 8
a 33 4b 42 4f 3a 05
53 0d 89 a4 a0 .
`.:.3KBO:.S....
0180 07 4d 16 32 a
a 0c 45 79 8d af 0c
a2 75 72 e3 46 .
M.2..Ey....ur.F
0190 ee b3 1c 4f 2
3 a9 08 c4 71 12 1c
aa a0 64 8c 1e .
..O#...q....d..
01a0 22 6c 93 97 2
3 14 ae 54 64 da b9
0d ce 57 54 66 "
l..#..Td....WTf
01b0 47 75 61 63 6
5 6b fe ae df 8f 78
69 40 c0 50 d4 G
uacek....xi@.P.
01c0 2e 1e 13 34 a
b 5d 71 4e 41 57 21
f5 b1 15 6c 61 .
..4.]qNAW!...la
01d0 2f 81 c8 0b 9
2 e0 13 43 a4 79 9b
6a 00 63 b8 d8 /
......C.y.j.c..
01e0 d0 7c c3 48 0
9 57 91 91 0c 78 4e
c4 89 0f 57 2e .
|.H.W...xN...W.
01f0 e4 0f 32 a3 1
6 cf 4e 5c 7c c3 0f
56 7f 80 93 b9 .
.2...N\|..V....
0200 e0 6e 65 24 5
e 17 97 30 d2 0e 83
11 43 a4 6d ac .
ne$^..0....C.m.
0210 62 c3 a8 90 9
b 43 28 c8 8c 80 14
1b 0e 5c 9f 2e b
....C(......\..
0220 85 ff fb 92 0
4 eb 8f f2 e6 42 d8
01 e8 1a e0 64 .
........B.....d
0230 65 fb 00 3d e
6 4c 0c 79 11 5c 0c
30 6b 89 7a 22 e
..=.L.y.\.0k.z"

0240 2c 00 f4 95 7
0 8b 16 7a 29 49 f7
25 cf 11 15 ae ,
...p..z)I.%....
0250 92 98 b3 11 0
7 b4 27 a5 d2 1b 50
33 77 42 f1 46 .
.....'...P3wB.F
0260 f2 e5 86 8a f
9 55 bd ee a9 e3 68
fc c9 f0 87 74 .
....U....h....t
0270 9b a5 e2 1a 2
2 0b 41 4d f1 b3 35
e0 89 77 35 43 .
...".AM..5..w5C
0280 96 79 03 43 4
2 96 31 cd a9 02 29
75 1c 50 11 6e .
y.CB.1...)u.P.n
0290 70 1d 6d a3 2
2 02 48 d8 b6 3c d8
05 ed 0d a9 3b p
.m.".H..<.....;
02a0 bb 14 dc e3 8
b d3 8a 07 15 06 cc
d2 48 54 8c f9 .
...........HT..
02b0 7f 39 b4 ea 8
0 88 8f 42 ff 8e b0
f9 46 f1 ea 21 .
9.....B....F..!
02c0 ba 1b 9e 2f 2
e f5 95 20 29 89 c9
20 89 6a 71 29 .
../... ).. .jq)
02d0 57 23 6a 43 3
f c4 f3 b3 fd af 16
07 f9 fb 61 c1 W
#jC?.........a.
02e0 fb f1 61 6e 4
1 67 38 67 1c 26 aa
ed ee de e5 05 .
.anAg8g.&......
02f0 5b fb 26 fb 5
2 af e1 6f f5 f8 fa
a1 77 a5 71 95 [
.&.R..o....w.q.
0300 6b eb 13 b5 6
7 5f 2f 7e e2 82 c9
10 15 44 c5 1d k
...g_/~.....D..
0310 10 e2 36 ce a
5 10 23 4e 51 07 5c
46 f1 7b 19 5f .
.6...#NQ.\F.{._
0320 4f 97 d0 d9 e
6 9e 04 b4 be 34 c7
5a 4b ee a8 ae O
........4.ZK...
0330 60 65 83 cd 1
5 76 1f 3c a1 31 53
ca 61 66 62 ca `
e...v.<.1S.afb.
0340 1f 98 a4 52 3
0 89 95 4e 67 52 39
94 e7 7d 68 4d .
..R0..NgR9..}hM
0350 1b 4a be b4 c

6 cb be 02 65 44 29
61 60 31 d7 0a .
J......eD)a`1..
0360 29 8b 22 92 a
a 59 e3 03 4d b5 33
c8 5f 20 05 5a )
."..Y..M.3._ .Z
0370 94 ad c1 c2 a
b 6b 11 73 db 8b 3a
9a 9e 4e 8e b7 .
....k.s..:..N..
0380 6f 4c cd 24 1
2 b1 d1 5f 6b 88 d5
6e cf 60 8d 71 o
L.$..._k..n.`.q
0390 a8 58 45 e9 c
a 29 5e dd 78 5f d8
b0 23 4b 27 70 .
XE..)^.x_..#K'p
03a0 cc 59 f3 b5 c
a c2 18 38 94 99 90
48 44 26 06 65 .
Y.....8...HD&.e
03b0 28 42 96 e6 1
4 df 30 54 8a 8c 5e
aa da b2 c2 f2 (
B....0T..^.....
03c0 47 0d d8 ff f
b 92 04 e8 8f f2 ee
23 57 01 ef 32 G
..........#W..2
03d0 50 56 24 6b 0
0 3d e6 4a 0c 4c 8d
5a 0c 3c c9 49 P
V$k.=.J.L.Z.<.I
03e0 9d 9d 2b 80 f
7 95 70 11 0a a5 0a
b8 75 f2 37 a1 .
.+...p.....u.7.
03f0 96 8a 0e 61 2
3 22 cc 1b 64 38 65
af d4 36 62 4a .
..a#"..d8e..6bJ
0400 1c 2d d1 4f 1
c a4 14 8e 6b ac 5a
55 46 6e f6 ed .
-.O....k.ZUFn..
0410 91 a3 81 45 0
d 4d d8 b2 8b 4b 9d
e2 f1 e5 08 95 .
..E.M...K......
0420 96 f8 43 5b 6
f 2b 2a 5e 66 1a b6
69 cf 48 86 e0 .
.C[o+*^f..i.H..
0430 b9 4c d7 8f 6
3 65 0a 3c 18 96 ef
73 1a 4e e4 c5 .
L..ce.<...s.N..
0440 f8 ad 3d c1 c
5 c9 d2 f6 3f 22 45
52 d5 d6 48 70 .
.=.....?"ER..Hp
0450 11 97 fc 3a c
7 9d 27 55 bf 6d 08
e4 b4 18 2e 46 .
..:..'U.m.....F
0460 71 de f0 fd 8
3 3c 66 f8 b7 a6 5a

9e 64 ad f9 49 q
....<f...Z.d..I
0470 5b ba 36 b5 2
1 c2 66 62 ac a6 5a
7d 49 61 36 34 [
.6.!.fb..Z}Ia64
0480 ed c5 3f 7f 1
0 c4 68 71 82 79 08
b0 d2 11 63 d9 .
.?...hq.y....c.
0490 37 be f7 a3 2
a 95 cc 39 64 e5 18
b5 9d d0 75 a9 7
...*..9d.....u.
04a0 36 3a b8 9d 4
8 ad e4 02 bb 6a 8c
3f 4f e1 36 08 6
:..H....j.?O.6.
04b0 c1 1c f4 db 4
0 10 86 89 41 85 01
91 e3 e6 e1 87 .
...@...A.......
04c0 43 f7 36 b9 f
b a8 6e 79 b5 2e db
9e af c5 6b bc C
.6...ny......k.
04d0 aa ad 86 5e e
1 f2 89 90 e5 01 87
88 3a 87 c5 45 .
..^........:..E
04e0 d8 83 03 0e 2
8 26 40 89 05 55 b6
71 bc 8b b2 d1 .
...(&@..U.q....
04f0 bd cc 47 e4 4
d 39 b5 52 0c 71 61
da 50 c0 30 19 .
.G.M9.R.qa.P.0.
0500 aa 7a 50 76 0
2 09 55 24 59 4c 4b
0c 45 19 dd e9 .
zPv..U$YLK.E...
0510 7e 4b c0 2b d
0 50 cb 2a ad cb 54
04 97 65 ce b8 ~
K.+.P.*..T..e..
0520 46 d5
F
.
No. Time
Source
Destination
Protocol
Length Info
194 7.201284000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1284 http49
574 [PSH, ACK] Seq=
115800 Ack=1 Win=46
Len=1230
Frame 194: 1284 byt
es on wire (10272 b
its), 1284 bytes ca

ptured (10272 bits)

on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.251214000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.251214000 s
econds
[Time delta fro
m previous captured
frame: 0.075001000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07500100
0 seconds]
[Time since ref
erence or first fra
me: 7.201284000 sec
onds]
Frame Number: 1
94
Frame Length: 1
284 bytes (10272 bi
ts)
Capture Length:
1284 bytes (10272
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
270
Identification:
0xf1dc (61916)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a6c [validatio

n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 115800, Ack:
1, Len: 1230
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1230]
Sequence number
: 115800 (relati
ve sequence number)
[Next sequence
number: 117030 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t

.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x94b
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2490]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 04 f6 f1 dc 4
0 00 31 06 3a 6c 4a
7c 0c 8a c0 a8 .
...@.1.:lJ|....
0020 01 0b 00 50 c
1 a6 2b ca 26 85 9e
87 4e aa 50 18 .
..P..+.&...N.P.
0030 00 2e 94 b8 0
0 00 2c c1 9d 1d 78
44 e6 26 4b 0a .
.....,...xD.&K.
0040 46 75 db f6 d
7 f9 5c 29 b6 d8 c9
9c 40 a1 fd c1 F
u....\)....@...
0050 30 16 3c 68 4
1 46 bd a5 c7 9c 26
1c 82 ec 69 2b 0
.<hAF....&...i+
0060 5f 2b c2 57 d
1 bc 49 39 37 ac 72
45 1d 59 6f da _
+.W..I97.rE.Yo.
0070 cb 29 93 40 5
4 2a f6 0a 8b ff fb
92 04 e8 8f f2 .
).@T*..........
0080 f8 21 56 83 0
f 4a 50 58 64 ea e0
3d e6 4a 0b f4 .
!V..JPXd..=.J..
0090 8d 58 0c 3d 2
9 41 94 1d 6b 40 f7
95 70 69 34 b6 .
X.=)A..k@..pi4.
00a0 3c 76 34 3a a
7 6e 43 d1 52 50 02
43 45 48 c3 64 <
v4:.nC.RP.CEH.d

00b0 18 21 42 70 5
c 9d 4d d0 00 5d 84
e0 5b aa da 30 .
!Bp\.M..]..[..0
00c0 9e 22 9c 21 3
7 de 3e 5c af 73 8b
68 18 9b a1 03 .
".!7.>\.s.h....
00d0 fe c3 17 53 6
e 8b 4c ac f4 a2 1a
9e 34 ef e5 e3 .
..Sn.L.....4...
00e0 3b 4f 2c ad 6
5 cb ff 6c 9f e3 4f
43 22 65 a5 ef ;
O,.e..l..OC"e..
00f0 92 aa b7 4b 0
c 3a ee a5 8d 4c 45
2a 47 1e d4 35 .
..K.:...LE*G..5
0100 28 d7 18 ab 6
e b2 d9 88 11 24 c4
3d 51 90 7e 98 (
...n....$.=Q.~.
0110 3b 72 0a 99 5
9 2a 42 10 c5 4b 30
7e c5 5f 2a a2 ;
r..Y*B..K0~._*.
0120 11 99 97 51 9
6 19 b4 ef ae 98 ea
df 6e da ee c1 .
..Q........n...
0130 bd 43 c8 90 f
4 46 50 20 f0 d6 58
ba d4 58 36 13 .
C...FP ..X..X6.
0140 65 3c 87 d5 a
d 69 dd a7 51 77 3c
d4 f2 83 85 94 e
<...i..Qw<.....
0150 14 9c 4c 29 b
d ba 11 95 da 28 61
ba d9 5b 1e 49 .
.L).....(a..[.I
0160 f1 4c 44 ff 5
c 81 14 c6 46 18 11
e3 29 94 e3 17 .
LD.\...F...)...
0170 8c ca 6a 01 5
1 62 f4 66 96 71 0b
78 d9 64 15 2a .
.j.Qb.f.q.x.d.*
0180 bd 91 6b 1d e
5 d7 9f 07 66 03 ce
81 6c 80 ac 58 .
.k.....f...l..X
0190 d1 19 19 24 e
b 18 ba c3 05 9e dd
f0 e9 26 94 91 .
..$.........&..
01a0 5e 67 8e 98 7
8 e0 52 20 1e 70 60
54 28 e5 80 92 ^
g..x.R .p`T(...
01b0 c5 25 ad 7b 9
f b6 55 fd ee 6e d5
74 1a ae b4 d7 .
%.{..U..n.t....
01c0 6e ce 9a 96 1

7 40 87 a0 11 07 75
19 cb e2 4b 56 n
....@....u...KV
01d0 b5 3b 20 eb 4
6 b3 08 34 1a 89 2a
f0 9e 46 7f 0a .
; .F..4..*..F..
01e0 33 94 b6 d2 f
3 b8 c3 c5 30 32 dd
7c 13 a9 53 35 3
.......02.|..S5
01f0 ed 87 2d 7c 8
3 52 94 ab 46 98 76
e2 ea 7d 53 5a .
.-|.R..F.v..}SZ
0200 96 b6 63 55 8
7 5b 08 b5 eb 6a f8
a6 c0 8b 90 97 .
.cU.[...j......
0210 fa ab 98 ac f
6 e5 da 0c d7 ba de
ff fb 92 04 e9 .
...............
0220 8f f3 18 29 d
5 83 0f 42 60 5c 85
0a c0 3d e9 4a .
..)...B`\...=.J
0230 0b a4 b1 56 0
c 3d 09 81 77 93 ea
c1 8c 21 28 8f .
..V.=..w....!(.
0240 d3 26 42 40 e
2 d1 59 30 15 bd 3a
5a f3 44 94 ca .
&B@..Y0..:Z.D..
0250 8c 15 ab 2c 9
6 53 bc 0b bf 06 41
66 bd d6 d2 7e .
..,.S....Af...~
0260 9b 0c 69 27 b
b 52 cf 1a 56 3a b6
a4 32 d5 04 ed .
.i'.R..V:..2...
0270 c4 31 f6 af 2
b c6 48 ec 79 3c e5
5d 1d 1a ad cb .
1..+.H.y<.]....
0280 a6 e2 f9 b9 7
e cf fc cf 0d 34 6e
59 00 fa aa 6a .
...~....4nY...j
0290 57 5d 4e 67 c
f 52 45 65 bd 4c 56
ef a7 7f 54 54 W
]Ng.REe.LV...TT
02a0 89 60 48 90 6
0 42 c5 a2 34 5a 41
29 2b f8 23 e6 .
`H.`B..4ZA)+.#.
02b0 3c 38 7a 5d 0
8 e3 48 9b bb 89 a0
c2 72 ab a8 30 <
8z]..H.....r..0
02c0 0e 16 06 8a 1
1 af 39 5c 15 6f a6
15 44 90 67 2f .
.....9\.o..D.g/
02d0 39 94 70 bb 9
0 d1 c3 06 a4 93 3b

38 fb 12 8e 80 9
.p.......;8....
02e0 84 4f 28 31 b
5 86 6d 15 a5 d6 1f
7d 64 9a ec 92 .
O(1..m....}d...
02f0 ab fa ce a6 e
e 4b de ff e8 8a 97
6c 2c 72 c9 8d .
....K.....l,r..
0300 35 04 2f 79 1
0 1b 76 b5 2c 33 fa
37 21 5f d6 9d 5
./y..v.,3.7!_..
0310 f1 2f 5e 65 f
3 f7 a5 6c 42 06 ab
85 da 49 6d e9 .
/^e...lB....Im.
0320 a9 8a ec 37 9
5 ab 44 a6 1c 9c 3d
aa 11 1e d0 23 .
..7..D...=....#
0330 d1 a5 a7 51 e
d 90 ba 8b ba 05 b3
f5 c5 8e 74 f7 .
..Q..........t.
0340 d7 a7 1e 96 3
7 67 21 b2 1c f1 06
a0 a3 35 99 7a .
...7g!......5.z
0350 87 77 b5 e1 6
7 0f eb 14 b7 ca e5
5a 69 3f a1 9a .
w..g......Zi?..
0360 ea 73 40 c6 b
1 50 d8 01 d2 24 29
6c da 11 8e 3b .
s@..P...$)l...;
0370 de f8 92 8a 4
d 19 6b f1 99 70 08
f7 db 83 dd 35 .
...M.k..p.....5
0380 49 03 39 91 5
7 5f 17 82 61 f9 8f
c8 6a b6 92 2b I
.9.W_..a...j..+
0390 4c 2d 61 08 4
5 a7 3c 2a fa 75 03
ca aa 6e f0 46 L
-a.E.<*.u...n.F
03a0 42 c3 31 a2 7
4 ea 7e 85 9b d8 cb
fe df bb 86 7c B
.1.t.~........|
03b0 b6 a8 fb 94 6
5 4b 41 55 68 95 e6
bd df ff fb 92 .
...eKAUh.......
03c0 04 eb 0f f2 c
f 27 55 03 0f 5a 50
5d c5 8a a0 63 .
....'U..ZP]...c
03d0 0b 4c 0b 4c 8
f 52 0c 3d 29 41 9d
15 ea 01 8c 31 .
L.L.R.=)A.....1
03e0 30 a9 5d 3f f
d 2d 40 10 05 6c 15
01 47 da 43 10 0

.]?.-@..l..G.C.
03f0 57 29 7b 45 e
6 8f c7 e8 95 0d 64
db 67 9e c3 1e W
){E......d.g...
0400 ea 08 25 dc 8
a 63 86 33 74 73 b1
b9 0e a3 99 4f .
.%..c.3ts.....O
0410 3a 85 00 6a 4
c bf 1a 8b a7 2a b6
6f 07 e3 ec b7 :
..jL....*.o....
0420 e6 86 fd 6d 0
e d8 69 c3 54 7c 59
a3 fb 57 fe d9 .
..m..i.T|Y..W..
0430 9e ff 9e 2a 6
6 25 7d 59 5a 28 fd
da c9 54 b4 6e .
..*f%}YZ(...T.n
0440 a3 0c ef bf f
4 39 01 57 03 70 18
10 ca 83 0e 21 .
....9.W.p.....!
0450 32 98 21 9a d
d 7d d0 e8 84 64 1b
2a 34 88 bb 29 2
.!..}...d.*4..)
0460 03 f6 32 7d 9
4 46 d7 cd c5 04 42
e8 a1 82 ad 47 .
.2}.F....B....G
0470 f4 db 93 d8 c
d b4 48 e5 b9 66 cd
20 4c d0 f1 dc .
.....H..f. L...
0480 24 25 25 76 4
0 0e 88 9d 36 38 f9
e8 38 3b 4f 6b $
%%v@...68..8;Ok
0490 f1 5b 6d d5 1
f 72 c4 2b e7 b8 ff
9e 75 13 ff b7 .
[m..r.+....u...
04a0 fa d8 62 1a 9
0 c0 b7 e9 2d 05 3f
c8 5e 48 4d cf .
.b.....-.?.^HM.
04b0 98 78 f5 de 5
b f7 de 92 86 c1 8c
f6 14 e1 bc 30 .
x..[..........0
04c0 6c 7e 2f dc a
1 86 cf 2f 80 62 f9
c6 ea 55 8f 4b l
~/..../.b...U.K
04d0 68 1d 3d d5 8
4 dc 1e dc e2 23 a0
0b 16 28 a5 bc h
.=......#...(..
04e0 3f 2c 81 74 b
d 64 6c ba 09 24 2e
a4 7d f0 bb 5c ?
,.t.dl..$..}..\
04f0 c8 ed 4f ff f
6 4c b7 98 87 9c f9
fb 3c 4d d5 b9 .
.O..L......<M..

0500 77 63 7f 55
w
c.U
No. Time
Source
Destination
Protocol
Length Info
195 7.201464000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=117030 Win=41580 L
en=0
Frame 195: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.251394000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.251394000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 7.201464000 sec
onds]
Frame Number: 1
95
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4

0
Identification:
0x4f62 (20322)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 11703
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 117030 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t

.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41580
[Calculated win
dow size: 41580]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 194]
[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 62 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Ob@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 2b 53 50 10 .
....P..N.+.+SP.
0030 a2 6c 18 d4 0
0 00
.
l....
No. Time
Source
Destination
Protocol

Length Info
196 7.257285000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=11703
0 Ack=1 Win=46 Len=
1260
Frame 196: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.307215000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.307215000 s
econds
[Time delta fro
m previous captured
frame: 0.055821000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05582100
0 seconds]
[Time since ref
erence or first fra
me: 7.257285000 sec
onds]
Frame Number: 1
96
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64

:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1dd (61917)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a4d [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 117030, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 117030 (relati
ve sequence number)
[Next sequence
number: 118290 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set

.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xef0
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 dd 4
0 00 31 06 3a 4d 4a
7c 0c 8a c0 a8 .
...@.1.:MJ|....
0020 01 0b 00 50 c
1 a6 2b ca 2b 53 9e
87 4e aa 50 10 .
..P..+.+S..N.P.
0030 00 2e ef 08 0
0 00 79 41 a7 4b b8
71 c4 18 00 60 .
.....yA.K.q...`
0040 e5 88 d4 18 0
1 2d a0 59 f0 10 76
87 24 2a a2 cb .
....-.Y..v.$*..
0050 59 77 e3 48 c
7 11 98 94 b7 48 19
bb 35 0b 8c 89 Y
w.H.....H..5...
0060 9b e7 48 f3 7
1 35 6d 56 7e 65 93
30 bb f3 cf d6 .
.H.q5mV~e.0....
0070 49 00 49 1c 1
7 2e a9 94 91 4a 83

a8 4e af 90 66 I
.I......J..N..f
0080 f2 55 43 bb 4
e cf 9d 27 f7 c7 ff
4c b3 9f fb f5 .
UC.N..'...L....
0090 7f ff fb 92 0
4 ed 0f f3 03 2c 54
03 38 4a 60 5f .
........,T.8J`_
00a0 c5 2a 80 63 0
f 4c 0b 84 d1 50 0c
3d 6b 81 89 9a .
*.c.L...P.=k...
00b0 6a 01 8c 2d 7
0 73 fa c4 c3 b4 5e
8c 5e 50 0e 70 j
..-ps....^.^P.p
00c0 85 84 49 12 c
a 52 bf 2a 88 1a 17
41 e1 10 5d d1 .
.I..R.*...A..].
00d0 be cd 25 ad 8
0 58 33 ca d7 22 76
2a 3f 17 de 99 .
.%..X3.."v*?...
00e0 3f 54 79 fa b
6 e1 69 68 18 8a c3
a9 c1 7c 22 7a ?
Ty...ih.....|"z
00f0 33 e7 46 9e 9
2 95 9b 3a 40 80 da
97 1a e2 bc 5b 3
.F....:@......[
0100 cc ee db 1a 8
a 60 ca 5a 67 3e 5e
39 2d 8b 75 2d .
....`.Zg>^9-.u0110 aa dc 48 95 a
f 7f ef ee d4 e2 8b
09 05 1f 39 09 .
.H...........9.
0120 84 26 cc f2 4
1 c4 29 f2 15 18 af
d3 90 f8 6a 18 .
&..A.).......j.
0130 b8 e9 ee 41 3
a 7f 5c 48 36 72 65
ff bd 12 6a d6 .
..A:.\H6re...j.
0140 f2 81 b3 80 2
9 b2 87 ad 4e 0f 59
e1 ea 8e 9f 61 .
...)...N.Y....a
0150 00 31 32 2f d
1 26 1b a4 4f e0 eb
18 65 08 bf 69 .
12/.&..O...e..i
0160 cd 43 2e 53 6
a 3e eb ce d7 ea 18
9d a9 e6 35 02 .
C.Sj>........5.
0170 96 b4 31 ea 0
d 4a e4 e0 40 f8 a6
10 33 c6 f7 a8 .
.1..J..@...3...
0180 29 6d d1 f0 0
c c8 65 fc 2a 4c f0
bb ce 1b f2 f1 )

m....e.*L......
0190 00 97 82 60 5
a 48 3e 00 6d e5 93
2e 7c db 85 85 .
..`ZH>.m...|...
01a0 a8 03 2d 21 e
d 1c b5 54 ab 88 74
55 5a 73 e0 dd .
.-!...T..tUZs..
01b0 ac 05 76 9b 4
5 3e 0b 52 ef d1 35
1e 8b 76 8a cd .
.v.E>.R..5..v..
01c0 6a b4 6b 53 7
b 30 d7 3a f6 df 8b
5f fe 5d 35 e4 j
.kS{0.:..._.]5.
01d0 94 a8 99 e1 b
f fa 12 7f 0a b7 28
21 ee d8 39 61 .
.........(!..9a
01e0 55 48 95 16 a
0 91 95 be 89 e6 78
f2 75 8e 17 34 U
H........x.u..4
01f0 bd c3 83 a3 4
9 5b 0c 4a d9 1c 07
0b 8f b9 34 98 .
...I[.J......4.
0200 4b 39 5a 11 1
c 1a 04 ed 35 15 79
a7 b7 0e ca ad K
9Z.....5.y.....
0210 07 0c b3 64 a
0 02 68 92 d7 02 44
56 38 8a ba c7 .
..d..h...DV8...
0220 49 5d eb 63 7
c 78 24 db fd 5e 7d
d8 c7 af df 7f I
].c|x$..^}.....
0230 68 3f f9 ff f
b 92 04 ec 8f f3 16
34 53 83 58 4a h
?.........4S.XJ
0240 e0 5c 25 1a 8
0 63 0c 4a 0b cc bf
4c 0d 61 69 81 .
\%..c.J...L.ai.
0250 7e 95 e9 81 8
c bd 30 66 cb 7f 9a
81 05 af 15 3c ~
.....0f.......<
0260 2d 08 1a 21 d
2 16 d1 43 a6 28 0d
b4 34 01 d6 3e ..!...C.(..4..>
0270 fd 96 ba 5a 9
b e6 68 92 44 35 79
23 af 44 b6 36 .
..Z..h.D5y#.D.6
0280 f0 37 d2 bc a
5 74 54 d0 89 a1 00
4f dc fa 35 4a .
7...tT....O..5J
0290 7a 0e 9d 6c 9
3 46 5c a0 2b a5 8a
90 97 36 55 c6 z
..l.F\.+....6U.

02a0 34 41 e4 c2 a
3 4d 8e b7 09 c7 da
ff be de 75 f3 4
A...M........u.
02b0 bc 31 44 df f
8 78 1f 22 89 cb c3
47 fe ca 92 9d .
1D..x."...G....
02c0 5d 6e 61 82 5
2 b4 1f c6 85 87 37
43 0b 82 0e 95 ]
na.R.....7C....
02d0 f3 26 08 50 5
3 28 2f 5a 80 c2 df
86 50 b2 2c 3c .
&.PS(/Z....P.,<
02e0 39 4c e4 45 7
7 6a fc 3b 1a 49 c9
06 6c fe 26 f8 9
L.Ewj.;.I..l.&.
02f0 2b 1c ed 2f 2
9 25 52 bc 65 2e 6f
4b 4b de 56 7d +
../)%R.e.oKK.V}
0300 10 26 32 3c c
a 60 c0 b1 45 b3 05
a5 ee cd 6b 93 .
&2<.`..E.....k.
0310 36 46 c3 d4 a
1 bd 7e ac 57 7b eb
8f ef 8d 20 cf 6
F....~.W{.... .
0320 30 a3 f0 12 f
d 03 50 73 62 cc 1b
a2 ab 33 84 e7 0
.....Psb....3..
0330 11 2e 1c 6e c
6 17 90 24 f9 68 5f
b9 b0 cc 63 6a .
..n...$.h_...cj
0340 23 21 99 63 4
a 09 47 04 4d 59 a5
7b b1 7a 62 75 #
!.cJ.G.MY.{.zbu
0350 9d 99 e9 4a b
e 03 e1 d7 96 f5 d3
7b 7c 1a bf 4a .
..J.......{|..J
0360 58 3b bc 27 2
a d0 c9 6f a2 9f d9
97 36 77 e5 c7 X
;.'*..o....6w..
0370 c5 63 67 3b c
6 fc b9 ff f8 d3 ef
5f ea 3e 5d b0 .
cg;......._.>].
0380 15 fe bf f4 d
5 69 83 0d 9a 0f 98
b9 19 2f 0d 2a .
....i......./.*
0390 5d 63 1c a4 3
1 1a 2d ac 02 4f 02
b7 60 81 40 cc ]
c..1.-..O..`.@.
03a0 80 9e 31 24 b
8 9c c6 32 8c 6d e4
0f 45 82 99 58 .
.1$...2.m..E..X
03b0 c5 d0 97 4d 4

5 e3 73 17 5d 65 cf
31 63 72 82 d7 .
..ME.s.]e.1cr..
03c0 52 cf 29 61 9
a 1c b1 24 91 a3 11
35 b6 7f 4b d1 R
.)a...$...5..K.
03d0 be df 3a f6 f
b ff fb 92 04 ed 0f
f3 00 34 d3 03 .
.:..........4..
03e0 38 32 e0 66 6
5 7a 50 67 2f 4c 0c
48 cf 4c 0c e1 8
2.fezPg/L.H.L..
03f0 6b 81 82 17 e
9 81 8c bd 30 be f1
26 f1 fd 35 37 k
.......0..&..57
0400 fe 4a 15 02 3
7 e9 a9 61 00 a5 10
44 3c ca db 0f .
J..7..a...D<...
0410 ad 01 eb 15 0
1 41 54 c9 c3 b3 05
3d 0f 74 71 0b .
....AT....=.tq.
0420 ab 25 67 20 0
4 da 86 64 0e d2 ac
db d1 2c b3 06 .
%g ...d.....,..
0430 4b b4 40 1b 1
9 43 52 41 fa 7a 1a
fa 51 a6 0b ac K
.@..CRA.z..Q...
0440 29 5c 60 15 4
f 9b 52 34 84 71 25
1f 31 38 61 57 )
\`.O.R4.q%.18aW
0450 e0 ad 78 2f b
e 2d 35 f3 bc e7 70
20 7f fd a7 da .
.x/.-5...p ....
0460 98 c4 6b 7b f
4 d6 ea 9c 45 29 2c
8b 3a 5d c4 08 .
.k{....E),.:]..
0470 46 d4 dd 05 3
2 5a e4 4e 0e bd 97
d4 f8 c2 2a 5b F
...2Z.N......*[
0480 85 ad fa e9 9
4 4c da 0c 1c a7 14
29 b9 14 f2 c2 .
....L.....)....
0490 60 80 d4 a5 b
0 52 85 a9 00 a1 d2
24 4a 17 c5 0a `
....R.....$J...
04a0 49 2d 10 6b a
0 8d 4e 3d 15 ed 0e
47 64 6f 3d 26 I
-.k..N=...Gdo=&
04b0 d2 8b 0c 12 6
8 d4 0b 05 9d a8 06
20 27 42 ff 9f .
...h...... 'B..
04c0 dd 5a 3d 28 a
5 06 80 a6 09 81 c2

2a 9b 07 69 a4 .
Z=(.......*..i.
04d0 70 2a 9d 00 f
8 38 f8 fa 52 a6 d0
30 a3 bf 5e 56 p
*...8..R..0..^V
04e0 21 77 a3 2a b
2 21 e6 d8 d7 7a 37
e2 15 5a 02 35 !
w.*.!...z7..Z.5
04f0 61 46 20 50 f
4 1d 88 66 8a 0c 47
10 61 06 b8 a0 a
F P...f..G.a...
0500 ca 76 49 b8 4
4 a7 8a fd d2 61 0b
02 00 ce 21 40 .
vI.D....a....!@
0510 30 c8 63 84 4
2 c0 38 cf e5 c8 90
90 7d 4e e3 40 0
.c.B.8.....}N.@
0520 95 a9
.
.
No. Time
Source
Destination
Protocol
Length Info
197 7.316764000
pc13.home
par03s13-inf8.1e100.net TCP
66 51691h
ttp [SYN] Seq=0 Win
=8192 Len=0 MSS=126
0 WS=4 SACK_PERM=1
Frame 197: 66 bytes
on wire (528 bits)
, 66 bytes captured
(528 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.366694000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.366694000 s
econds
[Time delta fro
m previous captured
frame: 0.059479000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05947900

0 seconds]
[Time since ref
erence or first fra
me: 7.316764000 sec
onds]
Frame Number: 1
97
Frame Length: 6
6 bytes (528 bits)
Capture Length:
66 bytes (528 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: par03s13-in
-f8.1e100.net (173.
194.45.72)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 5
2
Identification:
0x4f63 (20323)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: pa
r03s13-in-f8.1e100.
net (173.194.45.72)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51691 (51691), D
st Port: http (80),
Seq: 0, Len: 0
Source Port: 51
691 (51691)
Destination Por
t: http (80)
[Stream index:
3]
[TCP Segment Le
n: 0]

Sequence number
: 0 (relative se
quence number)
Acknowledgment
number: 0
Header Length:
32 bytes
.... 0000 0000
0010 = Flags: 0x002
(SYN)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...0 .
... = Acknowledgmen
t: Not set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.1. = Syn: Set
[Expert
Info (Chat/Sequenc
e): Connection esta
blish request (SYN)
: server port http]
[Co
nnection establish
request (SYN): serv
er port http]
[Se
verity level: Chat]
[Gr
oup: Sequence]
.... .... .
..0 = Fin: Not set
Window size val
ue: 8192
[Calculated win
dow size: 8192]
Checksum: 0x9ce
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
Options: (12 by
tes), Maximum segme
nt size, No-Operati
on (NOP), Window sc
ale, No-Operation (

NOP), No-Operation
(NOP), SACK permitt
ed
Maximum seg
ment size: 1260 byt
es
Kind: M
aximum Segment Size
(2)
Length:
4
MSS Val
ue: 1260
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...
0 0001 = Number: No
-Operation (NOP) (1
)
Window scal
e: 2 (multiply by 4
)
Kind: W
indow Scale (3)
Length:
3
Shift c
ount: 2
[Multip
lier: 4]
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...
0 0001 = Number: No
-Operation (NOP) (1
)
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...
0 0001 = Number: No
-Operation (NOP) (1
)
TCP SACK Pe
rmitted Option: Tru
e
Kind: S
ACK Permitted (4)
Length:

2
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 34 4f 63 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
4Oc@...........
0020 2d 48 c9 eb 0
0 50 b7 a1 65 01 00
00 00 00 80 02 H...P..e.......
0030 20 00 9c e4 0
0 00 02 04 04 ec 01
03 03 02 01 01
...............
0040 04 02
.
.
No. Time
Source
Destination
Protocol
Length Info
198 7.351289000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1308 http49
574 [PSH, ACK] Seq=
118290 Ack=1 Win=46
Len=1254
Frame 198: 1308 byt
es on wire (10464 b
its), 1308 bytes ca
ptured (10464 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.401219000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.401219000 s
econds
[Time delta fro
m previous captured
frame: 0.034525000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03452500
0 seconds]
[Time since ref
erence or first fra

me: 7.351289000 sec

onds]
Frame Number: 1
98
Frame Length: 1
308 bytes (10464 bi
ts)
Capture Length:
1308 bytes (10464
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: Not-

ECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
294
Identification:
0xf1de (61918)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a52 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 118290, Ack:
1, Len: 1254
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1254]
Sequence number
: 118290 (relati
ve sequence number)
[Next sequence

number: 119544 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe8d
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2514]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0e f1 de 4
0 00 31 06 3a 52 4a
7c 0c 8a c0 a8 .
...@.1.:RJ|....
0020 01 0b 00 50 c

1 a6 2b ca 30 3f 9e
87 4e aa 50 18 .
..P..+.0?..N.P.
0030 00 2e e8 d7 0
0 00 3e 85 69 09 32
0e a2 43 96 6e .
.....>.i.2..C.n
0040 3c ac a5 f3 6
b ad 60 9e 0e 73 2f
6a e6 87 e1 eb <
...k.`..s/j....
0050 a5 17 99 6a 6
5 ab d7 6a 48 4a c6
14 7e 9b 9c 10 .
..je..jHJ..~...
0060 fd dd b5 18 4
6 81 05 a5 26 e0 c5
85 cf 8a 31 e2 .
...F...&.....1.
0070 8f cd b0 b3 9
b 2f 5a 82 24 6f 40
c4 6b 2a 3b 64 .
..../Z.$o@.k*;d
0080 f9 a8 1d 0a a
6 3a 01 fa 08 4e 10
ff fb 92 04 e7 .
....:...N......
0090 0f f2 ee 2e 5
3 03 38 7a 60 60 85
9a 60 63 4f 4c .
...S.8z``..`cOL
00a0 0b c4 af 52 0
c 3d 09 81 78 95 ab
40 f7 a1 30 ea .
..R.=..x..@..0.
00b0 39 97 b9 89 1
b f8 be bb a9 45 c1
30 83 98 c0 a1 9
........E.0....
00c0 0c 21 ac ca 2
1 0d aa 20 07 75 5c
32 0a f1 84 b1 .
!..!.. .u\2....
00d0 2a de bb 6f 6
e 5f 7e c7 66 46 c5
d9 e7 a5 d3 82 *
..on_~.fF......
00e0 b9 1f 91 f1 d
3 e6 39 4d 6c 5e 00
cb 39 92 41 78 .
.....9Ml^..9.Ax
00f0 9c 52 93 3f 9
4 32 32 3c 7f 8d 34
ed 09 c0 90 d2 .
R.?.22<..4.....
0100 4e 05 b4 13 4
a de f2 ea b5 4d e6
43 7a 3c 22 2a N
...J....M.Cz<"*
0110 bf f5 f4 2c 0
1 28 10 38 a4 cb 0e
0c c8 57 63 41 .
..,.(.8.....WcA
0120 15 0a ec 8a f
8 48 2e 7d 0a 78 c9
44 92 d3 99 46 .
....H.}.x.D...F
0130 bb 4f 2d 5d 9
5 eb 9a e9 81 ea e6

cc be 87 4b 18 .
O-]..........K.
0140 14 b4 cc 0f 0
2 e7 10 b4 38 aa c8
8e 8a 70 eb cb .
.......8....p..
0150 2e ca 93 55 0
a f7 a9 4e 71 65 24
f0 c6 ec 71 94 .
..U...Nqe$...q.
0160 c5 52 00 13 0
8 8b b9 87 c8 a8 0c
44 5e b3 64 4f .
R.........D^.dO
0170 fb b9 25 3f e
f fd 2a 20 20 41 84
cc ad 32 e7 5d .
.%?..* A...2.]
0180 d7 63 8f 73 f
5 90 6e 2a aa 42 8c
d3 24 7a 4e 65 .
c.s..n*.B..$zNe
0190 b6 db 1f ce d
d 24 63 42 a4 ea 5b
88 f3 0d 24 78 .
....$cB..[...$x
01a0 52 f6 b1 81 1
a 98 9a 17 96 94 55
c2 e5 88 97 c5 R
.........U.....
01b0 17 56 28 fe b
0 f3 ac b7 2b 8b b4
0a 11 12 43 ae .
V(.....+.....C.
01c0 70 1d ec 0e b
8 a8 24 79 6d 41 f4
24 99 d2 68 72 p
.....$ymA.$..hr
01d0 ff d2 87 22 b
6 7e b8 d5 67 c8 de
3e 83 11 0e b1 .
..".~..g..>....
01e0 a6 a6 be 4d 7
1 f2 18 23 ca 22 31
70 ab 76 51 24 .
..Mq..#."1p.vQ$
01f0 9b 60 bd 63 6
d 8e a4 32 e3 b7 37
32 9c a1 49 04 .
`.cm..2..72..I.
0200 60 f2 7d ca 6
7 3f ff a8 ab 4d 4b
06 7f 51 ad 7f `
.}.g?...MK..Q..
0210 f6 7f b6 7b e
8 e9 41 1a 1c 30 5e
21 74 dc 2f 18 .
..{..A..0^!t./.
0220 28 6a e4 a2 2
4 51 37 53 2e 87 3a
e6 c5 ff fb 92 (
j..$Q7S..:.....
0230 04 e8 8f f2 e
8 2c d6 83 0f 4a 60
5a 25 3a f0 61 .
....,...J`Z%:.a
0240 e6 4c 0c 7c a
3 5a 0d 3d 29 41 82
13 2b 81 87 a5 .

L.|.Z.=)A..+...
0250 28 fa 2f 42 3
f 6a fb 64 10 ec c5
c7 d9 52 2f 40 (
./B?j.d.....R/@
0260 dc 9a fb 45 8
4 9f a2 16 cc fc c8
71 86 65 37 31 .
..E.......q.e71
0270 b2 38 46 5b d
3 6c 76 9a 39 54 79
96 05 4e 50 ae .
8F[.lv.9Ty..NP.
0280 da 42 6f 3e b
b 8e 34 c5 96 c7 e9
b4 e1 54 ca 7e .
Bo>..4......T.~
0290 fa 9f 7a 00 5
6 3c c0 85 31 85 a5
5c 93 a5 45 00 .
.z.V<..1..\..E.
02a0 62 8c 5a 8c 4
e 38 c3 e2 87 54 61
0a 28 b9 34 36 b
.Z.N8...Ta.(.46
02b0 a2 69 ad bb d
e be fd ca 5d 96 f0
1d f9 d0 74 d3 .
i......].....t.
02c0 71 ed ad 03 6
2 b4 03 8b 92 b6 77
1d 8f 99 d9 9c q
...b.....w.....
02d0 db fb 77 80 8
7 41 6a 6d 72 e7 c8
56 02 48 d8 d9 .
.w..Ajmr..V.H..
02e0 21 fe db d9 a
5 95 58 6c cd 7d 9c
35 4c cc 8c fc !
.....Xl.}.5L...
02f0 a2 c3 5c 38 c
9 81 e1 f7 8e 62 05
12 34 fc c2 a8 .
.\8.....b..4...
0300 24 00 71 67 b
8 8a 5a b6 de 6c 9c
04 a4 32 88 b1 $
.qg..Z..l...2..
0310 c2 92 14 86 7
e 8d 09 44 45 42 cc
06 b6 fd 32 f8 .
...~..DEB....2.
0320 84 36 fd 49 1
d 5b e9 10 5a 80 03
9e 9f 8b 0d bc .
6.I.[..Z.......
0330 f9 d3 e6 a8 b
5 f4 ad 1f c6 e9 6c
e4 1b a9 65 64 .
.........l...ed
0340 bc 73 37 bf 8
c 15 12 67 32 0b 07
4c 91 3b 0a 2b .
s7....g2..L.;.+
0350 31 4f 41 10 c
4 ba ba 2d 8c 62 a9
de 8e 94 99 11 1
OA....-.b......

0360 f3 f6 2b 27 6
5 b1 06 cb 1b 91 4a
24 b6 a2 02 a2 .
.+'e.....J$....
0370 f4 5b 34 e2 1
2 67 35 3a 42 ea 8a
d2 c1 80 99 08 .
[4..g5:B.......
0380 bf cb b2 82 c
a 35 2d 90 26 7a 20
bf 21 e8 d2 e4 .
....5-.&z .!...
0390 7d 50 81 69 5
2 c9 01 5f 16 0a b1
5b 36 53 d5 0f }
P.iR.._...[6S..
03a0 2c b9 84 6a 7
b dd 95 e9 fb 36 85
2a c5 15 d9 ec ,
..j{....6.*....
03b0 ae 73 6e 53 d
a 56 ab 10 c0 58 f9
83 a3 6f 53 06 .
snS.V...X...oS.
03c0 1a 63 eb 61 2
a 1b 70 e4 b6 9a 4a
e5 56 64 93 ff .
c.a*.p...J.Vd..
03d0 fb 92 04 e9 8
f f2 e2 23 d7 03 2f
62 50 60 64 6a .
......#../bP`dj
03e0 e0 61 eb 4a 0
c 08 91 5c 0c 3d 29
41 8c 1d 2b 81 .
a.J...\.=)A..+.
03f0 86 15 70 b5 f
2 2a b7 fe de e4 c7
43 12 22 01 6a .
.p..*.....C.".j
0400 60 e8 d4 26 0
5 5b 52 f8 82 3e 92
73 2f 91 4e 82 `
..&.[R..>.s/.N.
0410 95 b0 fa 3a 0
e e8 6e 70 de 47 75
74 2a a9 a5 f0 .
..:..np.Gut*...
0420 31 cc 55 97 8
7 ec 4a 64 fa 68 aa
d5 a7 29 6b fd 1
.U...Jd.h...)k.
0430 21 df fc b7 f
d 69 4a a8 fd cf de
96 46 13 b4 04 !
....iJ.....F...
0440 f7 0b 12 6d e
9 33 3b 72 4d 0f b4
db 47 56 74 e8 .
..m.3;rM...GVt.
0450 68 7a eb 92 d
0 45 8b d7 fa fa 20
56 9e 65 ba 83 h
z...E.... V.e..
0460 a2 1f 16 3a 0
3 1b 75 15 4b 95 cf
04 9d b7 04 ca .
..:..u.K.......
0470 a6 29 23 58 5

5 c5 7e 91 2b e3 29
92 b3 b7 dd 8a .
)#XU.~.+.).....
0480 a9 ac 82 35 1
6 90 6f 22 1d 9b ba
a9 e3 86 b3 8d .
..5..o"........
0490 0e c1 b3 fd 0
8 c2 6d 65 29 24 9e
00 8a ef aa e3 .
.....me)$......
04a0 2a 12 66 3a 3
2 a6 ef 4f f8 ef 78
a1 f6 5c a1 21 *
.f:2..O..x..\.!
04b0 10 35 b8 d5 c
c b0 52 ff fd 4f aa
15 85 b2 0a 42 .
5....R..O.....B
04c0 fd 9f 76 de d
1 c0 e0 e1 a0 e2 91
40 6e dd d0 a5 .
.v........@n...
04d0 98 91 e0 a4 6
0 9c 6e 29 c7 71 94
ec db 95 51 04 .
...`.n).q....Q.
04e0 5f b8 d5 9b 3
0 52 55 82 a9 a9 d4
35 0f 90 9c 85 _
...0RU....5....
04f0 e3 11 ba 3a 3
4 6b 11 65 c4 cc f4
e3 97 4d e1 78 .
..:4k.e.....M.x
0500 79 bb bf e2 7
a 48 f2 7c d0 b1 5a
0b 8a a8 7a 86 y
...zH.|..Z...z.
0510 ac c2 2e 2a f
d b4 76 e8 c6 f7 c7
d5
.
..*..v.....
No. Time
Source
Destination
Protocol
Length Info
199 7.351468000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=119544 Win=40951 L
en=0
Frame 199: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t

ype: Ethernet (1)

Arrival Time: N
ov 10, 2014 11:27:0
0.401398000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.401398000 s
econds
[Time delta fro
m previous captured
frame: 0.000179000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017900
0 seconds]
[Time since ref
erence or first fra
me: 7.351468000 sec
onds]
Frame Number: 1
99
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08

:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f64 (20324)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu

st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 11954
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 119544 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40951
[Calculated win
dow size: 40951]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d

4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 198]
[The RTT to
ACK the segment wa
s: 0.000179000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 64 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Od@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 35 25 50 10 .
....P..N.+.5%P.
0030 9f f7 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
200 7.352279000
par03s13-in-f8.
1e100.net pc13.home
TCP
66 http51
691 [SYN, ACK] Seq=
0 Ack=1 Win=42900 L
en=0 MSS=1430 SACK_
PERM=1 WS=128
Frame 200: 66 bytes
on wire (528 bits)
, 66 bytes captured
(528 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.402209000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141

5615220.402209000 s
econds
[Time delta fro
m previous captured
frame: 0.000811000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00081100
0 seconds]
[Time since ref
erence or first fra
me: 7.352279000 sec
onds]
Frame Number: 2
00
Frame Length: 6
6 bytes (528 bits)
Capture Length:
66 bytes (528 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: par0
3s13-in-f8.1e100.ne
t (173.194.45.72),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 5
2
Identification:
0x4740 (18240)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 5
6
Protocol: TCP (
6)
Header checksum
: 0x9ec6 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: par03s1
3-in-f8.1e100.net (
173.194.45.72)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 51691 (51691),

Seq: 0, Ack: 1, Le
n: 0
Source Port: ht
tp (80)
Destination Por
t: 51691 (51691)
[Stream index:
3]
[TCP Segment Le
n: 0]
Sequence number
: 0 (relative se
quence number)
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
32 bytes
.... 0000 0001
0010 = Flags: 0x012
(SYN, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.1. = Syn: Set
[Expert
Info (Chat/Sequenc
e): Connection esta
blish acknowledge (
SYN+ACK): server po
rt http]
[Co
nnection establish
acknowledge (SYN+AC
K): server port htt
p]
[Se
verity level: Chat]
[Gr
oup: Sequence]
.... .... .
..0 = Fin: Not set
Window size val
ue: 42900
[Calculated win
dow size: 42900]
Checksum: 0xc9a

d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
Options: (12 by
tes), Maximum segme
nt size, No-Operati
on (NOP), No-Operat
ion (NOP), SACK per
mitted, No-Operatio
n (NOP), Window sca
le
Maximum seg
ment size: 1430 byt
es
Kind: M
aximum Segment Size
(2)
Length:
4
MSS Val
ue: 1430
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...
0 0001 = Number: No
-Operation (NOP) (1
)
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...
0 0001 = Number: No
-Operation (NOP) (1
)
TCP SACK Pe
rmitted Option: Tru
e
Kind: S
ACK Permitted (4)
Length:
2
No-Operatio
n (NOP)
Type: 1
0..
. .... = Copy on fr
agmentation: No
.00
. .... = Class: Con
trol (0)
...

0 0001 = Number: No
-Operation (NOP) (1
)
Window scal
e: 7 (multiply by 1
28)
Kind: W
indow Scale (3)
Length:
3
Shift c
ount: 7
[Multip
lier: 128]
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 197]
[The RTT to
ACK the segment wa
s: 0.035515000 seco
nds]
[iRTT: 0.03
5649000 seconds]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 34 47 40 0
0 00 38 06 9e c6 ad
c2 2d 48 c0 a8 .
4G@..8.....-H..
0020 01 0b 00 50 c
9 eb 18 85 61 ba b7
a1 65 02 80 12 .
..P....a...e...
0030 a7 94 c9 ad 0
0 00 02 04 05 96 01
01 04 02 01 03 .
...............
0040 03 07
.
.
No. Time
Source
Destination
Protocol
Length Info
201 7.352413000
pc13.home
par03s13-inf8.1e100.net TCP
54 51691h
ttp [ACK] Seq=1 Ack
=1 Win=66780 Len=0
Frame 201: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})

Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.402343000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.402343000 s
econds
[Time delta fro
m previous captured
frame: 0.000134000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00013400
0 seconds]
[Time since ref
erence or first fra
me: 7.352413000 sec
onds]
Frame Number: 2
01
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As

ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: par03s13-in
-f8.1e100.net (173.
194.45.72)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f65 (20325)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: pa

r03s13-in-f8.1e100.
net (173.194.45.72)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51691 (51691), D
st Port: http (80),
Seq: 1, Ack: 1, Le
n: 0
Source Port: 51
691 (51691)
Destination Por
t: http (80)
[Stream index:
3]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 16695
[Calculated win
dow size: 66780]
[Window size sc
aling factor: 4]
Checksum: 0x9cd
8 [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 200]
[The RTT to
ACK the segment wa
s: 0.000134000 seco
nds]
[iRTT: 0.03
5649000 seconds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 65 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
(Oe@...........
0020 2d 48 c9 eb 0
0 50 b7 a1 65 02 18
85 61 bb 50 10 H...P..e...a.P.
0030 41 37 9c d8 0
0 00
A
7....
No. Time
Source
Destination
Protocol
Length Info
202 7.354505000
pc13.home
par03s13-inf8.1e100.net HTTP
306 GET /coll
ect?v=1&tid=UA-4570
8355-2&cid=5d68514b
-a9b5-4191-85a3-8ca
ec85c9881&t=event&e
c=AvastNG-Build-55&
ea=NgToolStarted&el
=0 HTTP/1.1
Frame 202: 306 byte
s on wire (2448 bit
s), 306 bytes captu
red (2448 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.404435000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615220.404435000 s
econds
[Time delta fro
m previous captured
frame: 0.002092000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00209200
0 seconds]
[Time since ref
erence or first fra
me: 7.354505000 sec
onds]
Frame Number: 2
02
Frame Length: 3
06 bytes (2448 bits
)
Capture Length:
306 bytes (2448 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Number of perprotocol-data: 1]
[Hypertext Tran
sfer Protocol, key
0]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: par03s13-in
-f8.1e100.net (173.
194.45.72)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 2
92
Identification:
0x4f66 (20326)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: pa
r03s13-in-f8.1e100.
net (173.194.45.72)

[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51691 (51691), D
st Port: http (80),
Seq: 1, Ack: 1, Le
n: 252
Source Port: 51
691 (51691)
Destination Por
t: http (80)
[Stream index:
3]
[TCP Segment Le
n: 252]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 253 (rel
ative sequence numb
er)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 16695
[Calculated win
dow size: 66780]
[Window size sc
aling factor: 4]
Checksum: 0x9dd
4 [validation disab

led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[iRTT: 0.03
5649000 seconds]
[Bytes in f
light: 252]
Hypertext Transfer
Protocol
GET /collect?v=
1&tid=UA-45708355-2
&cid=5d68514b-a9b54191-85a3-8caec85c9
881&t=event&ec=Avas
tNG-Build-55&ea=NgT
oolStarted&el=0 HTT
P/1.1\r\n
[Expert Inf
o (Chat/Sequence):
GET /collect?v=1&ti
d=UA-45708355-2&cid
=5d68514b-a9b5-4191
-85a3-8caec85c9881&
t=event&ec=AvastNGBuild-55&ea=NgToolS
tarted&el=0 HTTP/1.
1\r\n]
[GET /c
ollect?v=1&tid=UA-4
5708355-2&cid=5d685
14b-a9b5-4191-85a38caec85c9881&t=even
t&ec=AvastNG-Build55&ea=NgToolStarted
&el=0 HTTP/1.1\r\n]
[Severi
ty level: Chat]
[Group:
Sequence]
Request Met
hod: GET
Request URI
: /collect?v=1&tid=
UA-45708355-2&cid=5
d68514b-a9b5-4191-8
5a3-8caec85c9881&t=
event&ec=AvastNG-Bu
ild-55&ea=NgToolSta
rted&el=0
Request Ver
sion: HTTP/1.1
User-Agent: ava
st! ngtool Agent\r\
n
Host: www.googl
e-analytics.com\r\n
Connection: Kee
p-Alive\r\n
Cache-Control:
no-cache\r\n
\r\n
[Full request U
RI: http://www.goog

le-analytics.com/co
llect?v=1&tid=UA-45
708355-2&cid=5d6851
4b-a9b5-4191-85a3-8
caec85c9881&t=event
&ec=AvastNG-Build-5
5&ea=NgToolStarted&
el=0]
[HTTP request 1
/1]
[Response in fr
ame: 204]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 01 24 4f 66 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
$Of@...........
0020 2d 48 c9 eb 0
0 50 b7 a1 65 02 18
85 61 bb 50 18 H...P..e...a.P.
0030 41 37 9d d4 0
0 00 47 45 54 20 2f
63 6f 6c 6c 65 A
7....GET /colle
0040 63 74 3f 76 3
d 31 26 74 69 64 3d
55 41 2d 34 35 c
t?v=1&tid=UA-45
0050 37 30 38 33 3
5 35 2d 32 26 63 69
64 3d 35 64 36 7
08355-2&cid=5d6
0060 38 35 31 34 6
2 2d 61 39 62 35 2d
34 31 39 31 2d 8
514b-a9b5-41910070 38 35 61 33 2
d 38 63 61 65 63 38
35 63 39 38 38 8
5a3-8caec85c988
0080 31 26 74 3d 6
5 76 65 6e 74 26 65
63 3d 41 76 61 1
&t=event&ec=Ava
0090 73 74 4e 47 2
d 42 75 69 6c 64 2d
35 35 26 65 61 s
tNG-Build-55&ea
00a0 3d 4e 67 54 6
f 6f 6c 53 74 61 72
74 65 64 26 65 =
NgToolStarted&e
00b0 6c 3d 30 20 4
8 54 54 50 2f 31 2e
31 0d 0a 55 73 l
=0 HTTP/1.1..Us
00c0 65 72 2d 41 6
7 65 6e 74 3a 20 61
76 61 73 74 21 e
r-Agent: avast!
00d0 20 6e 67 74 6
f 6f 6c 20 41 67 65
6e 74 0d 0a 48
ngtool Agent..H

00e0 6f 73 74 3a 2
0 77 77 77 2e 67 6f
6f 67 6c 65 2d o
st: www.google00f0 61 6e 61 6c 7
9 74 69 63 73 2e 63
6f 6d 0d 0a 43 a
nalytics.com..C
0100 6f 6e 6e 65 6
3 74 69 6f 6e 3a 20
4b 65 65 70 2d o
nnection: Keep0110 41 6c 69 76 6
5 0d 0a 43 61 63 68
65 2d 43 6f 6e A
live..Cache-Con
0120 74 72 6f 6c 3
a 20 6e 6f 2d 63 61
63 68 65 0d 0a t
rol: no-cache..
0130 0d 0a
.
.
No. Time
Source
Destination
Protocol
Length Info
203 7.388294000
par03s13-in-f8.
1e100.net pc13.home
TCP
60 http51
691 [ACK] Seq=1 Ack
=253 Win=44032 Len=
0
Frame 203: 60 bytes
on wire (480 bits)
, 60 bytes captured
(480 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.438224000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.438224000 s
econds
[Time delta fro
m previous captured
frame: 0.033789000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03378900
0 seconds]
[Time since ref

erence or first fra

me: 7.388294000 sec
onds]
Frame Number: 2
03
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Padding: 000000
000000
Internet Protocol V
ersion 4, Src: par0
3s13-in-f8.1e100.ne
t (173.194.45.72),
Dst: pc13.home (192
.168.1.11)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4741 (18241)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 5
6
Protocol: TCP (
6)
Header checksum
: 0x9ed1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: par03s1
3-in-f8.1e100.net (
173.194.45.72)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 51691 (51691),
Seq: 1, Ack: 253,
Len: 0
Source Port: ht
tp (80)
Destination Por
t: 51691 (51691)
[Stream index:
3]
[TCP Segment Le

n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 253 (rel
ative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 344
[Calculated win
dow size: 44032]
[Window size sc
aling factor: 128]
Checksum: 0xafa
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 202]
[The RTT to
ACK the segment wa
s: 0.033789000 seco
nds]
[iRTT: 0.03
5649000 seconds]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17

e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 28 47 41 0
0 00 38 06 9e d1 ad
c2 2d 48 c0 a8 .
(GA..8.....-H..
0020 01 0b 00 50 c
9 eb 18 85 61 bb b7
a1 65 fe 50 10 .
..P....a...e.P.
0030 01 58 af a2 0
0 00 00 00 00 00 00
00
.
X..........
No. Time
Source
Destination
Protocol
Length Info
204 7.389280000
par03s13-in-f8.
1e100.net pc13.home
HTTP
497 HTTP/1.1
200 OK (GIF89a)
Frame 204: 497 byte
s on wire (3976 bit
s), 497 bytes captu
red (3976 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.439210000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.439210000 s
econds
[Time delta fro
m previous captured
frame: 0.000986000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00098600
0 seconds]
[Time since ref
erence or first fra
me: 7.389280000 sec
onds]
Frame Number: 2
04
Frame Length: 4
97 bytes (3976 bits
)
Capture Length:
497 bytes (3976 bi
ts)
[Frame is marke

d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:imagegif]
[Number of perprotocol-data: 1]
[Hypertext Tran
sfer Protocol, key
0]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: par0
3s13-in-f8.1e100.ne
t (173.194.45.72),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: Not-

ECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
83
Identification:
0x4742 (18242)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 5
6
Protocol: TCP (
6)
Header checksum
: 0x9d15 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: par03s1
3-in-f8.1e100.net (
173.194.45.72)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 51691 (51691),
Seq: 1, Ack: 253,
Len: 443
Source Port: ht
tp (80)
Destination Por
t: 51691 (51691)
[Stream index:
3]
[TCP Segment Le
n: 443]
Sequence number
: 1 (relative se
quence number)
[Next sequence
number: 444 (rel
ative sequence numb

er)]
Acknowledgment
number: 253 (rel
ative ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 344
[Calculated win
dow size: 44032]
[Window size sc
aling factor: 128]
Checksum: 0x572
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[iRTT: 0.03
5649000 seconds]
[Bytes in f
light: 443]
Hypertext Transfer
Protocol
HTTP/1.1 200 OK
\r\n
[Expert Inf
o (Chat/Sequence):
HTTP/1.1 200 OK\r\n
]
[HTTP/1
.1 200 OK\r\n]
[Severi

ty level: Chat]
[Group:
Sequence]
Request Ver
sion: HTTP/1.1
Status Code
: 200
Response Ph
rase: OK
Pragma: no-cach
e\r\n
Expires: Mon, 0
7 Aug 1995 23:30:00
GMT\r\n
Access-ControlAllow-Origin: *\r\n
Last-Modified:
Sun, 17 May 1998 03
:00:00 GMT\r\n
X-Content-TypeOptions: nosniff\r\
n
Content-Type: i
mage/gif\r\n
Date: Sun, 09 N
ov 2014 00:45:25 GM
T\r\n
Server: Golfe2\
r\n
Content-Length:
35\r\n
[Content le
ngth: 35]
Cache-Control:
private, no-cache,
no-cache=Set-Cookie
, proxy-revalidate\
r\n
Age: 121296\r\n
Alternate-Proto
col: 80:quic,p=0.01
\r\n
\r\n
[HTTP response
1/1]
[Time since req
uest: 0.034775000 s
econds]
[Request in fra
me: 202]
Compuserve GIF, Ver
sion: GIF89a
Version: GIF89a
Screen width: 1
Screen height:
1
Global settings
: (Global color tab
le present) (1 bit
per color) (1 bit p
er pixel)
1... .... =
Global color map i
s present: True (1)
.000 .... =
Bits per color min
us 1: 0
.... 0... =
Global color map i

s ordered: False (0
)
.... .000 =
Image bits per pix
el minus 1: 0
Background colo
r index: 255
Global color ma
p: ffffff000000
Image
Image left
position: 0
Image top p
osition: 0
Image width
:1
Image heigh
t: 1
Local setti
ngs: (1 bit per col
or) (1 bit per pixe
l)
0... ..
.. = Local color ma
p is present: False
(0)
.000 ..
.. = Bits per color
minus 1: 0
.... 0.
.. = Local color ma
p is ordered: False
(0)
.... .0
00 = Image bits per
pixel minus 1: 0
LZW minimum
code size: 2
Data block
(length = 2)
Data block
(length = 0)
Trailer (End of
the GIF stream)
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 e3 47 42 0
0 00 38 06 9d 15 ad
c2 2d 48 c0 a8 .
.GB..8.....-H..
0020 01 0b 00 50 c
9 eb 18 85 61 bb b7
a1 65 fe 50 18 .
..P....a...e.P.
0030 01 58 57 25 0
0 00 48 54 54 50 2f
31 2e 31 20 32 .
XW%..HTTP/1.1 2
0040 30 30 20 4f 4
b 0d 0a 50 72 61 67
6d 61 3a 20 6e 0
0 OK..Pragma: n
0050 6f 2d 63 61 6
3 68 65 0d 0a 45 78
70 69 72 65 73 o
-cache..Expires

0060 3a 20 4d 6f 6
e 2c 20 30 37 20 41
75 67 20 31 39 :
Mon, 07 Aug 19
0070 39 35 20 32 3
3 3a 33 30 3a 30 30
20 47 4d 54 0d 9
5 23:30:00 GMT.
0080 0a 41 63 63 6
5 73 73 2d 43 6f 6e
74 72 6f 6c 2d .
Access-Control0090 41 6c 6c 6f 7
7 2d 4f 72 69 67 69
6e 3a 20 2a 0d A
llow-Origin: *.
00a0 0a 4c 61 73 7
4 2d 4d 6f 64 69 66
69 65 64 3a 20 .
Last-Modified:
00b0 53 75 6e 2c 2
0 31 37 20 4d 61 79
20 31 39 39 38 S
un, 17 May 1998
00c0 20 30 33 3a 3
0 30 3a 30 30 20 47
4d 54 0d 0a 58
03:00:00 GMT..X
00d0 2d 43 6f 6e 7
4 65 6e 74 2d 54 79
70 65 2d 4f 70 Content-Type-Op
00e0 74 69 6f 6e 7
3 3a 20 6e 6f 73 6e
69 66 66 0d 0a t
ions: nosniff..
00f0 43 6f 6e 74 6
5 6e 74 2d 54 79 70
65 3a 20 69 6d C
ontent-Type: im
0100 61 67 65 2f 6
7 69 66 0d 0a 44 61
74 65 3a 20 53 a
ge/gif..Date: S
0110 75 6e 2c 20 3
0 39 20 4e 6f 76 20
32 30 31 34 20 u
n, 09 Nov 2014
0120 30 30 3a 34 3
5 3a 32 35 20 47 4d
54 0d 0a 53 65 0
0:45:25 GMT..Se
0130 72 76 65 72 3
a 20 47 6f 6c 66 65
32 0d 0a 43 6f r
ver: Golfe2..Co
0140 6e 74 65 6e 7
4 2d 4c 65 6e 67 74
68 3a 20 33 35 n
tent-Length: 35
0150 0d 0a 43 61 6
3 68 65 2d 43 6f 6e
74 72 6f 6c 3a .
.Cache-Control:
0160 20 70 72 69 7
6 61 74 65 2c 20 6e
6f 2d 63 61 63
private, no-cac
0170 68 65 2c 20 6

e 6f 2d 63 61 63 68
65 3d 53 65 74 h
e, no-cache=Set
0180 2d 43 6f 6f 6
b 69 65 2c 20 70 72
6f 78 79 2d 72 Cookie, proxy-r
0190 65 76 61 6c 6
9 64 61 74 65 0d 0a
41 67 65 3a 20 e
validate..Age:
01a0 31 32 31 32 3
9 36 0d 0a 41 6c 74
65 72 6e 61 74 1
21296..Alternat
01b0 65 2d 50 72 6
f 74 6f 63 6f 6c 3a
20 38 30 3a 71 e
-Protocol: 80:q
01c0 75 69 63 2c 7
0 3d 30 2e 30 31 0d
0a 0d 0a 47 49 u
ic,p=0.01....GI
01d0 46 38 39 61 0
1 00 01 00 80 ff 00
ff ff ff 00 00 F
89a............
01e0 00 2c 00 00 0
0 00 01 00 01 00 00
02 02 44 01 00 .
,...........D..
01f0 3b
;
No. Time
Source
Destination
Protocol
Length Info
205 7.389428000
pc13.home
par03s13-inf8.1e100.net TCP
54 51691h
ttp [ACK] Seq=253 A
ck=444 Win=66336 Le
n=0
Frame 205: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.439358000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.439358000 s

econds
[Time delta fro
m previous captured
frame: 0.000148000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00014800
0 seconds]
[Time since ref
erence or first fra
me: 7.389428000 sec
onds]
Frame Number: 2
05
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: par03s13-in
-f8.1e100.net (173.
194.45.72)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f67 (20327)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: pa
r03s13-in-f8.1e100.
net (173.194.45.72)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51691 (51691), D
st Port: http (80),
Seq: 253, Ack: 444

, Len: 0
Source Port: 51
691 (51691)
Destination Por
t: http (80)
[Stream index:
3]
[TCP Segment Le
n: 0]
Sequence number
: 253 (relative
sequence number)
Acknowledgment
number: 444 (rel
ative ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 16584
[Calculated win
dow size: 66336]
[Window size sc
aling factor: 4]
Checksum: 0x9cd
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 204]
[The RTT to

ACK the segment wa

s: 0.000148000 seco
nds]
[iRTT: 0.03
5649000 seconds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 67 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
(Og@...........
0020 2d 48 c9 eb 0
0 50 b7 a1 65 fe 18
85 63 76 50 10 H...P..e...cvP.
0030 40 c8 9c d8 0
0 00
@
.....
No. Time
Source
Destination
Protocol
Length Info
206 7.439629000
pc13.home
par03s13-inf8.1e100.net TCP
54 51691h
ttp [RST, ACK] Seq=
253 Ack=444 Win=0 L
en=0
Frame 206: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.489559000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.489559000 s
econds
[Time delta fro
m previous captured
frame: 0.050201000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05020100
0 seconds]
[Time since ref
erence or first fra
me: 7.439629000 sec

onds]
Frame Number: 2
06
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: TCP RST]
[Coloring Rule
String: tcp.flags.r
eset eq 1]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: par03s13-in
-f8.1e100.net (173.
194.45.72)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0

0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f68 (20328)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: pa
r03s13-in-f8.1e100.
net (173.194.45.72)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 51691 (51691), D
st Port: http (80),
Seq: 253, Ack: 444
, Len: 0
Source Port: 51
691 (51691)
Destination Por
t: http (80)
[Stream index:
3]
[TCP Segment Le
n: 0]
Sequence number
: 253 (relative
sequence number)
Acknowledgment

number: 444 (rel

ative ack number)
Header Length:
20 bytes
.... 0000 0001
0100 = Flags: 0x014
(RST, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
1.. = Reset: Set
[Expert
Info (Warn/Sequenc
e): Connection rese
t (RST)]
[Co
nnection reset (RST
)]
[Se
verity level: Warn]
[Gr
oup: Sequence]
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 0
[Calculated win
dow size: 0]
[Window size sc
aling factor: 4]
Checksum: 0x9cd
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 68 4
0 00 80 06 00 00 c0
a8 01 0b ad c2 .
(Oh@...........

0020 2d 48 c9 eb 0
0 50 b7 a1 65 fe 18
85 63 76 50 14 H...P..e...cvP.
0030 00 00 9c d8 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
207 7.475295000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=11954
4 Ack=1 Win=46 Len=
1260
Frame 207: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.525225000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.525225000 s
econds
[Time delta fro
m previous captured
frame: 0.035666000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03566600
0 seconds]
[Time since ref
erence or first fra
me: 7.475295000 sec
onds]
Frame Number: 2
07
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]

[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1df (61919)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a4b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 119544, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 119544 (relati
ve sequence number)
[Next sequence
number: 120804 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes

.... 0000 0001

0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xad8
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 df 4
0 00 31 06 3a 4b 4a
7c 0c 8a c0 a8 .
...@.1.:KJ|....
0020 01 0b 00 50 c
1 a6 2b ca 35 25 9e
87 4e aa 50 10 .
..P..+.5%..N.P.
0030 00 2e ad 88 0
0 00 87 49 46 03 42
09 8d 5c 35 2e .
......IF.B..\5.
0040 6c 2a 45 30 6

c 83 8d 99 34 c8 0c
23 c1 32 42 93 l
*E0l...4..#.2B.
0050 27 53 7b b4 8
9 6e 47 77 bb 44 3d
a4 15 6b 08 4b '
S{..nGw.D=..k.K
0060 ec f1 aa 0c 6
4 d5 25 79 e4 b5 6b
3d 4a 99 b1 02 .
...d.%y..k=J...
0070 f1 95 33 63 5
f c0 d6 fd 20 57 7e
6a fd 5f 39 a5 .
.3c_... W~j._9.
0080 f7 ef b9 03 4
1 47 1d 54 70 c4 2d
ff fb 92 04 e8 .
...AG.Tp.-.....
0090 8f f2 d1 23 d
6 83 0f 4a 50 60 24
ea d0 61 ec 4a .
..#...JP`$..a.J
00a0 0b e4 d3 54 0
c bd 0b 81 87 1a 2a
c1 87 a1 70 e7 .
..T......*...p.
00b0 98 16 4b 22 9
4 b5 be e6 3d 3e cf
f5 2c 96 4e a3 .
.K"....=>..,.N.
00c0 83 43 4c e7 6
d c8 6d c5 05 0c a2
43 9d 61 c4 6b .
CL.m.m....C.a.k
00d0 be 5a 31 9b d
8 95 6e 51 4c 6b 1e
90 b2 a9 dc 94 .
Z1...nQLk......
00e0 65 5c bc fa 4
0 4e 98 5b 44 27 31
bd e6 11 d6 28 e
\..@N.[D'1....(
00f0 b1 8f f3 1e 9
f 9c a5 fe ae 74 53
0d b2 9d f4 98 .
........tS.....
0100 a3 a8 8c 78 a
8 a3 47 02 06 c7 34
72 cb 3c 54 08 .
..x..G...4r.<T.
0110 39 3a 67 d0 f
d dc b2 be de 9f aa
6c b8 07 50 83 9
:g........l..P.
0120 ac 42 20 a0 a
4 b8 44 4d 02 6d d8
23 c4 1d fa b0 .
B ...DM.m.#....
0130 42 52 25 fc 9
a dd 28 a2 9c ba ad
b8 37 ba 88 54 B
R%...(.....7..T
0140 21 90 54 f0 5
b 48 04 76 75 56 48
8d a7 89 7a 54 !
.T.[H.vuVH...zT
0150 be b5 fc e3 a
e c0 34 ee b4 2e f2

b3 01 c3 3e da .
.....4.......>.
0160 95 c7 33 fb b
b cf 4f a4 aa cd 9e
50 b3 90 29 c7 .
.3...O....P..).
0170 f4 fe bf ff a
5 ba 87 01 09 12 a3
e9 dc e2 ba 30 .
..............0
0180 da 3f cd 2b 4
2 71 f2 50 5a 14 ea
b3 ff 6b 29 7c .
?.+Bq.PZ....k)|
0190 c0 29 e6 84 9
5 80 67 36 55 7b 2c
9a de 33 bd 5c .
)....g6U{,..3.\
01a0 2f b3 46 72 b
2 36 da b6 a1 d6 af
f5 1a ed 83 a6 /
.Fr.6..........
01b0 3e a3 f2 74 8
a 4e b2 74 a8 34 34
42 f1 c3 4b aa >
..t.N.t.44B..K.
01c0 50 6b 4c 06 3
6 a3 23 47 d1 ff 8f
fc 9f ea 61 a2 P
kL.6.#G......a.
01d0 8c 0c e7 70 c
1 60 a0 40 26 4e e1
28 32 cf cb 85 .
..p.`.@&N.(2...
01e0 38 06 03 74 e
b 01 89 4e a7 6d 84
7f af 2b 9b d0 8
..t...N.m...+..
01f0 c8 29 16 78 c
9 e5 4b c8 8f de 09
8d 72 28 52 02 .
).x..K.....r(R.
0200 e9 13 89 e0 2
5 94 a7 a0 68 97 c1
21 39 b2 15 ff .
...%...h..!9...
0210 81 76 70 ad f
1 a5 d2 29 71 75 19
60 88 a2 82 04 .
vp....)qu.`....
0220 9a 1b 78 18 9
0 bd 71 83 b6 ce 23
fa ac ff fb 92 .
.x...q...#.....
0230 04 e9 8f f3 1
1 2b 55 03 0f 7a 60
5e a5 2a b0 61 .
....+U..z`^.*.a
0240 ec 4c 0b 40 a
f 54 0d 3d 29 81 65
11 ea c1 a7 b1 .
L.@.T.=).e.....
0250 28 fa 18 08 a
d 01 41 40 22 11 0a
f6 51 bb 82 c0 (
.....A@"...Q...
0260 e1 4a 44 a8 2
5 a6 27 3c dc a5 d6
ad 37 0d 4c cb .

JD.%.'<....7.L.
0270 9b fd c4 e4 3
9 3c 54 f6 6c db c6
97 5b 61 23 a0 .
...9<T.l...[a#.
0280 b4 56 02 a0 9
1 b8 28 ec 29 f6 35
11 bb b5 7d 56 .
V....(.).5...}V
0290 51 fd b1 dd f
5 f3 71 9c d8 46 e1
74 dc d4 a7 15 Q
.....q..F.t....
02a0 12 13 78 91 8
d 26 51 22 e1 0a 9b
5e 1f e3 db b3 .
.x..&Q"...^....
02b0 39 d9 dd 67 e
e a1 7e 98 32 47 ef
20 b0 f0 71 12 9
..g..~.2G. ..q.
02c0 d9 66 94 a6 2
c 55 a4 bf 0b 8d a4
ba ea 13 16 62 .
f..,U.........b
02d0 69 f1 2c a4 8
2 ed 58 58 4e bd 11
6e 47 a1 74 f9 i
.,...XXN..nG.t.
02e0 51 4d 41 9d b
8 75 ac 21 56 69 5d
12 4b da 97 89 Q
MA..u.!Vi].K...
02f0 8c a6 ce b4 3
f 16 4c dc 53 de ec
46 2d d5 3f c7 .
...?.L.S..F-.?.
0300 cd 69 cd cc b
0 c9 91 03 85 da b9
d2 00 b1 52 fb .
i............R.
0310 06 8d ad 34 e
f 91 ff fa a9 75 11
e0 17 d0 84 94 .
..4.....u......
0320 2f 82 a3 a9 7
0 2a 43 4e 43 80 f2
99 88 27 d0 91 /
...p*CNC....'..
0330 66 a7 88 86 c
5 b8 b5 46 3e 5e 74
c2 6e 3c 91 1a f
......F>^t.n<..
0340 f2 e7 65 58 c
0 32 b3 cc 6a 06 ba
30 ac 46 2c d9 .
.eX.2..j..0.F,.
0350 4d 50 ff 1e 7
5 ea d6 a1 37 85 7f
dc cb d8 ff e2 M
P..u...7.......
0360 37 7b f5 5e d
1 a7 10 14 3a 2a 5a
8f 7f f6 2b ee 7
{.^....:*Z...+.
0370 e9 ff 7e 95 7
e 08 04 9a 9c c5 6c
0c a0 f3 08 dd .
.~.~.....l.....

0380 eb 94 86 09 9
5 ac 08 30 17 5b 66
ae fd 49 07 ab .
......0.[f..I..
0390 22 6c af c7 c
d b4 07 b1 e2 b3 8d
3b cd 95 9e d5 "
l.........;....
03a0 65 f8 e6 f3 7
5 88 76 d0 49 63 c9
ae e3 b0 2d 46 e
...u.v.Ic....-F
03b0 d7 da 3c ac 8
9 c6 ad ba 4b 29 c4
ce a9 ee 39 b6 .
.<.....K)....9.
03c0 a0 aa 5b da 8
9 b2 0e c2 8b d8 ad
ea 13 2d 66 ff .
.[..........-f.
03d0 fb 92 04 ee 8
f f3 02 2b 54 83 4f
42 60 63 85 8a .
......+T.OB`c..
03e0 a0 67 09 4c 0
c 68 b1 50 0d 61 69
81 6a 18 2a 81 .
g.L.h.P.ai.j.*.
03f0 97 ad 30 50 d
4 2b a3 73 79 48 a0
39 e6 bf 29 46 .
.0P.+.syH.9..)F
0400 da 4a 89 3b 2
2 16 d1 51 8d 1e 03
9d 64 ae 25 37 .
J.;"..Q....d.%7
0410 cd 41 71 88 0
2 65 9b 4e 3c 73 9a
be d5 ed 63 96 .
Aq..e.N<s....c.
0420 2a 61 cd 0c b
1 08 3f d4 3d 77 72
ca 36 18 5d a5 *
a....?.=wr.6.].
0430 68 0f 4c 95 1
5 17 b8 11 28 a1 88
9f 71 cd 70 3a h
.L.....(...q.p:
0440 b1 84 14 94 c
5 4e 44 67 96 82 64
1f 06 36 ed cc .
....NDg..d..6..
0450 a3 d2 8c 56 a
f ea 98 5a 26 2a 19
34 c0 82 e0 c3 .
..V...Z&*.4....
0460 03 41 ea 40 e
f c1 80 04 37 03 ec
d1 73 3d 01 be .
A.@....7...s=..
0470 e0 4f 36 c0 a
5 26 ae 2a 46 07 8e
30 23 aa 9c 1b .
O6..&.*F..0#...
0480 4a d6 76 b2 2
4 db 20 68 7a b0 23
97 42 2e 19 08 J
.v.$. hz.#.B...
0490 fe 60 0c 02 1

6 2b 10 2f 8c ab 81
58 dc fe b6 e5 .
`...+./...X....
04a0 de f8 ce 50 6
4 24 04 a9 81 b3 0e
1d 99 20 44 e5 .
..Pd$....... D.
04b0 68 f7 7f aa 0
1 07 20 34 11 f1 24
b5 59 2a 2d 9a h
..... 4..$.Y*-.
04c0 88 e6 bf c6 c
0 43 31 91 65 ea 24
3d 0d bb 18 38 .
....C1.e.$=...8
04d0 cf cb d9 65 e
9 96 76 2a fe 50 4b
e7 38 ca a0 4e .
..e..v*.PK.8..N
04e0 6a 22 06 90 7
1 92 f0 35 44 90 b2
29 9a 52 3c 13 j
"..q..5D..).R<.
04f0 07 8c ce 21 7
e 16 85 1a b3 9b 51
6f eb b3 d5 f2 .
..!~.....Qo....
0500 d5 f6 b7 b6 6
b 16 50 90 ed 56 35
8c 08 cd a1 99 .
...k.P..V5.....
0510 da 9a ef bf 0
f d7 4f d6 7e 1e 13
2f ec 46 14 64 .
.....O.~../.F.d
0520 41 8f
A
.
No. Time
Source
Destination
Protocol
Length Info
208 7.502092000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1297 http49
574 [PSH, ACK] Seq=
120804 Ack=1 Win=46
Len=1243
Frame 208: 1297 byt
es on wire (10376 b
its), 1297 bytes ca
ptured (10376 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.552022000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.552022000 s
econds
[Time delta fro
m previous captured
frame: 0.026797000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02679700
0 seconds]
[Time since ref
erence or first fra
me: 7.502092000 sec
onds]
Frame Number: 2
08
Frame Length: 1
297 bytes (10376 bi
ts)
Capture Length:
1297 bytes (10376
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
283
Identification:
0xf1e0 (61920)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a5b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.

11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 120804, Ack:
1, Len: 1243
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1243]
Sequence number
: 120804 (relati
ve sequence number)
[Next sequence
number: 122047 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0xdb8
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2503]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 03 f1 e0 4
0 00 31 06 3a 5b 4a
7c 0c 8a c0 a8 .
...@.1.:[J|....
0020 01 0b 00 50 c
1 a6 2b ca 3a 11 9e
87 4e aa 50 18 .
..P..+.:...N.P.
0030 00 2e db 86 0
0 00 38 0a 08 e4 03
03 45 cf 61 f9 .
.....8.....E.a.
0040 ba 02 69 e3 5
8 9b 45 32 e7 8c 7a
aa d9 13 0f e4 .
.i.X.E2..z.....
0050 37 0b cd 14 a
d cd 40 cf 35 9b 5c
30 a5 b4 2b a9 7
.....@.5.\0..+.
0060 df 76 55 ac 4
b 63 f1 0a d3 cc f5
b8 34 b6 f5 1a .
vU.Kc......4...
0070 26 3e e1 48 e
7 e6 08 ac 5c a3 03
2d 6a 92 2c 3d &
>.H....\..-j.,=
0080 85 60 53 8a 2
a ff fb 92 04 ec 8f
f3 0c 2f 54 03 .
`S.*......../T.
0090 58 5a 60 5c 8
5 2a a0 63 08 4c 0b
b8 b1 52 0d 3d X
Z`\.*.c.L...R.=
00a0 09 81 90 98 2
a 41 8c 2d 30 2c 87
38 43 fe c5 c2 .
...*A.-0,.8C...
00b0 47 42 51 70 e
2 af b4 9c 59 cb d8
c6 c5 9c ec 9d G
BQp....Y.......
00c0 43 00 d1 09 0
2 2d 4a 1d f8 62 2d
5d d1 a5 5f f2 C
....-J..b-].._.
00d0 c9 6c 0f 9b a
1 06 e3 8c d5 c6 91
26 f8 a4 15 06 .

l.........&....
00e0 14 59 1a 09 8
2 76 9a 1d 14 8a f4
92 7c 36 42 e1 .
Y...v......|6B.
00f0 cc a6 18 ab b
9 64 3c aa 59 1b ba
e9 8b 3c 1c 79 .
....d<.Y....<.y
0100 c1 e2 17 01 0
e 96 25 8d 4e 59 c3
3d 6c db eb b4 .
.....%.NY.=l...
0110 a7 fe a7 60 8
0 13 52 d2 3a c7 e4
0b b6 5d 5a 40 .
..`..R.:....]Z@
0120 11 6d 6a 26 a
4 19 94 84 40 9b ef
8a ae 8e 3f 14 .
mj&....@.....?.
0130 75 5e 16 f2 5
3 7e 15 a8 d4 5a 4d
53 f3 66 12 a9 u
^..S~...ZMS.f..
0140 49 83 11 20 2
8 64 49 8a e3 87 c2
f5 85 47 7f ce I
.. (dI......G..
0150 4a c8 1c 9a e
3 ae ff cb 0d 2a ff
c9 98 b3 b6 d6 J
........*......
0160 99 9d 77 80 5
1 c9 33 2e 84 57 dc
f6 27 f6 7e a9 .
.w.Q.3..W..'.~.
0170 62 86 33 21 0
1 97 51 75 8b 7a ba
06 33 35 1f 27 b
.3!..Qu.z..35.'
0180 eb ff 28 58 d
4 cf 8a 28 45 61 c8
1a 35 2b 69 d2 .
.(X...(Ea..5+i.
0190 9a 66 a5 f0 5
3 3a b0 fa d0 c5 7a
2d 5c 33 08 e1 .
f..S:....z-\3..
01a0 75 95 2b 8b 1
e e3 b6 e2 c9 86 ab
42 d7 71 c4 46 u
.+........B.q.F
01b0 7b 6e 0d 6d 1
b d3 75 f5 bd 75 31
02 61 f2 84 cf {
n.m..u..u1.a...
01c0 3c 4c 23 2e 4
7 9c d4 58 84 44 9a
fe 8f 46 85 dc <
L#.G..X.D...F..
01d0 af ff 5d 84 2
1 c8 e2 2e 36 e0 8c
58 35 ba 21 09 .
.].!...6..X5.!.
01e0 13 30 83 58 a
b 71 03 09 88 48 57
f3 cf 0c 91 76 .
0.X.q...HW....v

01f0 53 0d df a6 8
f b8 33 55 e4 15 f7
19 ab 2b e6 d0 S
.....3U.....+..
0200 fd b4 c4 af 0
4 d1 84 85 e0 24 9a
1f 83 8d 1c 0b .
........$......
0210 dc 92 83 41 0
b b3 9f eb 4d 75 5e
77 dd d9 ab 8f .
..A....Mu^w....
0220 dd 8e 71 66 0
3 4b b8 ff fb 92 04
eb 8f f2 f9 24 .
.qf.K.........$
0230 d4 03 4f 7a 5
0 63 65 2a 90 63 09
4c 0b a0 b1 50 .
.OzPce*.c.L...P
0240 0c e1 89 81 8
c 93 6a 41 8c 3d 28
fb 1f b1 af df .
.....jA.=(.....
0250 72 ba 55 57 f
a 9d 82 fa 82 a2 29
16 f0 1a 75 64 r
.UW......)...ud
0260 4b 10 c0 36 b
2 43 84 4e 3f ec 5d
d1 8c b8 16 df K
..6.C.N?.].....
0270 79 fa b3 2f 4
c a2 21 86 32 e9 2d
d6 3a 64 74 25 y
../L.!.2.-.:dt%
0280 9e aa f5 20 e
b ae 59 a2 a6 57 1b
87 be 90 87 46 .
.. ..Y..W.....F
0290 d8 f9 66 65 7
1 60 d5 5d da f6 df
a6 bd a6 e4 87 .
.feq`.]........
02a0 15 14 4a 03 d
6 81 52 37 21 da b1
4d 6e 53 b5 d1 .
.J...R7!..MnS..
02b0 ab a5 7d 5f d
6 c9 4a a5 81 3f 03
87 1a 31 80 91 .
.}_..J..?...1..
02c0 86 10 1b 4e 1
5 29 20 67 84 25 d8
8e 00 38 46 2a .
..N.) g.%...8F*
02d0 04 69 5c c8 d
1 05 12 26 91 de b1
f6 e2 c5 76 f9 .
i\....&......v.
02e0 ac 3e 0a 54 4
4 f1 e2 9d 5a c2 b5
2c 30 24 43 ef .
>.TD...Z..,0$C.
02f0 09 c0 cd 2c 6
8 42 14 83 cb a6 59
4f aa c7 8d 8a .
..,hB....YO....
0300 d6 6e 29 af c

7 91 75 cc df 4f f3
de 3a 0d aa 5a .
n)...u..O..:..Z
0310 2c df a9 6e a
8 24 43 29 00 01 35
c6 1e d3 60 74 ,
..n.$C)..5...`t
0320 16 a6 83 0e 4
7 a5 7c d1 c6 71 9f
07 06 fd 9d 72 .
...G.|..q.....r
0330 26 b7 ad 34 4
8 46 16 d5 75 1e 3c
a8 a0 5f 0c 2d &
..4HF..u.<.._.0340 42 94 52 54 8
1 20 f8 4a 43 7e c5
66 3b 12 e0 8c B
.RT. .JC~.f;...
0350 64 37 e0 7a 9
3 cf 3b b9 7d bf 97
be b6 55 bd d2 d
7.z..;.}....U..
0360 df b7 92 c8 a
a 38 91 02 5b 8f 23
a5 0b 91 61 4f .
....8..[.#...aO
0370 ed ae ba be f
a 55 75 57 b9 e1 d8
11 80 3b 60 e8 .
....UuW.....;`.
0380 f0 81 cd 38 4
6 26 91 32 82 83 a4
70 81 a3 45 72 .
..8F&.2...p..Er
0390 5d f8 ca ef 5
7 94 27 8c 87 37 3b
70 64 22 fc 13 ]
...W.'..7;pd"..
03a0 17 9d 61 f2 1
8 dc ec cc a6 11 8e
a5 d4 65 03 ea .
.a..........e..
03b0 c8 ad 9a 13 6
9 2b 91 62 70 50 bc
1d f3 bc 9a b7 .
...i+.bpP......
03c0 6b a6 b8 75 a
2 7b ee 61 6b ff fb
90 04 e9 0f f2 k
..u.{.ak.......
03d0 f2 2c d4 03 5
8 32 60 5f a4 ba 80
63 2f 4a 0b d0 .
,..X2`_...c/J..
03e0 d7 4e 0d 3d 0
b 81 87 98 6a 01 8c
25 30 f9 6f 35 .
N.=....j..%0.o5
03f0 73 fb 24 f3 d
0 76 4e 9a d9 b7 d2
fc 06 54 0c 70 s
.$..vN......T.p
0400 c5 35 e4 e4 2
6 72 04 ca 85 87 60
c0 14 b0 81 94 .
5..&r....`.....
0410 fd 79 18 b8 e
c e7 20 cd f1 68 57

9e 29 0f 31 6a .
y.... ..hW.).1j
0420 5d cf 2a b0 c
e eb c6 72 c1 cc c7
5a b2 40 a8 d2 ]
.*....r...Z.@..
0430 07 90 5d fa 5
c 08 ce b2 ae 51 ba
38 e4 d9 c3 ba .
.].\....Q.8....
0440 bf bd 38 a9 f
6 3f f7 f5 36 e8 ab
eb 42 fb 1e 95 .
.8..?..6...B...
0450 6f a5 9f fb 9
5 55 56 76 35 2c e0
2c 74 cb 82 3d o
....UVv5,.,t..=
0460 43 8c 8a 33 0
8 1c 21 2a f4 31 00
1c 95 b6 61 45 C
..3..!*.1....aE
0470 b0 18 40 44 6
5 ab cc 3c d8 ad 6c
6c 31 81 e0 ea .
.@De..<..ll1...
0480 30 c7 e6 67 d
f 9b 16 db 69 a4 7c
bd 34 eb 4c 49 0
..g....i.|.4.LI
0490 1b 5d d6 75 2
d 05 06 65 06 20 70
c7 3c 17 d0 23 .
].u-..e. p.<..#
04a0 38 f1 f9 47 c
c aa 1e 29 69 5c a2
56 60 15 2d 7a 8
..G...)i\.V`.-z
04b0 ec df 78 d0 e
e 49 6f af fd 2e c0
43 da e1 7d d5 .
.x..Io....C..}.
04c0 c0 ca 90 b5 b
1 08 05 37 46 02 4c
a2 fb f8 fc aa .
......7F.L.....
04d0 99 72 ad 4a a
7 67 1b 9b 7f 2d bf
21 9a f7 cf ca .
r.J.g...-.!....
04e0 c8 79 16 30 c
0 db 22 0f 7a 83 4e
22 96 ed b8 21 .
y.0..".z.N"...!
04f0 4c e1 19 90 f
f e6 ba a6 6d 62 fa
ab 7a 6a 79 e4 L
.......mb..zjy.
0500 36 ac 90 aa d
6 f8 7f ab 17 50 ea
59 fb 37 76 ff 6
........P.Y.7v.
0510 91
.
No. Time
Source
Destination

Protocol
Length Info
209 7.502275000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=122047 Win=41265 L
en=0
Frame 209: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.552205000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.552205000 s
econds
[Time delta fro
m previous captured
frame: 0.000183000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018300
0 seconds]
[Time since ref
erence or first fra
me: 7.502275000 sec
onds]
Frame Number: 2
09
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17

:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f69 (20329)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 12204
7, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 122047 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .

... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41265
[Calculated win
dow size: 41265]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 208]
[The RTT to
ACK the segment wa
s: 0.000183000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 69 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Oi@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 3e ec 50 10 .
....P..N.+.>.P.
0030 a1 31 18 d4 0
0 00
.
1....
No. Time
Source
Destination
Protocol
Length Info
210 7.620300000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=12204

7 Ack=1 Win=46 Len=

1260
Frame 210: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.670230000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.670230000 s
econds
[Time delta fro
m previous captured
frame: 0.118025000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11802500
0 seconds]
[Time since ref
erence or first fra
me: 7.620300000 sec
onds]
Frame Number: 2
10
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1e1 (61921)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a49 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 122047, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 122047 (relati
ve sequence number)
[Next sequence
number: 123307 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x2f8
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 e1 4
0 00 31 06 3a 49 4a
7c 0c 8a c0 a8 .
...@.1.:IJ|....
0020 01 0b 00 50 c
1 a6 2b ca 3e ec 9e
87 4e aa 50 10 .
..P..+.>...N.P.
0030 00 2e 2f 8f 0
0 00 72 06 02 cd 1a
4c d4 00 cd 64 .
./...r....L...d
0040 40 64 98 20 e
9 58 41 40 4a f9 5b
4f 10 65 30 e8 @
d. .XA@J.[O.e0.
0050 45 a0 05 f2 3
4 09 b5 bb 1f 87 95
91 20 29 1b a3 E
...4....... )..
0060 dd 62 f5 89 d
6 91 03 57 08 3e 51
36 92 68 37 72 .
b.....W.>Q6.h7r
0070 85 b4 18 2f 6
8 2f 92 5b b2 e0 02
0e 26 3b 9e db .
../h/.[....&;..
0080 3f 4b e1 f0 7
1 aa 65 ad bd d6 ab
e3 f3 03 f5 ff ?
K..q.e.........
0090 fb 92 04 e8 0
f f3 07 34 d3 83 58

5a e0 5e 86 9a .
......4..XZ.^..
00a0 90 63 0b 5c 0
c 00 d3 4a 0d 60 eb
81 5e 92 6a 41 .
c.\...J.`..^.jA
00b0 8c 2d 28 fa c
b 09 e4 56 30 e6 f2
56 ca 62 d2 00 .
-(....V0..V.b..
00c0 71 02 28 05 2
2 eb 4c 77 5c a0 88
b4 ef 60 63 04 q
.(.".Lw\....`c.
00d0 01 69 a4 ce 3
7 12 32 c8 e0 eb d1
e7 c5 be aa d1 .
i..7.2.........
00e0 ec e5 3c f9 e
a 21 4d d6 c7 95 b6
58 72 98 d6 80 .
.<..!M....Xr...
00f0 97 da fc de 4
9 f0 3b a7 dd 37 93
f1 c3 aa bd 29 .
...I.;..7.....)
0100 f3 1b c1 89 e
b 1b 7f f9 7f 8d 8d
7c 62 23 d6 0a .
..........|b#..
0110 a8 a3 62 e7 2
f b5 75 25 3d a9 d1
aa df b7 d1 d0 .
.b./.u%=.......
0120 d4 12 d8 c7 4
7 32 43 41 dc 14 c8
58 4b 33 20 37 .
...G2CA...XK3 7
0130 09 6e 46 2c a
a ec c1 0b 97 16 12
8d 1f 1d ce 2a .
nF,...........*
0140 98 34 6e 87 5
2 ea f8 53 3e 99 76
15 91 de 4d a9 .
4n.R..S>.v...M.
0150 59 2b 2a 9e e
0 f3 75 2d 4c 1b 9d
14 69 43 ee 3a Y
+*...u-L...iC.:
0160 4b 56 cd dc a
c 78 23 e7 3f 5d 35
b2 dd 99 ed 1c K
V...x#.?]5.....
0170 b3 fe fc bf b
f ff fe a1 f2 cc b3
56 da d2 fe 17 .
..........V....
0180 ac 2a a3 19 d
b f1 86 a1 82 e5 04
45 ed ae 64 4b .
*.........E..dK
0190 72 aa 91 57 9
4 69 13 6d 43 d6 e6
60 17 3e 95 b8 r
..W.i.mC..`.>..
01a0 cf e7 c7 3f 2
9 75 89 b6 ed 7e a4
f0 65 1e 15 ee .

..?)u...~..e...
01b0 76 5c eb 32 3
b 80 dc e1 da ad 45
f7 4d 6b 3f 0c v
\.2;.....E.Mk?.
01c0 3f c6 c2 21 d
7 c6 6d 9c e6 9b cc
5a 7f 98 51 5f ?
..!..m....Z..Q_
01d0 62 d3 58 ab d
e ef fe 4f 4d 7f ff
d0 67 11 b3 f8 b
.X....OM...g...
01e0 59 b2 d4 42 1
0 28 43 1c 6c 33 3c
78 c2 8c 75 65 Y
..B.(C.l3<x..ue
01f0 30 14 55 36 c
5 8d 6f 09 8c 23 ed
06 27 62 7f 07 0
.U6..o..#..'b..
0200 f2 55 2c 7a f
b 61 ff d5 f3 8f 48
62 d3 11 34 a2 .
U,z.a....Hb..4.
0210 6f 47 2e 40 7
8 c8 55 a8 1a 1c 54
be 26 7b 38 f0 o
G.@x.U...T.&{8.
0220 48 23 6a ad b
f 95 79 36 eb ce ac
c8 b0 d8 62 40 H
#j...y6......b@
0230 16 ff fb 92 0
4 eb 8f f3 23 2e d2
83 78 5a 60 61 .
.......#...xZ`a
0240 85 7a 90 63 0
f 4c 0b c0 d3 4c 0d
3d 2b 81 78 15 .
z.c.L...L.=+.x.
0250 ea 01 8c 3d 3
0 ea dd ed 21 09 40
51 96 c4 54 58 .
..=0...!.@Q..TX
0260 80 41 04 2c 9
8 c1 4f 3b 50 19 a6
4d 22 89 01 b3 .
A.,..O;P..M"...
0270 17 d0 bb 51 e
c e3 53 57 22 7a 93
d4 6e 8f 75 24 .
..Q..SW"z..n.u$
0280 1b 7e 71 d5 c
a d0 10 98 3c 01 6c
1f 0f 4c 40 7a .
~q.....<.l..L@z
0290 4a 1f 98 26 c
a 84 69 ac 65 d8 6f
6c d6 e3 a6 7c J
..&..i.e.ol...|
02a0 f7 92 5f 3e 3
5 ed 2f 9e d3 7c b9
b4 85 ea 59 97 .
._>5./..|....Y.
02b0 0f fd 5e 2d 1
9 4c 91 88 5a 59 b2
27 05 52 ee 03 .
.^-.L..ZY.'.R..

02c0 8c 8e ec a8 5
e 94 62 6e 86 2b 96
10 d6 23 61 12 .
...^.bn.+...#a.
02d0 f9 5a 96 3c 1
0 f6 c6 7e c8 79 23
19 1a 1b 01 13 .
Z.<...~.y#.....
02e0 2f 26 0b 1d 4
7 35 19 b4 51 5a 2b
30 83 6b f5 ae /
&..G5..QZ+0.k..
02f0 fb 7b 90 f9 0
4 98 e2 26 bd c0 fb
16 f3 40 e8 f0 .
{.....&.....@..
0300 b1 c8 c6 94 0
c 28 23 55 be 5e 21
02 0a e9 fe e4 .
....(#U.^!.....
0310 df f5 bd bf 2
6 b8 0c 80 60 0d d4
b0 99 03 c0 23 .
...&...`......#
0320 41 b6 5c 86 a
0 30 4b 9b 21 0a 56
1f a9 e3 d9 22 A
.\..0K.!.V...."
0330 c4 5b 4e 24 a
a ad b1 5f 65 84 39
40 e1 a1 b1 87 .
[N$..._e.9@....
0340 cb b8 1e 03 6
4 e5 e2 cf 41 13 8b
ac 21 af 97 ad .
...d...A...!...
0350 5a 75 36 f2 1
9 18 78 7f 0f ff ce
bc ce 15 0f 1a Z
u6...x.........
0360 0f 17 02 04 0
4 e3 1a 20 71 44 ec
b6 1f f2 91 07 .
...... qD......
0370 df d5 fe 5d 6
7 fe 8a 33 c0 b6 33
00 36 0d d3 44 .
..]g..3..3.6..D
0380 39 dc 0c 9a 1
8 01 dc a0 82 ae 53
2b 0f 18 6a b6 9
.........S+..j.
0390 38 ef 63 b3 6
2 24 69 99 9e be 8a
bc b3 a8 00 e9 8
.c.b$i.........
03a0 c7 9c 0d 05 d
9 0e cf 1d 61 d9 fd
a3 44 ba bb b4 .
.......a...D...
03b0 cc 1c ee b7 8
d 8e c5 3f 8e 2d e0
f8 16 4b c0 20 .
......?.-...K.
03c0 b8 50 85 42 0
0 e8 e5 bc 1e 3e 7c
05 1e e5 28 36 .
P.B.....>|...(6
03d0 13 94 5e ff f

b 92 04 e9 8f f2 c7
2c 54 03 18 5a .
.^........,T..Z
03e0 60 5c 05 7a 8
0 63 09 4c 0c 00 8f
5e 0c 3d 29 41 `
\.z.c.L...^.=)A
03f0 86 94 6b 80 f
7 a5 28 42 70 72 9c
ff e2 87 3c 32 .
.k...(Bpr....<2
0400 93 04 19 3d 1
5 c6 db 99 ea d3 26
31 ec 30 8e 4d .
..=......&1.0.M
0410 3c 6e 60 40 b
f 55 c7 57 3d 55 b3
52 67 d1 19 a0 <
n`@.U.W=U.Rg...
0420 a2 64 68 ce 2
8 87 5b 38 28 47 28
4a 2d 20 9a 39 .
dh.(.[8(G(J- .9
0430 3e a1 2e 98 3
a 27 15 16 06 c1 c9
46 02 16 11 0f >
...:'.....F....
0440 0e 93 68 f0 5
c 50 84 a3 d3 5c d8
12 2d 7b 81 01 .
.h.\P...\..-{..
0450 02 42 e8 fb 2
3 91 75 df 93 ea 18
72 c4 8f 73 d8 .
B..#.u....r..s.
0460 81 11 25 c4 c
0 45 3d 3f aa a9 26
67 94 01 43 2b .
.%..E=?..&g..C+
0470 4b 40 9f d1 9
8 4a 2d ab 27 e2 09
40 e2 77 08 53 K
@...J-.'..@.w.S
0480 95 62 31 8d 7
b 79 61 36 d2 d4 d8
87 9d bc f6 d6 .
b1.{ya6........
0490 bc f5 38 5f 9
b af 7e fb 34 7b de
db fb b5 ef 7d .
.8_..~.4{.....}
04a0 85 68 34 e1 4
0 50 a1 33 af 41 41
72 a7 41 02 e9 .
h4.@P.3.AAr.A..
04b0 12 0a 91 4a c
0 fa ea 85 ec fd 2c
79 f7 38 5c 32 .
..J......,y.8\2
04c0 66 9f 85 48 6
e 26 8b aa f2 55 0e
b2 a4 dd 5a 84 f
..Hn&...U....Z.
04d0 26 98 b1 78 c
9 b4 96 d8 ce bb 38
fd 3a d4 4c 87 &
..x......8.:.L.
04e0 39 48 22 5a e
5 6a 10 15 37 13 03

d8 b1 87 21 1a 9
H"Z.j..7.....!.
04f0 9b 96 f1 c7 2
c d6 3c 57 6d fa 5c
43 73 f3 ca ca .
...,.<Wm.\Cs...
0500 7d 30 8a 6c c
0 c7 17 38 11 10 84
8a 38 6b 56 50 }
0.l...8....8kVP
0510 30 81 e2 85 0
b bd 46 b5 5d cf a5
95 77 a6 94 95 0
.....F.]...w...
0520 70 58
p
X
No. Time
Source
Destination
Protocol
Length Info
211 7.631040000
pc13.home
livebox.home
DNS
86 Standard que
ry 0x3fae PTR 72.4
5.194.173.in-addr.a
rpa
Frame 211: 86 bytes
on wire (688 bits)
, 86 bytes captured
(688 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.680970000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.680970000 s
econds
[Time delta fro
m previous captured
frame: 0.010740000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01074000
0 seconds]
[Time since ref
erence or first fra
me: 7.631040000 sec
onds]
Frame Number: 2
11
Frame Length: 8

6 bytes (688 bits)

Capture Length:
86 bytes (688 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 7
2
Identification:
0x4f6a (20330)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: 4981
2 (49812), Dst Port
: domain (53)
Source Port: 49
812 (49812)
Destination Por
t: domain (53)
Length: 52
Checksum: 0x83a
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
7]
Domain Name System
(query)
[Response In: 2
14]
Transaction ID:
0x3fae
Flags: 0x0100 S

tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
72.45.194.1
73.in-addr.arpa: ty
pe PTR, class IN
Name: 7
2.45.194.173.in-add
r.arpa
[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 48 4f 6a 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
HOj............
0020 01 01 c2 94 0
0 35 00 34 83 a2 3f
ae 01 00 00 01 .
....5.4..?.....
0030 00 00 00 00 0
0 00 02 37 32 02 34
35 03 31 39 34 .
......72.45.194
0040 03 31 37 33 0
7 69 6e 2d 61 64 64
72 04 61 72 70 .
173.in-addr.arp
0050 61 00 00 0c 0
0 01
a

.....
No. Time
Source
Destination
Protocol
Length Info
212 7.648549000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
471 http49
574 [PSH, ACK] Seq=
123307 Ack=1 Win=46
Len=417
Frame 212: 471 byte
s on wire (3768 bit
s), 471 bytes captu
red (3768 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.698479000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.698479000 s
econds
[Time delta fro
m previous captured
frame: 0.017509000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01750900
0 seconds]
[Time since ref
erence or first fra
me: 7.648549000 sec
onds]
Frame Number: 2
12
Frame Length: 4
71 bytes (3768 bits
)
Capture Length:
471 bytes (3768 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp

.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
57
Identification:

0xf1e2 (61922)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d93 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 123307, Ack:
1, Len: 417
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 417]
Sequence number
: 123307 (relati
ve sequence number)
[Next sequence
number: 123724 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .

... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf3a
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1677]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 c9 f1 e2 4
0 00 31 06 3d 93 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b ca 43 d8 9e
87 4e aa 50 18 .
..P..+.C...N.P.
0030 00 2e f3 a4 0
0 00 49 50 d2 d6 84
bc a1 34 74 f5 .
.....IP.....4t.
0040 6a bf 01 bb 0
1 89 a2 1b 40 4d 05
5d 85 cd ce 05 j
.......@M.]....
0050 13 8a a9 5c 6
a 9a 4e 0a dc 1a e2
c8 cb 1b 46 56 .
..\j.N.......FV

0060 1a a3 dd ad b
d b6 6d d3 6e ff 15
ce a7 54 ed 5c .
.....m.n....T.\
0070 eb 79 69 db 6
7 b4 3d e6 b7 8a 41
f2 9a bd 53 77 .
yi.g.=...A...Sw
0080 d9 c8 f9 25 f
5 39 6a 30 76 ff fb
92 04 ed 0f f3 .
..%.9j0v.......
0090 27 2c 59 01 e
f 42 60 5d 43 ab 20
3d e9 4a 0c 58 '
,Y..B`]C. =.J.X
00a0 d7 68 07 a4 c
b 81 80 9b ad 00 f6
0d 70 1f 6a 92 .
h..........p.j.
00b0 e7 6b 76 8c e
a 3d 34 d2 38 86 ae
07 f7 69 79 6d .
kv..=4.8....iym
00c0 3b 51 0f 42 b
e 22 34 a8 36 81 a4
16 84 c2 66 a3 ;
Q.B."4.6.....f.
00d0 04 b5 5c 95 b
a 10 69 38 2f 6a 4b
d0 10 18 15 83 .
.\...i8/jK.....
00e0 0c 41 46 70 f
0 cf 38 4e 6d 1c cb
48 c1 9a 8c 4c .
AFp..8Nm..H...L
00f0 ce b2 6b 33 7
9 71 bf 38 68 d2 93
33 66 d3 ad e5 .
.k3yq.8h..3f...
0100 f6 fe b0 ce 0
2 40 b4 fe 2c 01 3b
5b 7e ef af 6b .
....@..,.;[~..k
0110 85 13 d0 68 4
2 2c 33 57 71 2d dc
89 3b 48 af 36 .
..hB,3Wq-..;H.6
0120 ed 0f 1e 14 a
2 46 0a 35 48 e6 b1
25 9d 4e 2c 4b .
....F.5H..%.N,K
0130 65 36 61 58 c
4 29 a6 0e c5 a8 c0
2a 4f c7 8e fa e
6aX.).....*O...
0140 29 8f a4 e0 a
2 e6 2d 89 67 ea 7a
d7 a9 d7 ed 88 )
.....-.g.z.....
0150 bf 7f 5b 11 9
f bb 94 7a e0 88 84
27 78 3c 65 66 .
.[....z...'x<ef
0160 04 c8 bc 7a c
5 d5 61 d3 e8 4a 9c
43 43 e8 6b bf .
..z..a..J.CC.k.
0170 d0 3e 01 04 4

c 09 1a 28 4e 8b f2
0c e4 73 82 4d .
>..L..(N....s.M
0180 5d b0 c4 42 9
b 46 23 34 2c fa ac
65 b6 5d 4d 9b ]
..B.F#4,..e.]M.
0190 5e ef 73 34 4
9 a9 86 6d 37 f6 24
20 85 13 e6 f2 ^
.s4I..m7.$ ....
01a0 9d d6 20 b1 7
1 6a 28 d4 43 76 49
3e ea a3 96 f5 .
. .qj(.CvI>....
01b0 3b 3d b1 17 f
2 df c1 53 8f ae cd
ea 9a 99 da 65 ;
=.....S.......e
01c0 ff df a4 bd 6
d 63 c9 4a 85 52 b9
40 99 86 9f a8 .
...mc.J.R.@....
01d0 f3 45 6a 5f d
6 ed 75
.
Ej_..u
No. Time
Source
Destination
Protocol
Length Info
213 7.648712000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=123724 Win=40845 L
en=0
Frame 213: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.698642000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.698642000 s
econds
[Time delta fro
m previous captured
frame: 0.000163000
seconds]
[Time delta fro

m previous displaye
d frame: 0.00016300
0 seconds]
[Time since ref
erence or first fra
me: 7.648712000 sec
onds]
Frame Number: 2
13
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124

-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f6b (20331)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 12372
4, Len: 0
Source Port: 49
574 (49574)
Destination Por

t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 123724 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40845
[Calculated win
dow size: 40845]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 212]
[The RTT to
ACK the segment wa
s: 0.000163000 seco

nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 6b 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Ok@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 45 79 50 10 .
....P..N.+.EyP.
0030 9f 8d 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
214 7.678453000
livebox.home
pc13.home
DNS
124 Standard que
ry response 0x3fae
PTR par03s13-in-f8
.1e100.net
Frame 214: 124 byte
s on wire (992 bits
), 124 bytes captur
ed (992 bits) on in
terface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.728383000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.728383000 s
econds
[Time delta fro
m previous captured
frame: 0.029741000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02974100
0 seconds]
[Time since ref
erence or first fra
me: 7.678453000 sec
onds]
Frame Number: 2
14
Frame Length: 1

24 bytes (992 bits)

Capture Length:
124 bytes (992 bit
s)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
10
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb722 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:
49812 (49812)
Source Port: do
main (53)
Destination Por
t: 49812 (49812)
Length: 90
Checksum: 0x695
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
7]
Domain Name System
(response)
[Request In: 21
1]
[Time: 0.047413
000 seconds]

Transaction ID:
0x3fae
Flags: 0x8180 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .0.. .
... .... = Authorit
ative: Server is no
t an authority for
domain
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs:
0
Additional RRs:
0
Queries
72.45.194.1
73.in-addr.arpa: ty
pe PTR, class IN
Name: 7
2.45.194.173.in-add
r.arpa
[Name L
ength: 26]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Answers

72.45.194.1
73.in-addr.arpa: ty
pe PTR, class IN, p
ar03s13-in-f8.1e100
.net
Name: 7
2.45.194.173.in-add
r.arpa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 86400
Data le
ngth: 26
Domain
Name: par03s13-in-f
8.1e100.net
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 6e 00 00 4
0 00 40 11 b7 22 c0
a8 01 01 c0 a8 .
n..@.@.."......
0020 01 0b 00 35 c
2 94 00 5a 69 5d 3f
ae 81 80 00 01 .
..5...Zi]?.....
0030 00 01 00 00 0
0 00 02 37 32 02 34
35 03 31 39 34 .
......72.45.194
0040 03 31 37 33 0
7 69 6e 2d 61 64 64
72 04 61 72 70 .
173.in-addr.arp
0050 61 00 00 0c 0
0 01 c0 0c 00 0c 00
01 00 01 51 80 a
.............Q.
0060 00 1a 0e 70 6
1 72 30 33 73 31 33
2d 69 6e 2d 66 .
..par03s13-in-f
0070 38 05 31 65 3
1 30 30 03 6e 65 74
00
8
.1e100.net.
No. Time
Source
Destination
Protocol
Length Info
215 7.751305000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=12372
4 Ack=1 Win=46 Len=
1260

Frame 215: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.801235000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.801235000 s
econds
[Time delta fro
m previous captured
frame: 0.072852000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07285200
0 seconds]
[Time since ref
erence or first fra
me: 7.751305000 sec
onds]
Frame Number: 2
15
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally

unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1e3 (61923)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (

6)
Header checksum
: 0x3a47 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 123724, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 123724 (relati
ve sequence number)
[Next sequence
number: 124984 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xec4
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 e3 4
0 00 31 06 3a 47 4a
7c 0c 8a c0 a8 .
...@.1.:GJ|....
0020 01 0b 00 50 c
1 a6 2b ca 45 79 9e
87 4e aa 50 10 .
..P..+.Ey..N.P.
0030 00 2e ec 4d 0
0 00 6e cb f0 74 c3
54 77 45 02 d7 .
..M..n..t.TwE..
0040 df 97 1e 47 7
6 59 23 82 37 a4 0a
e9 fb d1 81 5c .
..GvY#.7......\
0050 16 36 d1 6b 6
1 25 97 4d 3a 58 95
24 0d ac b1 32 .
6.ka%.M:X.$...2
0060 b1 29 25 35 9
e da 03 d1 e3 33 25
1c c6 b3 b7 b5 .
)%5.....3%.....
0070 b6 63 be da b
6 a1 f5 f1 f3 f7 fa
ea 68 f9 dd bb .
c..........h...
0080 e4 cb 55 3d c
e 66 d7 ad 99 6e ff
fb 92 04 e9 8f .
.U=.f...n......
0090 f2 ff 3f 59 8
3 09 32 e0 59 68 6b
30 31 23 5c 0b .
.?Y..2.Yhk01#\.
00a0 f4 c9 62 0c 2

4 cb 81 96 1f ac 00
f7 99 70 fd ff .
.b.$........p..
00b0 5f 5b 96 58 e
9 16 9c 57 7b 93 53
94 92 0c 92 30 _
[.X...W{.S....0
00c0 26 48 13 78 c
9 65 16 3d ae 44 2b
72 0a 6b 9a e8 &
H.x.e.=.D+r.k..
00d0 ba e7 79 cc c
e 75 8d 1e 78 53 ea
23 ea bd 82 f8 .
.y..u..xS.#....
00e0 ec 60 10 3c 6
0 74 70 a4 0b 29 4b
51 bc 28 6d 0b .
`.<`tp..)KQ.(m.
00f0 11 6b d5 16 a
c 7d e8 ce 4d 3c d9
f5 71 f7 d5 d6 .
k...}..M<..q...
0100 53 5d e6 82 0
8 58 88 90 94 44 15
2a 12 3c 04 0b S
]...X...D.*.<..
0110 86 96 b5 e3 4
8 df 6d 16 6e f5 52
93 08 ca 92 76 .
...H.m.n.R....v
0120 a9 b3 00 49 2
8 a9 01 e1 2d 62 ea
ac 85 0e cd d0 .
..I(...-b......
0130 f5 02 33 36 9
a a1 d6 23 3d 32 e4
d5 8c 32 ee 73 .
.36...#=2...2.s
0140 c5 85 47 58 9
5 0e 10 4f 49 43 40
d0 dd 39 37 41 .
.GX...OIC@..97A
0150 aa 63 96 c8 6
5 51 82 cb 76 cf 54
e9 8b 35 8e a1 .
c..eQ..v.T..5..
0160 91 b0 c6 c7 5
7 e5 e0 66 ea e0 4a
07 cf b9 7f 07 .
...W..f..J.....
0170 7f f4 94 da 4
b c6 bd d7 f7 7f fe
9e 82 2c 7d 13 .
...K........,}.
0180 b5 71 23 50 1
e 20 c1 54 ca 04 8c
0b 08 b2 a9 4c .
q#P. .T.......L
0190 6b d6 ac f3 c
a 70 43 6d 58 8f a8
76 6a 85 d7 7a k
....pCmX..vj..z
01a0 9e ab 2e 4b 4
0 3c 16 a3 61 1b 1c
ab f2 18 6e 51 .
..K@<..a.....nQ
01b0 26 a4 1b 70 c
4 e5 db 0f f9 b3 55

5b 9e 1c fe f3 &
..p......U[....
01c0 e3 c3 cf 53 c
5 23 d8 a2 00 94 e3
72 1d 65 4b 16 .
..S.#.....r.eK.
01d0 d3 f5 2a 8c 0
f 00 0d f4 31 14 f4
20 82 53 30 14 .
.*.....1.. .S0.
01e0 22 cc a8 a8 0
0 e8 f0 32 3c a0 1a
a1 6e cf dd df "
......2<...n...
01f0 fc ae bf 13 e
8 af 1e b5 46 28 8e
b1 2c 74 0e b7 .
.......F(..,t..
0200 11 52 0b 48 a
b 84 88 c2 ee 4c c9
b9 d7 ed 0d 67 .
R.H.....L.....g
0210 56 d5 6b f8 a
b de d3 39 90 ff 77
a7 79 51 93 fd V
.k....9..w.yQ..
0220 36 7c 9f 8d d
d f1 f7 e6 31 79 9c
28 ff fb 92 04 6
|......1y.(....
0230 e9 0f f3 0f 4
3 57 83 09 32 e0 5e
46 2a f0 3d e8 .
...CW..2.^F*.=.
0240 4c 0c 24 a9 5
a 0c 3d 09 89 5b 96
6b 80 f7 99 30 L
.$.Z.=..[.k...0
0250 7c cb 1f 15 7
b 85 ed 4c 80 3a 0c
1d 70 a9 63 f3 |
...{..L.:..p.c.
0260 61 dc 24 84 9
d fe 11 ba 2a b8 7a
50 84 c8 16 9b a
.$.....*.zP....
0270 10 f6 26 ab 1
a b5 db cf 05 1f dc
dc 21 ba ac 28 .
.&.........!..(
0280 32 4a 8e ac 4
7 1c 99 13 2f 8e 37
4a ec 49 cc 2e 2
J..G.../.7J.I..
0290 6c 84 9a 9c 2
4 9e 1d 9d e3 76 be
df 8a d5 ef 99 l
...$....v......
02a0 c7 87 fb bd 3
1 c1 06 50 c3 a0 eb
7d 23 c5 23 bb .
...1..P...}#.#.
02b0 e4 7a 35 1a d
f e8 f5 bf fd df c8
60 42 24 c1 4f .
z5........`B$.O
02c0 44 b4 f0 04 8
0 12 09 b1 a0 ec bb
a3 20 50 87 21 D

........... P.!
02d0 e2 ea 54 26 e
8 47 ab fa c5 f5 78
f2 3b a6 f6 5a .
.T&.G....x.;..Z
02e0 1f 90 19 56 e
f 79 18 e0 23 6c 0e
dc 1c 96 0f 13 .
..V.y..#l......
02f0 79 96 42 a3 4
9 17 4f a8 fb aa 51
b5 de f4 64 d7 y
.B.I.O...Q...d.
0300 30 b3 7d 44 5
d b7 cb 4d f3 2b 98
32 38 38 2d 0f 0
.}D]..M.+.288-.
0310 50 0c 3e e2 a
5 51 65 4c 64 92 e3
06 33 96 a5 7b P
.>..QeLd...3..{
0320 3c f0 e3 6c a
f 80 29 62 53 e5 86
ce c5 97 17 1b <
..l..)bS.......
0330 a8 b3 27 9f 8
b 13 35 35 4f 96 e9
2a b6 7b d5 69 .
.'...55O..*.{.i
0340 70 b7 95 99 1
5 bb ae a4 dd 49 06
48 1b 18 5e e4 p
........I.H..^.
0350 07 b1 a2 04 0
a 82 34 a0 8e d3 4e
79 da c8 da e6 .
.....4...Ny....
0360 7f 9a e5 d2 6
f a8 ab b6 f9 69 be
d5 73 36 24 44 .
...o....i..s6$D
0370 35 97 54 67 4
a 81 57 5a c8 b7 a2
81 4a a3 01 39 5
.TgJ.WZ....J..9
0380 1b 7d 67 05 6
5 0c 35 fa 01 0b 02
a9 c4 11 4c c0 .
}g.e.5.......L.
0390 82 82 d4 b9 b
2 9e 4b ca a6 88 af
83 72 f8 cd 16 .
.....K.....r...
03a0 1d e1 14 31 2
1 21 50 10 cd 1d 92
23 34 54 89 84 .
..1!!P....#4T..
03b0 d0 4d c1 46 4
9 5c 16 75 40 b4 7c
d3 4d df 34 ef .
M.FI\.u@.|.M.4.
03c0 a7 67 a3 38 4
4 a3 9c f6 09 77 e6
69 fb e3 ff fb .
g.8D....w.i....
03d0 92 04 eb 8f f
3 05 40 d6 03 2c 32
e0 62 e6 4a c0 .
.....@..,2.b.J.

03e0 61 e6 5c 4b f
8 d9 56 0d 3d 0b 81
82 1b 6a c1 8c a
.\K..V.=....j..
03f0 21 70 dd 0f 8
f b7 be 41 dc fd 72
05 00 28 87 64 !
p.....A..r..(.d
0400 ab 7d 1b a3 f
2 c4 45 9a fe c6 ca
b0 b3 36 90 10 .
}....E......6..
0410 eb 3c 05 26 5
d 6e 11 19 9a a0 e6
55 f5 61 fa ce .
<.&]n.....U.a..
0420 5f bb b8 5c b
9 21 ad 51 f9 dd ca
3e 61 db 95 a8 _
..\.!.Q...>a...
0430 b8 ec 22 f4 0
1 19 67 c6 85 d9 d5
9d 47 7d 08 fb .
."...g.....G}..
0440 e6 97 7b d9 f
2 ce 76 4d 47 71 c5
ed 45 ac 22 5c .
.{...vMGq..E."\
0450 c8 66 3d 8b 7
3 c5 14 d4 dd 67 53
90 16 06 00 28 .
f=.s....gS....(
0460 4e 29 76 02 1
3 95 89 7d 04 25 21
5d 7f 55 cc 2c N
)v....}.%!].U.,
0470 4e 6b b0 47 c
5 45 41 a1 e8 85 b2
99 af ec ba 65 N
k.G.EA........e
0480 c4 27 cf 85 c
b b7 ea b1 1c b0 f5
9f 67 ce 54 32 .
'..........g.T2
0490 85 ea ac cb 7
9 c3 af 5f 6a 0f ea
9d 6f ee ce 74 .
...y.._j...o..t
04a0 f8 6b 38 fa b
a ee be f9 af 5e 44
81 e8 ba e3 50 .
k8......^D....P
04b0 98 b0 ea 28 f
4 be 83 2f 1c 98 73
93 39 44 da d2 .
..(.../..s.9D..
04c0 46 01 78 d0 9
f 72 ae e8 f3 52 f9
33 0a 27 3d 13 F
.x..r...R.3.'=.
04d0 95 21 ad 06 5
8 96 dd a2 ad 12 9e
9e ed 35 ca 9c .
!..X........5..
04e0 b7 23 de dc f
d 6e 6f 64 05 fa 1e
86 9b 49 18 42 .
#...nod.....I.B
04f0 2a 71 f0 81 a

e 0d 4b 6d 95 c6 ac
fa d5 77 a1 ec *
q....Km.....w..
0500 d1 51 37 0d 1
d 0b 4d 59 56 a2 e2
34 ad 0a a1 e4 .
Q7...MYV..4....
0510 d5 ad eb a5 5
5 77 4c 3c 60 cd 20
01 cc c0 e0 93 .
...UwL<`. .....
0520 0c 1e
.
.
No. Time
Source
Destination
Protocol
Length Info
216 7.754063000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=12498
4 Ack=1 Win=46 Len=
1260
Frame 216: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.803993000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.803993000 s
econds
[Time delta fro
m previous captured
frame: 0.002758000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00275800
0 seconds]
[Time since ref
erence or first fra
me: 7.754063000 sec
onds]
Frame Number: 2
16
Frame Length: 1
314 bytes (10512 bi
ts)

Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1e4 (61924)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a46 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 124984, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 124984 (relati
ve sequence number)
[Next sequence
number: 126244 (

relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa80
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 e4 4
0 00 31 06 3a 46 4a
7c 0c 8a c0 a8 .
...@.1.:FJ|....
0020 01 0b 00 50 c
1 a6 2b ca 4a 65 9e

87 4e aa 50 10 .
..P..+.Je..N.P.
0030 00 2e a8 07 0
0 00 26 03 5f a1 52
19 52 a9 a4 f3 .
.....&._.R.R...
0040 68 17 88 70 9
d 8c 2b 1e 31 a5 0e
e2 c6 b7 05 de h
..p..+.1.......
0050 12 0c 38 4f b
2 2f 9b af 1b 48 e4
50 fa 3f 43 c0 .
.8O./...H.P.?C.
0060 6a 45 e4 22 6
6 e9 a6 48 5d 04 95
da b3 54 8b 47 j
E."f..H]....T.G
0070 86 d1 44 74 7
3 74 6e ff be 9c 76
96 20 7b 12 c0 .
.Dtstn...v. {..
0080 90 89 eb 15 f
f fb 92 04 e8 8f f2
de 2c 55 03 2f .
...........,U./
0090 42 62 5f e6 9
a a0 63 0b 5c 0b 50
cb 52 0d 3d 6b B
b_...c.\.P.R.=k
00a0 81 7d 1a 6a 4
1 8c 21 70 53 19 9d
cc 7a d9 43 f2 .
}.jA.!pS...z.C.
00b0 2a e1 ac 68 1
8 a2 fa a2 ea 14 bc
24 17 c9 32 14 *
..h.......$..2.
00c0 a1 fe 80 da f
3 e7 3e 59 ee c8 24
74 8a c8 da cb .
.....>Y..$t....
00d0 ef 5d b9 28 9
1 69 4e f1 b8 65 b4
b6 b4 c4 4c 97 .
].(.iN..e....L.
00e0 ed 2f b6 65 5
c d9 1e 78 f7 41 b2
c2 77 a8 47 a4 .
/.e\..x.A..w.G.
00f0 56 b6 cf 7d d
6 4c fd ee d4 88 1f
08 a2 1f 06 41 V
..}.L.........A
0100 8a a0 17 9a 0
d 08 08 49 9a 14 55
6c 5c 5d dc 93 .
......I..Ul\]..
0110 8a 65 0c 19 e
d 85 d4 05 13 06 b2
61 11 30 11 46 .
e.........a.0.F
0120 bb 0d 31 b8 5
c e5 0c e4 44 a1 b6
9d ec af 36 46 .
.1.\...D.....6F
0130 af 6a 0c 7b e
e a9 d5 2c e9 71 73
20 cb 65 4a d6 .

j.{...,.qs .eJ.
0140 48 97 6a 37 1
9 35 e5 b1 f0 5d 5e
66 db 63 4d 4f H
.j7.5...]^f.cMO
0150 30 c6 c4 bf 6
6 2f 39 79 97 1c 18
00 20 b0 80 60 0
...f/9y.... ..`
0160 30 0c ae b5 8
d d2 2d b2 de d4 3c
a0 04 15 f1 05 0
.....-...<.....
0170 11 cd 72 13 1
9 42 8d c6 6b 2f b0
cd 38 cb 43 04 .
.r..B..k/..8.C.
0180 91 3c 02 48 c
8 da 54 ba 6d a5 45
67 99 86 b1 7c .
<.H..T.m.Eg...|
0190 ed 63 1c ad 6
c bf d6 b1 8b 1b 44
d6 66 e3 ea ac .
c..l.....D.f...
01a0 33 7d 39 37 9
8 4e ba 96 d6 63 7f
7a df c6 81 dd 3
}97.N...c.z....
01b0 de da f2 40 f
8 a5 71 8f bf f5 f5
23 cb 0d 6b 12 .
..@..q....#..k.
01c0 1d 2a 8d 6c d
c 96 50 c6 e5 95 6d
4c ea 23 af 18 .
*.l..P...mL.#..
01d0 3b e4 30 63 c
8 89 25 76 8c 58 a5
7d 0d 03 19 02 ;
.0c..%v.X.}....
01e0 3b 28 47 29 8
2 23 36 9c 9a 79 a8
e2 d6 a4 ad 0a ;
(G).#6..y......
01f0 c5 85 37 f3 5
1 ba b3 25 f5 b7 1c
17 82 03 3a 8f .
.7.Q..%......:.
0200 8b 3d aa 2d 5
6 0e 3e 08 2a 23 06
e0 b6 a7 99 3d .
=.-V.>.*#.....=
0210 b0 f0 a7 7a 5
2 9d 65 c7 ac bf af
cd b7 87 d2 d8 .
..zR.e.........
0220 98 6b 88 39 2
e 74 ff fb 92 04 ec
8f f3 0d 2c 53 .
k.9.t........,S
0230 83 6f 5a 60 6
1 04 9a 80 67 2f 4a
0b 50 99 50 0d .
oZ`a...g/J.P.P.
0240 61 89 41 7c 9
5 ea 01 8c bd 30 dd
0f 57 e8 62 26 a
.A|.....0..W.b&

0250 b8 c7 d9 42 4
b 34 a0 08 83 c6 c0
40 50 9b f7 f8 .
..BK4.....@P...
0260 62 c9 4c f9 9
6 5c 8d 84 02 a7 a5
94 d7 ac f1 b4 b
.L..\..........
0270 3a 2c 68 b0 4
3 ac 9b 29 fe bd 6c
de ce 90 a9 17 :
,h.C..)..l.....
0280 0a f9 5f 0b 0
c 63 38 d6 b3 64 6a
8c 07 1b 2b 2d .
._..c8..dj...+0290 93 16 14 8a e
d 59 63 30 ed 95 66
bf 85 bb e3 59 .
....Yc0..f....Y
02a0 af 89 fe 33 2
c b4 18 ee 84 08 1d
a1 4a 67 ee 43 .
..3,.......Jg.C
02b0 88 18 e0 7e d
9 3c 82 c8 83 25 8b
1a 7f c6 1e b4 .
..~.<...%......
02c0 09 49 b6 6c 7
6 09 08 0f 5e 26 7f
6a 1a 91 69 c0 .
I.lv...^&.j..i.
02d0 95 db 78 21 c
e 56 58 95 e1 da 0c
1a f4 b2 39 cd .
.x!.VX.......9.
02e0 30 0c b7 83 d
3 94 a1 2b 08 51 69
04 9b 79 87 9b 0
......+.Qi..y..
02f0 2c 22 39 a6 7
3 6a fa a9 16 e6 47
b5 b7 41 da cd ,
"9.sj....G..A..
0300 7f 66 72 b1 d
e d2 f1 00 d5 e5 1a
71 4d de 69 4b .
fr........qM.iK
0310 ae b7 50 e0 1
0 f7 a0 69 e2 ed 98
e2 97 d9 56 85 .
.P....i......V.
0320 99 7b 23 01 5
8 5f 58 7c 00 84 ea
cb 03 44 fe 41 .
{#.X_X|.....D.A
0330 5a b0 b6 52 c
a bc 42 57 69 ba c5
24 36 68 24 a9 Z
..R..BWi..$6h$.
0340 23 4f 8b db 5
8 6b cf 11 a3 71 d3
d8 5d 6a ea a3 #
O..Xk...q..]j..
0350 c2 ac 54 e8 5
e 76 ad dd a0 e2 d3
69 ba d7 c6 f3 .
.T.^v.....i....
0360 5b 6a 4d 7b 6

b 5a f5 be fe f1 89
fa 46 30 b2 88 [
jM{kZ......F0..
0370 f8 17 36 4d 0
3 02 94 97 38 b8 d0
72 63 00 48 48 .
.6M....8..rc.HH
0380 db fc 62 0f 2
e 98 98 b5 5b 7c c4
66 94 45 8b 35 .
.b.....[|.f.E.5
0390 69 d3 87 63 2
f a0 d0 ae 44 a9 6a
50 45 2d c7 b7 i
..c/...D.jPE-..
03a0 d4 41 56 98 2
a 54 c8 83 64 b8 36
b8 01 54 e3 10 .
AV.*T..d.6..T..
03b0 19 05 85 41 5
b a1 42 82 c3 c8 e7
27 63 34 53 0c .
..A[.B....'c4S.
03c0 e6 67 df 38 d
2 08 e5 7a ff fb 92
04 ed 0f f3 00 .
g.8...z........
03d0 2c d3 83 58 4
a 60 61 a5 8a 70 67
2f 4c 0c 3c bb ,
..XJ`a..pg/L.<.
03e0 4c 0d 61 89 8
1 85 97 a9 c1 9c bd
30 32 e6 f7 db L
.a........02...
03f0 e8 16 d4 a5 f
a f3 ca 42 aa 1c 24
80 12 27 40 22 .
......B..$..'@"
0400 e3 04 d6 b2 3
c a0 30 a8 71 f7 30
a2 7a 5e 61 1b .
...<.0.q.0.z^a.
0410 30 86 12 2d e
6 e0 be 5a 4e f5 7d
48 d5 27 f9 33 0
..-...ZN.}H.'.3
0420 15 c6 0a b3 6
d 99 67 71 1f 66 f1
0c a2 48 b6 6a .
...m.gq.f...H.j
0430 53 52 22 92 2
e 4c 1c b1 29 71 d0
87 3d a1 57 cb S
R"..L..)q..=.W.
0440 bb cc e3 98 4
a 8d 7b eb ef ee 6f
26 ff fd b2 89 .
...J.{...o&....
0450 61 f4 a9 82 8
b 75 eb fe 87 01 4d
4c 97 d0 81 a0 a
....u....ML....
0460 92 44 b3 92 1
9 f6 32 a0 95 75 54
1e 85 42 ef bd .
D....2..uT..B..
0470 96 90 0b 2b 8
6 2d e7 28 8f c2 65

f7 34 cf 23 34 .
..+.-.(..e.4.#4
0480 d2 fb 34 c2 8
4 5f b9 b2 cd 44 91
00 8a 4e 44 3c .
.4.._...D...ND<
0490 ae a6 c5 07 e
c b3 b3 e3 e9 61 62
d1 b8 f3 72 23 .
........ab...r#
04a0 07 fc fb 1d e
d 7b 6d f5 5c 3c e3
8e 07 cf e2 82 .
....{m.\<......
04b0 c7 7a 6d ad 7
4 a9 c4 31 24 c4 64
07 19 80 6a a0 .
zm.t..1$.d...j.
04c0 1b 4f 89 14 9
c e9 09 97 ee 8b 6c
49 4c 59 e0 80 .
O........lILY..
04d0 f4 b3 59 e9 3
b 59 24 0a d1 24 54
b3 16 e0 69 7d .
.Y.;Y$..$T...i}
04e0 99 b9 6c e4 4
d ac 59 b0 c3 71 be
9c 72 6a 1b d4 .
.l.M.Y..q..rj..
04f0 2a 66 45 1a d
e 4c 72 40 3a 27 40
fa d4 03 c3 0a *
fE..Lr@:'@.....
0500 95 e0 13 ea 2
5 ce f8 5b 53 75 fb
8e d3 22 59 f7 .
...%..[Su..."Y.
0510 fc 71 70 73 a
7 87 ea 75 52 28 09
b4 32 ba b4 95 .
qps...uR(..2...
0520 85 28
.
(
No. Time
Source
Destination
Protocol
Length Info
217 7.754193000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=126244 Win=40215 L
en=0
Frame 217: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8

8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.804123000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.804123000 s
econds
[Time delta fro
m previous captured
frame: 0.000130000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00013000
0 seconds]
[Time since ref
erence or first fra
me: 7.754193000 sec
onds]
Frame Number: 2
17
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6

e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f6d (20333)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]

Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 12624
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 126244 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40215
[Calculated win
dow size: 40215]
[Window size sc

aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 216]
[The RTT to
ACK the segment wa
s: 0.000130000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 6d 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Om@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 4f 51 50 10 .
....P..N.+.OQP.
0030 9d 17 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
218 7.795309000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
459 http49
574 [PSH, ACK] Seq=
126244 Ack=1 Win=46
Len=405
Frame 218: 459 byte
s on wire (3672 bit
s), 459 bytes captu
red (3672 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.845239000 Romance
Standard Time
[Time shift for

this packet: 0.000

000000 seconds]
Epoch Time: 141
5615220.845239000 s
econds
[Time delta fro
m previous captured
frame: 0.041116000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04111600
0 seconds]
[Time since ref
erence or first fra
me: 7.795309000 sec
onds]
Frame Number: 2
18
Frame Length: 4
59 bytes (3672 bits
)
Capture Length:
459 bytes (3672 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
45
Identification:
0xf1e5 (61925)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d9c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:

Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 126244, Ack:
1, Len: 405
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 405]
Sequence number
: 126244 (relati
ve sequence number)
[Next sequence
number: 126649 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf65
1 [validation disab

led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 405]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 bd f1 e5 4
0 00 31 06 3d 9c 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b ca 4f 51 9e
87 4e aa 50 18 .
..P..+.OQ..N.P.
0030 00 2e f6 51 0
0 00 aa b6 c0 8a 5d
48 ac 11 1d 36 .
..Q......]H...6
0040 3e ea e8 77 3
0 23 53 4b 93 d0 79
b9 1b e7 d6 03 >
..w0#SK..y.....
0050 60 79 b4 9d e
e 0c 01 56 62 69 5b
0d 99 de ac b5 `
y.....Vbi[.....
0060 57 02 61 ab 3
d 40 83 49 cc 69 a1
bd 10 fe 8d d9 W
.a.=@.I.i......
0070 9e 22 07 cb b
6 35 d5 a8 b6 b5 54
72 7a 6b ff fb .
"...5....Trzk..
0080 92 04 e9 8f f
3 05 2f 53 03 58 4a
60 60 e5 8a 60 .
...../S.XJ``..`
0090 67 2f 4c 0b a
8 b3 4c 0d 61 69 81
82 1a a9 81 8c g
/L...L.ai......
00a0 2d 70 e5 bc 7
c 47 c5 c1 da 50 d9
37 94 2e 58 25 p..|G...P.7..X%
00b0 13 89 d9 d2 a
3 05 04 87 1e 08 9d
ab 3c 06 8d 42 .
...........<..B
00c0 9f b2 02 bd b
2 a0 32 af 48 5c ca
17 f4 88 bc 78 .
.....2.H\.....x
00d0 a0 fb 39 4f 4
9 a0 ba 2a c8 75 68
75 d4 f9 b1 4d .
.9OI..*.uhu...M
00e0 64 9a 01 c5 f

a 15 a9 37 83 42 25
d5 de 0c 54 0e d
......7.B%...T.
00f0 ce bc 47 96 5
b 34 e1 ad fc 7c 43
77 8d 7b 4d e4 .
.G.[4...|Cw.{M.
0100 a2 d0 0a be e
4 da a9 3f 5e a4 91
1a 0e 38 2c 35 .
......?^....8,5
0110 91 28 31 4b e
5 a7 67 46 11 13 d2
f5 37 b7 5e 76 .
(1K..gF....7.^v
0120 01 a7 f8 98 b
2 e5 df 0f c6 de 22
61 df 51 f8 ae .
........."a.Q..
0130 4b 29 ab d2 c
3 3c e2 3e dd 75 9c
aa 5e d1 61 71 K
)...<.>.u..^.aq
0140 9a e6 64 14 a
b 52 0b 12 71 e3 2b
35 44 61 94 81 .
.d..R..q.+5Da..
0150 39 35 1f 64 d
d c4 71 19 9c 8e 81
d6 99 b4 bc c8 9
5.d..q.........
0160 be 77 5c ea a
7 35 fa cb ed eb 3b
53 ea 66 a8 84 .
w\..5....;S.f..
0170 65 99 20 8e a
3 48 37 0d 20 04 5c
68 74 07 39 d5 e
. ..H7. .\ht.9.
0180 93 ab 7b df 5
d 15 73 6f e1 99 6b
c0 e8 cb a6 ab .
.{.].so..k.....
0190 58 c1 93 c8 f
1 bd a0 60 18 f4 f1
fd a5 da 63 4d X
......`......cM
01a0 a6 d2 a1 7d 9
e f6 89 81 b0 b1 79
62 f2 35 8c a7 .
..}......yb.5..
01b0 2f 95 a8 8d f
1 b1 53 a2 7f 9b 62
de d3 fc 43 bf /
.....S...b...C.
01c0 df 81 af fe 6
0 6c ad 11 60 cf d3
.
...`l..`..
No. Time
Source
Destination
Protocol
Length Info
219 7.909313000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home

TCP
1314 http49
574 [ACK] Seq=12664
9 Ack=1 Win=46 Len=
1260
Frame 219: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.959243000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.959243000 s
econds
[Time delta fro
m previous captured
frame: 0.114004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11400400
0 seconds]
[Time since ref
erence or first fra
me: 7.909313000 sec
onds]
Frame Number: 2
19
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1e6 (61926)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a44 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 126649, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 126649 (relati
ve sequence number)
[Next sequence
number: 127909 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x1a1
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1665]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 e6 4
0 00 31 06 3a 44 4a
7c 0c 8a c0 a8 .
...@.1.:DJ|....
0020 01 0b 00 50 c
1 a6 2b ca 50 e6 9e
87 4e aa 50 10 .
..P..+.P...N.P.
0030 00 2e 1a 1c 0
0 00 2e a2 9d 02 23
13 87 31 63 4c .
.........#..1cL
0040 32 33 4e 4c 0
4 8c 31 7a 76 36 56
26 7f 88 58 b1 2
3NL..1zv6V&..X.
0050 ad 90 03 a8 9
3 89 c1 f8 2c 82 78
1b f1 0a 94 7f .
.......,.x.....
0060 3f 1d 33 bf 4
7 b3 8d 75 a6 84 cb
73 c3 82 ec 09 ?
.3.G..u...s....
0070 e7 82 e0 8c 1
6 08 58 6a f3 6c 50
11 ec 3b 88 a6 .
.....Xj.lP..;..
0080 a4 51 18 7f 1
4 60 df 1d eb 55 79
ff fb 92 04 e8 .

Q...`...Uy.....
0090 8f f2 e4 34 d
3 03 4f 5a e0 5e 05
2a 60 67 0f 4c .
..4..OZ.^.*`g.L
00a0 0c 70 d3 4a 0
d 61 ab 81 77 97 a9
81 8c 3d 30 06 .
p.J.a..w....=0.
00b0 d7 7a 2f 71 f
f 14 e4 75 77 7a 53
41 32 47 42 17 .
z/q...uwzSA2GB.
00c0 2a aa 0e d5 3
c 15 00 67 dd 6b 42
58 71 ef 05 a5 *
...<..g.kBXq...
00d0 52 01 12 55 4
6 e5 6a 39 2a 83 f9
2c 7b 2a 4b 5c R
..UF.j9*..,{*K\
00e0 ab b5 61 f8 3
0 aa a8 c3 f0 9d 8d
b1 ab 9c 29 53 .
.a.0.........)S
00f0 55 24 9a 6b 6
8 8e 98 9f 51 61 60
c3 55 dd 3f e0 U
$.kh...Qa`.U.?.
0100 27 2b 06 26 6
1 21 da cc 95 cf f4
df 92 27 cf dd '
+.&a!.......'..
0110 a3 ee b7 f6 0
5 3e bd 37 19 a1 2c
08 94 f7 27 30 .
....>.7..,...'0
0120 35 a0 23 24 f
b 6a b2 ba 84 7b 80
2a 7f 1d 83 28 5
.#$.j...{.*...(
0130 c6 02 9d 0f 2
f 4f 33 1a 74 82 36
53 83 f7 80 22 .
.../O3.t.6S..."
0140 fe b7 7a fc 6
f dd 53 d1 f3 b7 6b
af 49 61 75 6d .
.z.o.S...k.Iaum
0150 ef 9a 4b c1 3
5 07 db da 4c 2e 38
3e 03 1d c4 ef .
.K.5...L.8>....
0160 b5 68 ab fa 9
d eb af f7 fa 6f 2e
27 67 ac 74 20 .
h.......o.'g.t
0170 7c 07 e8 f2 0
b 92 fa 06 9b f0 4c
98 b8 a4 95 2e |
.........L.....
0180 22 a3 b7 98 f
1 24 4d 9b dd b7 7e
9a c5 bc 69 e3 "
....$M...~...i.
0190 90 8f 40 8d 1
0 36 67 93 63 40 9d
2e 9c 60 46 f6 .
.@..6g.c@...`F.

01a0 50 ea f9 38 7
c 43 5d 79 e9 d2 e1
a0 7a 19 6a 03 P
..8|C]y....z.j.
01b0 8b 3e d9 40 2
1 30 41 d8 e3 f7 17
85 9d 90 ca 44 .
>.@!0A........D
01c0 0e ff 5f f9 2
c 40 27 82 cc ad 5f
4d 81 62 50 37 .
._.,@'..._M.bP7
01d0 71 6c 26 85 6
6 04 8a ae 00 1c 5e
be 8b 19 5c e4 q
l&.f.....^...\.
01e0 5f d4 d1 25 9
d e3 e6 06 38 40 86
d0 98 fa c4 19 _
..%....8@......
01f0 a4 7b 24 ca 3
c a4 66 61 b3 75 0b
d8 b8 d6 72 69 .
{$.<.fa.u....ri
0200 77 8d 67 f0 5
d 90 63 c1 75 ac 80
e3 aa b0 59 8e w
.g.].c.u.....Y.
0210 73 d2 69 60 f
b c3 09 4b dc 18 52
dc f4 d6 0f a8 s
.i`...K..R.....
0220 de 4c 31 ad 5
5 2e fd 8b 6a 13 11
00 8d ff fb 92 .
L1.U...j.......
0230 04 e9 8f f3 0
2 34 d3 03 4f 42 e0
5d 25 9a 70 63 .
....4..OB.]%.pc
0240 0f 4c 0a e8 7
d 58 0c 3d 89 41 61
90 2a c0 fc 25 .
L..}X.=.Aa.*..%
0250 28 4a d4 18 b
f 0f 85 33 ec b0 17
8a 03 97 b9 8d (
J.....3........
0260 c5 1b 52 4d f
2 8a e9 75 e7 17 f3
b2 2e 9e 36 c7 .
.RM...u......6.
0270 20 4d 71 0a 7
3 b5 18 5a 45 15 a5
d6 72 e9 38 66
Mq.s..ZE...r.8f
0280 d8 4b 26 b3 1
7 18 4e 1a 95 b7 8c
de 3e af 61 6d .
K&...N.....>.am
0290 d0 c4 8d 4b 6
f 62 99 1c 41 08 13
8f 16 74 59 18 .
..Kob..A....tY.
02a0 7e 20 5b 11 7
0 1c 4d 5b 1f 8a b9
0c 6b a5 c5 cf ~
[.p.M[....k...
02b0 86 19 1c 23 1

c 00 18 1d e2 04 2c
64 42 ac c6 3b .
..#......,dB..;
02c0 81 fa 58 d7 5
0 67 85 20 81 87 14
3c d3 05 0a da .
.X.Pg. ...<....
02d0 03 94 85 12 1
c 6c ac b1 d7 04 9f
21 0b 37 7b 7b .
....l.....!.7{{
02e0 7e 6e 6f 7f 5
9 e9 6c db fb 16 9d
ad 3b 53 57 6f ~
no.Y.l.....;SWo
02f0 d3 a6 8a 65 d
0 bc c6 64 5c 8d 7a
29 1a 8a 8f b3 .
..e...d\.z)....
0300 f5 65 63 e6 3
b 48 cf 7c 8f 23 11
91 95 13 ef a0 .
ec.;H.|.#......
0310 6b ab e7 76 9
f b5 12 23 21 bc 01
9d 06 39 94 aa k
..v...#!....9..
0320 84 75 bc d3 3
4 26 81 75 ed 0b 99
72 0b 3e d2 78 .
u..4&.u...r.>.x
0330 6d 01 94 0e e
a f5 a2 a7 d8 5d b5
8a 2f 57 bb 4f m
........]../W.O
0340 be e6 5f e7 7
7 af 36 7c 51 ea 3a
cb 9c 1e 54 9b .
._.w.6|Q.:...T.
0350 35 45 ab 5c 8
4 26 f6 3c 6b 68 09
97 4a 82 0d b8 5
E.\.&.<kh..J...
0360 cd 2b 04 43 8
f 01 cc 9c 20 a2 66
b4 04 5c d8 7c .
+.C.... .f..\.|
0370 00 a8 b0 99 0
e 42 f2 2e 68 69 6e
53 8c a0 5b 8f .
....B..hinS..[.
0380 dd 5c be cd 6
1 30 1c 1f 87 c0 e1
cc 0a de a1 c4 .
\..a0..........
0390 f2 03 03 a6 5
a c0 c8 a1 85 39 3e
ea f7 1a a2 0e .
...Z....9>.....
03a0 a8 69 8b e6 d
6 b8 bf 29 4f 9a 97
78 e5 fd 26 f8 .
i.....)O..x..&.
03b0 de 79 2c f6 6
f 26 a5 0e 91 45 e9
48 6b 59 9a b1 .
y,.o&...E.HkY..
03c0 91 ae dd 12 b
5 7f 5e 31 e8 5f 33

e3 6d fc 3c ff .
.....^1._3.m.<.
03d0 fb 92 04 f2 0
f f3 17 27 d7 83 0f
32 50 69 05 0a .
......'...2Pi..
03e0 e0 61 e9 4a 0
c 05 69 62 07 98 4d
c9 73 0f ac 40 .
a.J..ib..M.s..@
03f0 f6 31 28 31 2
d 8c 41 63 d4 90 42
90 4b 04 34 27 .
1(1-.Ac..B.K.4'
0400 86 78 66 1b e
5 e5 60 29 44 5d 11
10 9f a5 15 9a .
xf...`)D]......
0410 21 47 f6 1b 7
5 95 e9 8a 52 6b 90
b0 08 f8 28 b4 !
G..u...Rk....(.
0420 e3 89 f8 d6 5
5 cf 96 e4 a9 4d 4f
5d bc 18 9f 98 .
...U....MO]....
0430 b8 dd bb e6 3
b 87 73 44 b8 d6 f2
be 5e c3 1a 60 .
...;.sD....^..`
0440 ad ff 25 9f 9
6 d9 c4 5f 78 77 4d
e0 df 19 2f b4 .
.%...._xwM.../.
0450 d3 b9 fc 16 f
9 bf 82 8d fd 95 34
31 d6 41 1d 95 .
.........41.A..
0460 54 16 20 46 3
8 4b c0 d3 9d 69 b2
00 76 34 05 2c T
. F8K...i..v4.,
0470 22 42 b3 66 2
4 12 25 d0 fd b5 09
74 4a 07 b4 c6 "
B.f$.%....tJ...
0480 a9 b6 72 bd e
0 0e 6a 74 a7 ec 8e
1c 29 55 92 cb .
.r...jt....)U..
0490 0d 37 49 77 2
b 31 77 53 2d f6 b6
c5 39 f3 9b 09 .
7Iw+1wS-...9...
04a0 da c8 1e be 8
3 f4 39 ae e9 df 6b
2c 86 88 ea 0a .
.....9...k,....
04b0 f9 d3 cf eb 2
0 f1 ad 01 45 22 d3
35 0c 89 74 e0 .
... ...E".5..t.
04c0 72 f3 39 cf a
8 44 e3 d3 ef 6b c9
19 78 6a 4b 27 r
.9..D...k..xjK'
04d0 e5 cc fd ae 5
3 37 29 bb 54 f3 f6
5c 57 69 22 46 .

...S7).T..\Wi"F
04e0 e6 fb 36 ba 3
f 30 50 da cf 1e 98
8f 53 fa fb 96 .
.6.?0P.....S...
04f0 b9 79 34 0b e
f 71 a7 bc c0 99 f0
54 15 c4 cd 58 .
y4..q.....T...X
0500 57 01 28 5c c
2 fe 3e 9b ed c4 be
09 2d da ae b3 W
.(\..>.....-...
0510 3d ee a3 d2 0
a 88 6e 58 68 3a 80
72 40 02 c3 03 =
.....nXh:.r@...
0520 03 32
.
2
No. Time
Source
Destination
Protocol
Length Info
220 7.909498000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=127909 Win=39799 L
en=0
Frame 220: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
0.959428000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615220.959428000 s
econds
[Time delta fro
m previous captured
frame: 0.000185000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018500
0 seconds]
[Time since ref
erence or first fra
me: 7.909498000 sec

onds]
Frame Number: 2
20
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes

Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f6e (20334)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 12790
9, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number

: 1 (relative se
quence number)
Acknowledgment
number: 127909 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39799
[Calculated win
dow size: 39799]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 219]
[The RTT to
ACK the segment wa
s: 0.000185000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.

0010 00 28 4f 6e 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(On@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 55 d2 50 10 .
....P..N.+.U.P.
0030 9b 77 18 d4 0
0 00
.
w....
No. Time
Source
Destination
Protocol
Length Info
221 7.974314000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=12790
9 Ack=1 Win=46 Len=
1260
Frame 221: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.024244000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.024244000 s
econds
[Time delta fro
m previous captured
frame: 0.064816000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06481600
0 seconds]
[Time since ref
erence or first fra
me: 7.974314000 sec
onds]
Frame Number: 2
21
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)

[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1e7 (61927)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a43 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 127909, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 127909 (relati
ve sequence number)
[Next sequence
number: 129169 (
relative sequence n
umber)]
Acknowledgment

number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x7c6
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 e7 4
0 00 31 06 3a 43 4a
7c 0c 8a c0 a8 .
...@.1.:CJ|....
0020 01 0b 00 50 c
1 a6 2b ca 55 d2 9e
87 4e aa 50 10 .
..P..+.U...N.P.
0030 00 2e 7c 6a 0

0 00 88 0b d6 a5 52
24 27 bf b2 20 .
.|j......R$'..
0040 00 24 f5 96 b
c b6 db f8 2a 87 41
88 c7 1f 66 fa .
$......*.A...f.
0050 69 2d a8 65 9
5 25 b2 57 66 11 2a
26 ea 06 44 32 i
-.e.%.Wf.*&..D2
0060 29 d0 23 35 a
0 0e 3a cf 2b 40 48
32 3a da 9d 4e )
.#5..:.+@H2:..N
0070 32 d5 65 d6 3
6 7d d6 cf fb a2 9f
17 00 8e 0d 93 2
.e.6}..........
0080 59 51 26 39 8
d ff fb 92 04 ec 8f
f3 1f 56 57 81 Y
Q&9.........VW.
0090 e8 1b 70 5d 4
3 5a f0 3d 89 38 4b
5c 95 54 0c e1 .
.p]CZ.=.8K\.T..
00a0 89 41 7f 90 e
a 81 8c 3d 28 be 47
d3 e8 65 46 c7 .
A.....=(.G..eF.
00b0 06 18 8b 14 b
e e6 11 45 a8 42 f4
3f 9b 4e e3 61 .
......E.B.?.N.a
00c0 b5 90 84 30 8
5 0f 44 a8 a5 b9 35
14 08 d3 26 21 .
..0..D...5...&!
00d0 a9 ea 09 ad 4
3 97 e3 36 90 4d aa
cf 5c a8 7a 28 .
...C..6.M..\.z(
00e0 02 8d 10 9c 9
3 53 2a 7a 5a 5f 13
05 99 6c 92 94 .
....S*zZ_...l..
00f0 94 e4 c7 44 9
7 52 33 ca cf b0 a9
ef ee 4b 72 80 .
..D.R3......Kr.
0100 84 e9 25 8e b
6 f6 bb fb 28 62 86
ac 01 a8 0e 19 .
.%.....(b......
0110 5d 51 12 0f 2
f c8 fc 91 26 09 e1
73 dc 99 31 80 ]
Q../...&..s..1.
0120 2f 73 56 8b 6
4 a5 a1 92 00 1c 5c
05 b1 b8 e6 54 /
sV.d.....\....T
0130 39 95 01 36 8
b 7f 1d a8 7f 8d 45
58 78 97 86 ce 9
..6......EXx...
0140 3e 7a 46 5a 2
3 d5 d9 b1 54 18 4d

be 4a a5 aa 95 >
zFZ#...T.M.J...
0150 dc c4 5f 68 b
2 c5 9a cd 76 b1 67
ec e4 f5 36 b0 .
._h....v.g...6.
0160 2c 75 49 14 b
2 65 83 74 b7 75 03
3d c7 bd 6e 21 ,
uI..e.t.u.=..n!
0170 a6 51 e5 c2 c
4 03 1e 5e 24 19 81
54 f3 7a a0 46 .
Q.....^$..T.z.F
0180 d8 b6 07 64 2
a 66 a0 83 20 e6 51
bd 92 c9 39 28 .
..d*f.. .Q...9(
0190 16 a5 56 61 6
a 5e dc e9 60 bb 78
cd 89 2e 11 3e .
.Vaj^..`.x....>
01a0 30 4a 5e 06 2
e 2f 12 2a 5c 28 7e
3f a3 12 8b ab 0
J^../.*\(~?....
01b0 ab 08 77 f0 9
9 d3 4f 75 a8 a5 09
4f ed 63 ad 72 .
.w...Ou...O.c.r
01c0 72 cc 4d 66 7
5 e9 30 01 3a 80 34
e9 04 d7 a6 a5 r
.Mfu.0.:.4.....
01d0 f7 7a 2a 6c c
4 4a 04 5a 51 90 a0
65 46 49 60 18 .
z*l.J.ZQ..eFI`.
01e0 44 02 a3 72 6
3 cc 6a 5d b2 43 58
ba d7 e5 4f 74 D
..rc.j].CX...Ot
01f0 74 51 2e b3 4
c 97 3e 10 e7 ed 9b
6a 23 62 3a 99 t
Q..L.>....j#b:.
0200 70 2e 63 bd 1
3 01 0c f2 82 a5 da
4c 72 95 95 2b p
.c........Lr..+
0210 4f da a1 bb 4
7 65 51 f9 87 f0 af
e7 a2 db 37 b0 O
...GeQ.......7.
0220 ea 10 69 93 1
5 06 14 ff fb 92 04
ed 8f f3 08 2c .
.i............,
0230 d3 83 38 32 6
0 5c 05 7a 80 67 09
4c 0c ac b1 4c .
.82`\.z.g.L...L
0240 0d 3d 89 81 8
f 96 29 c1 9c 31 30
1a 39 55 cf 15 .
=....)..10.9U..
0250 58 0b fd 10 2
8 80 83 13 11 63 4c
44 44 4d 96 70 X

...(....cLDDM.p
0260 70 22 50 a5 c
c 0c d0 c9 13 98 5b
58 ab b0 0b 6b p
"P.......[X...k
0270 f5 23 99 8c a
c 14 82 54 f5 4d 5c
58 1b 15 65 38 .
#.....T.M\X..e8
0280 41 6a 46 de c
1 3d 13 00 36 79 31
15 d9 ad a1 79 A
jF..=..6y1....y
0290 38 67 47 da 7
d d4 d3 9b 6e 52 3f
12 bf 37 6c ea 8
gG.}...nR?..7l.
02a0 af 39 bb e1 3
a 22 5d 94 a0 88 17
d6 cc 63 fd fe .
9..:"]......c..
02b0 86 80 01 9a 0
0 4c 96 6c 94 18 10
c7 87 1f b6 17 .
....L.l........
02c0 42 ec a1 93 b
b 49 19 21 cb f9 42
b5 3b 02 4a 92 B
....I.!..B.;.J.
02d0 11 31 9a 5d 2
3 30 8c 46 a0 16 3d
3b f2 89 b5 ea .
1.]#0.F..=;....
02e0 fd cb 26 30 a
e e3 5f b1 6b c5 02
1b 29 71 87 e3 .
.&0.._.k...)q..
02f0 5c 46 11 c3 c
9 17 ae bc 7b 6c d3
5b 9d ac c4 a7 \
F......{l.[....
0300 f2 e2 37 a6 d
f f1 75 c6 31 de 31
fd 89 f9 26 a0 .
.7...u.1.1...&.
0310 49 44 dc 1d 1
c 00 34 44 cb 05 02
87 45 40 60 da I
D....4D....E@`.
0320 06 52 7b aa a
8 d1 08 45 42 cf 8b
6f 2d 98 f9 6b .
R{....EB..o-..k
0330 e1 03 c8 23 9
6 26 a2 36 e5 16 65
d5 e1 88 d5 45 .
..#.&.6..e....E
0340 66 1f 99 57 6
d 3e f7 9b 75 c4 f7
30 0b 5a 41 bd f
..Wm>..u..0.ZA.
0350 cc f5 5f 79 8
d c6 fd dd b7 3e 30
d9 ad ff 8b e2 .
._y.....>0.....
0360 d8 ff e1 f4 7
e 0c 89 54 28 c9 e1
3f a0 66 ed f6 .
...~..T(..?.f..

0370 65 6a 58 ad e
1 93 a0 ca 04 05 0c
0d 82 a1 33 1a e
jX...........3.
0380 88 20 82 62 b
e 44 06 7f 22 60 97
43 71 25 7a e9 .
.b.D.."`.Cq%z.
0390 2e 98 c0 cd 1
b 23 4e af 01 52 da
6e ee d5 3b 60 .
....#N..R.n..;`
03a0 87 e3 60 a1 5
4 dc 48 53 11 da a2
be 32 21 47 6c .
.`.T.HS....2!Gl
03b0 6f 25 12 52 0
c 9b a2 82 2d d9 f5
8d 7f af 4a 6b o
%.R....-.....Jk
03c0 31 a9 ed 6a 6
f 32 6b 19 cd ff fb
92 04 e9 0f f2 1
..jo2k.........
03d0 e3 29 53 83 3
8 5a 60 5d 25 8a 70
67 0b 4c 0b c0 .
)S.8Z`]%.pg.L..
03e0 d1 4c 0d 61 0
b 81 8b 16 69 81 ac
3d 30 d5 8f 60 .
L.a....i..=0..`
03f0 45 60 34 0e 2
8 72 a2 39 a5 8a 68
aa 67 a0 18 30 E
`4.(r.9..h.g..0
0400 5c 03 36 03 1
d 26 24 81 8e 4a 7e
1e a8 94 ec 15 \
.6..&$..J~.....
0410 22 e4 6b 5c 2
2 cf 43 59 87 28 2d
33 7e 47 1f 8c "
.k\".CY.(-3~G..
0420 25 32 89 92 e
8 97 67 11 65 05 e9
3c e1 31 15 bc %
2....g.e..<.1..
0430 f0 8e ac 2b 2
6 53 46 e6 10 aa 7b
03 76 27 86 b6 .
..+&SF...{.v'..
0440 16 b5 22 c7 9
7 1f d3 58 91 c3 11
82 86 93 50 08 .
."....X......P.
0450 65 c4 25 ab 3
d 5d 8a 65 86 50 19
93 54 2c a1 01 e
.%.=].e.P..T,..
0460 40 23 e6 68 3
8 1e a0 5c b3 36 8e
95 2a ef 41 00 @
#.h8..\.6..*.A.
0470 6c c3 4a 34 9
6 18 aa f8 8b be 97
b4 72 f9 4c 5e l
.J4........r.L^
0480 9d 45 db ca d

1 a9 86 8a c2 69 62
16 49 61 4d 1b .
E.......ib.IaM.
0490 11 2c b8 bd 8
f 79 40 32 30 73 a2
57 75 1d ff eb .
,...y@20s.Wu...
04a0 3e f9 99 64 d
3 d1 e5 4f ec e2 8e
90 38 81 f8 b0 >
..d...O....8...
04b0 eb e2 eb a9 b
c 39 9d 3a df 1e 44
cb 08 65 20 33 .
....9.:..D..e 3
04c0 ab d8 b3 50 3
c 34 07 da aa ba 01
9c 69 d9 8f 52 .
..P<4......i..R
04d0 1f 73 e2 94 0
d 85 7f cb a5 52 6e
b6 46 f6 1e 8d .
s.......Rn.F...
04e0 4c 4a 57 cd 2
d 22 a2 e8 f4 1d f5
5c 7d 08 79 6d L
JW.-".....\}.ym
04f0 a4 58 76 11 7
a ba c8 ed 96 0e 7a
ff 38 a7 7c ee .
Xv.z.....z.8.|.
0500 fd 58 b6 9d e
f fd 1f 99 f9 bb 68
68 7d 63 d5 0b .
X........hh}c..
0510 9d f5 ba aa a
5 36 ea 42 a1 b7 51
c8 29 c9 0d 07 .
....6.B..Q.)...
0520 13 e3
.
.
No. Time
Source
Destination
Protocol
Length Info
222 8.042320000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=12916
9 Ack=1 Win=46 Len=
1260
Frame 222: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t

ype: Ethernet (1)

Arrival Time: N
ov 10, 2014 11:27:0
1.092250000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.092250000 s
econds
[Time delta fro
m previous captured
frame: 0.068006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06800600
0 seconds]
[Time since ref
erence or first fra
me: 8.042320000 sec
onds]
Frame Number: 2
22
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa

gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1e8 (61928)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a42 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0

1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 129169, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 129169 (relati
ve sequence number)
[Next sequence
number: 130429 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win

dow size: 46]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xefa
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 e8 4
0 00 31 06 3a 42 4a
7c 0c 8a c0 a8 .
...@.1.:BJ|....
0020 01 0b 00 50 c
1 a6 2b ca 5a be 9e
87 4e aa 50 10 .
..P..+.Z...N.P.
0030 00 2e ef af 0
0 00 30 b8 92 20 af
20 a7 88 5b dd .
.....0.. . ..[.
0040 40 83 0d 82 5
9 65 39 60 68 ea ea
d5 67 8e 7e de @
...Ye9`h...g.~.
0050 c7 b2 f4 36 f
c 3d 68 d3 17 a1 30
61 3b f2 88 b9 .
..6.=h...0a;...
0060 52 80 c3 ca 7
a 27 29 28 37 0d 57
88 b4 60 ca 67 R
...z')(7.W..`.g
0070 e6 08 9b 46 a
b 1c bf 4f 6e ce 5a
72 73 99 76 ff .
..F...On.Zrs.v.
0080 fb 92 04 ea 8
f f3 14 2b d2 83 58
7a 60 5e 84 ca .
......+..Xz`^..
0090 50 67 0f 4a 0
b 98 b1 4c 0d 61 69
81 7f 16 29 81 P
g.J...L.ai...).
00a0 9c 31 30 c6 d
7 78 e7 d4 e9 0a 26
8d f0 8d bd c9 .
10..x....&.....
00b0 86 0c 50 b5 6
b fa 08 5e b4 6f 48
7b ac ae 1c 1a .
.P.k..^.oH{....
00c0 ca 50 e9 18 a
2 c1 2e c4 ec 5d 7c
bf 13 72 4c e5 .

P.......]|..rL.
00d0 6f b3 8f 84 3
6 fc 75 2f 25 b8 25
23 ec 8a b6 0f o
...6.u/%.%#....
00e0 54 be 21 7b b
a c1 82 ae 82 b9 cc
04 32 35 5c b7 T
.!{........25\.
00f0 57 74 81 17 3
7 7d bc 6f 3f 59 ce
3d ad fe b3 58 W
t..7}.o?Y.=...X
0100 cf 48 64 a0 f
c 19 3d eb 7d 0d e0
39 a0 51 48 94 .
Hd...=.}..9.QH.
0110 50 30 02 22 0
5 ca 3c e0 45 03 43
b3 e1 41 2c 0c P
0."..<.E.C..A,.
0120 e0 08 60 07 d
1 3e 64 27 30 93 a5
c8 a4 72 6f 55 .
.`..>d'0....roU
0130 65 cc 52 36 f
5 85 b4 aa c3 c5 7e
55 ad 57 2e ca e
.R6......~U.W..
0140 bb 0f 0e f3 b
8 07 02 83 b3 a9 a1
47 91 67 30 93 .
..........G.g0.
0150 d2 69 9b 33 d
b 4e e5 e5 7d 94 af
7d 5b 9b ff e6 .
i.3.N..}..}[...
0160 5f af f2 fd f
d 7f e9 18 ea 5a b1
a8 92 20 89 9e _
........Z... ..
0170 9c a2 09 41 5
0 a2 42 9b 3e ce 09
c6 a4 03 13 32 .
..AP.B.>......2
0180 8d b7 68 50 6
a 47 76 2f 2d 86 c9
88 ec 18 bf e9 .
.hPjGv/-.......
0190 ee a6 74 fc a
6 53 30 92 4d 02 58
a2 b3 09 a9 7a .
.t..S0.M.X....z
01a0 13 c5 54 e6 d
e 9a d3 52 38 0f fe
ac 8f d1 d0 fb .
.T....R8.......
01b0 84 4b 2a 35 8
7 fe aa cc 79 6d 6f
bc ef e2 3f ff .
K*5....ymo...?.
01c0 c9 17 74 9e e
9 12 bb 44 86 6e 79
0d 59 12 4c a5 .
.t....D.ny.Y.L.
01d0 60 1a b0 58 9
1 8d 3a 6f 4f 06 17
71 99 aa d8 65 `
..X..:oO..q...e

01e0 51 f3 5a 20 5
4 0a 5a b3 2e 74 f0
c0 12 39 50 45 Q
.Z T.Z..t...9PE
01f0 5b 23 7f 76 3
c 92 36 26 a7 b1 64
92 19 44 c5 7a [
#.v<.6&..d..D.z
0200 47 b7 f3 ce f
8 f0 27 82 bb 3c 08
45 a6 f1 06 e5 G
.....'..<.E....
0210 e4 3e 4f dc 6
f bc 9d 23 b0 97 b5
18 65 d5 43 8d .
>O.o..#....e.C.
0220 bf ff fb 92 0
4 ea 8f f2 f2 2c 53
03 38 62 60 5f .
........,S.8b`_
0230 25 8a 60 67 2
f 4c 0b fc d5 4c 0d
3d 2b 81 82 16 %
.`g/L...L.=+...
0240 69 81 9c bd 3
0 8b 41 97 f4 ef af
ff 6b d7 fd 75 i
...0.A.....k..u
0250 14 d0 ee 1a 6
0 99 96 19 a0 06 14
85 83 e1 2c 29 .
...`.........,)
0260 23 2c 11 fd 3
1 21 70 65 c3 24 c6
60 84 73 72 29 #
,..1!pe.$.`.sr)
0270 e9 86 10 a8 6
c c0 4a 33 77 07 ca
cf 69 ab a1 eb .
...l.J3w...i...
0280 fb 85 25 d9 4
3 79 bc 9d 6d 24 2f
2c 7f 3c a1 f8 .
.%.Cy..m$/,.<..
0290 25 8b e5 27 4
c 39 23 22 30 e8 a6
6f 4c 85 33 1b %
..'L9#"0..oL.3.
02a0 ea 46 82 56 b
9 82 4a f4 1f 9d d5
ab d8 d7 f7 4a .
F.V..J........J
02b0 29 13 34 24 2
f 7c 59 d9 42 a6 18
62 8c 9e 81 00 )
.4$/|Y.B..b....
02c0 a1 b2 16 0a d
3 18 04 c1 c2 32 bb
61 f7 96 33 9a .
........2.a..3.
02d0 45 a4 ad 8e c
d c7 da 5d 55 9e 4f
cb 59 9c e5 64 E
......]U.O.Y..d
02e0 ab cf 01 b5 a
a 03 77 80 e1 62 a2
19 c3 b2 a4 78 .
.....w..b.....x
02f0 2f 8e e0 76 2

5 64 06 85 ea c4 15
0d 9c 9f 7c d7 /
..v%d........|.
0300 2b 65 53 7f b
2 79 87 27 93 b1 4e
67 6a f4 28 2a +
eS..y.'..Ngj.(*
0310 82 18 69 08 b
4 ce 01 88 03 08 21
79 84 2c d8 d4 .
.i.......!y.,..
0320 48 85 04 a2 2
e 02 1c 1c aa 60 77
3f 8e ee 12 e6 H
........`w?....
0330 30 b3 e6 26 9
5 aa eb 3c 62 94 ad
df 1c 9d d9 17 0
..&...<b.......
0340 22 38 d6 57 7
9 47 da f6 02 50 35
98 42 d0 5b 1b "
8.WyG...P5.B.[.
0350 9a 25 93 9a 3
7 16 62 64 c1 6e 54
a5 41 01 90 8d .
%..7.bd.nT.A...
0360 cd d5 a5 1f c
8 cf f4 db f9 03 bc
be 9a 4e 40 ba .
............N@.
0370 51 0c 10 8d e
1 c5 14 c0 2e b0 e8
1f 24 24 f3 48 Q
...........$$.H
0380 90 4e f1 74 e
e e8 53 47 0b 32 f3
a5 21 50 f6 70 .
N.t..SG.2..!P.p
0390 95 f5 6b 3c f
9 33 e7 ea da 98 50
71 76 43 d3 6c .
.k<.3....PqvC.l
03a0 40 ea 51 41 e
c c9 85 8f 3c 59 04
a0 bd a1 54 23 @
.QA....<Y....T#
03b0 16 b8 ad 99 c
e 0b 29 49 39 b5 d3
5c ad 94 5d 7c .
.....)I9..\..]|
03c0 52 15 fa ff f
b 92 04 ea 8f f3 1f
35 52 83 58 5a R
..........5R.XZ
03d0 e0 5e 46 aa 6
0 67 0d 5c 0b c0 bd
4a 0d 61 69 81 .
^F.`g.\...J.ai.
03e0 79 9a 29 81 a
c 29 70 9a 2e 50 bb
fa 55 a7 fd 0c y
.)..)p..P..U...
03f0 10 11 08 87 4
0 99 41 44 a6 72 09
d6 18 5a e5 7d .
...@.AD.r...Z.}
0400 0d 8c bf 00 4
2 81 52 4f 2c 08 0d

0b 50 44 52 75 .
...B.RO,...PDRu
0410 b0 11 17 62 0
a 55 d9 a7 72 84 7a
72 4d 71 1d a3 .
..b.U..r.zrMq..
0420 d5 db a7 4e 8
f ac 24 43 a7 34 19
d8 87 ae 39 56 .
..N..$C.4....9V
0430 ae c1 1f 28 6
b 9d 9a 77 46 4d 74
a6 9b 8b 0e b1 .
..(k..wFMt.....
0440 03 79 d7 83 f
b e9 f7 fe 64 8d 9d
22 a7 ad 2e d7 .
y......d.."....
0450 6e 95 da 38 a
1 15 00 5e 81 42 50
e4 63 85 1d 71 n
..8...^.BP.c..q
0460 65 51 b5 97 7
c f3 b5 32 1d 19 0b
5a 01 66 9d 47 e
Q..|..2...Z.f.G
0470 63 69 da cb d
0 bd d7 98 50 b9 5c
79 ef a4 87 e0 c
i......P.\y....
0480 18 0a 09 72 a
7 c3 e3 46 41 c6 6c
23 db 03 cb 97 .
..r...FA.l#....
0490 d8 50 51 cf 8
c c0 e3 f2 77 5c bf
a8 f4 c0 bb 95 .
PQ.....w\......
04a0 43 d7 cb f5 1
f fd 28 de 56 f3 7a
91 f7 e1 a7 64 C
.....(.V.z....d
04b0 03 20 39 b3 7
9 22 fd 90 12 3c c5
83 3a 75 fa 87 .
9.y"...<..:u..
04c0 31 14 1f eb 8
1 e3 b2 a2 c6 a0 d7
66 38 c3 f0 12 1
..........f8...
04d0 79 c3 ed 91 6
f ca e6 9c 9b 6f 3c
13 3c bc 63 d2 y
...o....o<.<.c.
04e0 23 f7 0d a4 d
6 af d8 2e d5 85 5a
ef d0 6f db b3 #
.........Z..o..
04f0 56 44 43 95 e
1 6b 6d fb 81 5c 9d
ec d9 f0 3f cf V
DC..km..\....?.
0500 de 33 8d eb f
d 46 9a b3 81 ad 82
95 51 80 ba 83 .
3...F......Q...
0510 1d 58 0d c8 6
8 3b ca 60 c6 9e 12
49 02 cb 5c 46 .

X..h;.`...I..\F
0520 b8 c8
.
.
No. Time
Source
Destination
Protocol
Length Info
223 8.042506000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=130429 Win=39169 L
en=0
Frame 223: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.092436000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.092436000 s
econds
[Time delta fro
m previous captured
frame: 0.000186000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018600
0 seconds]
[Time since ref
erence or first fra
me: 8.042506000 sec
onds]
Frame Number: 2
23
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 4
0
Identification:
0x4f6f (20335)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 13042
9, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 130429 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39169
[Calculated win
dow size: 39169]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 222]
[The RTT to
ACK the segment wa
s: 0.000186000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 6f 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Oo@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 5f aa 50 10 .
....P..N.+._.P.
0030 99 01 18 d4 0
0 00
.
.....
No. Time
Source
Destination

Protocol
Length Info
224 8.058317000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
449 http49
574 [PSH, ACK] Seq=
130429 Ack=1 Win=46
Len=395
Frame 224: 449 byte
s on wire (3592 bit
s), 449 bytes captu
red (3592 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.108247000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.108247000 s
econds
[Time delta fro
m previous captured
frame: 0.015811000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01581100
0 seconds]
[Time since ref
erence or first fra
me: 8.058317000 sec
onds]
Frame Number: 2
24
Frame Length: 4
49 bytes (3592 bits
)
Capture Length:
449 bytes (3592 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),

Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
35
Identification:
0xf1e9 (61929)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3da2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 130429, Ack:
1, Len: 395
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 395]
Sequence number
: 130429 (relati
ve sequence number)
[Next sequence
number: 130824 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xdea
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 395]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 b3 f1 e9 4
0 00 31 06 3d a2 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b ca 5f aa 9e
87 4e aa 50 18 .
..P..+._...N.P.
0030 00 2e de a1 0
0 00 9f a1 73 ea 20
19 6a cc 0a 28 .
.......s. .j..(
0040 e4 2c 76 71 3
d 30 ab ee cb d2 ce
37 09 86 a3 90 .
,vq=0.....7....
0050 d5 1b 73 29 1
d 1c 03 58 9e 0f 48
ac 03 67 44 d7 .
.s)...X..H..gD.
0060 b8 b8 1d f2 5
c ba b6 b3 94 72 e8
a0 55 32 03 58 .
...\....r..U2.X
0070 f6 a6 7e 72 2

f a3 16 9d 9b ff fb
92 04 ea 0f f2 .
.~r/...........
0080 f3 2f 52 83 5
8 5a 60 62 25 8a 50
67 2f 4c 0b a0 .
/R.XZ`b%.Pg/L..
0090 b3 4c 0d 61 2
9 81 73 96 29 81 9c
3d 30 21 74 08 .
L.a).s.)..=0!t.
00a0 11 23 70 a2 b
6 ae dc 7b 40 02 2a
30 f2 cc 10 b1 .
#p....{@.*0....
00b0 60 43 c0 01 4
1 ca 04 18 05 cd 95
c8 21 9c 62 26 `
C..A.......!.b&
00c0 18 88 ab 58 1
e 53 a0 a7 53 90 23
f5 14 9b 95 bc .
..X.S..S.#.....
00d0 f3 36 de 7e c
6 63 50 64 09 8c 36
4a 79 a1 7d 05 .
6.~.cPd..6Jy.}.
00e0 23 92 22 59 6
6 11 ad ea 81 92 3f
21 e2 11 3d ca #
."Yf.....?!..=.
00f0 25 9d 41 79 a
5 57 2e 04 39 90 45
59 9b 73 74 bc %
.Ay.W..9.EY.st.
0100 cc bc b7 52 9
b df 81 be ed 2a f5
f6 30 57 1d 74 .
..R.....*..0W.t
0110 0d 01 0b 31 0
4 4d 90 61 41 4f 22
3d 17 61 91 2d .
..1.M.aAO"=.a.0120 b0 e2 38 b0 e
a c7 8b ae 57 39 55
20 a5 ab 04 4f .
.8.....W9U ...O
0130 cc 41 d2 b9 d
7 69 fc a4 86 e8 a2
f2 f7 47 a8 43 .
A...i.......G.C
0140 76 d8 27 22 4
a b9 d7 5f e6 17 47
95 f6 cd 74 eb v
.'"J.._..G...t.
0150 66 0a b6 f5 2
4 73 ac c0 a7 6d 33
94 b5 e6 6f 30 f
...$s...m3...o0
0160 bb 1c 54 ad b
1 ec 74 04 58 32 f7
80 48 91 1b 04 .
.T...t.X2..H...
0170 02 5b 1a 6d 9
3 3a 41 0e 87 df 09
6b 5c 51 40 9a .
[.m.:A....k\Q@.
0180 48 a0 99 0c f
b 4b 48 0b f0 c3 dd

18 8a b9 f7 dd H
....KH.........
0190 09 b8 d5 aa b
4 aa d9 a0 94 ef e0
19 f1 14 2c f6 .
.............,.
01a0 7b 1e 02 52 d
9 81 b9 11 53 48 9e
bf 79 b9 5c a8 {
..R....SH..y.\.
01b0 b2 cf e0 79 a
b bf 9f ab 4f fe e2
44 f3 e6 7b 9d .
..y....O..D..{.
01c0 a5
.
No. Time
Source
Destination
Protocol
Length Info
225 8.107321000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=13082
4 Ack=1 Win=46 Len=
1260
Frame 225: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.157251000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.157251000 s
econds
[Time delta fro
m previous captured
frame: 0.049004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04900400
0 seconds]
[Time since ref
erence or first fra
me: 8.107321000 sec
onds]
Frame Number: 2
25
Frame Length: 1

314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ea (61930)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a40 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 130824, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 130824 (relati
ve sequence number)

[Next sequence
number: 132084 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4e7
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1655]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ea 4
0 00 31 06 3a 40 4a
7c 0c 8a c0 a8 .
...@.1.:@J|....

0020 01 0b 00 50 c
1 a6 2b ca 61 35 9e
87 4e aa 50 10 .
..P..+.a5..N.P.
0030 00 2e 4e 77 0
0 00 30 a4 03 d8 66
d8 02 a1 9e 85 .
.Nw..0...f.....
0040 0f 04 88 03 e
5 63 b4 83 ec 53 4e
a2 ee 45 2e 70 .
....c...SN..E.p
0050 4b 1f 97 24 a
1 7b 25 8f d5 87 5b
59 e0 fc b0 37 K
..$.{%...[Y...7
0060 36 b9 25 4e b
7 ec e9 08 cd 0e c8
56 4e 9c 4c 30 6
.%N.......VN.L0
0070 c6 b8 98 c9 f
2 24 2f 27 2a d2 7e
53 62 74 f2 a7 .
....$/'*.~Sbt..
0080 11 ee 43 2d 7
b 59 35 a5 b0 f9 36
b9 01 79 a3 6b .
.C-{Y5...6..y.k
0090 ff fb 92 04 e
b 8f f3 1d 2c d2 83
58 62 60 61 c5 .
.......,..Xb`a.
00a0 8a 50 6b 0c 4
c 0b 80 b1 4e 0d 61
89 81 6d 96 29 .
Pk.L...N.a..m.)
00b0 81 9c 3d 30 0
2 9f e9 9a e9 30 1a
3b 80 46 f4 a3 .
.=0.....0.;.F..
00c0 50 66 92 ef b
7 32 52 d9 24 a8 9a
0f 04 95 11 e3 P
f...2R.$.......
00d0 a8 74 4b 57 6
d 73 55 81 da 6c b6
1c 93 c4 de d8 .
tKWmsU..l......
00e0 79 c8 b9 8c a
a 40 e1 d3 c6 db 15
c8 58 a2 31 f4 y
....@......X.1.
00f0 64 e3 42 84 c
9 89 02 43 a7 c5 4e
7b 41 74 4c b2 d
.B....C..N{AtL.
0100 d2 35 13 92 8
4 f8 dc 10 28 cc a7
e1 69 3c 80 10 .
5......(...i<..
0110 8a 0e 5a 39 a
4 c5 b7 d6 a7 6b 40
ec 8a c8 23 20 .
.Z9.....k@...#
0120 ad e5 ee d9 0
6 04 12 0d a4 ba 96
8c c5 08 7e 2b .
.............~+
0130 58 d2 31 15 8

6 61 9b 0d 2b b5 6a
bd 6b 67 84 a9 X
.1..a..+.j.kg..
0140 fc aa 14 8c 8
b 83 8c aa e5 0a 97
4c ac d4 82 ec .
..........L....
0150 b9 59 9b 47 1
6 47 95 87 9d 4a ee
08 e3 08 46 d2 .
Y.G.G...J....F.
0160 72 3c a8 78 7
b ac 51 47 53 32 d2
f8 a5 a7 d0 5e r
<.x{.QGS2.....^
0170 b1 d6 33 59 c
5 d0 9e f7 ea ca 72
05 43 47 d0 cd .
.3Y......r.CG..
0180 9e 21 2d 65 b
e 53 d7 17 9a 0c 7f
ec fc 43 06 fa .
!-e.S.......C..
0190 28 55 30 35 a
a a1 a9 f6 9c 54 d2
1b 1b c3 7d 2f (
U05.....T....}/
01a0 22 94 f2 58 9
1 94 6b 10 9c 42 01
22 42 db 30 34 "
..X..k..B."B.04
01b0 4a 69 5d 98 5
d 21 19 4f 64 04 0a
1f 42 71 0a 55 J
i].]!.Od...Bq.U
01c0 0b be a3 98 8
6 e4 3e b2 14 16 41
03 8f 3c 11 2e .
.....>...A..<..
01d0 4d 49 20 97 2
7 0f 84 47 f6 5f cb
f2 ea 40 58 61 M
I .'..G._...@Xa
01e0 59 e8 38 a9 a
6 90 cd 48 59 ed d1
81 83 70 70 b8 Y
.8....HY....pp.
01f0 49 05 ee 6e 8
8 d9 7c 2a 44 28 2a
97 d6 9d 55 21 I
..n..|*D(*...U!
0200 1b 58 49 45 1
1 31 36 73 e1 6f 1f
eb db 66 c5 53 .
XIE.16s.o...f.S
0210 b9 5a f0 5e 4
5 0d a4 42 59 15 34
2c c2 e0 e0 7f .
Z.^E..BY.4,....
0220 68 58 c2 62 7
7 a8 63 43 e0 08 bc
a2 83 4c 52 6f h
X.bw.cC.....LRo
0230 38 4e ff fb 9
2 04 ec 0f f2 f8 2c
d4 83 2f 4a 60 8
N........,../J`
0240 61 a5 2a 90 6
7 09 4c 0c 18 af 56

0c bd 29 81 84 a
.*.g.L...V..)..
0250 15 2b c1 87 a
5 30 45 6c 1a 04 7e
73 40 c0 89 35 .
+...0El..~s@..5
0260 dc 52 68 b9 2
b 00 e4 00 70 10 ce
b7 10 be 2b 12 .
Rh.+...p.....+.
0270 07 d9 e6 48 1
9 92 27 fc 54 29 5c
df 05 b6 66 e7 .
..H..'.T)\...f.
0280 cd 4f e3 c7 8
5 66 f1 f0 14 60 50
4c 98 17 5d e0 .
O...f...`PL..].
0290 ee 4e e2 4e 7
3 6f ef 4b 49 4a 13
86 e6 7c 9d 43 .
N.Nso.KIJ...|.C
02a0 40 cd 0f 80 4
9 9e 58 c9 35 94 ec
32 fb 76 34 86 @
...I.X.5..2.v4.
02b0 d5 a8 e1 fb a
9 be ab 4a d9 67 d5
2f 63 5d 0f 96 .
......J.g./c]..
02c0 10 12 81 f6 3
c c1 a8 26 62 da 7e
29 8c a3 a1 ae .
...<..&b.~)....
02d0 5c 29 6d cd 6
3 bd 3f 63 a5 a1 8a
25 29 56 30 ba \
)m.c.?c...%)V0.
02e0 b0 cf 2d 25 f
a c4 8d 91 19 16 e2
28 60 d1 fd ee .
.-%.......(`...
02f0 d9 ff f2 44 6
d fd 17 f6 71 63 f0
1b a3 75 b1 1a .
..Dm...qc...u..
0300 8b c2 3f 53 d
4 7f ba f3 42 ab 86
3e a3 38 25 df .
.?S....B..>.8%.
0310 41 07 c9 e9 e
d cc c3 04 dd 58 53
b6 66 24 86 84 A
........XS.f$..
0320 53 b4 eb 58 8
8 b4 98 e5 00 5a d4
c5 47 a0 16 ea S
..X.....Z..G...
0330 f4 4c dc df d
a 3b 98 8d 4e 31 47
85 d9 f1 73 b2 .
L...;..N1G...s.
0340 40 ac 7a 3a 7
7 11 bb f3 73 14 b5
62 c5 cf 89 b3 @
.z:w...s..b....
0350 0d f7 25 81 f
f f1 5f 52 d9 aa bb
05 10 f9 89 1c .

.%..._R........
0360 c9 21 97 6f 2
a 27 ff c5 96 02 f4
21 fd 80 38 03 .
!.o*'.....!..8.
0370 09 38 66 ff f
6 31 4e 8f 23 be fe
c4 55 20 02 89 .
8f..1N.#...U ..
0380 90 dd 55 a6 5
a 7b 37 49 84 db 94
6d b9 0d 90 08 .
.U.Z{7I...m....
0390 6b 92 e3 16 7
d 09 f4 b0 4f 1f 64
2b 4e 10 6e 5e k
...}...O.d+N.n^
03a0 39 95 f6 48 e
7 8f 4e 0f d5 b6 ae
d9 aa 1e 74 88 9
..H..N.......t.
03b0 fd 8f e2 a1 9
4 26 d2 74 b5 23 f2
ea ab 67 cf cf .
....&.t.#...g..
03c0 ef 99 14 97 e
3 18 63 3a 4d 81 e7
5a 92 24 84 0f .
.....c:M..Z.$..
03d0 02 07 86 c3 f
f fb 90 04 e9 8f f3
15 21 58 03 0c .
...........!X..
03e0 32 50 5b 84 9
b 10 3d e6 4a 0b 80
7f 64 07 b0 69 2
P[...=.J...d..i
03f0 49 84 0f ac 4
1 86 19 29 4b 9b be
4a a7 c4 c5 a9 I
...A..)K..J....
0400 20 23 77 73 2
4 0e 82 92 7f e0 68
c4 60 dc 20 8d
#ws$.....h.`. .
0410 30 ef 56 ca 3
7 8a 0a dc f9 ab 9f
c4 b5 13 86 5f 0
.V.7.........._
0420 18 b4 8e 73 d
b 2a 36 55 e6 e5 f6
b7 df be 5a 2c .
..s.*6U......Z,
0430 b4 72 da c5 8
7 d0 6b 7f 29 06 d9
51 fa e8 29 df .
r....k.)..Q..).
0440 6f 7f 7c 63 1
4 ba 86 92 e5 cd 8a
fa fe c7 4d bc o
.|c..........M.
0450 b6 c1 da fb 8
5 3b 2f eb b2 7b 97
ff fe 81 47 06 .
....;/..{....G.
0460 0c 16 15 58 4
e b5 0b 03 05 84 40
08 38 06 f5 0f .
..XN.....@.8...

0470 05 09 75 46 1
d 5a 52 13 87 f1 e3
aa 6e cd 65 d2 .
.uF.ZR.....n.e.
0480 aa 0a 95 cb 0
8 f7 52 2d c0 6b 4f
6e c5 6a 17 b4 .
.....R-.kOn.j..
0490 c6 6d ed 34 e
d 94 83 a5 bb 9b 15
dd 2c af 59 fb .
m.4........,.Y.
04a0 67 89 d7 cb 6
9 ce c8 e1 c3 c0 90
94 f8 76 c1 10 g
...i........v..
04b0 50 59 68 5b 9
f 2d 89 44 a7 70 2b
91 56 45 55 fb P
Yh[.-.D.p+.VEU.
04c0 ff 5a 57 92 2
0 be 02 64 41 35 f4
f8 91 3a d3 a8 .
ZW. ..dA5...:..
04d0 48 2b 92 a9 c
5 97 ef c9 e2 59 fb
34 8d 6a 09 18 H
+.......Y.4.j..
04e0 12 ce 53 25 d
b 76 82 52 d4 54 06
a1 24 93 82 30 .
.S%.v.R.T..$..0
04f0 d1 1a 69 6a c
7 c9 31 0a 2c 44 30
0c 2e 0c 9e b4 .
.ij..1.,D0.....
0500 19 05 0e 89 6
e 50 b8 46 09 12 4a
52 28 22 3c 16 .
...nP.F..JR("<.
0510 4e ea c0 48 9
5 f5 d9 ec fa bf ca
aa 33 85 32 49 N
..H........3.2I
0520 02 1c
.
.
No. Time
Source
Destination
Protocol
Length Info
226 8.107497000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=132084 Win=38755 L
en=0
Frame 226: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.157427000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.157427000 s
econds
[Time delta fro
m previous captured
frame: 0.000176000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017600
0 seconds]
[Time since ref
erence or first fra
me: 8.107497000 sec
onds]
Frame Number: 2
26
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f70 (20336)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]

[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 13208
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 132084 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38755
[Calculated win

dow size: 38755]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 225]
[The RTT to
ACK the segment wa
s: 0.000176000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 70 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Op@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 66 21 50 10 .
....P..N.+.f!P.
0030 97 63 18 d4 0
0 00
.
c....
No. Time
Source
Destination
Protocol
Length Info
227 8.256329000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1298 http49
574 [PSH, ACK] Seq=
132084 Ack=1 Win=46
Len=1244
Frame 227: 1298 byt
es on wire (10384 b
its), 1298 bytes ca
ptured (10384 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.306259000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.306259000 s
econds
[Time delta fro
m previous captured
frame: 0.148832000
seconds]
[Time delta fro
m previous displaye
d frame: 0.14883200
0 seconds]
[Time since ref
erence or first fra
me: 8.256329000 sec
onds]
Frame Number: 2
27
Frame Length: 1
298 bytes (10384 bi
ts)
Capture Length:
1298 bytes (10384
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
284
Identification:
0xf1eb (61931)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a4f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.

11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 132084, Ack:
1, Len: 1244
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1244]
Sequence number
: 132084 (relati
ve sequence number)
[Next sequence
number: 133328 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0x176
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1244]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 04 f1 eb 4
0 00 31 06 3a 4f 4a
7c 0c 8a c0 a8 .
...@.1.:OJ|....
0020 01 0b 00 50 c
1 a6 2b ca 66 21 9e
87 4e aa 50 18 .
..P..+.f!..N.P.
0030 00 2e 17 65 0
0 00 0d 1c 07 00 10
07 8c 8b f0 49 .
..e...........I
0040 d1 6c c5 4c d
d 5a 6c 3b d8 d3 8b
1e 94 53 41 59 .
l.L.Zl;.....SAY
0050 5c f9 7b c9 8
5 0d f9 42 65 a8 63
51 c9 c8 f9 88 \
.{....Be.cQ....
0060 2b cb 30 29 7
f ce 11 b8 fd 61 5e
8a 6f 85 d5 15 +
.0).....a^.o...
0070 73 21 9c ea e
5 ba fe c1 33 a3 80
81 13 13 4b 0c s
!......3.....K.
0080 9f 34 60 a0 9
c f3 05 dd 50 ff fb
92 04 ea 0f f2 .
4`.....P.......
0090 f8 42 58 03 0
9 1a e0 5d 23 db 00
61 86 4a 4c 90 .
BX....]#..a.JL.
00a0 bb 56 0c bc c
9 81 66 0f 6b 01 87
99 28 74 cb cf .
V....f.k...(t..
00b0 a6 2d eb db a
8 39 50 09 69 30 78
0a c1 d0 b4 bc .
-...9P.i0x.....
00c0 e9 c8 a1 ed 5
c b2 03 54 98 92 b0
05 ca 43 b8 18 .
...\..T.....C..
00d0 33 32 d9 69 9
5 2a 7f 33 b2 4d 20
ce 8e bd 11 4b 3

2.i.*.3.M ....K
00e0 33 1a 94 92 a
0 88 33 cb b2 92 66
89 35 78 a1 74 3
.....3...f.5x.t
00f0 27 52 8a ac 3
8 85 fd d2 94 d9 ba
ac 6b 36 be f8 '
R..8.......k6..
0100 5d c5 9d 7a 8
8 34 08 e0 20 b8 9c
28 f7 54 6d 2b ]
..z.4.. ..(.Tm+
0110 36 2d 69 fe 3
3 6f 6f ff d0 4b 11
a9 18 8f 83 ac 6
-i.3oo..K......
0120 e3 3a 53 40 5
4 ad 0f 68 2a ac 05
0e 8c 8d bb b7 .
:S@T..h*.......
0130 b4 f5 e3 68 c
5 3a ca e3 11 ab 98
63 0d ce e1 42 .
..h.:.....c...B
0140 fc 53 19 6f 2
6 12 56 46 55 1c 37
36 66 6c 28 a1 .
S.o&.VFU.76fl(.
0150 41 65 a3 1d 5
b a1 c7 71 fb dc 05
5e 60 c0 cd b1 A
e..[..q...^`...
0160 3f c7 ce ff d
4 22 40 d1 40 d0 0c
c1 86 89 10 8a ?
...."@.@.......
0170 2e 75 db e9 1
4 a1 8f fe 91 d9 8c
2a cc 77 c0 0a .
u.........*.w..
0180 23 c8 74 30 c
b 35 50 e6 99 0d 17
3a f2 8e a1 c5 #
.t0.5P....:....
0190 b9 b3 30 33 a
7 1a dc ed 59 75 05
59 5f 6f d7 89 .
.03....Yu.Y_o..
01a0 55 93 d2 59 5
3 49 aa 17 9b 8b c8
ac 02 d5 83 58 U
..YSI.........X
01b0 ac 48 97 36 e
9 35 3c 4a ce 99 7a
98 ff 0d f0 c9 .
H.6.5<J..z.....
01c0 54 b5 5a bb c
3 f5 f6 a4 d6 1a 95
10 dc 54 48 e4 T
.Z..........TH.
01d0 3a b0 3f a1 8
f eb 75 3f eb 06 8f
0b 3a 0b d6 36 :
.?...u?....:..6
01e0 c1 01 ef 84 9
8 08 c4 83 8e 03 86
a5 6c 60 00 41 .
...........l`.A

01f0 78 c0 8f ac b
6 94 5a 8e 5b 34 f6
c3 69 d4 7e 65 x
.....Z.[4..i.~e
0200 70 a8 2f 27 e
6 7d f2 bf 18 83 f5
9b df 4f 72 31 p
./'.}.......Or1
0210 49 95 fa d2 0
4 88 52 c4 c2 af 5d
5b 80 b4 8a 45 I
.....R...][...E
0220 a3 24 d4 bf 5
4 d1 f9 6f 15 37 18
ff fb 92 04 eb .
$..T..o.7......
0230 8f f3 06 24 d
4 83 38 62 50 64 25
7a 90 65 e9 4c .
..$..8bPd%z.e.L
0240 0b f4 97 50 0
c e1 e9 41 82 16 6a
01 9c 25 30 c3 .
..P...A..j..%0.
0250 52 22 ef bb e
7 1d 4b 38 a2 b9 65
50 fd be a5 07 R
"....K8..eP....
0260 31 9c 34 79 0
c 91 da 32 80 46 e6
9c 15 0e 13 9c 1
.4y...2.F......
0270 49 b5 7b 8b a
1 84 40 5c 09 7c 09
52 96 db db 15 I
.{...@\.|.R....
0280 8f da 94 d3 d
8 af 26 ed 84 c6 90
66 3b 8d cd 10 .
.....&....f;...
0290 2c 71 39 4c 3
8 83 5e 64 21 ed 9b
ea 33 59 7c 77 ,
q9L8.^d!...3Y|w
02a0 31 be b5 5f d
f 0f b4 ad bf dd 32
37 22 cd 65 90 1
.._......27".e.
02b0 a1 4b ec 04 4
2 18 35 e0 33 28 34
9b 38 1a 53 e2 .
K..B.5.3(4.8.S.
02c0 01 88 f4 21 9
a 2f 34 01 8a 94 af
d6 4d f1 05 37 .
..!./4.....M..7
02d0 7e 98 fd f7 4
2 69 9c d2 cc d1 d0
ca 24 76 20 c7 ~
...Bi......$v .
02e0 e6 cb 71 9c b
c 68 72 aa f0 fa 10
8e 9d 3b 35 56 .
.q..hr......;5V
02f0 e4 8d de df a
4 0e 53 1d 8d dc ab
d9 27 bf 37 99 .
.....S.....'.7.
0300 b6 c7 f2 c4 4

4 cf 07 c9 98 09 21
60 00 90 5c 5d .
...D.....!`..\]
0310 ec 27 71 34 d
0 8a be b6 51 49 90
41 b2 e0 13 33 .
'q4....QI.A...3
0320 75 94 7e 04 8
4 a6 02 c1 a4 03 59
a4 2f ec 56 64 u
.~.......Y./.Vd
0330 4a fc 45 e3 0
a 5f a6 2f 48 e3 4d
c4 ea c1 72 2a J
.E.._./H.M...r*
0340 16 78 f6 4c 4
3 4f ce 22 21 ce d5
3a 53 05 6f 78 .
x.LCO."!..:S.ox
0350 a4 4b 22 0e d
5 91 3f 23 a4 cb de
74 ac be d4 a5 .
K"...?#...t....
0360 ce c5 1e 86 3
2 6d ae 98 d4 fb 73
f7 6f 7e ff 3d .
...2m....s.o~.=
0370 6b 58 49 16 8
f 61 3d 29 d0 49 5e
e5 b2 8a 57 43 k
XI..a=).I^...WC
0380 30 81 0d 05 c
8 72 36 93 c8 7c 5d
54 67 97 1c 61 0
....r6..|]Tg..a
0390 e4 77 99 23 6
1 61 8c b5 8a 56 3c
53 1f 83 1e 3d .
w.#aa...V<S...=
03a0 d6 ae 7b 36 1
f a3 9b ce 02 f8 b1
7a f8 cf d5 78 .
.{6.......z...x
03b0 f4 6c c8 b1 9
f 47 93 bf 38 ea 45
b6 8f f2 f9 36 .
l...G..8.E....6
03c0 a7 a5 f1 09 e
1 28 98 60 8e 05 74
44 12 ff fb 92 .
....(.`..tD....
03d0 04 e8 0f f3 0
c 32 d3 83 58 42 e0
55 c6 0a 80 67 .
....2..XB.U...g
03e0 2b 4c 0c ac a
5 4e 0c e1 89 81 8f
97 a9 c1 9c 2d +
L...N.........03f0 30 26 b8 b5 d
5 cf 2e a6 75 96 e8
08 29 b9 48 46 0
&......u...).HF
0400 41 14 ab 12 0
e a9 80 c8 0a c7 23
5b d0 cd 38 96 A
.........#[..8.
0410 26 20 70 db 5
c 66 94 15 60 15 9f

32 f4 c1 f7 54 &
p.\f..`..2...T
0420 69 f8 88 92 d
e 90 1c 82 70 bd b6
4f 95 60 35 c8 i
.......p..O.`5.
0430 1e 55 b6 a9 f
2 9b ec d4 a8 6d 9d
d6 99 ff c2 f4 .
U.......m......
0440 3d 8e e0 d0 d
0 54 1a 58 10 08 e5
3c 4c f6 c6 a3 =
....T.X...<L...
0450 3a 26 d7 e9 0
2 0f 31 4c 41 32 c6
01 02 cf b9 61 :
&....1LA2.....a
0460 61 81 9a d6 4
c 0a 67 80 fa 1b 27
08 52 ce de 88 a
...L.g...'.R...
0470 7c 5c f4 89 4
c 88 d3 9c 03 5f 28
a5 4b e4 8c 2a |
\..L...._(.K..*
0480 10 54 ba bc b
1 72 79 31 e6 81 a5
28 6e c5 54 94 .
T...ry1...(n.T.
0490 0f 27 15 08 1
7 5b 1d 15 f4 d5 47
72 ed a7 47 53 .
'...[....Gr..GS
04a0 6d 41 bc 77 b
b 99 72 b8 8a 34 f2
1e 6d 1d d3 3f m
A.w..r..4..m..?
04b0 fa c0 03 cc 1
3 14 48 03 a2 42 68
59 2a 3c 6c 54 .
.....H..BhY*<lT
04c0 6b 3c 87 47 a
3 22 94 0b 2e 79 8d
a8 4d 78 7e 41 k
<.G."...y..Mx~A
04d0 51 84 a6 cd 7
8 39 b3 e7 4d 8c 8a
01 ac f4 ab 35 Q
...x9..M......5
04e0 8b 66 87 8a c
b 68 d4 fd 8b d2 7c
c3 46 23 85 52 .
f...h....|.F#.R
04f0 ac d0 f3 ca 5
c a3 7e b2 04 da ea
a2 a9 96 e5 77 .
...\.~........w
0500 fe 79 f3 cc d
c 59 ea 16 73 03 13
65 5c eb a6 6d .
y...Y..s..e\..m
0510 ff 5d
.
]
No. Time
Source

Destination
Protocol
Length Info
228 8.270327000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=13332
8 Ack=1 Win=46 Len=
1260
Frame 228: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.320257000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.320257000 s
econds
[Time delta fro
m previous captured
frame: 0.013998000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01399800
0 seconds]
[Time since ref
erence or first fra
me: 8.270327000 sec
onds]
Frame Number: 2
28
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9

0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ec (61932)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a3e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 133328, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 133328 (relati
ve sequence number)
[Next sequence
number: 134588 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi

ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xce1
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2504]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ec 4
0 00 31 06 3a 3e 4a
7c 0c 8a c0 a8 .
...@.1.:>J|....
0020 01 0b 00 50 c
1 a6 2b ca 6a fd 9e
87 4e aa 50 10 .
..P..+.j...N.P.
0030 00 2e ce 1c 0
0 00 0b 12 04 10 39
f8 c5 16 98 24 .
.........9....$
0040 00 91 e1 53 a
6 bc 00 e0 67 de 74
08 54 ef 71 45 .
..S....g.t.T.qE
0050 41 17 ac c8 e
2 2c 83 38 a3 3f 5a
d1 c9 a8 3e c4 A
....,.8.?Z...>.
0060 92 72 4f 20 e
5 1a a6 91 bb a7 45
c3 a3 1e 14 07 .
rO ......E.....

0070 3a 84 11 3f 0
9 ac 20 b9 be cc d0
ba 69 ed 65 d4 :
..?.. .....i.e.
0080 ef c5 29 4d 6
b 4b 5e 9f ee de 8b
a6 77 f9 e8 a6 .
.)MkK^.....w...
0090 66 0b 5d ff f
b 92 04 e6 8f f2 b9
23 d4 03 2f 62 f
.]........#../b
00a0 50 5a e4 aa 7
0 67 0c 4a 0b a8 bd
4e 0d 3d 69 81 P
Z..pg.J...N.=i.
00b0 81 98 29 81 a
c 2d 30 05 0f 91 d6
ab 5d 75 21 41 .
.)..-0.....]u!A
00c0 c6 78 b1 cf 4
0 64 4c 8f 17 02 83
16 0e 06 0a 0a .
x..@dL.........
00d0 02 82 ae 50 f
8 e3 b0 0c 51 ff 63
60 b9 c4 56 45 .
..P....Q.c`..VE
00e0 79 8a 55 ad a
8 54 fe 54 6d b5 b8
a5 be 97 26 ab y
.U..T.Tm.....&.
00f0 ba 56 38 e8 e
c 54 04 a2 2c 16 5c
a9 64 e0 43 28 .
V8..T..,.\.d.C(
0100 74 e3 22 42 0
2 74 93 8e d7 e2 84
9c 45 aa 48 3b t
."B.t......E.H;
0110 fe dd 31 63 f
3 79 5a cb 16 07 6b
d6 01 03 b7 58 .
.1c.yZ...k....X
0120 c6 5d d4 2a d
8 4c 19 a3 c2 b4 d5
8c 3a 01 40 42 .
].*.L......:.@B
0130 04 21 4c c0 2
0 68 99 63 58 02 91
60 ef 31 dc 14 .
!L. h.cX..`.1..
0140 7c 58 51 85 2
3 83 95 2d a9 29 86
f5 a7 0e 4d 4c |
XQ.#..-.)....ML
0150 f5 49 de b7 b
a ec 9c 6f 37 50 25
05 43 73 9e 20 .
I.....o7P%.Cs.
0160 25 8b 2a 43 9
1 f3 92 68 99 aa 28
ec bb 7e f1 dc %
.*C...h..(..~..
0170 43 f2 a7 ff 6
c 8b e2 4d 91 b8 84
3c 67 2a 79 f7 C
...l..M...<g*y.
0180 5a a7 52 42 0

4 64 91 f5 74 42 28
50 30 a1 64 4e Z
.RB.d..tB(P0.dN
0190 86 42 a6 31 8
f 32 d6 7f 1a 0a 0a
38 42 93 09 a5 .
B.1.2.....8B...
01a0 0a 86 ee 10 1
3 40 a1 66 32 3b 92
c7 7a 91 f0 9e .
....@.f2;..z...
01b0 7a 03 83 0b 9
1 99 ab 50 5b b1 78
af 51 f9 2d a2 z
......P[.x.Q.-.
01c0 c8 03 32 2c d
3 90 ee dc 53 fa f7
7f 69 30 b7 fe .
.2,....S...i0..
01d0 d6 4c ce 7b 5
b 1f 4e 36 93 62 70
c1 25 3d 82 bb .
L.{[.N6.bp.%=..
01e0 a7 54 ea d5 2
8 00 65 e3 99 65 41
dc c0 66 cc 48 .
T..(.e..eA..f.H
01f0 41 21 24 61 4
c 50 49 4b 90 06 24
85 40 48 dc 84 A
!$aLPIK..$.@H..
0200 1c 0e 10 8e 3
e da 66 0f 0b 97 5a
59 2a 35 1f 17 .
...>.f...ZY*5..
0210 67 21 ee 74 b
9 4c 81 a1 39 0d 61
ea 83 c0 6b 69 g
!.t.L..9.a...ki
0220 2e 62 07 48 e
9 d5 24 5a 67 2f d2
98 71 e4 4b 49 .
b.H..$Zg/..q.KI
0230 1d 3a 3e bc f
c ff fb 92 04 ed 8f
f3 23 2e d3 03 .
:>.........#...
0240 58 62 60 65 8
5 7a 50 6b 0c 4c 0b
e0 b1 4c 0d 61 X
b`e.zPk.L...L.a
0250 69 81 81 96 2
9 41 ac 31 30 57 c9
c3 8b 14 08 d3 i
...)A.10W......
0260 58 d7 b7 e8 2
d 08 05 78 12 61 aa
22 18 00 2a 48 X
...-..x.a."..*H
0270 2c 05 96 02 4
0 c3 53 42 40 21 9b
62 34 c9 d1 94 ,
...@.SB@!.b4...
0280 5e af 3b df 5
b 28 d9 11 31 99 cb
08 7d b4 b4 dc ^
.;.[(..1...}...
0290 a7 9e 04 1a a
0 90 72 93 28 7b 92

b6 b7 46 3c 8d .
.....r.({...F<.
02a0 6b a5 69 8f 4
1 04 cd 6d 13 90 e2
bd 88 d3 af 10 k
.i.A..m........
02b0 cc 28 d6 23 d
b f6 72 ff 30 52 fa
6b 2f fe e3 f4 .
(.#..r.0R.k/...
02c0 65 da 9b 28 3
2 2c ea 92 0c 3c 14
c6 4c 07 47 48 e
..(2,...<..L.GH
02d0 49 0c 10 24 4
8 69 f6 8b b1 72 fe
68 80 7c ce 12 I
..$Hi...r.h.|..
02e0 d1 4f 63 37 a
6 46 b3 96 16 c5 1b
9c 85 8c 3c 54 .
Oc7.F........<T
02f0 e7 6c 2a 41 5
1 85 a5 b4 84 37 1c
b7 21 fc f9 1e .
l*AQ....7..!...
0300 da 7d 10 21 3
e ea 94 49 26 c9 1a
6d 38 e6 da 23 .
}.!>..I&..m8..#
0310 e0 ed ed 26 f
f e7 22 fe 4c 8c 2e
fe 2f fa f9 f3 .
..&..".L.../...
0320 8d 7f e8 1d 0
3 0b 31 87 86 8f 28
91 1b 96 4d 30 .
.....1...(...M0
0330 58 a2 c5 87 5
f 50 50 dc ec f8 89
d4 70 96 07 b7 X
..._PP.....p...
0340 aa cc ec a5 2
0 6a 3c 79 d4 4d b4
d8 9d 86 e6 30 .
... j<y.M.....0
0350 1e 14 86 d4 8
a 0c a9 5f e0 97 83
32 a2 64 56 d0 .
......_...2.dV.
0360 7c 7d 64 be 4
0 a9 08 a1 cb b2 cb
7c 38 82 2b 86 |
}d.@......|8.+.
0370 97 bf fa bd b
7 fc 1a ad f3 d7 c5
75 f0 da 5b ab .
..........u..[.
0380 97 ff 1a 2f 0
9 a4 36 78 1a 02 90
03 ec 80 94 97 .
../..6x........
0390 08 06 3c c0 0
f 68 38 97 88 80 ac
00 39 63 07 08 .
.<..h8.....9c..
03a0 36 95 83 a7 2
c 4c 29 38 46 6a db
79 75 42 6c 8d 6

...,L)8Fj.yuBl.
03b0 88 be c0 95 6
d 6c 87 76 37 8f d5
73 a8 96 82 f8 .
...ml.v7..s....
03c0 22 ca ac 7a 2
2 12 c8 95 b1 c4 fc
fd 34 3e 89 ae "
..z".......4>..
03d0 69 b1 5c db 8
e 7f 98 ff fb 92 04
e7 8f f2 e0 2b i
.\............+
03e0 53 03 4f 5a 6
0 5e 46 8a 50 6b 0b
5c 0c 18 d1 4a S
.OZ`^F.Pk.\...J
03f0 0d bd 6b 81 7
f 9a 69 41 bc 2d 70
aa 73 fa ae af .
.k...iA.-p.s...
0400 fe 6e 51 b7 b
d 89 4d 41 42 60 07
67 4a a8 40 92 .
nQ...MAB`.gJ.@.
0410 10 40 83 b2 9
6 b0 58 11 10 9b 12
40 fd f8 04 f1 .
@....X....@....
0420 f9 5b 91 55 c
5 95 f6 d2 f5 b8 cf
70 f6 ea c5 7a .
[.U.......p...z
0430 fc d8 7d c4 4
b 75 e0 ba d7 27 63
54 99 e7 c1 f8 .
.}.Ku...'cT....
0440 be 81 20 79 4
3 e1 99 89 a9 bb 95
1e 9b 21 37 5b .
. yC........!7[
0450 b4 c8 35 9f 6
3 14 14 d3 2c e1 b7
ac fe a6 ae db .
.5.c...,.......
0460 f9 d3 d4 6d 2
a 84 c3 15 70 cf 86
34 43 8d cb 11 .
..m*...p..4C...
0470 44 c6 24 19 b
f 00 21 30 ff c9 81
02 d6 db d8 5f D
.$...!0......._
0480 28 d5 e1 b2 1
e 76 fa bc 13 2b 5c
52 3b 10 bd b7 (
....v...+\R;...
0490 36 2f 75 da 8
b 5d 14 26 5f 1e af
56 3b 0f 7c 75 6
/u..].&_..V;.|u
04a0 c0 c0 0a 0d 2
8 b8 e8 0b 05 28 8e
86 ba 99 2a f1 .
...(....(....*.
04b0 03 b8 25 a4 3
b ae f9 be 3f d6 bf
78 6e d3 8e 3e .
.%.;...?..xn..>

04c0 85 7b 78 ad 6
e df eb 75 4c 62 63
2b 3c c2 01 0e .
{x.n..uLbc+<...
04d0 62 9a a2 46 9
3 ec 2a 36 49 24 1a
3d 1d 8e 06 32 b
..F..*6I$.=...2
04e0 82 82 53 46 d
b 40 ef ac 15 02 cf
41 77 bd f0 c6 .
.SF.@.....Aw...
04f0 7e 1e a6 a6 0
2 21 be a6 8e dc 86
62 7a ba cf 67 ~
....!.....bz..g
0500 d4 1a 8d 72 c
8 20 86 f2 07 34 7c
3f 52 33 66 b9 .
..r. ...4|?R3f.
0510 c6 d8 02 0d 5
7 be f3 09 b5 64 7a
66 34 ff f1 cf .
...W....dzf4...
0520 b3 77
.
w
No. Time
Source
Destination
Protocol
Length Info
229 8.270510000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=134588 Win=38129 L
en=0
Frame 229: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.320440000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.320440000 s
econds
[Time delta fro
m previous captured
frame: 0.000183000
seconds]

[Time delta fro

m previous displaye
d frame: 0.00018300
0 seconds]
[Time since ref
erence or first fra
me: 8.270510000 sec
onds]
Frame Number: 2
29
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11

), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f71 (20337)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 13458
8, Len: 0
Source Port: 49
574 (49574)

Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 134588 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38129
[Calculated win
dow size: 38129]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 228]
[The RTT to
ACK the segment wa

s: 0.000183000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 71 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Oq@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 6f e9 50 10 .
....P..N.+.o.P.
0030 94 f1 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
230 8.413333000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=13458
8 Ack=1 Win=46 Len=
1260
Frame 230: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.463263000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.463263000 s
econds
[Time delta fro
m previous captured
frame: 0.142823000
seconds]
[Time delta fro
m previous displaye
d frame: 0.14282300
0 seconds]
[Time since ref
erence or first fra
me: 8.413333000 sec
onds]
Frame Number: 2

30
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ed (61933)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a3d [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 134588, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number

: 134588 (relati
ve sequence number)
[Next sequence
number: 135848 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x34e
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ed 4
0 00 31 06 3a 3d 4a

7c 0c 8a c0 a8 .
...@.1.:=J|....
0020 01 0b 00 50 c
1 a6 2b ca 6f e9 9e
87 4e aa 50 10 .
..P..+.o...N.P.
0030 00 2e 34 eb 0
0 00 f5 55 42 40 17
10 46 33 40 3c .
.4....UB@..F3@<
0040 e5 a0 00 8a 3
3 89 cc c0 82 eb a7
d3 c0 0c 89 78 .
...3..........x
0050 bf 25 f5 c9 4
6 8c 73 ec 35 da 39
6b 3f 4e ab 51 .
%..F.s.5.9k?N.Q
0060 09 3d 55 1d 6
4 d0 fb 39 96 d5 5f
0d 3e 38 66 4b .
=U.d..9.._.>8fK
0070 20 44 b4 88 7
d 3a 23 10 ef 11 7a
0f a1 69 4d 8d
D..}:#...z..iM.
0080 20 2e 12 64 1
6 5c 7b 87 54 66 31
33 ab ff fb 92
..d.\{.Tf13....
0090 04 e9 0f f3 0
3 34 52 83 4f 5a e0
5d 86 aa 50 6b .
....4R.OZ.]..Pk
00a0 0d 5c 0c 44 d
3 4a 0d 65 0b 81 70
9a 69 41 ac 29 .
\.D.J.e..p.iA.)
00b0 70 1c 4f fa 0
a 3a 70 bb da b7 7b
17 ad a6 18 db p
.O..:p...{.....
00c0 06 7c 69 97 2
c 06 0e 0d 11 14 26
1e 85 ad 06 2c .
|i.,.....&....,
00d0 02 ac 03 1d 0
d 53 f1 41 33 55 ac
ca 2a c3 4a be .
....S.A3U..*.J.
00e0 8e cc 82 eb d
4 8d 78 b8 34 b2 80
2b 15 64 00 1a .
.....x.4..+.d..
00f0 e4 a0 87 4c 5
0 27 99 2e 1d 37 ca
06 3a 79 20 50 .
..LP'...7..:y P
0100 10 e7 7e a0 d
a fe 81 b6 76 cd 54
bd bf d4 6b ef .
.~.....v.T...k.
0110 46 df 96 73 5
7 20 2b d4 b1 01 46
c1 8f 40 c1 44 F
..sW +...F..@.D
0120 e4 0c 9b 64 0
3 ea 4a a4 53 a2 60
03 b5 f2 f9 10 .

..d..J.S.`.....
0130 8a 31 29 10 a
a 91 79 58 a8 e8 b1
09 34 1b 3d eb .
1)...yX....4.=.
0140 c6 11 83 62 7
a a8 54 52 2f 41 a6
60 ab 49 82 6e .
..bz.TR/A.`.I.n
0150 6d 59 ac 7f 8
8 c8 f5 ad f3 29 84
cc 53 7b 39 fb m
Y.......)..S{9.
0160 0f 1e f1 84 5
4 cb 8f a5 be 7f 24
35 ff 49 f5 b5 .
...T.....$5.I..
0170 45 7a a1 27 7
a 11 f0 e3 90 33 43
c5 74 e8 74 8b E
z.'z....3C.t.t.
0180 bc 98 00 12 2
5 d1 a2 d7 4b e5 e6
eb c3 70 c8 b1 .
...%...K....p..
0190 9d 86 15 15 9
c 5b 62 46 e5 59 6e
2f 48 f3 b3 6e .
....[bF.Yn/H..n
01a0 8f 54 95 0e 2
4 c1 83 16 dc 2a f6
98 60 4b 60 84 .
T..$....*..`K`.
01b0 3c fb e7 b0 f
1 c5 bf 3e 0f 5e cc
ea ef b7 7b fc <
......>.^....{.
01c0 ae eb aa cf a
d fc e3 ed df d7 ed
b3 6e b7 02 f6 .
...........n...
01d0 30 87 54 24 e
f 42 42 92 17 60 89
66 0c 50 15 59 0
.T$.BB..`.f.P.Y
01e0 09 f0 60 e3 2
4 14 c2 04 5d 2e b9
a8 4c ed a8 a0 .
.`.$...]...L...
01f0 46 01 aa 00 0
d 85 15 90 44 5f 77
b6 bb 77 a4 b5 F
.......D_w..w..
0200 04 ee d4 4e a
d 2a 08 d5 1c 61 26
42 ab a4 49 72 .
..N.*...a&B..Ir
0210 42 4a a1 65 c
a 60 32 eb 29 84 95
2e a5 5f 9b fb B
J.e.`2.)...._..
0220 7a 61 c9 a5 6
5 ff ee bd 33 2f dd
32 dd e2 98 ff z
a..e...3/.2....
0230 fb 92 04 e9 8
f f3 06 2c 52 03 59
5a 60 5b 25 9a .
......,R.YZ`[%.

0240 50 6b 09 4c 0
b ac bb 4a 0d 61 29
81 81 96 69 01 P
k.L...J.a)...i.
0250 9c 3d 30 3c 8
3 99 83 3e a4 8f 00
60 ea 69 40 0a .
=0<...>...`.i@.
0260 48 21 57 9d 6
e 3f a3 8a b7 67 0c
bf 0e 4b 5a 25 H
!W.n?...g...KZ%
0270 52 4e c2 09 c
c a7 5e 73 91 05 65
08 02 65 eb 7c R
N....^s..e..e.|
0280 f3 6e 33 13 2
e dc cd 2b 11 63 b1
08 53 50 7e 5b .
n3....+.c..SP~[
0290 82 12 0c 00 5
f 79 ed 13 06 ea dc
b6 dc b7 72 9a .
..._y........r.
02a0 2c f8 eb f3 6
0 97 fa 0e 9a e7 ff
74 ff 76 30 96 ,
...`......t.v0.
02b0 76 92 c7 97 3
c e5 09 0f 75 c9 d0
84 83 92 03 c8 v
...<...u.......
02c0 8f e0 37 3b 8
1 06 26 ba 37 38 eb
64 a9 0d 5d 13 .
.7;..&.78.d..].
02d0 45 7b b9 10 8
3 01 40 be 75 b5 45
53 c4 6a 99 8d E
{....@.u.ES.j..
02e0 99 65 da e0 b
0 1b 79 b6 11 94 cf
ac 13 8d b6 70 .
e....y........p
02f0 28 18 8a 04 2
c 7c 5c 9e 10 93 0a
26 df 9d 55 cf (
...,|\....&..U.
0300 e4 e7 e7 b7 0
b 9a 4c 34 68 1c f8
9c 7a 24 0a 39 .
.....L4h...z$.9
0310 af 6a 3c 87 2
e 7c 41 ff d6 ff ca
08 0e 10 2f 61 .
j<..|A......./a
0320 a1 06 8c 33 b
5 7c ec a1 1c a9 7e
4e ce d4 60 a1 .
..3.|....~N..`.
0330 48 62 1a a6 0
6 3c 43 f2 48 0d 82
a2 2a 7d a9 b1 H
b...<C.H...*}..
0340 d3 7b e1 d7 a
0 1b 36 3e 71 87 b3
e6 ab 76 1b 1f .
{....6>q....v..
0350 38 14 3c 4e 7

1 04 18 c2 34 4c 26
8f c2 73 5d ea 8
.<Nq...4L&..s].
0360 24 de 83 67 d
6 35 25 01 70 61 47
e5 14 e2 92 eb $
..g.5%.paG.....
0370 72 de 5c 7b d
7 bf 94 ff df b5 e7
3c 10 9c e1 ea r
.\{.......<....
0380 83 ce 47 4d 6
7 78 bf 10 45 0b 8e
35 c0 25 0c 5d .
.GMgx..E..5.%.]
0390 31 0e a2 44 7
8 14 22 31 0e 45 22
53 0b 68 46 d3 1
..Dx."1.E"S.hF.
03a0 a6 31 41 53 3
0 c9 d9 2d 49 ba dd
8a 18 ac f6 55 .
1AS0..-I......U
03b0 0a 92 09 86 4
c 83 45 d0 2e 44 88
bb 50 d5 4a a1 .
...L.E..D..P.J.
03c0 0b db 17 64 5
7 7c 4e bb fb 1c 94
6c c9 6a 38 71 .
..dW|N....l.j8q
03d0 78 ff fb 92 0
4 eb 8f f2 f9 2d 52
83 58 62 60 61 x
........-R.Xb`a
03e0 c5 ea 40 67 2
c 4c 0c 64 ab 56 0c
3d 29 81 86 12 .
.@g,L.d.V.=)...
03f0 2a c1 87 a5 2
8 eb 03 47 fb 72 ed
68 e9 14 82 62 *
...(..G.r.h...b
0400 8e 23 d7 1f 5
5 b0 65 01 68 7d 66
a5 7a 54 84 70 .
#..U.e.h}f.zT.p
0410 a1 68 d2 44 1
f 54 35 74 49 97 b9
0f 02 51 63 6f .
h.D.T5tI....Qco
0420 96 cd 51 d5 8
4 64 e1 cf 94 ef 26
89 26 c8 3c 32 .
.Q..d....&.&.<2
0430 a7 8b 8b ac 6
8 e0 46 74 a1 26 d2
e1 30 b5 43 27 .
...h.Ft.&..0.C'
0440 eb 3e 9d 30 c
2 0d bb 52 9c bd e2
a2 47 d7 d2 30 .
>.0...R....G..0
0450 83 1e 98 60 7
5 29 8e 9c d1 04 dd
87 a0 57 18 48 .
..`u).......W.H
0460 2f 2e 25 1c b
0 1c bc e7 d2 d0 ac

c8 9a 59 21 51 /
.%..........Y!Q
0470 98 90 9d 10 6
2 5d b3 4b 38 f7 9b
d8 c6 25 4f 91 .
...b].K8....%O.
0480 3f 36 d3 35 b
b 7e b9 2c ff cf 9d
bf 75 46 34 fe ?
6.5.~.,....uF4.
0490 1b 13 5d 35 a
c 94 b6 8a ce ab 79
d8 f3 88 d5 07 .
.]5......y.....
04a0 55 19 ef 22 f
2 1a 7e fe 69 98 92
9d df 1c b3 90 U
.."..~.i.......
04b0 55 65 e7 8f 2
a 45 ce a3 51 8b f2
d8 29 58 f4 3c U
e..*E..Q...)X.<
04c0 be 0c 95 3a 1
e 96 93 21 9e 09 c5
4a d1 6d 48 0e .
..:...!...J.mH.
04d0 ee e9 08 0e f
7 25 07 cd a4 92 84
b2 77 bd 48 65 .
....%......w.He
04e0 56 cd f6 b7 7
a 6c b3 35 97 b3 f5
2b 39 dc b4 e9 V
...zl.5...+9...
04f0 d6 50 b1 8f 1
f 55 e2 29 9c 50 c2
58 d0 02 36 f3 .
P...U.).P.X..6.
0500 9d 3c bf 64 7
1 29 d4 92 85 8e 75
4c fb f2 85 89 .
<.dq)....uL....
0510 ee 23 99 e3 a
9 88 3e 4a 08 01 6b
90 f1 76 0f 59 .
#....>J..k..v.Y
0520 b1 d3
.
.
No. Time
Source
Destination
Protocol
Length Info
231 8.418330000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
888 http49
574 [PSH, ACK] Seq=
135848 Ack=1 Win=46
Len=834
Frame 231: 888 byte
s on wire (7104 bit
s), 888 bytes captu

red (7104 bits) on

interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.468260000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.468260000 s
econds
[Time delta fro
m previous captured
frame: 0.004997000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00499700
0 seconds]
[Time since ref
erence or first fra
me: 8.418330000 sec
onds]
Frame Number: 2
31
Frame Length: 8
88 bytes (7104 bits
)
Capture Length:
888 bytes (7104 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
74
Identification:
0xf1ee (61934)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3be6 [validatio

n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 135848, Ack:
1, Len: 834
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 834]
Sequence number
: 135848 (relati
ve sequence number)
[Next sequence
number: 136682 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t

.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x23c
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2094]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 6a f1 ee 4
0 00 31 06 3b e6 4a
7c 0c 8a c0 a8 .
j..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b ca 74 d5 9e
87 4e aa 50 18 .
..P..+.t...N.P.
0030 00 2e 23 c3 0
0 00 b4 c3 e6 d8 03
ad 96 4c b2 10 .
.#..........L..
0040 fd d6 1d bd 0
f 01 8d 87 04 0c c6
14 ee 61 c2 29 .
............a.)
0050 91 02 30 a3 1
5 98 08 92 82 63 e1
71 8a c5 52 fd .
.0......c.q..R.
0060 0c fa 69 5e 8
b ff 71 d7 b9 11 fe
f4 aa d5 b9 58 .
.i^..q........X
0070 8a 96 1c c2 5
9 72 b3 70 36 f6 8d
17 6e e7 a6 65 .
...Yr.p6...n..e
0080 44 d2 cf f0 6
f 2e ff ff fb 92 04
e7 8f f2 b3 1b D
...o...........
0090 58 03 0c 49 c
0 59 63 ba f0 61 86
4a 0b 80 6b 62 X
..I.Yc..a.J..kb
00a0 0c 31 07 09 9
f 0f 6b c1 86 25 29
c2 87 e3 1b 60 .
1....k..%)....`

00b0 fc 04 d1 35 4
a 85 71 bc 7c 11 71
20 c0 6f 71 98 .
..5J.q.|.q .oq.
00c0 5a 6c ff 70 2
2 3d d9 65 dc bb ac
8a ae 9d 30 f3 Z
l.p"=.e......0.
00d0 5d 78 23 dc 9
4 f5 34 a4 af 36 3e
76 f9 18 b9 b4 ]
x#...4..6>v....
00e0 9e f1 9a a6 9
5 e8 be fa 95 6e b9
13 dc 72 55 49 .
........n...rUI
00f0 2f 09 16 25 6
5 c1 8a c9 13 4a e4
af 96 63 a1 3a /
..%e....J...c.:
0100 11 f7 f0 5e 0
5 2f e6 69 55 c2 82
bd fd f7 8a 19 .
..^./.iU.......
0110 88 22 22 85 0
a 94 31 03 a8 ae 87
84 d9 9a 8f bd .
""...1.........
0120 dd 85 00 b0 f
5 c3 2a fb 51 d9 99
3f 27 e7 72 d4 .
.....*.Q..?'.r.
0130 49 bd 08 3b d
8 47 24 95 00 09 4d
56 19 3a a2 c7 I
..;.G$...MV.:..
0140 24 67 5a ae c
1 d0 7d 66 7e d4 be
db a7 61 f5 09 $
gZ...}f~....a..
0150 42 8d 41 f3 0
5 0b 09 46 78 c9 19
d0 d5 5a c9 a3 B
.A....Fx....Z..
0160 d1 91 84 ec 1
4 f3 be bc ee 1d b7
a4 87 a0 a1 e0 .
...............
0170 60 59 22 01 4
a 80 a6 e8 d0 4e 96
c9 e0 6e 36 28 `
Y".J....N...n6(
0180 82 7b 4e 00 f
c 8f 5b a4 d1 69 76
84 8c 5d 4c cc .
{N...[..iv..]L.
0190 d6 37 4c c1 8
e 79 12 66 16 40 9a
a8 1f 72 cb 44 .
7L..y.f.@...r.D
01a0 df dd d7 c1 6
c cf 73 df d3 e1 46
87 9e 55 45 8a .
...l.s...F..UE.
01b0 8b 1b 9f 8b 2
e 78 34 4a a4 40 aa
40 d7 45 03 99 .
....x4J.@.@.E..
01c0 10 d0 4e c2 3

a e3 1e 75 1e e4 d3
3b e4 aa 3a b4 .
.N.:..u...;..:.
01d0 05 80 65 ca 6
a 68 78 e2 82 86 78
d0 ce 10 e8 a6 .
.e.jhx...x.....
01e0 0b c3 1e 37 8
e 5c c2 65 33 cf 7c
dc 56 8e 35 43 .
..7.\.e3.|.V.5C
01f0 13 a6 c8 91 c
5 7b 9d 9c fb ac be
b6 e1 bd 84 e3 .
....{..........
0200 0b 02 55 a9 e
2 dc 78 5a 6e cb ad
62 24 2c c5 a4 .
.U...xZn..b$,..
0210 7c 5f ef e2 b
3 7d d7 ef e2 06 35
ab 6f 7f 39 87 |
_...}....5.o.9.
0220 68 08 98 96 1
1 17 0e 21 c3 ff fb
92 04 ec 8f f2 h
......!........
0230 fb 1b 58 03 0
c 19 c2 5f a2 ea f0
3d e9 38 4b 98 .
.X...._...=.8K.
0240 85 58 0d 61 8
9 41 86 11 aa c1 97
a5 28 a7 54 07 .
X.a.A......(.T.
0250 3a 79 94 3e 9
e bd 47 18 83 14 5a
95 1e 57 ab 95 :
y.>..G...Z..W..
0260 7d 96 f1 79 c
5 f8 24 7a 59 1b 6b
07 ad 80 c0 cb }
..y..$zY.k.....
0270 e2 d3 b1 86 1
3 22 99 ad 5b d4 ee
15 82 a6 03 e1 .
...."..[.......
0280 31 f3 c6 be f
3 55 32 49 99 fb 85
df 6b 32 6b 58 1
....U2I....k2kX
0290 9a ea e7 18 3
7 c6 f1 bf 4d 4f a0
fb 82 ce 28 6c .
...7...MO....(l
02a0 f0 1d 0b 48 b
b 52 50 58 61 93 09
61 59 10 29 6e .
..H.RPXa..aY.)n
02b0 9d fd ba 4d c
f 40 54 19 ce 95 10
2b e4 0c 1b c2 .
..M.@T....+....
02c0 4e 39 78 2e b
7 65 86 81 ec 9a c4
66 c6 d1 ae 3d N
9x..e.....f...=
02d0 0c 52 5a 6e 2
f ce e2 53 5d 14 80

5b 6c 53 d0 dc .
RZn/..S]..[lS..
02e0 d3 31 f0 b5 0
e 3a 5e 3c 00 f7 56
36 ab 47 d7 67 .
1...:^<..V6.G.g
02f0 4d 56 db ac 4
7 7a 9b 70 31 eb 4c
65 cd 80 e2 2e M
V..Gz.p1.Le....
0300 70 51 d4 82 7
4 55 5f e4 60 92 ed
b7 ce 79 dc 7e p
Q..tU_.`....y.~
0310 5f ff bf 50 d
2 fc ad 03 71 71 21
cd 12 81 21 3e _
..P....qq!...!>
0320 c3 dc 97 95 8
e b4 b1 e6 3b 70 98
02 4c a3 48 97 .
.......;p..L.H.
0330 10 8d 45 1a 3
3 da ff e2 dd e9 ae
72 4f 72 82 79 .
.E.3......rOr.y
0340 d2 7d 2f 6d 1
e 9a 1f 9b 2d 0e 88
11 be 71 89 23 .
}/m....-....q.#
0350 11 92 d0 2f a
7 55 d8 4b dc 29 64
71 56 4d 6d f9 .
../.U.K.)dqVMm.
0360 ba 56 d6 7a 5
9 6b 5a 42 82 58 46
1c 1e c4 a9 53 .
V.zYkZB.XF....S
0370 c9 a9 f4 99 9
8 ff 72 ea
.
.....r.
No. Time
Source
Destination
Protocol
Length Info
232 8.418477000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=136682 Win=38745 L
en=0
Frame 232: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)

Arrival Time: N
ov 10, 2014 11:27:0
1.468407000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.468407000 s
econds
[Time delta fro
m previous captured
frame: 0.000147000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00014700
0 seconds]
[Time since ref
erence or first fra
me: 8.418477000 sec
onds]
Frame Number: 2
32
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f72 (20338)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl

lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 13668
2, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 136682 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38745
[Calculated win
dow size: 38745]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab

led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 231]
[The RTT to
ACK the segment wa
s: 0.000147000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 72 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Or@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 78 17 50 10 .
....P..N.+.x.P.
0030 97 59 18 d4 0
0 00
.
Y....
No. Time
Source
Destination
Protocol
Length Info
233 8.552337000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=13668
2 Ack=1 Win=46 Len=
1260
Frame 233: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.602267000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.602267000 s

econds
[Time delta fro
m previous captured
frame: 0.133860000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13386000
0 seconds]
[Time since ref
erence or first fra
me: 8.552337000 sec
onds]
Frame Number: 2
33
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1ef (61935)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a3b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro

l Protocol, Src Por

t: http (80), Dst P
ort: 49574 (49574),
Seq: 136682, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 136682 (relati
ve sequence number)
[Next sequence
number: 137942 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x956
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks

um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ef 4
0 00 31 06 3a 3b 4a
7c 0c 8a c0 a8 .
...@.1.:;J|....
0020 01 0b 00 50 c
1 a6 2b ca 78 17 9e
87 4e aa 50 10 .
..P..+.x...N.P.
0030 00 2e 95 62 0
0 00 00 78 30 01 8a
99 96 c9 90 80 .
..b...x0.......
0040 a9 69 a2 0d 0
0 78 a7 ea 82 37 76
6c df 2e 9d eb .
i...x...7vl....
0050 05 01 69 f5 b
5 52 01 6c d3 31 bb
d4 c4 16 0f 2d .
.i..R.l.1.....0060 83 3d a9 49 c
b f0 14 0b 5a 5f 2c
c7 89 d1 89 a3 .
=.I....Z_,.....
0070 4b 26 8d 90 5
6 f7 a1 63 9e b6 15
b1 1e a3 18 ca K
&..V..c........
0080 fb fb 39 d6 f
f 79 d2 ff c4 ff fb
92 04 ec 8f f3 .
.9..y..........
0090 23 2b d4 83 1
8 7a 60 5c e4 6a 90
63 0f 4a 0c 10 #
+...z`\.j.c.J..
00a0 8d 4e 0c e5 e
9 49 8e 16 29 c1 9c
25 30 7f 3d fe .
N...I..)..%0.=.
00b0 3f 62 8f 7d d
d 06 06 84 8b 00 d2
22 28 80 61 23 ?
b.}......."(.a#
00c0 86 08 01 16 2
0 19 dd c0 68 7b d4
25 f7 72 5b b2 .
... ...h{.%.r[.
00d0 ec ce 66 89 8
7 b3 05 9b 19 65 39
d4 6e f6 28 5a .
.f......e9.n.(Z
00e0 ad 4a 01 e3 d
e 88 48 2e 51 c6 ac
f1 6b d7 07 81 .
J....H.Q...k...
00f0 28 bb a7 13 b

7 e1 70 f0 b6 d7 b4
4a 12 8a 2c 8c (
.....p....J..,.
0100 d8 ed 92 55 d
f b7 15 49 e9 57 4b
e6 eb bc 71 cf .
..U...I.WK...q.
0110 f0 26 36 ef 5
1 aa 2a 8c 81 cf 01
4c 74 02 c5 0c .
&6.Q.*....Lt...
0120 51 49 c4 00 0
e fc 59 79 65 fe 6c
0f 48 1b 01 84 Q
I....Yye.l.H...
0130 03 4f 10 9f a
b 48 ad 34 cf b3 f1
3c 41 01 f6 a6 .
O...H.4...<A...
0140 6e 90 4d 65 0
e 96 41 49 d2 aa 3d
a9 08 03 bd ef n
.Me..AI..=.....
0150 de 1d c3 a7 6
7 3e 8c 6d 32 bd 05
68 fc cd bb 18 .
...g>.m2..h....
0160 8a dd 33 9d 4
7 ba 17 4c 44 10 68
88 7a c4 7b 2c .
.3.G..LD.h.z.{,
0170 b6 ff a3 40 2
a 62 5e 0d b9 49 e8
cd 65 5f 63 f7 .
..@*b^..I..e_c.
0180 40 9b fc a8 1
a 8d ca c0 0d 11 a8
a0 1c e0 b0 31 @
..............1
0190 90 50 fe 1f a
d 2a 46 76 41 05 14
0a c2 f8 bb 94 .
P...*FvA.......
01a0 78 b9 ae 87 5
9 aa e7 77 86 0b b8
7c e4 fd 90 44 x
...Y..w...|...D
01b0 3f 5a 63 a4 e
b 0b 1a d3 69 85 f5
51 e9 25 af da ?
Zc.....i..Q.%..
01c0 ca 7b ab de 5
a 7e 22 e3 c8 93 ce
6e 6a 6c aa 36 .
{..Z~"....njl.6
01d0 1d 31 41 32 d
6 0e 88 a6 b1 d4 02
89 07 42 3a 03 .
1A2.........B:.
01e0 f1 29 61 ee 5
c f9 e3 6c 35 50 5b
27 b1 97 c7 e6 .
)a.\..l5P['....
01f0 97 c3 f2 ff 3
5 a8 a4 e0 ce 42 cc
44 dc 39 db 6a .
...5....B.D.9.j
0200 77 09 cf 3a f
2 a8 de 7b 68 98 0d

06 48 09 07 e2 w
..:...{h...H...
0210 0a 5c 45 83 c
2 35 2b 34 d5 b5 c8
8e a8 55 f5 f5 .
\E..5+4.....U..
0220 43 23 e9 c4 a
4 ff c2 42 71 de 95
ff fb 92 04 e8 C
#.....Bq.......
0230 8f f2 db 34 5
3 83 39 32 e0 5f 46
9a 60 67 08 5c .
..4S.92._F.`g.\
0240 0b e0 a7 4c 0
c e9 89 81 6c 95 e9
81 87 ad 30 03 .
..L....l.....0.
0250 fd ed ba 83 3
4 44 c7 9d 30 33 05
01 23 59 80 18 .
...4D..03..#Y..
0260 92 e9 e0 15 3
e d0 55 0a 99 1d 09
c0 00 6b 27 18 .
...>.U......k'.
0270 01 e4 20 5c d
5 c4 c0 17 4c 64 d9
30 75 b1 96 d0 .
. \....Ld.0u...
0280 f2 a1 38 cb e
e 8d 25 ec db 4e dc
f0 d4 2b 8f 07 .
.8...%..N...+..
0290 a1 d2 d1 d8 e
5 cc 02 7c 22 78 3f
09 f2 5b 37 dc .
......|"x?..[7.
02a0 c5 ca 9d 26 7
3 5b 9b 6a ab dc 55
95 3b db 36 e8 .
..&s[.j..U.;.6.
02b0 3b c5 f6 cd 1
b b8 8e 86 d2 48 a0
38 d2 19 09 47 ;
........H.8...G
02c0 25 21 bb 20 4
0 e1 35 72 c9 9d f2
e2 49 9a d1 c1 %
!. @.5r....I...
02d0 75 46 7a 8b 2
4 c0 3c 9e aa 92 86
2d 2a 8e 65 88 u
Fz.$.<....-*.e.
02e0 a9 45 16 c0 c
e c3 bf 4a ca a1 d8
48 41 5a 76 80 .
E.....J...HAZv.
02f0 f8 75 11 d2 5
e 97 a8 34 db e2 d8
76 94 5e 69 8d .
u..^..4...v.^i.
0300 ad 81 e4 e4 5
2 1f f1 e7 9d 00 8d
88 e1 64 96 83 .
...R........d..
0310 1a 50 54 d0 4
6 41 b4 1f a2 ce 46
c6 84 3f 10 e2 .

PT.FA....F..?..
0320 34 13 bc 09 d
6 da 92 44 1a 24 25
38 31 1a 91 09 4
......D.$%81...
0330 21 1a 57 4c a
a 86 c8 7f b3 2b 12
eb b4 1a 13 41 !
.WL.....+.....A
0340 24 e8 45 00 d
9 19 42 52 89 4e 41
0c b7 c3 8a 09 $
.E...BR.NA.....
0350 d3 5d 53 9b 5
d 21 5e 72 be 59 b4
f7 fb 8e 8b 8b .
]S.]!^r.Y......
0360 9c 4c d9 67 b
b 4a 3f fd 35 1d 2e
62 01 98 a4 86 .
L.g.J?.5..b....
0370 50 e1 b0 0e 2
2 1a a5 a0 b7 c3 a0
1c f2 41 61 70 P
..."........Aap
0380 70 0c a8 da c
1 a2 92 2a a9 40 95
3e fc 3b ec e5 p
......*.@.>.;..
0390 61 aa 43 32 6
8 a8 5c 48 b4 5c 22
4c 46 95 45 67 a
.C2h.\H.\"LF.Eg
03a0 28 53 ed 6f 1
2 95 b8 61 7a 2b 2e
fe 9b 6e a4 2c (
S.o...az+...n.,
03b0 db 4c 48 4f 6
f ce 64 f9 9b d8 b9
cd 8b b5 e6 ff .
LHOo.d.........
03c0 e7 fb ff af 2
5 9a 41 a1 d3 c0 31
57 07 ff fb 92 .
...%.A...1W....
03d0 04 ed 0f f3 0
4 35 53 03 39 42 e0
65 66 9a 50 69 .
....5S.9B.ef.Pi
03e0 eb 5c 0b 20 a
5 4e 0c e5 69 81 5a
16 29 c1 87 ad .
\. .N..i.Z.)...
03f0 30 ba 4b b6 d
f 4f 2e 2a 3a fc 31
3b 01 da 56 43 0
.K..O.*:.1;..VC
0400 88 68 20 87 7
3 06 21 e0 9b 08 cb
1b 8b 68 17 a4 .
h .s.!......h..
0410 18 c3 9c aa a
b fd e5 6e 30 94 03
48 1d 39 54 81 .
......n0..H.9T.
0420 ac 13 0a 76 5
d 0e d1 0a 26 2d 32
25 e6 e6 84 f9 .
..v]...&-2%....

0430 98 98 96 1d 1
c 6e 70 a0 90 c6 2a
42 c9 0b 22 7e .
....np...*B.."~
0440 8b 15 1f 64 2
a 09 9b ba cc 6b a9
1a cf 68 2c ea .
..d*....k...h,.
0450 2f cf c5 0e 3
a 2e 14 d0 9b 69 7f
f5 19 05 21 99 /
...:....i....!.
0460 a4 32 f9 38 d
3 24 1c 1b 59 8c 80
8c 18 18 be a9 .
2.8.$..Y.......
0470 70 ff c1 e7 3
6 11 57 f0 aa 2b 11
62 0f fa 8e c4 p
...6.W..+.b....
0480 6a d2 44 e0 5
a 83 b7 91 43 3e 3b
d6 a3 96 c9 54 j
.D.Z...C>;....T
0490 2a 06 b7 cc f
e 09 88 f2 03 1c 2b
3a be 5c 3d f1 *
.........+:.\=.
04a0 b6 f8 98 cd b
1 3e a4 d6 b2 9c bf
98 79 e2 30 35 .
....>......y.05
04b0 9a 96 70 d2 4
4 29 fb 3f f2 86 52
42 01 cd 4f da .
.p.D).?..RB..O.
04c0 c2 02 c8 41 5
6 a2 30 c0 ab b0 65
c8 65 3b 09 bc .
..AV.0...e.e;..
04d0 43 99 3b fa 8
4 f7 65 62 3f ed d6
52 e9 ce b6 17 C
.;...eb?..R....
04e0 92 00 84 3e d
5 5b 1c 37 a6 01 3c
ee 82 61 5a e5 .
..>.[.7..<..aZ.
04f0 2b a4 3b 08 5
4 00 40 fa 8b 40 b0
6f bb 9c dd 6b +
.;.T.@..@.o...k
0500 4c ef b9 46 b
2 57 33 d5 33 73 ba
67 2b ff b1 7b L
..F.W3.3s.g+..{
0510 92 7a 1e e5 2
7 dc ad 3f d6 0e 0c
60 cf 0b 74 36 .
z..'..?...`..t6
0520 04 cc
.
.
No. Time
Source
Destination
Protocol

Length Info
234 8.570341000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1305 http49
574 [PSH, ACK] Seq=
137942 Ack=1 Win=46
Len=1251
Frame 234: 1305 byt
es on wire (10440 b
its), 1305 bytes ca
ptured (10440 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.620271000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.620271000 s
econds
[Time delta fro
m previous captured
frame: 0.018004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01800400
0 seconds]
[Time since ref
erence or first fra
me: 8.570341000 sec
onds]
Frame Number: 2
34
Frame Length: 1
305 bytes (10440 bi
ts)
Capture Length:
1305 bytes (10440
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64

:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
291
Identification:
0xf1f0 (61936)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a43 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 137942, Ack:
1, Len: 1251
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1251]
Sequence number
: 137942 (relati
ve sequence number)
[Next sequence
number: 139193 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set

.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x45f
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2511]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0b f1 f0 4
0 00 31 06 3a 43 4a
7c 0c 8a c0 a8 .
...@.1.:CJ|....
0020 01 0b 00 50 c
1 a6 2b ca 7d 03 9e
87 4e aa 50 18 .
..P..+.}...N.P.
0030 00 2e 45 f5 0
0 00 19 06 34 83 03
74 4b b2 e2 59 .
.E.....4..tK..Y
0040 28 2d 62 0f 3
5 6e 67 5e 04 c1 26
04 b0 fd 87 1f (
-b.5ng^..&.....
0050 b5 fa e5 b0 5
8 17 a3 b2 51 16 14
ca 62 d3 8e 94 .
...X...Q...b...
0060 21 da 23 90 a
8 8f d6 a0 b4 d4 90
a5 b0 dd e0 70 !
.#............p
0070 71 4e 9b 15 8
8 34 27 50 cb 52 64

96 1e 62 4d fa q
N...4'P.Rd..bM.
0080 65 29 ec ff f
b 92 04 f1 0f f3 4f
2c 52 83 5a 7a e
)........O,R.Zz
0090 60 65 45 ea 4
0 67 0d 4c 0b a8 93
4c 0c e5 e9 41 `
eE.@g.L...L...A
00a0 7e 16 69 41 9
c 2d 30 ba f4 33 91
0c ea 63 4d f5 ~
.iA.-0..3...cM.
00b0 f4 3e 9f a8 3
8 61 0a 07 a2 e1 0b
8f 14 95 65 e1 .
>..8a........e.
00c0 41 a2 e6 aa d
4 b6 13 23 33 79 02
90 85 3a 23 86 A
......#3y...:#.
00d0 61 4c 8e b4 0
8 ce db f8 db c2 ab
28 24 cf 5c f4 a
L.........($.\.
00e0 33 4d 59 e2 8
a c4 93 6a 96 75 54
78 28 7b 83 e4 3
MY....j.uTx({..
00f0 fe b0 fe ee c
5 56 ed e8 99 85 e0
ff 13 1f eb 07 .
....V..........
0100 86 fe 77 ef e
1 45 cd f5 ff f6 9f
22 a9 05 0f fa .
.w..E....."....
0110 83 72 e6 00 5
8 56 01 bc 6a 08 20
35 b5 0f 87 05 .
r..XV..j. 5....
0120 18 21 ef 53 d
8 e1 2d 7a 2a 73 5b
48 75 1d 0b 52 .
!.S..-z*s[Hu..R
0130 2c 3b 2e d3 e
1 0d aa ca 38 61 f2
ba 49 a8 f2 75 ,
;......8a..I..u
0140 2c 65 42 c0 e
c ca d5 25 11 4a ad
c0 48 e2 f1 8d ,
eB....%.J..H...
0150 d9 9b 89 4f f
e 49 e7 98 6d 4a 5c
30 f4 11 89 da .
..O.I..mJ\0....
0160 75 71 4f ab 8
8 77 f6 85 c8 1c 1d
ce 3f f4 a0 c0 u
qO..w......?...
0170 1d 10 d8 0c f
8 99 c2 c5 1d b2 c9
87 44 24 19 44 .
...........D$.D
0180 c3 c4 b4 f5 c
3 a6 54 c0 6b 40 15
d7 a5 af 54 74 .

.....T.k@....Tt
0190 9f 58 f4 ae 1
f 55 b9 ca 61 53 cb
d4 6f 12 78 ac .
X...U..aS..o.x.
01a0 f2 be 84 d1 6
5 3a ee bc f2 b6 d6
ae 9d 15 bf e6 .
...e:..........
01b0 e7 ca 6b 5f 5
8 8d 8d 5b c2 3c ff
ad fe b7 20 49 .
.k_X..[.<.... I
01c0 ae 84 ab 3e 5
7 81 fe b3 b5 68 5e
80 c7 c6 c5 89 .
..>W....h^.....
01d0 85 0a 6a c9 a
0 9c 74 a0 9a f1 d1
8c 58 a8 10 48 .
.j...t.....X..H
01e0 04 f3 3e 30 3
0 df 84 ca 1e 76 ad
6c d6 1c 9f 6b .
.>00....v.l...k
01f0 30 eb fe ef b
4 0b 60 42 e2 d3 e5
90 47 66 5a 6c 0
.....`B....GfZl
0200 69 f6 34 44 b
4 13 64 d0 03 d8 24
27 a8 9a d6 04 i
.4D..d...$'....
0210 4b fc 98 19 3
e d5 f9 86 d1 41 24
40 35 bb a1 c8 K
...>....A$@5...
0220 c2 ea c5 fc a
8 ff fb 92 04 ea 0f
f3 16 2b d2 83 .
............+..
0230 5a 5a 60 5e a
5 8a 50 67 0f 4c 0b
8c b1 4c 0d 65 Z
Z`^..Pg.L...L.e
0240 69 81 6d 13 a
9 41 ac 3d 28 a3 3d
4c 2c 8c 72 df i
.m..A.=(.=L,.r.
0250 75 8b a1 2b 5
4 10 b1 e2 81 92 53
be a6 03 07 00 u
..+T.....S.....
0260 85 62 6f f2 a
8 80 ba a7 72 d3 60
25 cb 28 9a d0 .
bo.....r.`%.(..
0270 eb 99 45 05 4
e 43 39 28 ba b4 56
81 25 78 53 6a .
.E.NC9(..V.%xSj
0280 f2 fc a6 86 9
c 19 5c 99 aa fd 4a
ec cf 85 2d e6 .
.....\...J...-.
0290 80 5b 08 ad f
c c0 74 db 88 ff 10
71 5d 75 c3 07 .
[....t....q]u..

02a0 dc 96 d7 f1 b
5 58 fb ff d1 ec 78
d1 52 6a 7c 0b .
....X....x.Rj|.
02b0 a2 c1 98 d2 e
4 a0 80 1f 3d 58 8c
a9 85 b2 22 42 .
.......=X...."B
02c0 6b c3 18 53 3
c 4d c2 83 d0 5b 75
31 31 20 ef 00 k
..S<M...[u11 ..
02d0 82 71 af 4f 4
1 69 d9 2c 8e bb 90
77 a3 21 37 3a .
q.OAi.,...w.!7:
02e0 36 95 9e 6a 5
1 62 53 7e 49 28 85
e5 12 8f 62 3b 6
..jQbS~I(....b;
02f0 c3 68 54 e4 8
0 51 0f f2 44 11 08
66 df 9d 88 3a .
hT..Q..D..f...:
0300 55 64 fd 74 a
d 8e 51 f6 e6 7e ac
aa ff ea 3e ff U
d.t..Q..~....>.
0310 9e 1e af d5 4
0 80 2b f6 77 40 26
8a 41 0c 8c 4c .
...@.+.w@&.A..L
0320 b1 68 e8 83 0
9 64 01 16 6c 71 13
b8 70 83 1b 24 .
h...d..lq..p..$
0330 f6 73 eb ed 7
c 67 69 d9 7e 7d 29
a6 67 df 0e e5 .
s..|gi.~}).g...
0340 2f b9 11 5c 7
a 2b 4f 29 15 59 34
c8 ec ac f0 13 /
..\z+O).Y4.....
0350 09 7e c1 f4 8
7 9b e2 a2 16 c7 e2
bd 08 62 f7 30 .
~...........b.0
0360 d4 d5 ff b5 1
9 24 d2 99 c0 65 de
fa 93 2f 00 35 .
....$...e.../.5
0370 c8 df e1 ea c
4 e8 1b 80 34 69 5a
01 22 0c b6 40 .
.......4iZ."..@
0380 46 6d 34 02 6
f 7f 31 1c 79 5c b7
1b 70 fa 76 3a F
m4.o.1.y\..p.v:
0390 d4 2e f3 cb 4
c 14 90 7d ea 56 e7
16 94 33 39 c9 .
...L..}.V...39.
03a0 a4 31 c9 c5 5
9 0f 45 9e d3 90 a0
cb aa 8d 09 f7 .
1..Y.E.........
03b0 48 38 5c 3e 8

5 4f 98 df d6 ce db
3e 5e 63 58 dc H
8\>.O.....>^cX.
03c0 5d d6 06 ff c
c 50 85 ff fb 92 04
ec 8f f3 2b 2e ]
....P........+.
03d0 52 83 5a 5a 6
0 60 25 8a 50 67 0f
4c 0c 24 d1 4a R
.ZZ``%.Pg.L.$.J
03e0 0d 69 6b 81 6
1 16 29 41 ac 2d 30
0f 46 a0 65 dd .
ik.a.)A.-0.F.e.
03f0 64 6b 1a 5d 8
1 44 a7 7c 7c 10 d1
13 9d f8 05 0a d
k.].D.||.......
0400 46 68 b3 70 6
d 68 a3 a6 c0 5d 6c
40 a3 c4 59 75 F
h.pmh...]l@..Yu
0410 3b 92 54 02 b
e 9e 63 0f 24 a2 02
8c e2 d1 e5 55 ;
.T...c.$......U
0420 d5 3f e1 0e 4
c 47 6b 76 92 8a c8
50 09 ec 93 88 .
?..LGkv...P....
0430 8f 41 7a 62 a
5 01 f1 29 76 a1 ef
6e 3a 4a a1 49 .
Azb...)v..n:J.I
0440 6e e5 61 a8 c
b eb 85 aa 6f 8a af
af f8 d3 6b ba n
.a.....o.....k.
0450 d9 a2 1d 02 c
5 02 50 2d b1 97 3a
c3 81 c4 49 ae .
.....P-..:...I.
0460 02 41 30 a7 0
4 a0 d6 e5 26 7e 13
f1 68 a0 34 b5 .
A0.....&~..h.4.
0470 8e 45 f1 7d 2
8 e4 ac ee 13 10 24
70 24 aa 57 14 .
E.}(.....$p$.W.
0480 8a d6 81 69 a
d ce 4a e9 27 72 95
a7 54 f0 b0 a5 .
..i..J.'r..T...
0490 34 52 38 3d 9
9 c3 9d 67 c7 0e 3f
c9 fa 73 9e 88 4
R8=...g..?..s..
04a0 ed d5 3c db a
8 31 b9 67 fb 09 d3
5e e6 ff fd 44 .
.<..1.g...^...D
04b0 5a 6b 74 e8 c
5 9b 01 ab d9 a0 12
61 87 28 97 a0 Z
kt........a.(..
04c0 84 c6 b0 4d b
a cc 0c be 2d 19 b1

37 56 20 d8 43 .
..M....-..7V .C
04d0 cd 02 2b 04 6
1 e8 50 65 bf 7d 9d
ac c9 7c 07 39 .
.+.a.Pe.}...|.9
04e0 c8 a4 86 26 8
e 99 ca 20 eb 76 22
be f5 40 3e 1c .
..&... .v"..@>.
04f0 b1 6c ec 5c 2
5 02 42 3a 99 a9 22
61 c3 55 17 b4 .
l.\%.B:.."a.U..
0500 d0 34 74 0f 9
2 ab 2f 2c c5 6c b5
50 3a fc d8 c5 .
4t.../,.l.P:...
0510 5d df 57 41 a
a 9e fa f4 aa
]
.WA.....
No. Time
Source
Destination
Protocol
Length Info
235 8.570526000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=139193 Win=38745 L
en=0
Frame 235: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.620456000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.620456000 s
econds
[Time delta fro
m previous captured
frame: 0.000185000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018500
0 seconds]
[Time since ref
erence or first fra

me: 8.570526000 sec

onds]
Frame Number: 2
35
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:

20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f73 (20339)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 13919
3, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]

Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 139193 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38745
[Calculated win
dow size: 38745]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 234]
[The RTT to
ACK the segment wa
s: 0.000185000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .

.;....`n.dx..E.
0010 00 28 4f 73 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Os@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 81 e6 50 10 .
....P..N.+...P.
0030 97 59 18 d4 0
0 00
.
Y....
No. Time
Source
Destination
Protocol
Length Info
236 8.696347000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=13919
3 Ack=1 Win=46 Len=
1260
Frame 236: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.746277000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.746277000 s
econds
[Time delta fro
m previous captured
frame: 0.125821000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12582100
0 seconds]
[Time since ref
erence or first fra
me: 8.696347000 sec
onds]
Frame Number: 2
36
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512

bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1f1 (61937)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a39 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 139193, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 139193 (relati
ve sequence number)
[Next sequence
number: 140453 (
relative sequence n
umber)]

Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc33
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 f1 4
0 00 31 06 3a 39 4a
7c 0c 8a c0 a8 .
...@.1.:9J|....
0020 01 0b 00 50 c
1 a6 2b ca 81 e6 9e
87 4e aa 50 10 .
..P..+.....N.P.

0030 00 2e c3 3c 0
0 00 6d 50 fc d4 24
f9 01 29 76 28 .
..<..mP..$..)v(
0040 63 34 4b 14 5
3 65 6a 2a 98 eb ac
c1 37 fe bc 52 c
4K.Sej*....7..R
0050 57 17 8d bf e
e fc 3f 5e 27 55 f4
18 84 01 61 b1 W
.....?^'U....a.
0060 83 07 a9 79 9
d 6d a6 22 19 a9 84
e4 81 d6 99 66 .
..y.m.".......f
0070 2a ed 35 e7 7
d 76 38 58 68 f7 9c
28 2c 08 20 4f *
.5.}v8Xh..(,. O
0080 20 96 3d 3d 1
9 4f ff fb 92 04 ec
0f f3 0f 2b 52
.==.O........+R
0090 83 59 7a 60 5
e e6 8a 50 6b 0b 5c
0c 70 d5 4a 0d .
Yz`^..Pk.\.p.J.
00a0 69 6b 81 8b 9
a a9 41 9c 35 70 ee
fa 97 2f e3 4f i
k....A.5p.../.O
00b0 10 51 87 8a c
8 ca 4c 09 a0 19 07
ae 08 f2 34 d0 .
Q....L.......4.
00c0 62 36 a7 45 b
6 c4 84 f6 19 3f 77
87 52 2b 16 58 b
6.E.....?w.R+.X
00d0 23 bc 40 3a 4
3 8a ae bc da 41 db
d5 e6 b2 91 99 #
.@:C....A......
00e0 55 18 a8 c3 5
1 be 19 36 26 dc 81
e1 fa c2 50 84 U
...Q..6&.....P.
00f0 48 c3 0c fc 2
3 ff b1 f7 76 0d 11
69 df fe 7c 0c H
...#...v..i..|.
0100 19 2c e7 9e 6
0 7c 0e 19 ff ff 69
d0 40 25 12 83 .
,..`|....i.@%..
0110 95 91 92 3e 6
a c2 a2 2d d9 b6 8c
b9 6d 2d 40 c6 .
..>j..-....m-@.
0120 bb 95 e3 73 e
d e4 28 4c ed d5 d1
44 86 56 b3 b8 .
..s..(L...D.V..
0130 37 25 df bd 7
1 70 8d 17 31 f5 35
1c 46 21 c1 9d 7
%..qp..1.5.F!..
0140 0d 84 07 32 7

0 49 00 2b 59 98 c6
8b 0a 4d 4e f0 .
..2pI.+Y....MN.
0150 91 34 cd 1f f
e 7f 4f 84 ff a5 37
ff e1 38 33 40 .
4....O...7..83@
0160 47 48 29 cb 1
4 26 64 9b 28 ec 5b
ef 57 76 d2 f2 G
H)..&d.(.[.Wv..
0170 88 30 26 12 6
3 24 cc 0c fd ab 97
99 da 85 32 92 .
0&.c$........2.
0180 15 1b 25 7b f
8 79 e9 6c 2e e8 c7
26 69 96 ec 7d .
.%{.y.l...&i..}
0190 d2 22 5d fb 1
1 1c 7c ea 0b d5 1e
6a 32 2a 44 cf .
"]...|....j2*D.
01a0 c5 34 90 8f d
e ce a0 50 c3 c4 07
b6 3b 9b 0f 0a .
4.....P....;...
01b0 86 1b 8d dd 7
9 c1 82 82 63 2f 18
72 4e 30 25 36 .
...y...c/.rN0%6
01c0 f7 43 00 da 4
5 40 88 4d 94 19 32
4d a2 73 1d 44 .
C..E@.M..2M.s.D
01d0 dd 57 5b 09 c
f c9 90 1c 71 01 17
9b 7b 0d b1 b8 .
W[.....q...{...
01e0 ac 29 45 67 6
0 0b b6 67 17 18 91
db 15 d1 66 5a .
)Eg`..g......fZ
01f0 db 2c 0b 49 d
7 07 84 67 08 72 29
73 39 b8 f0 52 .
,.I...g.r)s9..R
0200 e6 a5 b2 54 7
f 68 7d 7a f0 e8 6a
18 ce 8b a0 da .
..T.h}z..j.....
0210 58 58 10 6a 4
6 ac 24 5c ed c4 68
b0 e1 80 22 99 X
X.jF.$\..h...".
0220 24 30 73 d9 1
7 be 92 96 ff fb 92
04 e7 0f f2 aa $
0s.............
0230 20 d5 83 18 4
a 50 5c 04 2a d0 3d
e9 4a 4c a4 ff
...JP\.*.=.JL..
0240 62 0c 3c 6b 8
1 9a 96 ec 41 87 a5
30 30 47 be 94 b
.<k....A..00G..
0250 65 de e7 a9 f
c 78 e2 0a a6 80 d6

ae 6d 96 96 9d e
....x......m...
0260 60 6e bc 26 5
1 e8 fe 2c ef 23 42
8a ee ef 6b 7c `
n.&Q..,.#B...k|
0270 56 0b 84 7b b
a dc 5b 64 e7 cc 72
c9 24 8d 64 4b V
..{..[d..r.$.dK
0280 c9 66 51 8f b
b 87 63 5c 49 a7 0a
4b 77 6b 7e fc .
fQ...c\I..Kwk~.
0290 7d ff 54 96 0
9 12 58 65 c7 21 88
7a 44 d2 99 0c }
.T...Xe.!.zD...
02a0 3e 89 27 ea 1
4 1a a6 21 27 6f a4
f6 93 8e 7e 29 >
.'....!'o....~)
02b0 c7 87 51 08 c
8 04 cb 86 5b e6 ea
f0 bb 8d 73 19 .
.Q.....[.....s.
02c0 54 13 d3 c3 8
a 3b 2d 66 65 5c 56
97 6c 64 bb d6 T
....;-fe\V.ld..
02d0 e4 0c f0 62 d
d ba b3 39 46 89 89
ff cf c7 35 9d .
..b...9F.....5.
02e0 e2 ee 6a 59 c
5 22 60 1d 14 cb 4e
c8 de 46 b9 a2 .
.jY."`...N..F..
02f0 ff 7b be 7a 7
a 4e 67 33 bf 31 61
05 d8 50 3e 47 .
{.zzNg3.1a..P>G
0300 01 0a 1c 22 1
c 16 44 c1 6b 65 87
b1 f4 aa 6e 51 .
.."..D.ke....nQ
0310 42 f2 d3 68 7
2 34 01 e9 7e 9b 33
fa fa ba 0e a4 B
..hr4..~.3.....
0320 66 79 e9 3c e
1 a1 c6 91 73 4e 92
91 59 53 22 11 f
y.<....sN..YS".
0330 63 50 77 57 3
9 27 7f 5e 6a 11 da
a8 62 f1 28 e3 c
PwW9'.^j...b.(.
0340 11 c6 09 02 6
e a4 60 83 a3 f5 f3
33 9d cd 5d 55 .
...n.`....3..]U
0350 d4 33 7d 3e f
b a2 7c 47 1d d6 f7
cf 8f 01 08 18 .
3}>..|G........
0360 d8 3e 9d 4c 6
8 b3 04 e8 71 cc 9c
90 f6 0e 17 52 .

>.Lh...q......R
0370 a1 9d 4d 71 4
9 ba 0f b0 df 33 4a
62 58 90 38 86 .
.MqI....3JbX.8.
0380 a1 94 a6 5c 4
2 5e a4 0c aa 76 fe
fa a8 13 3b 8b .
..\B^...v....;.
0390 98 78 96 18 e
7 c1 9b 29 7e be c5
6f 9a 2e a3 bf .
x.....)~..o....
03a0 f7 b4 df 26 a
9 40 7e d4 b3 f8 5e
34 4c a2 3a e2 .
..&.@~...^4L.:.
03b0 f6 c3 ed a1 4
1 98 7f 99 96 55 c4
a8 8a 69 a0 07 .
...A....U...i..
03c0 c4 7d 5a c2 7
6 d3 0f 70 9a 0e ff
fb 92 04 e7 8f .
}Z.v..p........
03d0 f2 d5 23 d9 8
3 0f 32 50 5c a5 5b
30 61 e6 4c 0c .
.#...2P\.[0a.L.
03e0 24 f1 66 0c 3
c 6b 81 88 9e 2c c1
83 21 70 c4 ee $
.f.<k...,..!p..
03f0 f2 88 df a3 3
9 6f fd b9 a7 cf b6
f0 5b ab 50 a6 .
...9o......[.P.
0400 d4 42 59 c0 c
6 57 4e 76 26 60 89
15 0f e9 b9 4a .
BY..WNv&`.....J
0410 0e b4 48 29 2
9 c3 f7 31 75 72 d9
67 72 4c a2 67 .
.H))..1ur.grL.g
0420 7a bc ee 63 1
8 55 14 40 16 f5 33
bf bb a9 54 8c z
..c.U.@..3...T.
0430 6b 35 48 ec f
b aa a6 ca ce df 93
6d e2 20 f4 56 k
5H........m. .V
0440 8c 53 63 7e b
7 55 6a 17 6b bf d0
67 82 6b e8 a4 .
Sc~.Uj.k..g.k..
0450 c7 d3 f6 ff d
a df be 82 e4 00 08
dd 2c 68 d1 76 .
...........,h.v
0460 33 0c f2 07 3
3 4c 39 9b 49 74 79
9c 63 a9 25 92 3
...3L9.Ity.c.%.
0470 44 76 7b dd 1
3 14 ae 4e 4d c8 dd
0e 73 d1 3e 1d D
v{....NM...s.>.

0480 8d f0 c8 fc 6
9 cb f5 16 f4 58 1b
1a 10 79 06 a0 .
...i....X...y..
0490 32 3c 34 2f 7
2 a9 45 2c 85 e9 91
57 53 49 c3 d2 2
<4/r.E,...WSI..
04a0 29 ba b6 2c 8
0 65 8f 3e 31 ae 5e
96 77 dd c9 3c )
..,.e.>1.^.w..<
04b0 22 01 ba 33 6
c e9 99 4c 41 2c c6
05 b8 57 43 90 "
..3l..LA,...WC.
04c0 47 75 46 b1 b
6 71 5d 79 15 39 fd
79 0e e6 54 be G
uF..q]y.9.y..T.
04d0 5f 99 85 d6 7
f 57 e5 14 e7 71 88
45 b9 a0 32 e5 _
....W...q.E..2.
04e0 c9 56 b3 15 f
c e2 12 c5 81 db bb
bb e7 a9 97 fa .
V..............
04f0 67 91 c2 b3 2
b 58 c8 37 a4 59 86
0f 28 d0 98 4c g
...+X.7.Y..(..L
0500 18 af 3d 7b 1
6 d3 a9 62 87 3f be
e4 52 4a 54 86 .
.={...b.?..RJT.
0510 71 28 72 15 2
a e8 b4 49 18 f0 c6
0b 72 9f 22 c2 q
(r.*..I....r.".
0520 e6 fa
.
.
No. Time
Source
Destination
Protocol
Length Info
237 8.717661000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
872 http49
574 [PSH, ACK] Seq=
140453 Ack=1 Win=46
Len=818
Frame 237: 872 byte
s on wire (6976 bit
s), 872 bytes captu
red (6976 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})

Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.767591000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.767591000 s
econds
[Time delta fro
m previous captured
frame: 0.021314000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02131400
0 seconds]
[Time since ref
erence or first fra
me: 8.717661000 sec
onds]
Frame Number: 2
37
Frame Length: 8
72 bytes (6976 bits
)
Capture Length:
872 bytes (6976 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)

Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
58
Identification:
0xf1f2 (61938)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bf2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74

-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 140453, Ack:
1, Len: 818
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 818]
Sequence number
: 140453 (relati
ve sequence number)
[Next sequence
number: 141271 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46

[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x449
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2078]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5a f1 f2 4
0 00 31 06 3b f2 4a
7c 0c 8a c0 a8 .
Z..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b ca 86 d2 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 44 9e 0
0 00 23 65 5b 66 c3
34 76 c8 56 0d .
.D...#e[f.4v.V.
0040 75 43 0c 28 3
7 3f 9a a2 0b 7c 85
1a 85 43 45 65 u
C.(7?...|...CEe
0050 ac fe cc fd 5
c b9 93 4d c2 ee 07
b6 e6 33 64 db .
...\..M.....3d.
0060 55 76 4d 9a 7
c f7 9d 4c 58 e3 09
0a 97 b0 04 45 U
vM.|..LX......E
0070 4c 13 9c 34 0
a 8e 02 30 7c 4b 41
02 53 e8 c7 2a L
..4...0|KA.S..*
0080 ff fb 92 04 e
9 0f f3 04 20 d9 01
ec 32 52 5c a7 .
....... ...2R\.
0090 8b 30 3d 25 5
c 4b 00 81 62 07 bc
c9 41 7a 98 ac .
0=%\K..b...Az..
00a0 41 86 19 30 7
c c8 f1 e2 b6 f7 fc
8b 28 02 99 f6 A
..0|.......(...
00b0 6f 97 a5 35 8
8 19 a2 7e 0c e0 ee
22 01 fd 10 ed o
..5...~..."....
00c0 75 ab ec 37 d
7 26 eb f1 d4 d0 b2

99 14 50 ee 4d u
..7.&.......P.M
00d0 19 ae 50 f2 8
3 ab b3 86 b4 24 c1
02 ca 4d 0e 0e .
.P......$...M..
00e0 2c b3 e4 19 4
9 35 34 1c e7 22 30
f3 2a 35 89 fa ,
...I54.."0.*5..
00f0 df 88 e2 66 b
f bb e2 0f 09 4b 03
a2 c5 9c d0 da .
..f.....K......
0100 cf 0b 9a cb 0
e 68 99 2f b3 4b cd
a6 46 f9 00 7b .
....h./.K..F..{
0110 40 83 18 41 b
4 49 c8 41 86 42 49
71 a5 79 9f 4b @
..A.I.A.BIq.y.K
0120 40 87 55 b1 b
5 89 6e 92 37 c2 cd
a0 48 3d cc 4d @
.U...n.7...H=.M
0130 54 c0 52 8f 3
3 7d c5 96 e9 b4 1b
66 91 b5 b3 c5 T
.R.3}.....f....
0140 e3 c6 99 fb 1
a 63 df fb fb 28 b2
c3 c8 83 85 5c .
....c...(.....\
0150 3c 26 c1 4b 0
7 20 f2 41 a1 a5 cf
17 1e e5 11 38 <
&.K. .A.......8
0160 55 64 4d e5 a
c 2b 9e ed 25 d5 a8
4b cf 6a 0b 83 U
dM..+..%..K.j..
0170 a1 60 7c 1d 8
d 61 0d 89 e8 e4 5d
d1 19 c2 e5 5e .
`|..a....]....^
0180 8e f8 d9 96 d
a f4 be 4b 59 a4 37
2e e8 cb df 30 .
......KY.7....0
0190 38 24 49 92 4
4 31 d1 ad d9 72 78
a0 a0 4a a3 45 8
$I.D1...rx..J.E
01a0 44 ae b2 ff 0
a 4d c8 f8 9a ba f5
3b 17 16 53 10 D
....M.....;..S.
01b0 6d 8d 78 51 2
2 10 40 ab 4c 28 ca
9e d5 38 4b 86 m
.xQ".@.L(...8K.
01c0 1e 93 ba 1f c
c 7a 36 65 aa 6e 6d
8c 46 25 b8 c1 .
....z6e.nm.F%..
01d0 5e 16 b6 a8 2
5 b8 e9 a2 ee 01 8b
1a 03 35 6d 4a ^

...%........5mJ
01e0 2b 69 ad 5a e
8 91 53 ac e2 23 fc
45 30 77 72 2f +
i.Z..S..#.E0wr/
01f0 04 38 52 dc b
c 44 4a e2 92 0a 55
58 0d 8f 6d 26 .
8R..DJ...UX..m&
0200 f9 10 e5 93 5
3 84 74 b0 78 88 e3
1c 2c 6c 20 41 .
...S.t.x...,l A
0210 24 d4 e4 21 a
7 83 af 57 95 8a 0e
a4 35 62 c8 67 $
..!...W....5b.g
0220 14 3b ff fb 9
2 04 ee 0f f3 2d 2f
d7 83 0f 32 60 .
;.......-/...2`
0230 65 07 0b 00 6
1 88 5c 0b ac 9d 5e
07 bc c9 41 69 e
...a.\...^...Ai
0240 16 ec 00 c6 2
1 30 c5 dc b2 4a 0b
51 da 87 ac 97 .
...!0...J.Q....
0250 57 0b 97 1b 1
2 20 7c 01 a9 ee b8
84 c3 2e d5 e2 W
.... |.........
0260 9f 55 ea ab d
9 8c e7 17 c2 59 40
93 63 47 02 c7 .
U.......Y@.cG..
0270 0d 1a a2 63 1
0 60 b0 f1 61 32 0d
14 39 27 73 3c .
..c.`..a2..9's<
0280 e8 81 21 53 d
e 67 b2 34 45 90 cb
43 32 ab 2e 72 .
.!S.g.4E..C2..r
0290 0a 33 ec 9f 6
5 bb 18 ec 44 af 43
2e 3c 15 62 a8 .
3..e...D.C.<.b.
02a0 0d 59 6d f2 5
f d3 d4 23 a8 50 7f
0b 80 4f 98 07 .
Ym._..#.P...O..
02b0 c0 44 b2 3f 7
c 71 e6 60 5c 5a 45
45 eb 58 78 6d .
D.?|q.`\ZEE.Xxm
02c0 bd 35 7b 07 6
4 0b da f8 bd fd 3d
bd 75 7b 51 66 .
5{.d.....=.u{Qf
02d0 ee 48 32 bc 2
5 50 8e a3 88 74 ee
6c 23 fc de d6 .
H2.%P...t.l#...
02e0 f8 8e aa fd c
6 36 c6 bf 8f ff 9a
6d ef 4d 9a 57 .
....6.....m.M.W

02f0 d5 f7 72 de 2
0 53 ed 10 c5 cf 29
99 40 f2 e0 5e .
.r. S....).@..^
0300 82 0d 7b 15 b
a 94 03 e4 eb 3f 8c
52 58 50 31 17 .
.{......?.RXP1.
0310 81 f1 78 c4 2
9 82 48 fd 4f 48 ca
da bf 73 dd 42 .
.x.).H.OH...s.B
0320 ae b7 94 bd 9
f 14 56 3f 73 67 f6
39 7a 26 94 8f .
.....V?sg.9z&..
0330 88 d2 b9 ad 7
6 53 51 d8 c1 4b 4e
76 61 ff 25 e9 .
...vSQ..KNva.%.
0340 bf 07 13 da 7
1 f0 bb c9 e5 c7 1f
9e a1 2a 9f ba .
...q........*..
0350 f9 1d ba 6c 1
e 0d 0d af 1e 91 a9
a8 32 76 25 42 .
..l........2v%B
0360 ed ee 71 57 1
3 2d f4 55
.
.qW.-.U
No. Time
Source
Destination
Protocol
Length Info
238 8.717827000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=141271 Win=38745 L
en=0
Frame 238: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.767757000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.767757000 s
econds

[Time delta fro

m previous captured
frame: 0.000166000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00016600
0 seconds]
[Time since ref
erence or first fra
me: 8.717827000 sec
onds]
Frame Number: 2
38
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080

0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f74 (20340)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),

Seq: 1, Ack: 14127

1, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 141271 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38745
[Calculated win
dow size: 38745]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an

ACK to the segment

in frame: 237]
[The RTT to
ACK the segment wa
s: 0.000166000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 74 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Ot@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 8a 04 50 10 .
....P..N.+...P.
0030 97 59 18 d4 0
0 00
.
Y....
No. Time
Source
Destination
Protocol
Length Info
239 8.759347000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=14127
1 Ack=1 Win=46 Len=
1260
Frame 239: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.809277000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.809277000 s
econds
[Time delta fro
m previous captured
frame: 0.041520000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04152000
0 seconds]
[Time since ref

erence or first fra

me: 8.759347000 sec
onds]
Frame Number: 2
39
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1f3 (61939)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a37 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 141271, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:

0]
[TCP Segment Le
n: 1260]
Sequence number
: 141271 (relati
ve sequence number)
[Next sequence
number: 142531 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x5be
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17

e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 f3 4
0 00 31 06 3a 37 4a
7c 0c 8a c0 a8 .
...@.1.:7J|....
0020 01 0b 00 50 c
1 a6 2b ca 8a 04 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 5b ec 0
0 00 24 02 6a 48 40
1c 8b a1 02 4e .
.[...$.jH@....N
0040 0e b3 fe 49 0
c 49 6a 04 fd 5b 91
7a 9f 56 85 ae .
..I.Ij..[.z.V..
0050 fa d2 19 83 c
7 3b 8f 66 0d 5b 1b
f5 ff 35 91 79 .
....;.f.[...5.y
0060 2e f6 09 2b 9
5 96 67 46 15 b1 47
44 11 22 5e 21 .
..+..gF..GD."^!
0070 2e e0 b1 12 0
f 96 b8 a4 66 ae d7
a9 ad 3e a3 d9 .
.......f....>..
0080 b5 b6 1a 48 0
e 2a a3 ab 88 12 a2
e9 0b b7 71 a5 .
..H.*........q.
0090 89 cd ff fb 9
2 04 eb 8f f2 bf 30
57 83 0f 1a 60 .
.........0W...`
00a0 62 09 0a f0 3
d 25 5c 0b e8 e9 5c
07 bc cb 81 84 b
...=%\...\.....
00b0 1c 2b 80 f6 2
5 70 61 a2 48 0a 33
98 2f 81 ca 24 .
+..%pa.H.3./..$
00c0 2e 27 4a e9 4
1 1c cb 85 80 c1 f1
48 9d 65 3f 07 .
'J.A......H.e?.
00d0 0e b3 0d 2b 8
6 29 a8 c1 78 35 8f
21 db 35 ad 9c .
..+.)..x5.!.5..
00e0 d7 12 c1 cf 7
f 0e fa de d8 16 e9
e7 57 49 2a 40 .
...........WI*@
00f0 27 c9 66 82 0
6 d7 3f 3c 4e c9 64
48 a6 69 3b f9 '
.f...?<N.dH.i;.
0100 bb be 9f 3c f
c f1 1f b6 75 2d fe
33 c9 7f 66 fd .
..<....u-.3..f.
0110 5c 3b c2 cc b
7 ac fb bf 69 9b fe
c6 bd 18 7f 72 \

;......i......r
0120 34 ae 36 d6 0
4 69 4e 94 f9 74 df
96 ae ec 4a 68 4
.6..iN..t....Jh
0130 63 6a 20 2a 1
d d4 ca a4 dd e4 08
f4 84 ee 18 d0 c
j *............
0140 4a f6 39 82 c
2 23 33 59 d7 51 74
44 31 fc 95 4b J
.9..#3Y.QtD1..K
0150 5a 47 38 d9 a
2 64 74 0e f7 a5 f6
7c 78 51 62 04 Z
G8..dt....|xQb.
0160 c3 22 22 c3 c
e 3c b8 9c 5a 17 43
02 0e 26 1e 50 .
""..<..Z.C..&.P
0170 26 74 e5 48 1
d 01 83 80 44 59 d5
2b b6 99 b8 20 &
t.H....DY.+...
0180 64 b5 90 26 d
d f6 d0 df 9a 5c d5
35 1a 08 7c 8a d
..&.....\.5..|.
0190 55 c4 d1 1c 6
8 f5 86 9b cc 73 fa
97 c6 fa be 3d U
...h....s.....=
01a0 ad f3 ab d2 4
8 f5 e4 d4 da 45 0e
46 0b 21 1a e8 .
...H....E.F.!..
01b0 1a 2c cd 7c 0
a 88 64 b2 4b f8 b1
b5 05 3c bf 7f .
,.|..d.K....<..
01c0 8d 0f b7 ff 7
8 75 f7 5a 4c ac 0a
69 c1 27 b4 e0 .
...xu.ZL..i.'..
01d0 c0 69 f5 a9 6
3 d4 0e 81 8b a2 61
fa a9 64 9a 72 .
i..c.....a..d.r
01e0 53 8c b4 f6 c
5 a6 ac ee 1b 60 89
52 f5 ac bf 8a S
........`.R....
01f0 0d 3c 41 35 2
e df 27 d3 95 ad 1e
82 45 06 8f bd .
<A5..'.....E...
0200 1e c5 c7 b6 e
9 8d c0 91 49 c9 c7
3c ef 77 64 90 .
.......I..<.wd.
0210 d3 ea 4a c0 a
2 cd 33 31 a2 f1 bf
7d 42 5d fb cf .
.J...31...}B]..
0220 dd 7c cf 19 d
b 3b 67 ff e6 36 f8
ed bf 3b 67 ca .
|...;g..6...;g.

0230 47 36 f4 d8 f
f fb 92 04 ed 0f f3
10 39 56 81 ef G
6..........9V..
0240 42 e0 65 c9 2
a d0 3d e6 5e 0b 78
a3 5a 0c 3d 09 B
.e.*.=.^.x.Z.=.
0250 41 84 9a 6b 4
1 87 99 70 6c ff 7e
b1 d1 6c 91 a4 A
..kA..pl.~..l..
0260 d3 a2 ef 69 d
0 53 84 52 f9 70 aa
5d cd 40 8d 66 .
..i.S.R.p.].@.f
0270 4e cc e0 84 4
6 6d 2b 31 98 16 8b
1a 78 94 a3 e9 N
...Fm+1....x...
0280 64 66 ad 4f e
d 5a b6 bd 71 19 ec
20 94 b9 f1 d1 d
f.O.Z..q.. ....
0290 7a 6f 27 4e 9
e 5a 22 01 62 4d 40
9e 76 ff b7 8c z
o'N.Z".bM@.v...
02a0 9c f7 7a f2 c
e cd 9d bb 36 7f be
7f ea 77 19 14 .
.z.....6....w..
02b0 2a 29 01 38 2
8 3c 20 ab 8b 22 b2
2a 21 bf d6 86 *
).8(< ..".*!...
02c0 13 71 6f 01 5
c 0c c6 8a d8 44 0b
3b e6 62 65 4f .
qo.\....D.;.beO
02d0 70 68 9b c2 1
7 7a 47 95 5b fd d6
7b cd 59 28 ff p
h...zG.[..{.Y(.
02e0 5b f9 24 53 2
e 67 ad e3 57 1d 39
11 1b bd 12 7a [
.$S.g..W.9....z
02f0 d3 92 0b d0 d
7 46 88 d9 03 92 6d
8f f3 59 59 cf .
....F....m..YY.
0300 8f 57 e7 3d 6
4 f4 7f 8f fe 53 c7
bc dd f3 8e e5 .
W.=d....S......
0310 c0 2c 1b 68 6
a b0 22 1b 10 9d 87
d2 25 c2 ab 7a .
,.hj.".....%..z
0320 b4 ce 21 b2 1
9 0d 5d 88 d9 aa de
3e f0 a9 ee 58 .
.!...]....>...X
0330 c5 39 c1 f6 4
4 c8 a2 07 0b e9 66
66 46 b4 60 d9 .
9..D.....ffF.`.
0340 72 38 49 9c a

8 75 49 64 85 83 81
fe cf 61 00 a2 r
8I..uId.....a..
0350 92 67 22 bb 9
2 2c 1f ca 5d 34 98
d2 c7 58 98 eb .
g"..,..]4...X..
0360 3c c6 ab 9a 8
1 f1 c3 2d 69 f1 b5
b6 d5 4f 34 64 <
......-i....O4d
0370 41 3a c2 df 1
7 38 d1 e8 f6 d0 be
43 7e 82 98 fe A
:...8.....C~...
0380 80 17 7f bf f
7 28 44 7c 89 03 d1
39 26 04 29 4b .
....(D|...9&.)K
0390 3b 44 e9 f2 a
1 e0 7a 41 14 8e 32
d0 4c 9f 99 26 ;
D....zA..2.L..&
03a0 80 77 8b 8f 4
0 dc 89 91 14 29 3a
35 17 0c 87 c4 .
w..@....):5....
03b0 4b c3 81 a9 3
5 8d 1e d1 32 79 36
36 10 22 a9 7a K
...5...2y66.".z
03c0 de 2f aa ba d
6 e6 75 fe ae a6 e6
a6 bf d6 f4 cc .
/....u.........
03d0 91 33 45 48 9
4 0b ff fb 90 04 e9
8f f3 03 46 56 .
3EH..........FV
03e0 83 0f 32 e2 5
b 86 da f0 3d e6 5c
0c 48 eb 58 07 .
.2.[...=.\.H.X.
03f0 e0 cb 81 8f 2
0 6b 01 84 a1 71 0f
5d ba dd 62 53 .
... k...q.]..bS
0400 8d 5b cb 65 4
8 08 3a 87 b0 37 82
7d ce c6 29 eb .
[.eH.:..7.}..).
0410 ab a1 59 d0 d
f c7 65 b6 ec f2 ed
3b 2d a3 4b d5 .
.Y...e....;-.K.
0420 3e 1a ca 31 2
e ba d3 41 c7 09 03
bf c9 0a 55 4c >
..1...A......UL
0430 cb 62 79 05 e
5 21 27 9e 02 d4 35
d2 4b c9 bb 7b .
by..!'...5.K..{
0440 1d 8d e9 63 e
3 91 f5 37 7d 57 d7
4d c4 41 f3 a6 .
..c...7}W.M.A..
0450 b8 d7 1d 28 c
e d8 fc 75 fd 35 cf

fc df 3a 12 23 .
..(...u.5...:.#
0460 00 a8 14 42 0
6 67 13 01 62 28 25
ba b1 64 80 0d .
..B.g..b(%..d..
0470 8a 91 40 e1 3
2 ce 59 2d ca 49 1b
06 48 4b 20 85 .
.@.2.Y-.I..HK .
0480 42 9b 3a cc 9
1 b2 12 fa dd 34 67
da 75 14 5a c2 B
.:......4g.u.Z.
0490 c3 83 c2 ae 0
2 09 44 56 ad 33 45
d9 88 c8 d5 16 .
.....DV.3E.....
04a0 29 0f 63 14 a
9 9f 2a 9e ad ab a8
c2 98 4c 55 8c )
.c...*......LU.
04b0 b4 72 cd 23 2
a 19 9d e9 c9 6c ec
cf db 1e ba dd .
r.#*....l......
04c0 5e 54 d1 08 2
a 30 2e 49 61 fa 7b
2d 93 c8 b7 1b ^
T..*0.Ia.{-....
04d0 be 20 c4 99 b
0 86 c8 c2 f2 92 ac
6e 06 df 59 63 .
.........n..Yc
04e0 14 dd 2b 3c b
b c5 bd 3b 54 45 1a
29 31 92 0d 44 .
.+<...;TE.)1..D
04f0 42 6a 49 b1 c
3 07 c0 40 21 93 25
88 75 c9 e3 ad B
jI....@!.%.u...
0500 e8 4a 6d d5 3
e 33 75 e9 16 a4 77
37 ad c7 15 fc .
Jm.>3u...w7....
0510 f1 91 2b 58 d
6 8b 95 af 8f e7 9f
f6 2d 0b 22 7e .
.+X........-."~
0520 7e 29
~
)
No. Time
Source
Destination
Protocol
Length Info
240 8.871352000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1311 http49
574 [PSH, ACK] Seq=
142531 Ack=1 Win=46
Len=1257

Frame 240: 1311 byt

es on wire (10488 b
its), 1311 bytes ca
ptured (10488 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.921282000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.921282000 s
econds
[Time delta fro
m previous captured
frame: 0.112005000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11200500
0 seconds]
[Time since ref
erence or first fra
me: 8.871352000 sec
onds]
Frame Number: 2
40
Frame Length: 1
311 bytes (10488 bi
ts)
Capture Length:
1311 bytes (10488
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
297
Identification:
0xf1f4 (61940)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9

Protocol: TCP (
6)
Header checksum
: 0x3a39 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 142531, Ack:
1, Len: 1257
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1257]
Sequence number
: 142531 (relati
ve sequence number)
[Next sequence
number: 143788 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1

... = Push: Set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x796
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2517]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 11 f1 f4 4
0 00 31 06 3a 39 4a
7c 0c 8a c0 a8 .
...@.1.:9J|....
0020 01 0b 00 50 c
1 a6 2b ca 8e f0 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 79 60 0
0 00 38 ad 0a 69 08
ec 38 68 8a 7c .
.y`..8..i..8h.|
0040 38 71 5b 4c 3
e d6 31 79 b9 48 75
b5 bb b7 79 7b 8
q[L>.1y.Hu...y{
0050 1a f8 67 6b 5
6 53 fa 4d 8e be c3
e1 7f 19 69 57 .
.gkVS.M......iW
0060 d0 c7 94 8e 9
9 b8 39 cb af ef b5
a6 c0 d1 ae 71 .
.....9........q
0070 8d df 15 ef 1
e 3d 52 de 17 1f 7b
a2 38 c8 4c da .
....=R...{.8.L.
0080 a4 cf 85 c2 8
b 3a c3 54 04 4d 00
ff fb 92 04 e7 .
....:.T.M......
0090 0f f2 da 38 d
6 01 f1 42 e0 59 67
2a d0 3d 68 5c .
..8...B.Yg*.=h\

00a0 4c 85 37 56 0
7 c8 ab c1 8a a2 eb
00 f7 a1 70 cd L
.7V..........p.
00b0 d9 1f 4a 9e 7
6 a2 7b 7d 66 e0 1d
90 61 92 0b 55 .
.J.v.{}f...a..U
00c0 62 8c 87 21 4
9 7c 12 2d 27 47 1e
a4 1d 6d 9f 5a b
..!I|.-'G...m.Z
00d0 aa 03 b5 5a 2
d 1d 57 10 f2 6f 4d
4f 8a e3 da 35 .
..Z-.W..oMO...5
00e0 55 d2 7a 18 e
c 32 fa 44 65 b4 24
a4 01 d0 6f 06 U
.z..2.De.$...o.
00f0 0e 5a a9 78 6
4 be 5e a5 2b 59 99
d5 6e f5 fe d6 .
Z.xd.^.+Y..n...
0100 27 87 5f 8c 6
3 00 14 b0 c3 4f d2
79 27 14 24 5d '
._.c....O.y'.$]
0110 0c 43 3f f5 5
8 70 84 2a 54 85 d9
5f 36 f8 a7 a1 .
C?.Xp.*T.._6...
0120 dc 9c 43 14 4
0 54 31 fc 77 28 91
46 4c 20 ce b3 .
.C.@T1.w(.FL ..
0130 e1 ac 35 76 3
0 32 27 0c 6e f4 68
95 c8 f6 01 b0 .
.5v02'.n.h.....
0140 aa a2 38 4f 7
b e3 9a 59 94 c1 38
7d 62 1f 75 f7 .
.8O{..Y..8}b.u.
0150 3b ed 56 a5 d
f ff ab 69 4f c7 64
aa 33 73 ff 78 ;
.V....iO.d.3s.x
0160 f8 d7 fb 4b 9
7 3f 1d 73 e0 72 4c
df 75 bf 92 bd .
..K.?.s.rL.u...
0170 fd dc 43 d8 6
f 9b 81 ce 46 11 26
31 19 70 c8 77 .
.C.o...F.&1.p.w
0180 f5 82 19 1a 1
9 99 65 4e bb 52 ce
18 af 6b c7 fe .
.....eN.R...k..
0190 f6 52 b8 c2 d
f cb df 2c 19 57 81
06 e0 60 4e 75 .
R.....,.W...`Nu
01a0 f3 73 3e 34 4
4 02 1c 07 f0 1d 6e
61 f1 5c f4 61 .
s>4D.....na.\.a
01b0 9f d4 56 74 0

d bd b4 9b a9 4a 9f
7a 94 2a ae 36 .
.Vt.....J.z.*.6
01c0 de fe 7c fc 9
a 0b 22 55 ec 3a e7
9b dc 89 af eb .
.|..."U.:......
01d0 70 74 dc 93 c
0 7b ef 04 3f 51 40
a7 aa 35 3a b1 p
t...{..?Q@..5:.
01e0 80 8f 7c 75 8
a 50 61 ba cf 15 9f
b9 7f 89 f9 20 .
.|u.Pa........
01f0 dd 6a 91 27 d
f 0d 76 f3 d0 c4 95
32 84 8a 96 85 .
j.'..v....2....
0200 51 3c 9d 6e 4
a 19 25 61 8c c2 8f
41 ac 9b 73 98 Q
<.nJ.%a...A..s.
0210 c9 73 f9 e0 e
3 a7 98 d8 bc 09 01
01 a5 d0 e9 20 .
s.............
0220 58 ea 00 0c d
4 70 46 54 82 10 a1
64 ab 52 ff fb X
....pFT...d.R..
0230 92 04 e8 0f f
2 db 2e 55 83 18 32
60 5a c7 6a c0 .
......U..2`Z.j.
0240 3d e8 5c 0b b
0 ed 54 0c 4c cb 89
79 9f aa c0 f7 =
.\...T.L..y....
0250 a1 70 6c 87 f
e c2 67 2a a4 25 a6
19 22 b1 29 21 .
pl...g*.%..".)!
0260 88 c6 58 01 9
9 64 30 85 4b 81 c3
ba 38 51 89 9f .
.X..d0.K...8Q..
0270 74 dd 2d 6c c
2 67 81 07 59 d7 cd
bc ad 8c b0 b4 t
.-l.g..Y.......
0280 1f 5d f4 64 9
3 ff 24 14 49 ac 02
a3 54 59 aa a7 .
].d..$.I...TY..
0290 6a 57 21 a4 e
b f6 34 f4 c4 1d 62
0a d3 36 3e 5f j
W!...4...b..6>_
02a0 0c 8d b4 7e 6
b ea f9 d6 18 79 4f
52 ce 11 11 d9 .
..~k....yOR....
02b0 1c d2 a2 41 c
f 21 a5 23 7f ea 3c
52 84 ec 20 a0 .
..A.!.#..<R.. .
02c0 6c 11 e5 64 4
1 db 4b 2f 95 2e 20

a4 f6 85 f9 a9 l
..dA.K/.. .....
02d0 6b 3d f6 8f 5
4 f9 f5 3b 9c cc 2e
5e 8e 5e df bc k
=..T..;...^.^..
02e0 17 5e 8f 45 3
8 d5 a8 c3 5e fe 33
06 96 0a 93 92 .
^.E8...^.3.....
02f0 6b 4e 89 e3 1
e 93 cc bd af 3c b3
ad 56 14 6b cd k
N.......<..V.k.
0300 90 26 28 b0 9
0 61 07 c8 2d 2a a4
24 c4 50 ab 09 .
&(..a..-*.$.P..
0310 89 a8 08 8a 7
6 9c 7d b2 0d a3 e8
58 1d 05 5b 70 .
...v.}....X..[p
0320 cd 1a 6b a1 9
8 55 3e 84 3f e2 3c
3d 73 82 c5 48 .
.k..U>.?.<=s..H
0330 57 f8 7d a9 e
f ed 12 98 85 7d eb
fe f1 8d 64 59 W
.}......}....dY
0340 1a 0b d7 38 3
1 87 7d 30 88 be b8
58 bb 3c 53 ab .
..81.}0...X.<S.
0350 19 34 a1 1a 6
7 a3 4c 7e 98 1e d1
c3 26 44 0e 69 .
4..g.L~....&D.i
0360 67 1c 91 9f 3
9 06 d3 71 97 5a 5d
83 08 18 d4 fc g
...9..q.Z].....
0370 95 96 35 c5 d
2 ce 45 90 ce 62 4a
c0 f3 38 65 42 .
.5...E..bJ..8eB
0380 55 79 52 00 5
2 00 d3 3f 17 4e 12
36 dd 8e 75 64 U
yR.R..?.N.6..ud
0390 ec 66 61 e2 b
8 7b 1d e2 3a 8c 84
ce 34 7f c9 ac .
fa..{..:...4...
03a0 53 a7 85 13 c
f 9b f6 ed a7 45 64
b5 d2 6d fd fe S
........Ed..m..
03b0 d8 f9 5a 83 f
6 a9 e9 bd 0a 8a 21
4a 97 4b 9a e6 .
.Z.......!J.K..
03c0 a4 c9 cd 77 0
c 6d 68 d0 9a df 7a
6f dd b9 56 39 .
..w.mh...zo..V9
03d0 ff fb 92 04 e
e 0f f3 13 2f 55 03
18 5a 60 63 a7 .

......./U..Z`c.
03e0 0a b0 3d eb 5
c 0c 20 b1 54 07 e0
c9 81 56 95 6b .
.=.\. .T....V.k
03f0 00 f7 99 30 0
a 4e 1f a3 a0 e3 3a
8c 91 ea 46 93 .
..0.N....:...F.
0400 b4 3d 20 49 4
e 8d 4a 51 13 cb 09
1d 3e 85 a6 63 .
= IN.JQ....>..c
0410 59 8b d8 2d 9
c 3a 8e a0 ff c4 de
32 8f b2 cc 22 Y
..-.:.....2..."
0420 0d 83 d7 05 4
e 3e fa 1c c5 3c 08
87 52 f4 0e d6 .
...N>...<..R...
0430 33 0a 7c 8d 6
b 97 dc ee f6 93 ff
e6 ef 33 2b 5b 3
.|.k........3+[
0440 b7 96 ee f8 7
7 43 87 d0 00 a4 aa
28 43 90 31 ab .
...wC.....(C.1.
0450 6d d6 1f 4f 5
6 db 2d eb 6e b1 13
61 65 e0 a0 ac m
..OV.-.n..ae...
0460 2a 36 cb d6 5
e 7b 87 f0 86 c2 c5
8b 56 75 2a d5 *
6..^{......Vu*.
0470 9f b5 43 23 b
b 8d 7b 8c 69 a0 e3
85 8e 5a c7 dc .
.C#..{.i....Z..
0480 a1 9a 8f 08 8
5 13 9b 48 c7 73 f2
45 25 44 bb 5e .
......H.s.E%D.^
0490 b1 1f 1b 3d d
d 50 c5 be cb 71 f0
26 14 16 17 40 .
..=.P...q.&...@
04a0 04 98 d9 f7 4
7 24 51 00 47 13 6a
dc 96 28 bb 8f .
...G$Q.G.j..(..
04b0 62 e2 9b 6e 2
e ea 90 94 69 f5 98
21 6b 16 92 16 b
..n....i..!k...
04c0 0f 61 6c 1d a
1 07 0f f7 a7 e0 7b
80 b8 01 8f cd .
al.......{.....
04d0 21 54 be 83 7
a 16 d3 eb b7 7e 3e
82 98 80 af 5c !
T..z....~>....\
04e0 e4 35 6c 25 1
4 53 47 9d 09 9f 37
04 09 64 79 02 .
5l%.SG...7..dy.

04f0 8a 28 d4 cb 0
3 07 8d 41 d8 bc c2
ca 97 71 53 ab .
(.....A.....qS.
0500 9a bc 0c 32 4
3 e2 ab 68 d7 d2 65
eb 1a ac 20 60 .
..2C..h..e... `
0510 80 6a d2 0b 4
2 68 85 d0 d6 8a 52
36 93 9e 85
.
j..Bh....R6...
No. Time
Source
Destination
Protocol
Length Info
241 8.871533000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=143788 Win=38115 L
en=0
Frame 241: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
1.921463000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615221.921463000 s
econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 8.871533000 sec
onds]
Frame Number: 2
41
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke

d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De

fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f75 (20341)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 14378
8, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 143788 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001

0000 = Flags: 0x010

(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 240]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 75 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Ou@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 93 d9 50 10 .
....P..N.+...P.
0030 94 e3 18 d4 0

0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
242 8.966356000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=14378
8 Ack=1 Win=46 Len=
1260
Frame 242: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.016286000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.016286000 s
econds
[Time delta fro
m previous captured
frame: 0.094823000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09482300
0 seconds]
[Time since ref
erence or first fra
me: 8.966356000 sec
onds]
Frame Number: 2
42
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1

300
Identification:
0xf1f5 (61941)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a35 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 143788, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 143788 (relati
ve sequence number)
[Next sequence
number: 145048 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x06c
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 f5 4
0 00 31 06 3a 35 4a
7c 0c 8a c0 a8 .
...@.1.:5J|....
0020 01 0b 00 50 c
1 a6 2b ca 93 d9 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 06 c0 0
0 00 5e 21 62 21 8b
7e 50 39 53 4e .
.....^!b!.~P9SN
0040 8d cd 52 bc 8
9 1e e0 29 37 32 a1
70 99 9d b2 c5 .
.R....)72.p....
0050 72 cc 6c 64 b
2 4d 5a 0d 34 a5 be

d1 8d 09 42 b2 r
.ld.MZ.4.....B.
0060 0f 5a 2b 46 f
d c4 6a be 9c 58 6f
ed 91 b7 98 10 .
Z+F..j..Xo.....
0070 b8 9c b0 10 b
a 0d 8d 22 1c 35 50
a3 9a b7 b1 cd .
......".5P.....
0080 71 f5 04 ac 6
9 35 9c 7b 33 ff fb
92 04 ee 8f f3 q
...i5.{3.......
0090 00 2d d6 03 0
f 32 60 63 07 2a d0
3d 86 5c 0c 44 .
-...2`c.*.=.\.D
00a0 b5 58 0c 61 0
9 81 91 98 2b 40 f6
21 30 28 3c 45 .
X.a....+@.!0(<E
00b0 f2 86 10 3f 6
8 62 ea 89 46 44 4a
26 04 23 36 79 .
..?hb..FDJ&.#6y
00c0 dc 96 e5 6b 1
6 75 19 d4 61 e2 55
7b 98 3f 24 2e .
..k.u..a.U{.?$.
00d0 51 6b f9 57 0
6 76 90 00 d5 b7 21
f9 03 25 78 df Q
k.W.v....!..%x.
00e0 5f 5e 33 85 2
3 71 66 10 5e 20 e0
bf 95 9c c3 cb _
^3.#qf.^ ......
00f0 41 d1 eb b4 8
0 65 f3 aa 7b a1 a9
42 0a 69 f5 0b A
....e..{..B.i..
0100 8b c5 d3 15 1
6 d4 68 3e 75 8e 29
20 41 47 c4 1f .
.....h>u.) AG..
0110 4d e2 e5 d4 3
a 07 50 87 83 10 83
10 56 32 40 a2 M
...:.P.....V2@.
0120 6b 7c de b8 1
6 d6 be 5f 2c f5 c4
91 25 59 2b 26 k
|....._,...%Y+&
0130 b9 50 8c d5 f
5 8a cf f3 7d eb 7d
fd a2 36 39 51 .
P......}.}..69Q
0140 e5 96 cc 9b 8
4 ba a3 48 c7 bb 24
89 d2 f9 66 27 .
......H..$...f'
0150 a9 11 08 9a b
7 72 35 7a bb 64 3f
8b 69 45 5c 82 .
....r5z.d?.iE\.
0160 2c 69 80 49 b
7 5b 12 35 ae 25 3c
e3 31 c0 18 b0 ,

i.I.[.5.%<.1...
0170 3e 1f 24 28 b
4 4b e4 c8 1a 15 05
03 2f 6e 96 23 >
.$(.K....../n.#
0180 31 a2 16 c4 f
8 a0 78 f4 58 0f d8
a2 ef 3a 7b b4 1
.....x.X....:{.
0190 a4 a6 ca b7 b
9 97 49 51 81 8b 9c
e8 f9 c0 6e 51 .
.....IQ......nQ
01a0 c4 00 a8 31 4
2 96 0c ca 66 c0 a7
f0 8a d5 32 ea .
..1B...f.....2.
01b0 df fe 9c 99 3
d a4 be c8 5e 59 e7
7b 6c fc f8 da .
...=...^Y.{l...
01c0 03 92 ce cd 2
f 10 b1 d5 c4 7a 77
6c 7b 22 3d 0d .
.../....zwl{"=.
01d0 b5 bd 7c 2f f
8 7b 37 70 02 b2 88
18 b0 94 a4 98 .
.|/.{7p........
01e0 9b cf 58 93 3
f 00 55 1f 45 b6 f0
2a 24 6b 2f 75 .
.X.?.U.E..*$k/u
01f0 6d e4 8d 18 b
d 30 54 f9 e5 0d 4e
1f de 88 3f 32 m
....0T...N...?2
0200 eb 1e a3 2f 6
0 73 3f e9 ea e4 28
85 f3 f1 2d 1e .
../`s?...(...-.
0210 e5 5d ff d3 0
a a9 c5 bb 45 cf 3f
5e b0 b2 7f 32 .
]......E.?^...2
0220 38 21 26 b0 3
4 9c b6 86 ea ab 35
ff fb 92 04 e8 8
!&.4.....5.....
0230 8f f3 03 29 5
6 83 0f 1a 60 58 05
2a f0 61 23 4c .
..)V...`X.*.a#L
0240 0b f5 09 5e 0
7 bc 4b 81 90 22 6b
81 84 8d 71 ff .
..^..K.."k...q.
0250 7f 6f 74 ef 9
c 3f a9 fa 8b 03 4a
ab 49 1b 8e bf .
ot..?....J.I...
0260 51 69 6d d5 f
3 56 e3 2c 6a 89 c4
a9 72 12 61 2c Q
im..V.,j...r.a,
0270 21 0b 50 f4 7
3 d0 2a ae c2 a7 0a
ee f1 f3 f5 d3 !
.P.s.*.........

0280 44 fb bd 4a 1
b f6 e2 ea 9e 1f 26
70 5b 91 ca 86 D
..J......&p[...
0290 ea 46 d1 dd b
3 64 4f ee 73 96 5a
7a 5d 6f 66 92 .
F...dO.s.Zz]of.
02a0 ef 53 5f 91 f
a 16 85 52 99 dd 13
bb 32 a2 9e 53 .
S_....R....2..S
02b0 23 de f0 c8 3
a 24 b6 2e d7 59 58
18 4d 4c 5a 71 #
...:$...YX.MLZq
02c0 b6 5a ac 08 f
3 85 14 8e c6 66 85
f6 e3 e7 45 2e .
Z.......f....E.
02d0 cd 32 5f 3a 6
e e7 dc 51 79 a8 e4
93 2b 94 e6 60 .
2_:n..Qy...+..`
02e0 76 63 0e 75 5
c cc cc 8a b9 2c 82
9c c9 3d cf 96 v
c.u\....,...=..
02f0 99 b1 77 d2 6
f b0 63 1a 63 ff 4e
ca fd ff 71 de .
.w.o.c.c.N...q.
0300 4f aa 5a 97 2
d 2e dc 77 a4 7b 1c
f1 ef c2 ab dd O
.Z.-..w.{......
0310 79 49 d5 d4 2
e f3 e9 fd 02 a9 48
48 d3 5d 14 68 y
I........HH.].h
0320 5b 8d c4 20 5
0 c4 71 11 66 fd 87
b6 49 55 ce 31 [
.. P.q.f...IU.1
0330 a1 3e 59 9b 5
e 2e 03 84 b2 ae 92
94 fb 9f 4e e8 .
>Y.^.........N.
0340 89 46 91 ec f
6 2a 8c df cd a1 50
41 62 9e 7d 2c .
F...*....PAb.},
0350 47 3b 6a ee f
d 0a dd 3f 0b fe eb
ef 27 f8 d7 09 G
;j....?....'...
0360 68 89 39 e5 f
f 25 bd 56 d2 96 d9
df 4c 85 2b f2 h
.9..%.V....L.+.
0370 5d ad 9e 25 7
6 f7 4f f1 2d 83 2c
6e 1f 21 b0 8b ]
..%v.O.-.,n.!..
0380 42 01 7a 32 a
d 52 e0 f3 60 02 9c
a0 9a 5a 9b 02 B
.z2.R..`....Z..
0390 78 5e a0 6a 3

6 76 29 c4 76 9f c0
a4 a5 2d 7c fc x
^.j6v).v....-|.
03a0 c5 69 ce ed a
5 89 9e ee 06 b3 22
8a ac 4c 80 f0 .
i........"..L..
03b0 f2 32 06 07 0
c 6a c5 2f 2b 0a 21
2b ef 6a e3 a8 .
2...j./+.!+.j..
03c0 14 5d 4b 8f 8
a 8a d7 3a e5 ae a4
b1 4c ff fb 92 .
]K....:....L...
03d0 04 e9 8f f2 e
3 23 57 01 ef 1a 52
61 8b 7a e0 61 .
....#W...Ra.z.a
03e0 22 6e 0c 28 8
1 56 0c 60 a9 49 7a
8d 2b 01 87 a4 "
n.(.V.`.Iz.+...
03f0 e1 df f5 2a 4
5 e0 20 2b 1a 7a 1d
c7 89 58 5b 94 .
..*E. +.z...X[.
0400 c6 c2 87 bd 9
0 46 16 12 1b 6a 52
c8 ad 56 5a e0 .
....F...jR..VZ.
0410 f9 64 85 1b 1
e 36 29 ac 1d 6c 21
b9 45 2c d5 08 .
d...6)..l!.E,..
0420 0f 5c c8 48 c
9 71 16 b5 d6 22 5d
a4 f3 b4 cc a5 .
\.H.q..."].....
0430 47 f1 ca f3 0
9 19 54 2d 81 29 62
aa 80 52 c3 a3 G
.....T-.)b..R..
0440 ce 10 4b f6 2
c 08 a3 e4 45 d4 55
82 57 e2 b6 5e .
.K.,...E.U.W..^
0450 e1 67 ae e4 c
d b0 04 cb 12 a3 50
12 6b 82 be 90 .
g........P.k...
0460 5d b9 ef 4a d
7 2c a8 0a 6d eb 2c
97 3a 7b 83 a4 ]
..J.,..m.,.:{..
0470 6b 10 ee 12 a
c f0 40 a8 4e 54 99
84 52 8c 2d 95 k
.....@.NT..R.-.
0480 d8 e4 72 e9 d
6 78 b4 b7 be 4c e4
fb 4f ef f2 87 .
.r..x...L..O...
0490 81 0c 24 28 1
a 70 1a 05 42 d1 73
52 1c b1 94 39 .
.$(.p..B.sR...9
04a0 74 97 70 b3 8
7 b5 2e f1 b4 1d 30

e1 aa 31 30 61 t
.p.......0..10a
04b0 60 55 73 2c a
8 80 c2 23 86 05 2f
e2 cd 11 95 21 `
Us,...#../....!
04c0 1b ef 93 50 2
1 af 50 ab 8e b8 43
76 c7 0d a9 10 .
..P!.P...Cv....
04d0 cb 95 f8 bc 5
3 dd 5b 6e 08 29 15
6d b7 2c 18 d4 .
...S.[n.).m.,..
04e0 4a bb de 02 c
f fc 03 3c 4c 75 f6
97 78 c9 37 ff J
......<Lu..x.7.
04f0 8a c5 15 17 4
9 e3 ed 85 76 3e f0
6e 71 c0 2e b9 .
...I...v>.nq...
0500 23 a8 72 85 9
4 15 a9 aa 9b f6 de
36 c6 69 96 51 #
.r........6.i.Q
0510 34 2a 72 1a 5
0 b5 56 a1 18 e4 0d
1c 4e 58 fc c0 4
*r.P.V.....NX..
0520 f0 63
.
c
No. Time
Source
Destination
Protocol
Length Info
243 9.018357000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
877 http49
574 [PSH, ACK] Seq=
145048 Ack=1 Win=46
Len=823
Frame 243: 877 byte
s on wire (7016 bit
s), 877 bytes captu
red (7016 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.068287000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141

5615222.068287000 s
econds
[Time delta fro
m previous captured
frame: 0.052001000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05200100
0 seconds]
[Time since ref
erence or first fra
me: 9.018357000 sec
onds]
Frame Number: 2
43
Frame Length: 8
77 bytes (7016 bits
)
Capture Length:
877 bytes (7016 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
63
Identification:
0xf1f6 (61942)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3be9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]

Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 145048, Ack:
1, Len: 823
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 823]
Sequence number
: 145048 (relati
ve sequence number)
[Next sequence
number: 145871 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xf2b
7 [validation disab
led]
[Good Check
sum: False]

[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2083]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5f f1 f6 4
0 00 31 06 3b e9 4a
7c 0c 8a c0 a8 .
_..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b ca 98 c5 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e f2 b7 0
0 00 d3 40 a9 76 81
ff ab 2a b2 89 .
......@.v...*..
0040 e9 d1 f9 4a a
c 60 4a 2a 4c e1 8b
06 b5 cd a7 22 .
..J.`J*L......"
0050 7f 44 7a 9a f
2 57 6d 54 59 ee 93
7e fc 83 1f 23 .
Dz..WmTY..~...#
0060 0f 9d 36 0f e
9 67 30 e0 89 f6 36
89 e6 18 64 9e .
.6..g0...6...d.
0070 fb 1a ec 6c e
a 38 be 0c d2 61 a9
ad f3 4f de 22 .
..l.8...a...O."
0080 e7 f7 9a ff f
b 92 04 e9 8f f2 b9
1d d5 81 ef 32 .
..............2
0090 50 62 06 2a b
0 61 e8 4c 0b f4 8f
52 0c 60 c9 41 P
b.*.a.L...R.`.A
00a0 71 93 ea 81 8
7 99 28 77 fb ce 95
ee bf 3f f9 ff q
.....(w.....?..
00b0 fa 51 20 3b 8
5 a3 07 d9 65 a9 ca
3c e8 76 75 b0 .
Q ;....e..<.vu.
00c0 10 16 92 9d 2
5 3b 1c 7b f1 b5 fd
67 90 8b 74 bf .
...%;.{...g..t.
00d0 9a 76 db bf c
9 40 27 72 79 76 b8
d1 2d b8 99 9d .
v...@'ryv..-...
00e0 94 0f aa e7 0
e db b7 44 99 4a 31
37 ad 67 63 80 .
......D.J17.gc.

00f0 20 c4 4e 67 9
2 16 14 3e e8 89 67
5c 4b b9 34 95
.Ng...>..g\K.4.
0100 63 b4 8b 71 c
b 7d cd 79 ca df da
af d0 d9 8a a2 c
..q.}.y........
0110 40 2b 61 48 c
6 70 9e e8 04 ca c5
21 30 a3 d0 0a @
+aH.p.....!0...
0120 3e d9 95 a8 8
f 25 15 45 16 ed 58
fb 56 6a 16 00 >
....%.E..X.Vj..
0130 de 72 ee f1 9
c ab 98 4d 56 23 63
41 b9 35 d5 59 .
r.....MV#cA.5.Y
0140 40 73 67 ae f
7 a3 8c 35 0c 93 4f
1d a4 55 56 b0 @
sg....5..O..UV.
0150 86 dd 41 d7 8
4 87 bd ac 42 1c 6d
25 96 c3 28 8a .
.A.....B.m%..(.
0160 ee 16 62 99 7
b c7 14 96 6b 4f 14
26 62 95 b7 76 .
.b.{...kO.&b..v
0170 31 76 85 80 b
9 04 bc ee a6 aa 55
84 11 b0 5c c0 1
v........U...\.
0180 85 12 8c 8b e
b 84 aa 31 72 cd aa
ed 19 a8 57 94 .
......1r.....W.
0190 5f f5 b2 f7 f
c 37 c1 55 39 26 4b
d9 40 69 52 1c _
....7.U9&K.@iR.
01a0 5b 59 5e bd 7
f 5f 6a 26 47 3d 7c
ea d6 da 5e 45 [
Y^.._j&G=|...^E
01b0 20 f1 b0 28 1
8 4a 08 c2 86 e1 e1
32 a0 d3 df 7e
..(.J.....2...~
01c0 ab c9 95 f4 6
8 6e dc 03 2c b1 a2
ac 34 e1 72 5e .
...hn..,...4.r^
01d0 c4 d5 62 2c 8
8 b7 6f 00 61 61 d7
14 6f 8d 01 e3 .
.b,..o.aa..o...
01e0 04 f8 b4 20 1
4 e7 a5 40 93 1b ca
23 81 bc 7a 07 .
.. ...@...#..z.
01f0 d3 43 52 69 c
5 72 10 20 5e 41 35
02 4f 09 46 6e .
CRi.r. ^A5.O.Fn
0200 31 ce 96 a2 3

3 18 93 d8 8b 17 fa
40 9f f2 b8 42 1
...3......@...B
0210 33 96 0a 4c 7
a 70 ad 8b 35 09 1e
54 35 6a d1 be 3
..Lzp..5..T5j..
0220 c4 a1 8f a3 b
2 ff fb 92 04 ed 8f
f3 38 24 d3 83 .
...........8$..
0230 18 4a 52 5b e
4 fa 90 63 08 4a 0c
7c a5 4e 0c 61 .
JR[...c.J.|.N.a
0240 09 81 81 91 e
a 01 8c 31 28 da 7e
2b 55 ef ed 46 .
......1(.~+U..F
0250 c5 3d 6b c4 6
8 05 41 35 3a ed 01
ae 13 41 e1 88 .
=k.h.A5:....A..
0260 60 14 4b e9 4
e 5c 2e 56 8d d7 a1
c6 66 0a 63 98 `
.K.N\.V....f.c.
0270 ea dd e7 f1 8
f eb 78 fc a7 52 63
b9 d4 32 80 ae .
.....x..Rc..2..
0280 04 59 b6 3d 8
b 1f f6 c9 a5 fc b1
ed 46 38 5b db .
Y.=........F8[.
0290 55 7b 6a f7 3
7 e8 e9 c4 da 5c 95
b5 79 f5 b1 62 U
{j.7....\..y..b
02a0 9c a4 8f a0 b
d 6b 7a da ee e4 f5
a9 58 59 a0 76 .
....kz.....XY.v
02b0 c4 61 07 e8 b
f e4 24 2e ea b6 35
b4 be 44 78 7a .
a....$...5..Dxz
02c0 4c a4 99 d2 c
b 2f 0c 0f 42 e1 12
b1 45 a1 fa 8e L
..../..B...E...
02d0 fd 8e a7 b1 3
0 69 7b da 69 7f 29
13 62 09 e8 81 .
...0i{.i.).b...
02e0 0d 0f 27 65 2
9 c5 3b 73 e9 ef 8f
df 69 b9 90 66 .
.'e).;s....i..f
02f0 65 a9 14 eb f
f 5a 7f 71 cb 42 5e
e4 3c 55 9a 57 e
....Z.q.B^.<U.W
0300 ae d3 8e 7b a
9 98 25 fb d9 b8 f2
d1 a9 40 59 41 .
..{..%......@YA
0310 9b 21 41 13 0
8 72 65 40 e2 e8 61

2f d9 84 90 d5 .
!A..re@..a/....
0320 21 65 64 33 0
c 7b 52 e9 05 76 e4
d4 3f 39 47 53 !
ed3.{R..v..?9GS
0330 b1 42 a7 32 9
e a7 87 aa db 37 2f
9a 17 64 e0 ec .
B.2.....7/..d..
0340 6a 45 20 26 6
4 81 50 d4 7d 9d a2
c9 37 a9 b4 cd j
E &d.P.}...7...
0350 26 03 c3 5b a
4 fe 95 b4 8c ce 38
82 26 d2 ca c6 &
..[......8.&...
0360 6f 3d b8 51 f
a 8b 5d 8d aa 5e 4f
47 a5
o
=.Q..]..^OG.
No. Time
Source
Destination
Protocol
Length Info
244 9.018533000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=145871 Win=38745 L
en=0
Frame 244: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.068463000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.068463000 s
econds
[Time delta fro
m previous captured
frame: 0.000176000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017600
0 seconds]
[Time since ref
erence or first fra

me: 9.018533000 sec

onds]
Frame Number: 2
44
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:

20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f76 (20342)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 14587
1, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]

Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 145871 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38745
[Calculated win
dow size: 38745]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 243]
[The RTT to
ACK the segment wa
s: 0.000176000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .

.;....`n.dx..E.
0010 00 28 4f 76 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Ov@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca 9b fc 50 10 .
....P..N.+...P.
0030 97 59 18 d4 0
0 00
.
Y....
No. Time
Source
Destination
Protocol
Length Info
245 9.032103000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=14587
1 Ack=1 Win=46 Len=
1260
Frame 245: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.082033000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.082033000 s
econds
[Time delta fro
m previous captured
frame: 0.013570000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01357000
0 seconds]
[Time since ref
erence or first fra
me: 9.032103000 sec
onds]
Frame Number: 2
45
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512

bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1f7 (61943)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a33 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 145871, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 145871 (relati
ve sequence number)
[Next sequence
number: 147131 (
relative sequence n
umber)]

Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x422
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 f7 4
0 00 31 06 3a 33 4a
7c 0c 8a c0 a8 .
...@.1.:3J|....
0020 01 0b 00 50 c
1 a6 2b ca 9b fc 9e
87 4e aa 50 10 .
..P..+.....N.P.

0030 00 2e 42 2d 0
0 00 6f 19 48 d0 d5
94 fc 44 e6 79 .
.B-..o.H....D.y
0040 85 be a5 71 d
3 a4 96 2e 62 00 83
19 b0 06 98 cc .
..q....b.......
0050 a9 52 1c 47 2
0 f1 06 2c 30 f8 09
cd 78 1b ae de .
R.G ..,0...x...
0060 d0 dc a7 a2 a
4 69 cd 14 94 3f 5d
e0 75 3b cc 53 .
....i...?].u;.S
0070 54 88 21 4e 0
5 6e a3 7b 8e af e2
07 ca c1 e7 57 T
.!N.n.{.......W
0080 0a a4 01 63 d
8 51 ef 28 e6 d5 2e
18 be ab 93 46 .
..c.Q.(.......F
0090 ff fb 92 04 e
8 8f f2 e3 24 d3 83
0f 4a 50 59 65 .
.......$...JPYe
00a0 7a 80 63 0b 4
c 0c 20 b1 4c 0c 61
69 81 80 15 e9 z
.c.L. .L.ai....
00b0 c1 9c 35 30 a
7 1f 7b 13 1a 8f e0
83 39 0b 94 99 .
.50..{.....9...
00c0 41 89 54 0f d
1 7d 4f 60 4c 6b 6f
08 cb eb 4e 23 A
.T..}O`Lko...N#
00d0 a5 25 1b 94 5
6 08 76 9d 3b 17 94
af 2b b2 1a 04 .
%..V.v.;...+...
00e0 3a 43 55 78 9
8 7c ce 2c e6 f2 97
81 32 2a 87 af :
CUx.|.,....2*..
00f0 65 2c 9e 39 d
e e4 67 5d bd 77 2a
d7 5e 05 74 ca e
,.9..g].w*.^.t.
0100 bc 20 2e 04 0
e 56 1f 74 96 d5 be
e4 2d 09 49 fc .
...V.t....-.I.
0110 cb ec 21 b2 5
3 16 7a b6 29 29 a5
95 51 ab 52 50 .
.!.S.z.))..Q.RP
0120 cf 4a 93 e0 6
c 96 e4 88 75 21 99
7a 75 c3 a8 0e .
J..l...u!.zu...
0130 4e 31 8b 1c d
1 aa 14 b1 6d fe aa
46 06 a6 ef 7f N
1......m..F....
0140 8c ee d9 9b 3

a f2 ef 11 4f c3 0f
38 75 61 54 79 .
...:...O..8uaTy
0150 33 a0 2f 9b c
f cf a5 fe c3 ff ef
ff f5 eb b7 d9 3
./.............
0160 d3 4c a3 f2 c
c 8f d8 8f a2 d0 17
26 b7 32 4c 00 .
L.........&.2L.
0170 d8 64 b9 06 6
5 cb 44 98 46 b1 8d
61 fa 0a 48 61 .
d..e.D.F..a..Ha
0180 92 c0 d3 35 d
b 61 6c 24 38 91 1e
a7 03 5a 34 c8 .
..5.al$8....Z4.
0190 f5 97 a9 82 2
3 31 95 cb 85 bb 46
9b 91 84 d4 6c .
...#1....F....l
01a0 3a 86 77 b5 1
c d5 20 f1 84 11 3d
c9 68 9f 8a 17 :
.w... ...=.h...
01b0 15 35 7a 4c 4
1 70 b1 0b d7 86 9c
cf 68 9e 96 0b .
5zLAp......h...
01c0 0c 73 e6 5c 9
6 2c 3e 09 a6 85 4b
88 1d 24 3d 48 .
s.\.,>...K..$=H
01d0 7b d0 9e 1e 4
0 7b ee 1c d4 2a a2
a1 48 08 3c a2 {
...@{...*..H.<.
01e0 6f fb 82 9c 1
2 fc a8 7d 43 d0 03
98 f2 af 52 96 o
......}C.....R.
01f0 54 ad 5e db 9
f 23 40 c5 c7 2c 6c
89 4a e1 07 c0 T
.^..#@..,l.J...
0200 76 33 89 fc 8
6 70 cf ef b0 ce cd
22 9f 79 14 e1 v
3...p.....".y..
0210 5f df d5 45 7
0 a1 f1 fd e2 b8 4a
a7 90 6c 0d b7 _
..Ep.....J..l..
0220 d5 83 60 7e 3
f cd 22 37 7e 77 07
ec 5e 42 df bf .
.`~?."7~w..^B..
0230 68 67 ff fb 9
2 04 ec 0f f3 0d 2c
d3 83 0f 42 60 h
g........,...B`
0240 63 04 aa 70 6
3 0c 4a 0b f1 0b 56
07 bc 6b 81 6c c
..pc.J...V..k.l
0250 11 aa c1 87 a
1 28 65 50 a7 9d 75

e4 0e 89 80 ae .
....(eP..u.....
0260 53 2e 81 5b 9
0 93 67 2a 22 8d 38
9a 1c ac e9 80 S
..[..g*".8.....
0270 90 98 b8 94 f
5 6e 50 53 1b e4 6a
2d 98 c8 24 22 .
....nPS..j-..$"
0280 ed 2a 16 e0 3
f ea ff c0 c2 cd 8c
fe 9a b0 b5 2b .
*..?..........+
0290 05 57 bf a7 4
f 7f 3b b4 59 97 16
ff b9 17 b1 ad .
W..O.;.Y.......
02a0 eb 7a 7d fa 6
2 ba 78 f7 f6 4b e6
de 4b ef e9 f9 .
z}.b.x..K..K...
02b0 6c ff fa ee b
5 b8 b5 5b e0 d8 15
72 22 c3 47 01 l
......[...r".G.
02c0 11 dd 64 09 a
b 09 fa c9 7d 66 94
d2 c9 ec e5 3a .
.d.....}f.....:
02d0 a5 ac 8b d2 4
7 3b 2d 6b a8 10 75
38 cf ae ac f5 .
...G;-k..u8....
02e0 77 82 b1 62 0
5 5e 37 1b 3f e5 a0
f8 fa a6 5e 07 w
..b.^7.?.....^.
02f0 58 99 e0 69 6
4 4a 81 b7 b6 25 12
b5 b6 63 0a a6 X
..idJ...%...c..
0300 5a 55 c2 59 6
0 2b b8 55 cb 3c 58
3a ae 45 72 b9 Z
U.Y`+.U.<X:.Er.
0310 e9 19 6d 0e 4
3 5c 33 5c c6 72 20
0e 20 90 01 9f .
.m.C\3\.r . ...
0320 8d d1 38 50 8
8 ec c1 20 a7 e3 03
4f 94 f7 37 f5 .
.8P... ...O..7.
0330 81 3a 75 2a d
4 eb 3e 1e 44 ed aa
f8 d1 cf c4 4d .
:u*..>.D......M
0340 4d 82 b9 42 2
0 9a 82 99 d5 51 12
9b ff 73 cf c7 M
..B ....Q...s..
0350 fc c9 ff ad b
a da c9 ec bf d9 53
ff d7 db 5d 6a .
.........S...]j
0360 35 98 86 a5 9
1 05 76 4f 44 a0 10
d4 3b ff 14 02 5

.....vOD...;...
0370 ca d4 7b 12 8
6 bd bc ad 4c c0 a3
03 41 21 e1 e8 .
.{.....L...A!..
0380 fa 08 12 70 5
9 35 36 95 55 24 55
9a 20 8c ec f5 .
..pY56.U$U. ...
0390 53 33 40 c1 6
7 a5 5a 2d 91 30 b5
b8 fb 4b 69 42 S
3@.g.Z-.0...KiB
03a0 a6 26 8c 22 5
6 fe 57 93 d7 bb 6a
53 4b 7e 7a 86 .
&."V.W...jSK~z.
03b0 29 19 4c 2a 3
d fc 45 2b df b9 12
85 8d 7c b5 f9 )
.L*=.E+.....|..
03c0 e9 c1 26 09 6
0 84 aa 18 5f f4 ac
27 ff 7b 6b fb .
.&.`..._..'.{k.
03d0 c7 5e 7f 7f f
f fb 92 04 eb 0f f2
ea 23 d6 03 0f .
^..........#...
03e0 1a 52 5e 44 6
a b0 61 e3 4a 4b 3c
8f 52 0c 61 09 .
R^Dj.a.JK<.R.a.
03f0 41 91 16 a9 c
1 8c 25 30 f8 49 44
3f a9 0d 6f d1 A
.....%0.ID?..o.
0400 fe b5 04 10 a
8 cc cd 91 8b 46 17
19 9a 86 a4 fa .
........F......
0410 4a 5e 30 41 d
7 3b a8 d7 9e c6 8e
42 b4 f3 b5 8a J
^0A.;.....B....
0420 9d 2e 65 75 6
a 47 09 ab 1b 42 1a
4c e9 2d c8 20 .
.eujG...B.L.-.
0430 79 71 0c 49 6
0 eb 6b 03 11 91 28
98 7a a2 d5 2e y
q.I`.k...(.z...
0440 f9 70 f4 1b 1
9 fe 9b 69 5a 54 d8
b5 87 4c 37 c7 .
p.....iZT...L7.
0450 b1 ac bf d6 3
4 6a da 1c ef 09 3d
ad 75 67 ff d5 .
...4j....=.ug..
0460 ff d6 a4 01 a
0 04 9d a7 60 69 34
37 52 23 d1 db .
.......`i47R#..
0470 ac 46 db ec f
3 44 4d fd 25 32 e1
69 a9 26 a3 a5 .
F...DM.%2.i.&..

0480 55 5c 92 20 e
f 43 d9 d7 51 a7 c2
37 43 6f dd 58 U
\. .C..Q..7Co.X
0490 ac fe 53 72 6
9 cc b7 0b 85 05 43
e5 d9 d5 07 82 .
.Sri.....C.....
04a0 63 f9 a1 d6 0
9 25 d4 5f 36 ca ad
03 84 e7 9b 15 c
....%._6.......
04b0 9d dd cd b9 0
f e6 ad 6a d8 b3 6b
e7 f7 ef 72 e5 .
......j..k...r.
04c0 77 55 ed f5 1
7 54 d1 08 d3 38 7e
e2 db 03 5b 33 w
U...T...8~...[3
04d0 93 4c 86 6d 1
7 58 10 b4 93 71 94
05 df 5f 20 40 .
L.m.X...q..._ @
04e0 0f 2a 77 39 7
a c8 6a 33 92 6c 6a
90 9c 69 90 fc .
*w9z.j3.lj..i..
04f0 dd ac e3 50 a
8 0a a4 dc b6 97 3c
a2 7e 2e 04 63 .
..P......<.~..c
0500 4b 58 ac ac 8
d ea a6 3d 87 e7 b1
fa 89 20 de 48 K
X.....=..... .H
0510 66 e4 a4 4e 3
5 bf 05 4b ff 9d 43
6f 3d 7f 3f d4 f
..N5..K..Co=.?.
0520 b1 2d
.
No. Time
Source
Destination
Protocol
Length Info
246 9.165741000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
883 http49
574 [PSH, ACK] Seq=
147131 Ack=1 Win=46
Len=829
Frame 246: 883 byte
s on wire (7064 bit
s), 883 bytes captu
red (7064 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})

Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.215671000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.215671000 s
econds
[Time delta fro
m previous captured
frame: 0.133638000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13363800
0 seconds]
[Time since ref
erence or first fra
me: 9.165741000 sec
onds]
Frame Number: 2
46
Frame Length: 8
83 bytes (7064 bits
)
Capture Length:
883 bytes (7064 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)

Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
69
Identification:
0xf1f8 (61944)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3be1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74

-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 147131, Ack:
1, Len: 829
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 829]
Sequence number
: 147131 (relati
ve sequence number)
[Next sequence
number: 147960 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46

[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x1cc
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2089]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 65 f1 f8 4
0 00 31 06 3b e1 4a
7c 0c 8a c0 a8 .
e..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b ca a0 e8 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 1c cc 0
0 00 ab fd ed d6 66
8e 19 33 91 d4 .
.........f..3..
0040 80 08 a2 15 1
9 28 92 ad 80 c3 cc
41 81 aa f3 a6 .
....(.....A....
0050 5f b9 0c ec a
e 1b 6b ec 35 4b df
e7 2e 5d 21 79 _
.....k.5K...]!y
0060 21 6e dc fd 3
d 04 b2 37 18 b5 42
32 03 34 80 08 !
n..=..7..B2.4..
0070 35 24 50 6f 1
1 b4 cb 76 fe 36 2a
8f 51 8a 27 af 5
$Po...v.6*.Q.'.
0080 4a 29 4c 63 d
2 86 a8 aa 3b bf ff
fb 92 04 ed 0f J
)Lc....;.......
0090 f3 2c 34 51 8
3 39 4a e0 60 65 9a
40 67 0b 4c 0c .
,4Q.9J.`e.@g.L.
00a0 48 d5 46 0d 6
5 6b 81 87 1a a8 c1
9c 2d 70 3d fd H
.F.ek......-p=.
00b0 be 03 3c 0c 3
8 e3 82 30 78 91 a7
df ea a8 b5 a2 .
.<.8..0x.......
00c0 ca 9b 36 0c 9
6 2d 88 11 70 31 64

6e 21 c6 f2 4e .
.6..-..p1dn!..N
00d0 98 b7 b4 bd 1
3 08 f3 21 30 16 4a
be 96 c5 1b 88 .
......!0.J.....
00e0 e0 4c ef 5c 8
b d9 20 14 78 5b 55
fb 71 4a 2e 4b .
L.\.. .x[U.qJ.K
00f0 73 80 e4 12 c
c 32 6e b4 61 61 69
c4 23 a2 c1 8d s
....2n.aai.#...
0100 46 c2 81 3b 1
8 87 90 53 ce 95 1d
a0 b0 95 fd 9f F
..;...S........
0110 c9 1f ba 91 3
5 3b 6e 73 91 d5 96
65 ba 21 2c 65 .
...5;ns...e.!,e
0120 a5 dd 2f 8b 5
c 8d 09 c2 11 39 2c
81 a5 48 be 36 .
./.\....9,..H.6
0130 3d 2c 9e 86 c
f 9d 77 44 2a 1a 09
81 e5 b4 d2 b4 =
,....wD*.......
0140 ab 31 42 15 8
2 43 56 ae a0 ee d2
aa 55 d7 f4 5e .
1B..CV.....U..^
0150 54 d4 a6 95 d
b a3 2f e4 66 31 8d
b4 e6 10 5c 48 T
...../.f1....\H
0160 81 70 6c db d
6 9b 48 c1 00 c7 7f
a9 62 fb 9f de .
pl...H.....b...
0170 90 30 e9 50 b
4 96 e6 16 ee 2b ab
d1 d4 c2 f3 08 .
0.P.....+......
0180 d0 2d f8 21 2
2 10 83 c4 11 05 28
60 26 44 8e f3 .
-.!".....(`&D..
0190 44 32 40 9a 4
f 63 a4 17 7a 99 fc
a7 44 05 47 9c D
2@.Oc..z...D.G.
01a0 b2 35 32 d7 5
a 6c 82 53 8c f2 49
d9 ba 50 18 e6 .
52.Zl.S..I..P..
01b0 44 f3 22 48 2
8 93 15 0b 4c 11 74
47 b1 1a cb 64 D
."H(...L.tG...d
01c0 46 f6 7a d6 8
a 9f 7a c7 91 e5 ab
a6 cb ea 31 66 F
.z...z.......1f
01d0 8e 71 b5 fd 7
f e8 90 43 b0 eb 2f
49 b6 3c b9 82 .

q.....C../I.<..
01e0 c3 71 e9 6d 4
a 58 7a 55 8b c8 44
be 71 69 fc 1e .
q.mJXzU..D.qi..
01f0 b1 d1 c8 90 7
e e2 f3 f3 72 85 14
44 38 5d 58 dc .
...~...r..D8]X.
0200 f4 be 9e c4 1
5 8e f3 ef b2 17 56
e2 62 8a fd 95 .
.........V.b...
0210 04 93 55 d8 f
b 41 43 01 1d c8 1e
33 46 03 d0 91 .
.U..AC....3F...
0220 6b 3a c2 71 0
c 09 ff f7 b3 ff 50
c5 ff fb 92 04 k
:.q......P.....
0230 e7 0f f2 fe 2
c d3 83 18 4a 60 5f
86 aa 30 67 27 .
...,...J`_..0g'
0240 5c 0b 9c c3 5
2 0c 69 29 89 6f 95
e8 c1 9c b5 30 \
...R.i).o.....0
0250 7e 28 7b 17 0
c b4 a3 41 24 08 8a
49 22 4d 30 75 ~
({....A$..I"M0u
0260 92 b9 3b d1 4
e 58 c3 00 b5 46 f2
d7 90 25 d7 4b .
.;.NX...F...%.K
0270 70 79 9d c7 5
1 c3 6f 93 b1 71 c3
f2 27 5f 1e cd p
y..Q.o..q..'_..
0280 35 c7 a6 9b 3
9 1d 19 44 e8 f0 3f
c9 3a 16 d8 76 5
...9..D..?.:..v
0290 ed 70 cc cf 6
8 09 c7 b1 6f ec f1
10 e5 fd 35 01 .
p..h...o.....5.
02a0 81 c2 9a c5 3
5 48 be 91 28 10 05
03 f0 45 ca 11 .
...5H..(....E..
02b0 90 f3 db eb 6
d 11 89 52 32 bf ef
e0 58 e0 a3 03 .
...m..R2...X...
02c0 8c 60 53 8b 0
9 19 4e 50 51 83 a4
98 8c f4 88 54 .
`S...NPQ......T
02d0 aa 12 d0 21 d
0 e5 30 04 ae e4 ab
19 59 6e 28 5e .
..!..0.....Yn(^
02e0 16 91 f0 5b f
d 29 80 97 ed 9c b1
ca 9f 86 90 76 .
..[.).........v

02f0 9c d7 db 6e 7
6 22 68 75 a8 9a 32
44 67 db 25 67 .
..nv"hu..2Dg.%g
0300 2e 1c 63 e7 9
9 11 0e 57 bf d9 fc
d3 58 cf ff ff .
.c....W....X...
0310 8d 43 f9 07 2
c fe 4a 91 b8 2b 42
40 b9 a1 47 a1 .
C..,.J..+B@..G.
0320 72 41 81 00 c
9 4d 03 44 f5 38 ca
05 79 33 30 8f r
A...M.D.8..y30.
0330 35 41 8a 4a d
5 6a e7 f0 e1 2a d3
28 b6 d3 d4 e4 5
A.J.j...*.(....
0340 ba 9d 4d 41 4
0 22 71 04 5e 7a 36
36 61 ef a6 c5 .
.MA@"q.^z66a...
0350 cb ab da a9 a
3 3b 7b dc c6 29 6e
a7 be f5 61 90 .
....;{..)n...a.
0360 39 47 d8 a8 f
7 ea 04 01 00 00 26
0f f5 f5 38 a1 9
G........&...8.
0370 cc b8 fa
.
..
No. Time
Source
Destination
Protocol
Length Info
247 9.165927000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=147960 Win=38222 L
en=0
Frame 247: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.215857000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615222.215857000 s
econds
[Time delta fro
m previous captured
frame: 0.000186000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018600
0 seconds]
[Time since ref
erence or first fra
me: 9.165927000 sec
onds]
Frame Number: 2
47
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f77 (20343)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]

Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 14796
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 147960 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38222
[Calculated win
dow size: 38222]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:

0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 246]
[The RTT to
ACK the segment wa
s: 0.000186000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 77 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Ow@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca a4 25 50 10 .
....P..N.+..%P.
0030 95 4e 18 d4 0
0 00
.
N....
No. Time
Source
Destination
Protocol
Length Info
248 9.223362000
Netgear_2e:1a:0
9
Broadcast
HomePlug
AV 60 MAC Manag
ement, Get Bridge I
nformations Confirm
ation
Frame 248: 60 bytes
on wire (480 bits)
, 60 bytes captured
(480 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.273292000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.273292000 s
econds
[Time delta fro
m previous captured
frame: 0.057435000
seconds]
[Time delta fro
m previous displaye

d frame: 0.05743500
0 seconds]
[Time since ref
erence or first fra
me: 9.223362000 sec
onds]
Frame Number: 2
48
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:homeplug-av]
[Coloring Rule
Name: Broadcast]
[Coloring Rule
String: eth[0] & 1]
Ethernet II, Src: N
etgear_2e:1a:09 (20
:0c:c8:2e:1a:09), D
st: Broadcast (ff:f
f:ff:ff:ff:ff)
Destination: Br
oadcast (ff:ff:ff:f
f:ff:ff)
Address: Br
oadcast (ff:ff:ff:f
f:ff:ff)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f
actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Netgear
_2e:1a:09 (20:0c:c8
:2e:1a:09)
Address: Ne
tgear_2e:1a:09 (20:
0c:c8:2e:1a:09)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: Homeplug
AV (0x88e1)
HomePlug AV protoco
l
MAC Management
Header
.... ...1 =
Version: 1.1 (1)

Type: Get B
ridge Informations
Confirmation (0x602
1)
.... ..
01 = LSB: Confirm (
0x01)
.... .0
0. = MSB: STA - Cen
tral Coordinator (0
x00)
Fragmentati
on Info: 0x0000
.... 00
00 = Fragment count
:0
0000 ..
.. = Fragment index
:0
Fragmen
t Sequence number:
0
Get Bridge Info
rmations Confirmati
on
Bridging: T
rue
Bridge Term
inal Equipement Ide
ntifier: 5
Number of s
tations: 4
Bridged Des
tination Address: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1)
Bridged Des
tination Address: A
pple_86:da:3d (04:e
5:36:86:da:3d)
Bridged Des
tination Address: H
onHaiPr_be:71:b9 (8
4:4b:f5:be:71:b9)
Bridged Des
tination Address: H
onHaiPr_c9:0e:4a (0
0:1f:3a:c9:0e:4a)
0000 ff ff ff ff f
f ff 20 0c c8 2e 1a
09 88 e1 01 21 .
..... ........!
0010 60 00 00 01 0
5 04 90 01 3b d0 17
e1 04 e5 36 86 `
.......;.....6.
0020 da 3d 84 4b f
5 be 71 b9 00 1f 3a
c9 0e 4a 00 00 .
=.K..q...:..J..
0030 00 00 00 00 0
0 00 00 00 00 00 00
00
.
...........
No. Time
Source
Destination

Protocol
Length Info
249 9.244368000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=14796
0 Ack=1 Win=46 Len=
1260
Frame 249: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.294298000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.294298000 s
econds
[Time delta fro
m previous captured
frame: 0.021006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02100600
0 seconds]
[Time since ref
erence or first fra
me: 9.244368000 sec
onds]
Frame Number: 2
49
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),

Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1f9 (61945)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a31 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 147960, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 147960 (relati
ve sequence number)
[Next sequence
number: 149220 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x9a2
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 f9 4
0 00 31 06 3a 31 4a
7c 0c 8a c0 a8 .
...@.1.:1J|....
0020 01 0b 00 50 c
1 a6 2b ca a4 25 9e
87 4e aa 50 10 .
..P..+..%..N.P.
0030 00 2e 9a 23 0
0 00 6e e9 14 80 56
ec 94 23 02 48 .
..#..n...V..#.H
0040 35 0d 0b 81 4
9 57 5d 91 a7 50 41
80 b6 0f ac 22 5
...IW]..PA...."
0050 6a 3b 42 b9 8
0 c1 bb f4 72 b9 54
be 02 43 a2 bc j
;B.....r.T..C..
0060 f8 4d 05 24 0
9 54 42 0e 41 a4 0e
18 20 8b 12 8e .
M.$.TB.A... ...
0070 a5 b8 78 ae 9

c 17 52 6d 5e 4b 9c
17 64 aa 9c 3e .
.x...Rm^K..d..>
0080 aa 97 76 10 8
f d7 da 21 ff f1 9a
56 96 d8 21 61 .
.v....!...V..!a
0090 f5 ff fb 92 0
4 ea 0f f2 e5 31 55
03 19 5a 60 5e .
........1U..Z`^
00a0 c4 da 50 63 0
f 4a 0c 2c e3 56 0c
69 6b 81 6f 14 .
.Pc.J.,.V.ik.o.
00b0 aa c1 87 ad 3
0 29 1d cc a4 05 14
a1 39 97 01 35 .
...0)......9..5
00c0 d5 b1 60 13 8
c d2 2f a8 95 79 6f
67 55 07 2a 89 .
.`.../..yogU.*.
00d0 53 05 52 73 b
1 b3 39 a7 a2 aa 15
4f 63 ed cb 71 S
.Rs..9....Oc..q
00e0 25 2a cc 7d 5
8 0c e1 36 59 a5 a6
01 2e cc fc 25 %
*.}X..6Y......%
00f0 37 47 3f 34 f
c 4e d2 6e fe e7 9b
9f 61 04 1c f0 7
G?4.N.n....a...
0100 68 f9 f9 20 1
1 f3 65 e2 82 82 82
d5 1b ad 03 98 h
.. ..e.........
0110 3d dd 13 a8 f
2 36 a3 77 f8 e5 b2
e9 30 57 59 51 =
....6.w....0WYQ
0120 a1 da 42 99 c
4 2b a9 38 ac 91 87
d8 30 63 d1 aa .
.B..+.8....0c..
0130 fb d9 ab 50 8
4 31 a8 7b 54 f3 de
83 0e dc 87 2b .
..P.1.{T......+
0140 55 b7 9c b5 1
3 66 7e 0c ab dc a8
88 47 cf 68 5e U
....f~.....G.h^
0150 78 62 f8 66 d
a 43 7f e1 91 bf e6
c1 0f 00 41 f4 x
b.f.C........A.
0160 45 05 05 07 c
e 50 16 89 c3 8b 2c
e4 17 72 cf 90 E
....P....,..r..
0170 43 49 a0 09 d
b 19 ab b0 a1 cd 95
09 eb 7d 20 75 C
I...........} u
0180 2a 02 3a e4 c
6 29 8a c1 e2 1b 6b

ac 0d 06 4d 92 *
.:..)....k...M.
0190 c8 72 1d 75 c
e 8d f6 16 ab 46 72
8a 88 83 5d 6f .
r.u.....Fr...]o
01a0 29 2c c1 21 2
b be 01 29 f7 40 c2
16 95 c7 f6 44 )
,.!+..).@.....D
01b0 20 10 33 19 e
5 06 62 39 e0 d1 90
7c 1b 1c 40 e2
.3...b9...|..@.
01c0 c5 c3 a2 c6 1
7 32 c2 21 f3 96 0e
23 47 09 17 87 .
....2.!...#G...
01d0 da f4 e7 18 9
d 7c 3e a3 85 cb bc
cf 2f 3b 4c 54 .
....|>...../;LT
01e0 20 bd 9f ce 6
8 10 74 09 82 cc 90
80 f2 86 ea 8a
...h.t.........
01f0 6d ad d8 d6 1
4 97 93 bd 88 c2 79
7f 2c cb 02 7b m
.........y.,..{
0200 6c e1 97 66 b
3 b6 f2 8e a0 0e 53
de 56 61 ce a6 l
..f......S.Va..
0210 63 92 ec b2 8
3 86 da f5 a3 b5 94
5c 85 96 a2 bb c
..........\....
0220 58 7e ac aa c
9 96 49 11 a7 62 a9
94 fb 03 f4 90 X
~....I..b......
0230 a9 4a 59 ff f
b 92 04 ec 8f f2 de
31 56 83 19 42 .
JY........1V..B
0240 60 63 c5 4a d
0 61 e6 4c 0c 9c a5
60 0c 60 c9 81 `
c.J.a.L...`.`..
0250 7a 15 ec 40 f
7 8d 30 95 68 4d 55
bd c7 5f 55 64 z
..@..0.hMU.._Ud
0260 13 b5 66 b0 5
5 27 43 0d 3b 91 98
12 72 b9 21 d8 .
.f.U'C.;...r.!.
0270 20 86 94 76 b
2 dc f2 03 d2 36 be
9a d4 79 32 7b
..v.....6...y2{
0280 34 fa 42 db 5
d e3 cf 8d 44 ce af
d8 cd 6a 43 1c 4
.B.]...D....jC.
0290 19 93 12 bc 7
d 5a aa 31 56 b1 5f
a5 19 4a d2 52 .

...}Z.1V._..J.R
02a0 fb fc cb fa 7
f b9 2a 6b 18 7c ee
27 bb fd 6f 5f .
.....*k.|.'..o_
02b0 3f f1 2c f3 0
f 45 05 99 65 cc c0
9a 4a 25 6e 4a ?
.,..E..e...J%nJ
02c0 9e 64 4a c2 8
c 2c 98 83 74 29 4d
c2 46 24 d3 cb .
dJ..,..t)M.F$..
02d0 90 fb 2b 01 e
9 b5 40 97 1b e7 59
0b 75 7c bb 6b .
.+...@...Y.u|.k
02e0 7e 4a 2a bf b
e 77 1d 6d 6f 25 64
a5 93 26 6b f1 ~
J*..w.mo%d..&k.
02f0 f3 d0 da ba b
a ec 20 bc 8a aa 10
ea 5f ea 4c eb .
..... ....._.L.
0300 9a 1a 7a d8 a
6 3e 58 c4 0a 4a 54
e5 04 08 99 e5 .
.z..>X..JT.....
0310 16 03 5d 8a 5
3 d5 59 db da b1 5e
3b 90 a1 0e 8a .
.].S.Y...^;....
0320 fd 67 0b 4b a
8 7f 2c 5e eb ea fc
58 90 8d 50 41 .
g.K..,^...X..PA
0330 ed 19 b8 15 9
4 8b 18 e9 37 cd 5d
c1 d5 c8 03 4d .
.......7.]....M
0340 69 ad c2 c5 a
b bc 36 d7 1a aa 8a
29 9d 84 c7 06 i
.....6....)....
0350 94 8c 8a 3d 9
d 98 e2 ac 46 36 46
1a 42 11 f2 4c .
..=....F6F.B..L
0360 a5 76 eb b3 a
7 52 fd d9 8c 2c a5
b7 46 5c 47 72 .
v...R...,..F\Gr
0370 83 a3 33 c8 5
d 14 a3 6a 79 c1 af
21 16 ac 62 b2 .
.3.]..jy..!..b.
0380 d3 94 72 18 5
7 6c a5 9b 93 49 45
ed 43 29 ef 26 .
.r.Wl...IE.C).&
0390 d8 0c ac 1b 1
2 9d e7 95 8c 1a ab
db f9 67 c5 52 .
............g.R
03a0 79 2f e5 b8 a
4 bb 7b a7 60 0c 1a
8b ef be 75 7d y
/....{.`.....u}

03b0 f7 5f 7f b6 b
f ad 39 d1 67 df dc
f9 7a 44 af 73 .
_....9.g...zD.s
03c0 89 af ca bd 6
1 40 29 1b f5 af b8
65 bc 53 be cf .
...a@)....e.S..
03d0 6c 95 8e 79 2
d ff fb 92 04 ea 0f
f2 fa 2c d8 81 l
..y-........,..
03e0 f8 2a 60 62 a
8 cb 10 61 e3 5c 0b
70 af 60 07 e1 .
*`b...a.\.p.`..
03f0 09 81 81 1c 6
b c1 87 95 70 2f 43
48 16 08 b7 44 .
...k...p/CH...D
0400 14 c7 31 8d 3
8 c7 28 36 d5 10 85
5d 8c e1 f2 c7 .
.1.8.(6...]....
0410 3c 41 a0 99 7
b bb 67 66 65 2b fd
fa 96 6b 5d f4 <
A..{.gfe+...k].
0420 d3 36 5f 69 c
4 ca 57 52 f7 f7 5f
f4 64 69 11 c3 .
6_i..WR.._.di..
0430 c3 29 22 4c b
8 b9 75 b5 2b d1 4d
00 72 a4 7d 7d .
)"L..u.+.M.r.}}
0440 6b 54 ab 9d 3
6 88 d7 6a fb 6e 7b
65 a5 54 05 18 k
T..6..j.n{e.T..
0450 3d 09 48 18 8
1 e8 19 e0 d8 26 a7
8c 38 06 12 cc =
.H......&..8...
0460 12 7e 03 26 b
4 34 75 9a 9e b9 d5
4d a8 5c b5 be .
~.&.4u....M.\..
0470 49 ca 01 b5 5
7 3e 49 64 5c 9c fd
41 f0 74 d7 b5 I
...W>Id\..A.t..
0480 06 5a 88 12 a
9 93 94 9f a7 45 c2
a7 9c e4 ba 69 .
Z.......E.....i
0490 7c ba da fc a
4 fe fe fe dd 12 c7
2a c7 3d 0e be |
..........*.=..
04a0 b3 85 13 3a c
2 e8 d6 06 5d 50 67
3c 8b 9e d5 4e .
..:....]Pg<...N
04b0 8e ab 89 98 7
4 e9 ba dc 36 0e 44
31 88 34 db 45 .
...t...6.D1.4.E
04c0 41 30 f5 b8 b

9 5f 98 e0 94 2f d8
2c e4 22 f8 db A
0..._.../.,."..
04d0 a7 2a 57 48 b
5 55 81 32 b5 9f 17
d4 b6 e5 dc 78 .
*WH.U.2.......x
04e0 f4 5b de bf b
7 b5 9c a2 dd 99 17
48 40 59 9b d4 .
[.........H@Y..
04f0 5a ed ad 0a 5
1 ea 58 7d 14 df 51
63 ef 83 f7 e9 Z
...Q.X}..Qc....
0500 47 33 16 9a 5
7 7f 54 bc 5c d4 aa
a2 3d 77 e3 77 G
3..W.T.\...=w.w
0510 17 22 97 17 7
a ea 22 ec 80 48 2c
bb 48 2a 24 94 .
"..z."..H,.H*$.
0520 96 a5
.
.
No. Time
Source
Destination
Protocol
Length Info
250 9.315370000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
889 http49
574 [PSH, ACK] Seq=
149220 Ack=1 Win=46
Len=835
Frame 250: 889 byte
s on wire (7112 bit
s), 889 bytes captu
red (7112 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.365300000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.365300000 s
econds
[Time delta fro
m previous captured
frame: 0.071002000
seconds]
[Time delta fro

m previous displaye
d frame: 0.07100200
0 seconds]
[Time since ref
erence or first fra
me: 9.315370000 sec
onds]
Frame Number: 2
50
Frame Length: 8
89 bytes (7112 bits
)
Capture Length:
889 bytes (7112 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls

tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
75
Identification:
0xf1fa (61946)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bd9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 149220, Ack:
1, Len: 835
Source Port: ht

tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 835]
Sequence number
: 149220 (relati
ve sequence number)
[Next sequence
number: 150055 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x62d
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f

light: 2095]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 6b f1 fa 4
0 00 31 06 3b d9 4a
7c 0c 8a c0 a8 .
k..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b ca a9 11 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 62 d5 0
0 00 cc 80 64 6b 78
1d 9a 37 15 12 .
.b.....dkx..7..
0040 13 b9 fc 16 a
a a8 51 e4 34 78 72
0a 3f a9 bc 5b .
.....Q.4xr.?..[
0050 6e 15 ea 5a e
9 18 be de da d2 cd
ed 37 d4 63 bc n
..Z........7.c.
0060 fc f2 ca cf d
2 cd 60 19 5d 19 fd
55 e6 eb e9 4a .
.....`.]..U...J
0070 7e ce 07 6a f
a 87 17 b3 15 b8 f8
79 73 0f 5a 4a ~
..j.......ys.ZJ
0080 01 30 5b 1e 9
3 ab 44 6b f8 bb 72
ff fb 92 04 ea .
0[...Dk..r.....
0090 0f f2 b3 28 d
7 83 19 32 50 53 e4
3a f0 3d e6 4a .
..(...2PS.:.=.J
00a0 0d 70 bf 58 0
7 e5 69 81 b5 1e 6b
01 8c 21 70 3b .
p.X..i...k..!p;
00b0 28 47 7f fe b
d 37 3b ac a0 0b d0
fe 28 12 e0 ba (
G...7;.....(...
00c0 2d 82 f4 3e a
3 ba 41 ce 96 59 02
b6 f2 8d a8 25 ..>..A..Y.....%
00d0 2c b6 6d 74 b
3 d7 cb b8 6f 26 a8
de 73 f7 9d ba ,
.mt....o&..s...
00e0 3d 5a a8 e5 c
4 b0 a4 2f c8 3c 83
e6 79 8e 2f 2a =
Z...../.<..y./*
00f0 84 cf 73 16 f
f 11 f7 d2 0f 2e 18
09 b4 92 1c 7a .
.s............z
0100 90 e0 16 d0 d
a 09 db 5a 56 e8 4e
71 97 e7 21 a0 .

......ZV.Nq..!.
0110 2b fe c5 d7 1
d a5 ea cc be 94 cb
25 52 38 ab 0e +
..........%R8..
0120 b1 02 16 92 7
2 ec c8 89 69 d1 33
22 d9 f6 d4 98 .
...r...i.3"....
0130 5a 3c 25 02 a
2 35 dc f2 8a e3 b2
13 ca 0c bc cb Z
<%..5..........
0140 8c 53 33 77 4
6 f5 05 91 49 65 0e
c4 9a 5e 99 da .
S3wF...Ie...^..
0150 d6 81 e3 02 5
1 d1 30 49 29 99 af
d0 1b 18 a5 84 .
...Q.0I).......
0160 32 67 5f a5 7
5 28 55 97 35 62 d5
ab 4b a6 b6 c3 2
g_.u(U.5b..K...
0170 b6 89 76 ea 8
e 56 48 19 db 08 6c
18 bb d3 52 0e .
.v..VH...l...R.
0180 7d f2 ae 10 d
9 cd 83 0c f7 46 4a
2b 16 bd 93 ec }
........FJ+....
0190 d8 60 7c b1 e
6 94 ea 19 ce 25 40
60 13 d5 46 4f .
`|......%@`..FO
01a0 86 04 d2 64 4
2 12 2e 1c 37 dc 83
66 69 8a 65 39 .
..dB...7..fi.e9
01b0 49 81 ed 01 2
8 8a 82 02 47 82 4b
24 5b 5c ea d2 I
...(...G.K$[\..
01c0 b0 2d 25 da 7
7 80 c8 29 8f b9 6d
4d 40 3d 66 75 .
-%.w..)..mM@=fu
01d0 7c bd 35 90 4
6 85 06 bc 15 8c 71
29 56 1d 65 31 |
.5.F.....q)V.e1
01e0 87 61 c1 e2 d
5 25 06 0e 75 e7 49
81 d2 db a7 5d .
a...%..u.I....]
01f0 e8 8b 47 a9 d
c 68 48 51 8d 05 9c
e7 e9 b1 5c 9c .
.G..hHQ......\.
0200 5b 9e 4a 80 4
2 ce 90 75 15 18 9f
6e 99 1d fb 99 [
.J.B..u...n....
0210 0e ad 2a 5d 6
3 15 fd 03 83 6a 9a
a0 f3 70 d6 b7 .
.*]c....j...p..

0220 74 6f 50 96 3
c d7 a1 df b8 3a 6d
8c f8 ff fb 92 t
oP.<....:m.....
0230 04 e7 8f f2 c
e 29 56 83 18 5a 60
60 65 3a c0 3f .
....)V..Z``e:.?
0240 08 4c 0b 9c a
3 58 0c 65 a9 41 75
91 ea c1 8c 21 .
L...X.e.Au....!
0250 28 b6 a2 ad d
2 5e 4b 10 c6 35 62
a1 dd a4 93 78 (
....^K..5b....x
0260 63 32 81 4a 1
2 a0 09 fa 90 20 97
bf 8f 5c 12 96 c
2.J..... ...\..
0270 aa ef 38 23 5
0 22 35 58 76 16 56
8a 13 f2 34 74 .
.8#P"5Xv.V...4t
0280 84 2b ba 86 4
7 d2 3d 5b 57 dd a0
8d b9 63 5c 36 .
+..G.=[W....c\6
0290 f7 06 53 1a 9
4 1f 22 d7 da f1 52
62 d3 bb 4b 26 .
.S..."...Rb..K&
02a0 54 6c ba 8b 3
6 30 26 72 7b 4c 57
2b 3a 89 85 aa T
l..60&r{LW+:...
02b0 ea 20 46 18 3
2 54 32 52 4a 30 96
e5 35 44 0b 6f .
F.2T2RJ0..5D.o
02c0 a9 86 07 55 a
2 19 2b 2a e2 06 0e
05 63 92 b2 12 .
..U..+*....c...
02d0 2c 86 31 56 c
6 ea 8e 29 74 69 35
89 08 dd d6 6f ,
.1V...)ti5....o
02e0 47 36 4d 37 0
f 2c c3 58 fa d4 29
e3 6f ff 2b 96 G
6M7.,.X..).o.+.
02f0 ff ef 1b f3 0
f 2c cc dd 80 d2 c7
ff 1c bf ba 22 .
....,........."
0300 e4 9f 5a 41 2
3 6f 8e d1 c3 32 0f
3d db a8 56 be .
.ZA#o...2.=..V.
0310 59 3f 47 fa 2
1 0a 74 21 95 1f 96
bb 9a 98 63 4d Y
?G.!.t!......cM
0320 3c 52 b9 48 f
1 34 d2 94 a8 9e 78
c3 42 9d a6 9d <
R.H.4....x.B...
0330 80 dd 16 a3 8

e 5f b5 1c 80 ec 66
d2 09 e4 67 18 .
...._....f...g.
0340 38 ca cf e7 6
5 72 c9 9c ee 03 7a
3b da 1e 5b 62 8
...er....z;..[b
0350 ff 8d c0 cb d
9 e9 2c 99 09 01 c3
6c 41 e0 65 07 .
.....,....lA.e.
0360 d0 45 09 1d 6
8 58 f2 8c 95 61 9b
1c 48 6d 94 f1 .
E..hX...a..Hm..
0370 77 9a 2b e3 3
f f2 2f 7f 97
w
.+.?./..
No. Time
Source
Destination
Protocol
Length Info
251 9.315549000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=150055 Win=38115 L
en=0
Frame 251: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.365479000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.365479000 s
econds
[Time delta fro
m previous captured
frame: 0.000179000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017900
0 seconds]
[Time since ref
erence or first fra
me: 9.315549000 sec
onds]
Frame Number: 2

51
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0

0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f78 (20344)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 15005
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)

Acknowledgment
number: 150055 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 250]
[The RTT to
ACK the segment wa
s: 0.000179000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 78 4
0 00 80 06 00 00 c0

a8 01 0b 4a 7c .
(Ox@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca ac 54 50 10 .
....P..N.+..TP.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
252 9.388318000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=15005
5 Ack=1 Win=46 Len=
1260
Frame 252: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.438248000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.438248000 s
econds
[Time delta fro
m previous captured
frame: 0.072769000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07276900
0 seconds]
[Time since ref
erence or first fra
me: 9.388318000 sec
onds]
Frame Number: 2
52
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]

[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)

.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1fb (61947)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a2f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 150055, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 150055 (relati
ve sequence number)
[Next sequence
number: 151315 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)

Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb48
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 fb 4
0 00 31 06 3a 2f 4a
7c 0c 8a c0 a8 .
...@.1.:/J|....
0020 01 0b 00 50 c
1 a6 2b ca ac 54 9e
87 4e aa 50 10 .
..P..+..T..N.P.
0030 00 2e b4 88 0
0 00 81 33 44 f2 cb
32 42 04 09 4c .

......3D..2B..L
0040 13 45 c3 a9 9
a 0b 4a 12 dc e3 ce
69 f4 ad a5 3d .
E....J....i...=
0050 6a c5 c0 98 5
c 17 64 3f 5c 60 f9
12 7b 1f f5 a0 j
...\.d?\`..{...
0060 2d ca 8d 8c 8
9 c5 fb 02 90 a2 69
ad 4e c4 53 64 .........i.N.Sd
0070 f5 b2 5e 6e 4
8 a4 52 5a 09 a4 2a
12 e8 f5 89 38 .
.^nH.RZ..*....8
0080 59 22 a5 b2 5
7 4d d0 67 59 b4 95
cf ff fb 92 04 Y
"..WM.gY.......
0090 ec 0f f2 e3 2
9 55 03 1a 6a 60 5d
e4 7a a0 61 e8 .
...)U..j`].z.a.
00a0 4a 0c 60 a3 5
2 0c 69 e9 41 93 11
ea 01 9c bd 28 J
.`.R.i.A......(
00b0 44 5e 68 8f 4
7 f4 7f ff f4 be 4d
30 43 90 16 d5 D
^h.G.....M0C...
00c0 b0 aa 86 46 0
c 34 3d 3d 02 a7 95
69 62 53 3f 0a .
..F.4==...ibS?.
00d0 3a 19 0c e7 3
1 63 30 eb 56 cf 3d
f1 8d 2a 2b 49 :
...1c0.V.=..*+I
00e0 4e 82 bf 25 8
b c8 24 7d d4 66 92
25 8a 5b 99 11 N
..%..$}.f.%.[..
00f0 0a 5b 3c a7 e
6 cb 40 a4 b5 8d b5
d6 b6 75 1f 4c .
[<...@......u.L
0100 50 4e 1e 07 8
f 40 a7 6d 0d 70 17
6e 27 ff 47 ee P
N...@.m.p.n'.G.
0110 ea d3 ff 53 6
8 d8 d7 51 32 50 3a
39 18 09 1c 24 .
..Sh..Q2P:9...$
0120 bb 2f 6b 5e 1
a 16 b0 e0 13 94 d5
cc 80 c3 81 cf .
/k^............
0130 7d 29 83 2b 1
8 6a 33 75 75 ea f4
79 74 ed bd d7 }
).+.j3uu..yt...
0140 66 db 99 ff b
d 39 fa 4d 7c 06 27
70 a1 dc 5c 72 f
....9.M|.'p..\r

0150 0b 13 fa 1a 0
2 43 1b 91 7a 00 e2
d9 9f 22 20 5d .
....C..z...." ]
0160 79 89 94 e2 e
7 96 bf b8 87 6f fc
a8 57 b5 96 5a y
........o..W..Z
0170 cf fe ee a7 b
1 0e ad 7c 1f 31 f2
a6 12 24 9c 86 .
......|.1...$..
0180 18 17 62 9d 1
2 64 f3 20 de c8 d9
00 1b b6 b9 44 .
.b..d. .......D
0190 e8 d2 34 1b 1
9 6f ad 52 06 b5 37
fe 80 0c 2d 1a .
.4..o.R..7...-.
01a0 9e 32 24 44 8
5 4c 5c 68 99 7b 47
a3 29 63 ea 1d .
2$D.L\h.{G.)c..
01b0 c7 05 34 68 6
6 ec ee f4 9d fa 8d
86 b6 ee d3 15 .
.4hf...........
01c0 78 9c fa 10 e
d 8a ba 65 fa da fb
47 3e cd 15 75 x
......e...G>..u
01d0 ff 76 bf d2 7
c a0 31 10 c5 a7 20
1d 3e a0 60 b4 .
v..|.1... .>.`.
01e0 cb 0c fb cf a
2 d4 75 25 02 e6 64
ca 76 88 12 aa .
.....u%..d.v...
01f0 5b 86 e4 3f 4
d 02 bd ba d6 85 34
45 e8 ad ab d5 [
..?M.....4E....
0200 da 8d 59 65 8
a 06 ac 3f 84 02 23
31 05 aa 2f 14 .
.Ye...?..#1../.
0210 4e a5 b1 2c 8
d 06 59 a8 87 38 6b
59 45 c2 04 77 N
..,..Y..8kYE..w
0220 a9 1d 49 0a 4
4 b9 bb f2 91 87 52
23 d5 ea ff fb .
.I.D.....R#....
0230 92 04 ea 0f f
2 f9 2f 54 83 3a 6a
60 5a 84 fa 80 .
...../T.:j`Z...
0240 63 0d 4a 0b f
c db 50 0c e9 0b 81
81 95 a9 81 8c c
.J...P.........
0250 2d 30 1e 2b 8
f 3e 59 8a 5f 7e 97
95 4a 84 56 06 0.+.>Y._~..J.V.
0260 66 dc 42 ea 8

e 00 c7 d2 02 af a4
d4 be c9 b3 d0 f
.B.............
0270 a4 9e 49 bc e
2 d7 e8 2a 35 6b fb
de ed 47 ec 5c .
.I....*5k...G.\
0280 c2 e1 6d f0 a
4 3d 27 10 a4 53 5a
d1 5a 69 30 ac .
.m..='..SZ.Zi0.
0290 7d 3c e9 40 b
4 fc df 12 e2 0a 1e
99 1b 54 bf 6a }
<.@.........T.j
02a0 fa 0d 38 ed 4
e 9a 82 df 2a bc a2
53 65 37 14 2c .
.8.N...*..Se7.,
02b0 b9 37 a8 53 f
5 25 59 cd df d9 d7
da b7 16 a0 22 .
7.S.%Y........"
02c0 0b 99 7a 85 1
e 17 e9 8a 0f bc fb
50 1e 13 7d b0 .
.z........P..}.
02d0 29 d3 2c 96 0
7 21 9f c9 e0 02 90
4f 89 de 4b a8 )
.,..!.....O..K.
02e0 20 c0 b4 02 8
0 71 be fe 9d e9 6c
ea 0a 4b 48 0f
....q....l..KH.
02f0 52 50 9c 53 5
e 74 a9 34 75 39 89
f3 36 9b 0d 21 R
P.S^t.4u9..6..!
0300 cc 3c ea 5b 8
e 10 5b 97 ea 1c 05
ac be 76 e8 56 .
<.[..[......v.V
0310 84 fa 18 08 f
e c4 5a e6 54 af fb
3f 5a 60 8b 16 .
.....Z.T..?Z`..
0320 30 14 a5 a0 6
0 02 02 e9 e6 3c 5e
d5 98 9a 72 dd 0
...`....<^...r.
0330 cc e7 9b 13 4
3 eb a5 a0 9f 89 b4
b6 81 77 0c fd .
...C........w..
0340 d3 4c f9 cc a
d 40 6b 42 dc ad 8a
18 02 6e a0 5b .
L...@kB.....n.[
0350 40 dd bc 18 a
6 ac 72 80 03 ba 4c
b8 27 15 97 b1 @
.....r...L.'...
0360 c7 1f a9 1d f
d 2c a9 7c f7 68 1b
64 38 74 eb 85 .
....,.|.h.d8t..
0370 c5 7d 82 54 d
7 29 f4 6e 46 e5 d5

7e 5c 82 f2 27 .
}.T.).nF..~\..'
0380 03 7e 22 18 5
d 61 30 ac d6 09 96
21 b4 eb 21 35 .
~".]a0....!..!5
0390 df 5d ec 81 1
6 f3 b5 88 a8 69 31
27 b1 3f 95 c1 .
].......i1'.?..
03a0 9d 81 c0 53 f
7 f9 0e 48 67 f1 fd
da de 6c 7e c2 .
..S...Hg....l~.
03b0 06 a9 2e b1 e
e 69 4b 18 e2 f3 a3
51 aa 83 b9 bb .
....iK....Q....
03c0 a6 6c 82 01 0
2 67 ea 1f 88 e8 fb
10 0f 3d 4c a4 .
l...g.......=L.
03d0 ff fb 92 04 e
c 0f f3 14 2f 53 83
58 6a 60 62 05 .
......./S.Xj`b.
03e0 da 50 67 0b 4
c 0c 04 c1 4e 0c 69
a9 81 76 15 a9 .
Pg.L...N.i..v..
03f0 01 ac 2d 30 5
3 fa 29 fd 46 fb 4b
9c df ff ff 4b .
.-0S.).F.K....K
0400 35 55 82 9e 0
4 68 25 28 11 02 b1
ca 17 64 fd c5 5
U...h%(.....d..
0410 0e 93 51 73 2
5 b2 5b 60 e1 58 87
61 6f e2 76 b1 .
.Qs%.[`.X.ao.v.
0420 ca 78 85 bd a
8 99 11 e7 3e ad 2c
b6 51 0f 32 c7 .
x......>.,.Q.2.
0430 e1 95 33 09 7
8 56 0e ba 8e 0f 14
d1 a9 8c 4f a9 .
.3.xV........O.
0440 73 23 c5 69 2
2 83 aa 71 39 e6 49
99 93 66 a9 22 s
#.i"..q9.I..f."
0450 73 52 ad a7 e
6 3f a5 95 39 0c f9
64 df ca 37 b5 s
R...?..9..d..7.
0460 9e 21 20 53 a
8 42 90 e1 07 2c 2d
69 f2 75 d3 45 .
! S.B...,-i.u.E
0470 d9 5f 47 71 c
2 c3 3f aa d7 37 28
d1 01 14 a0 a9 .
_Gq..?..7(.....
0480 28 a3 bb 4a 1
7 30 2c e6 47 62 de
2f d5 ea e6 d9 (

..J.0,.Gb./....
0490 45 02 b0 bc 1
0 4c 8a 90 7a c9 eb
6e 62 35 f4 d6 E
....L..z..nb5..
04a0 66 56 1e dc a
c b8 99 74 91 09 c1
43 a9 21 26 37 f
V.....t...C.!&7
04b0 57 71 8c 40 4
3 35 52 46 df fc 00
b1 7e 9e fe c5 W
q.@C5RF....~...
04c0 4a c1 11 45 e
2 07 98 0b 0c 43 41
71 4b b8 a9 64 J
..E.....CAqK..d
04d0 14 45 50 e5 0
f d9 97 1c 59 72 8b
69 2e a5 a6 87 .
EP.....Yr.i....
04e0 d2 75 6e 58 8
9 4b 2e 4b 48 ab 9d
ff b8 e0 c4 a0 .
unX.K.KH.......
04f0 49 db 15 ed 7
2 aa 74 51 05 10 95
be 90 b8 86 a3 I
...r.tQ........
0500 54 0a 6c bd 3
2 b7 a2 75 b2 0a 9d
a6 14 ce 2d 7c T
.l.2..u......-|
0510 c9 b6 59 a3 3
e ed e6 54 a2 f9 da
f4 51 cb 7f eb .
.Y.>..T....Q...
0520 79 65
y
e
No. Time
Source
Destination
Protocol
Length Info
253 9.461374000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=15131
5 Ack=1 Win=46 Len=
1260
Frame 253: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:27:0

2.511304000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.511304000 s
econds
[Time delta fro
m previous captured
frame: 0.073056000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07305600
0 seconds]
[Time since ref
erence or first fra
me: 9.461374000 sec
onds]
Frame Number: 2
53
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1fc (61948)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a2e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)

Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 151315, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 151315 (relati
ve sequence number)
[Next sequence
number: 152575 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc

aling factor: -1 (u
nknown)]
Checksum: 0xe97
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 fc 4
0 00 31 06 3a 2e 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b ca b1 40 9e
87 4e aa 50 10 .
..P..+..@..N.P.
0030 00 2e e9 74 0
0 00 09 ee ab 52 81
87 a6 e9 f2 a3 .
..t.....R......
0040 0f bb 09 91 3
c ce 81 e1 2c 44 71
eb 41 cc 23 ba .
...<...,Dq.A.#.
0050 2c 01 12 11 0
4 cd 58 a1 94 88 41
87 2c a3 c7 2d ,
.....X...A.,..0060 c8 62 d9 6f f
7 57 95 1c 1b e5 05
67 49 85 88 cf .
b.o.W.....gI...
0070 e7 88 11 4e 8
4 c6 8a e0 d4 c4 68
5c 94 f0 07 96 .
..N......h\....
0080 69 8a 91 d6 e
5 4a ff fb 92 04 e9
8f f3 05 37 d4 i
....J........7.
0090 03 59 6a e0 5
e 85 fa 40 67 0d 4c
0c 3c c1 4e 0c .
Yj.^..@g.L.<.N.
00a0 e9 a9 89 80 1
a 68 c1 9c b5 70 0c
57 98 cb f7 20 .
....h...p.W...
00b0 5f d3 f2 88 d
e 13 06 43 18 69 26
68 06 09 23 40 _
......C.i&h..#@
00c0 13 6a a3 54 9
3 2c 3a 5d 27 32 26
9c 6c 00 c0 68 .
j.T.,:]'2&.l..h
00d0 63 70 89 6b 7

5 44 8a 5c a7 2e 2c
81 e1 a4 7f fd c
p.kuD.\..,.....
00e0 69 f2 e9 96 2
f 24 3c 18 c0 4a c7
81 38 23 9f cc i
.../$<..J..8#..
00f0 d3 3d a9 22 b
1 d5 68 67 c9 12 fb
ca d9 96 6c 6e .
=."..hg......ln
0100 ed cc 13 41 7
c c0 ce b4 e5 d3 56
d8 63 5d 42 5a .
..A|.....V.c]BZ
0110 db 4a 05 53 5
d 89 da 20 06 a6 20
f4 8a e6 59 48 .
J.S].. .. ...YH
0120 5a c9 86 86 7
6 ad ab 0c 10 8a 37
f7 2b 11 85 26 Z
...v.....7.+..&
0130 29 1c a6 81 2
2 6e e8 8d c8 72 98
a5 cf dc f4 5b )
..."n...r.....[
0140 0c bf 74 fb d
2 ce b5 06 d5 f6 3a
8d 21 9d 9c a5 .
.t.......:.!...
0150 fe 6e c5 33 2
4 5a bf 86 64 a6 d6
d9 68 de fa da .
n.3$Z..d...h...
0160 d7 02 41 3b b
f bd df df af 78 44
3d ac 24 97 ae .
.A;.....xD=.$..
0170 e8 56 88 29 a
8 97 43 08 75 89 03
43 a6 9c b6 20 .
V.)..C.u..C...
0180 2c 31 f4 69 e
6 cf 2d 59 7d 9d 60
43 10 e4 65 fe ,
1.i..-Y}.`C..e.
0190 58 83 44 f6 d
5 5b ac 89 ee 98 c7
96 92 b1 4f fc X
.D..[........O.
01a0 af 54 10 3f 2
6 19 2b c8 ba d5 e9
09 08 17 bf 14 .
T.?&.+.........
01b0 51 95 d6 a5 0
c f2 6d a8 c9 d8 c0
fa 3a cf 59 08 Q
.....m.....:.Y.
01c0 df bc 38 9b 7
f a5 17 ef f7 9f ed
2d 27 2d 0c 87 .
.8........-'-..
01d0 b3 d5 aa 6f 1
c 37 a9 fd 0e 53 18
11 f0 d9 18 72 .
..o.7...S.....r
01e0 a4 8c 3a 70 e
4 0e 72 dd 3a f0 43

42 a5 b5 00 8a .
.:p..r.:.CB....
01f0 27 c5 a0 4a d
c db 11 11 87 2c 4e
92 6f 0e 48 6d '
..J.....,N.o.Hm
0200 7f 33 e5 9f b
2 9f 38 18 0f 74 36
4d ae c7 09 21 .
3....8..t6M...!
0210 b1 6b 53 22 3
f 8f 65 a6 71 46 e4
f0 5d 5a a9 d0 .
kS"?.e.qF..]Z..
0220 18 42 91 ab 7
2 40 95 57 ff fb 92
04 e8 0f f2 df .
B..r@.W........
0230 3b d4 03 3a 5
2 e0 5c 65 da 40 67
2d 4c 0b b4 cf ;
..:R.\e.@g-L...
0240 4e 0d 69 6b 8
1 91 1a 68 81 ac a5
70 77 7f da ea N
.ik...h...pw...
0250 ba cd 0f d4 9
b 3f fa 91 55 2a c5
7a ec 03 52 95 .
....?..U*.z..R.
0260 89 06 10 26 a
c ea 41 21 d2 79 22
c6 80 36 d0 09 .
..&..A!.y"..6..
0270 48 1f f9 46 7
2 57 72 1f ed ba 7a
97 d0 3e 8a bd H
..FrWr...z..>..
0280 35 94 be 85 5
3 1a 3d 62 5b 24 1b
08 19 04 99 36 5
...S.=b[$.....6
0290 a4 a9 76 c3 c
1 fc 12 a9 ae a6 d1
fd f9 ab 2a ce .
.v...........*.
02a0 31 ec 9d b6 a
7 f9 b0 52 45 89 70
d3 8d 76 ed 95 1
......RE.p..v..
02b0 2d 23 7d 86 a
0 84 b5 0e d8 28 9b
7b 52 58 4a 6d #}......(.{RXJm
02c0 bb b1 11 6b 9
0 cc 3c 13 57 d2 22
cb e1 d9 3c da .
..k..<.W."...<.
02d0 5a 5c b1 da 5
9 f8 1d 0e 2a 33 2d
bf 85 d8 d5 e9 Z
\..Y...*3-.....
02e0 cd 31 39 c9 c
3 d1 23 45 06 0a 12
9a 30 4e bc 9c .
19...#E....0N..
02f0 8d 04 10 4e 9
4 55 f7 aa 4d 41 b3
35 3f fa 91 4b .

..N.U..MA.5?..K
0300 cd 44 e4 1b 0
8 98 0b 36 ea cf b2
41 e7 be f6 19 .
D.....6...A....
0310 8e 24 48 0a e
a 00 a9 9f d9 1b b1
05 ce b2 a7 4f .
$H............O
0320 07 39 d8 8e 5
1 d6 c6 ae 65 6a 61
64 8f 15 a5 06 .
9..Q...ejad....
0330 95 2e 4a 17 d
4 6b 6c a4 c4 e2 8c
8b 4c ac 84 47 .
.J..kl.....L..G
0340 b2 40 40 85 1
1 e6 e7 49 9b 40 c3
13 ce 9a 28 f9 .
@@....I.@....(.
0350 dc 17 8f 47 0
9 a6 fb 86 fa 4c 19
0f 07 40 72 68 .
..G.....L...@rh
0360 50 84 d9 c2 2
a 13 0b 12 57 14 40
f3 5c 54 cb b5 P
...*...W.@.\T..
0370 55 6e 09 0c 7
5 3f 0d c1 69 28 ca
42 2a 48 f7 ea U
n..u?..i(.B*H..
0380 c2 a6 7f 5c a
1 3b c6 a2 91 29 f9
3b f0 5b ba 69 .
..\.;...).;.[.i
0390 a8 be 74 fb 7
a d4 2f e5 51 9a 58
8c a2 90 54 c9 .
.t.z./.Q.X...T.
03a0 1d 26 d1 26 a
5 26 d3 64 b5 b3 15
b1 47 b1 19 46 .
&.&.&.d....G..F
03b0 78 b5 3f cb 6
6 1e c9 54 b6 da c8
4d 9d 96 b6 26 x
.?.f..T...M...&
03c0 06 04 21 e5 0
c 43 4f 2a 2d 2e ff
fb 90 04 e9 8f .
.!..CO*-.......
03d0 f3 02 36 d3 8
3 1a 6a e0 5d 05 7a
50 63 0b 4c 0b .
.6...j.].zPc.L.
03e0 78 ad 5c 0c 6
1 29 81 83 95 6b 81
87 a5 30 39 da x
.\.a)...k...09.
03f0 57 7f 7b 7e e
f ff a5 60 0c 24 37
2c 58 70 c3 1a W
.{~...`.$7,Xp..
0400 8a 31 66 66 d
1 1a 42 84 b9 62 39
0f c6 e5 7f 66 .
1ff..B..b9....f

0410 70 55 b5 30 a
6 ef 78 2c d2 c3 62
7b 5b ee 20 50 p
U.0..x,..b{[. P
0420 d2 60 44 52 6
d 26 58 e2 d4 d7 06
e6 c1 7b e9 ef .
`DRm&X......{..
0430 1f 76 a6 5b b
5 e5 d3 b3 94 c6 d3
ec 3e f9 b9 d5 .
v.[........>...
0440 01 06 22 82 8
4 80 8f 58 78 54 55
32 ec 60 11 4c .
."....XxTU2.`.L
0450 fc 2c 1b f5 2
9 ba 27 31 c2 32 df
89 32 a4 dd 56 .
,..).'1.2..2..V
0460 05 d2 f9 3b f
1 59 c9 c0 7a 22 95
37 da 7e c0 2f .
..;.Y..z".7.~./
0470 34 39 76 9e d
4 ba 24 8b 58 06 25
24 6d c5 66 d5 4
9v...$.X.%$m.f.
0480 3d 2e dc a0 d
2 d4 5d 95 a0 cd 5f
71 8c a7 dd 75 =
.....]..._q...u
0490 65 b8 fb 48 9
7 8c 0b 96 38 41 cd
a5 00 c8 0c c8 e
..H....8A......
04a0 e7 9b 7b a5 1
8 85 90 b2 b4 cd 32
55 a8 b9 ff b7 .
.{.......2U....
04b0 fe 5f 50 e1 8
0 2e 03 59 0a 9b c4
9c 79 21 b6 5a .
_P....Y....y!.Z
04c0 cb 58 86 5c 0
6 d2 de fe 21 a4 ab
8a da 7f 32 2e .
X.\....!.....2.
04d0 1e fc 39 58 f
b ba 29 87 05 25 a1
4b 34 6e b0 c1 .
.9X..)..%.K4n..
04e0 f2 71 96 4f c
5 17 fb 9a 86 7d 7e
e8 a4 44 31 21 .
q.O.....}~..D1!
04f0 22 4f 24 21 2
2 21 03 9e 40 54 04
5c d0 e0 f8 fc "
O$!"!..@T.\....
0500 14 20 89 c1 5
1 b5 02 44 80 ab ac
ea 27 6e f7 ef .
..Q..D....'n..
0510 ea 73 ba 2f 4
2 80 22 c3 e6 43 ac
b9 2d cb 4a d1 .
s./B."..C..-.J.
0520 5c 09

\
.
No. Time
Source
Destination
Protocol
Length Info
254 9.461558000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=152575 Win=37800 L
en=0
Frame 254: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.511488000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.511488000 s
econds
[Time delta fro
m previous captured
frame: 0.000184000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018400
0 seconds]
[Time since ref
erence or first fra
me: 9.461558000 sec
onds]
Frame Number: 2
54
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule

String: http || tcp

.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0

Identification:
0x4f79 (20345)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 15257
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 152575 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .

... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37800
[Calculated win
dow size: 37800]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 253]
[The RTT to
ACK the segment wa
s: 0.000184000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 79 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Oy@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca b6 2c 50 10 .
....P..N.+..,P.
0030 93 a8 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info

255 9.463363000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
875 http49
574 [PSH, ACK] Seq=
152575 Ack=1 Win=46
Len=821
Frame 255: 875 byte
s on wire (7000 bit
s), 875 bytes captu
red (7000 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.513293000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.513293000 s
econds
[Time delta fro
m previous captured
frame: 0.001805000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00180500
0 seconds]
[Time since ref
erence or first fra
me: 9.463363000 sec
onds]
Frame Number: 2
55
Frame Length: 8
75 bytes (7000 bits
)
Capture Length:
875 bytes (7000 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64

:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
61
Identification:
0xf1fd (61949)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =

Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3be4 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 152575, Ack:
1, Len: 821
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 821]
Sequence number
: 152575 (relati
ve sequence number)
[Next sequence
number: 153396 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .

... = ECN-Echo: Not

set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4fb
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 821]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5d f1 fd 4
0 00 31 06 3b e4 4a
7c 0c 8a c0 a8 .
]..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b ca b6 2c 9e
87 4e aa 50 18 .
..P..+..,..N.P.
0030 00 2e 4f bb 0
0 00 4b d1 6e 7d 80
84 ce 15 9c 1f .
.O...K.n}......
0040 49 33 40 a6 d
7 6e 53 c5 a7 2e a8
e2 de de 59 56 I
3@..nS.......YV
0050 ed 2d a4 a9 e
7 60 c7 cb c7 f1 32
db 1d 22 38 df .
-...`....2.."8.
0060 3b 8f ec 52 7
b 80 2c ef bf 5d b3
bf 73 6d eb 59 ;
..R{.,..]..sm.Y
0070 97 b4 5c 0c f
f 24 f3 54 a5 a8 6a
8f 99 26 c3 ff .

.\..$.T..j..&..
0080 fb 92 04 eb 0
f f3 0e 2b d7 03 38
4a 60 5e 05 fa .
......+..8J`^..
0090 f0 61 e6 4c 0
b bc 95 5c 0c e1 29
41 88 10 ab 41 .
a.L...\..)A...A
00a0 87 99 28 cf 2
c a3 2d ad 29 e4 91
7d ae ae 84 d0 .
.(.,.-.)..}....
00b0 81 4c 58 15 4
7 0b 36 96 e2 b5 60
fa 43 a1 0f 85 .
LX.G.6...`.C...
00c0 5c 11 24 86 f
5 01 0a 03 7b 49 90
60 ea 12 68 b0 \
.$.....{I.`..h.
00d0 1d 94 a2 a0 d
2 14 46 91 2e cf 51
2c 71 9f 79 69 .
.....F...Q,q.yi
00e0 8e 0c 0b 92 1
1 18 13 89 0a 87 aa
3a 38 78 37 09 .
..........:8x7.
00f0 01 61 71 33 1
e 25 03 1b dd 17 81
18 93 2a 58 2b .
aq3.%.......*X+
0100 78 6e bb cb 0
e 0d b6 b1 89 85 96
82 5d ae d5 56 x
n..........]..V
0110 99 0a 4e 1d e
1 e3 0e 27 28 34 38
c6 e1 e9 43 c5 .
.N....'(48...C.
0120 00 b8 a0 7a 2
4 f1 76 75 02 e1 35
28 93 5f bd 8e .
..z$.vu..5(._..
0130 12 e2 50 18 b
d e9 51 e1 31 57 6d
62 f6 e2 d4 83 .
.P...Q.1Wmb....
0140 db 84 3d 9a 3
9 1a a9 09 70 a4 6a
44 28 c0 6b 8f .
.=.9...p.jD(.k.
0150 11 0b 89 02 8
6 03 68 17 34 1d 42
9d d4 a5 29 4c .
.....h.4.B...)L
0160 42 6d ad 2f 1
1 69 b9 f9 61 5d 55
23 cb 7d 10 c0 B
m./.i..a]U#.}..
0170 89 05 13 54 8
f b9 20 5f e5 c2 f5
c2 90 b1 4b 63 .
..T.. _......Kc
0180 7a 60 c7 4f 3
7 4a d9 18 d9 8e ed
43 15 ba ca f4 z
`.O7J.....C....

0190 bb 2c f0 6c d
d 0a c3 d9 c4 7b b1
72 42 41 cd cc .
,.l.....{.rBA..
01a0 8c 66 8b 54 1
f 10 97 15 57 8c 31
51 bb e9 bb aa .
f.T....W.1Q....
01b0 6b aa 1c 74 c
9 62 80 17 31 a6 72
d0 80 68 28 14 k
..t.b..1.r..h(.
01c0 3e f5 ba db 1
e e4 50 9e 14 0f 2a
c6 d7 d3 87 1c >
.....P...*.....
01d0 c0 a6 d1 15 1
0 48 c8 f0 b4 09 a2
fe b0 a6 8a fa .
....H..........
01e0 c3 87 1c 6e 1
1 95 7b 11 a6 a2 47
bb f6 2c 53 f7 .
..n..{...G..,S.
01f0 22 01 4c 7a 7
a fd ab 75 79 4c 9b
51 2f 3f 94 16 "
.Lzz..uyL.Q/?..
0200 90 31 7d 5d 2
0 8c ca 08 0f 92 e9
93 d4 31 3b 10 .
1}] ........1;.
0210 ae d0 ca 75 4
c bb 41 cd 65 33 4c
f3 69 0d cf 08 .
..uL.A.e3L.i...
0220 8e ff fb 92 0
4 ea 0f f3 17 2c 57
03 38 32 60 60 .
........,W.82``
0230 a3 4a d0 61 e
9 38 0b bc 95 58 0c
e5 09 41 7e 15 .
J.a.8...X...A~.
0240 eb 01 87 a1 3
0 33 43 8a 43 a6 61
33 8c 67 b0 59 .
...03C.C.a3.g.Y
0250 c8 30 8a 10 4
4 89 af e3 34 66 4c
0d 76 c5 4c 00 .
0..D...4fL.v.L.
0260 68 31 a8 46 f
4 54 a9 97 2d f6 67
97 f3 ce d1 6b h
1.F.T..-.g....k
0270 a4 4a b9 98 3
9 a9 2d 18 4c d2 cd
4d cb bb 0f 59 .
J..9.-.L..M...Y
0280 49 8b 8b 97 8
4 20 ba ee 93 a7 92
17 2c cd 7b df I
.... ......,.{.
0290 ed 9b 04 07 0
8 4c 45 4a 13 11 b4
b0 69 c0 10 98 .
....LEJ....i...
02a0 ab e3 c7 51 c

c 2f dd 65 cf 35 15
84 1d cf a0 a0 .
..Q./.e.5......
02b0 90 63 a6 39 0
3 de a7 65 59 a5 a1
4e a9 4e 41 67 .
c.9...eY..N.NAg
02c0 76 50 e5 c6 b
1 b6 55 16 d0 a3 f4
f2 ea 19 51 60 v
P....U.......Q`
02d0 94 3d 7e d5 6
b 18 f2 23 62 c6 ef
6f 09 b9 0a 2a .
=~.k..#b..o...*
02e0 bd f5 b9 1c f
b ed 22 d5 ae d8 c2
81 ff 75 eb d8 .
....."......u..
02f0 b5 d3 96 56 5
4 d6 6f 89 31 9a 87
7e b3 25 17 24 .
..VT.o.1..~.%.$
0300 e0 50 c2 c0 6
9 61 12 05 85 a9 fa
2b 5c e2 b6 9f .
P..ia.....+\...
0310 1a 0e 42 d3 2
c 31 77 8f 79 10 a7
e2 04 c7 73 39 .
.B.,1w.y.....s9
0320 40 49 8e d4 9
b 72 6b ca 39 72 6b
28 df ed 24 64 @
I...rk.9rk(..$d
0330 14 9a ac 57 0
a c0 6b 70 a6 61 41
95 89 e8 82 45 .
..W..kp.aA....E
0340 35 50 46 86 9
c 38 61 e2 2f dd 22
c5 78 fc 40 e1 5
PF..8a./.".x.@.
0350 a9 37 85 5b 9
8 75 11 6a 13 68 98
b9 fb ae 22 e7 .
7.[.u.j.h....".
0360 5e ea 20 a6 1
0 8b 52 ba f4 75 52
^
. ...R..uR
No. Time
Source
Destination
Protocol
Length Info
256 9.525378000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=15339
6 Ack=1 Win=46 Len=
1260
Frame 256: 1314 byt
es on wire (10512 b

its), 1314 bytes ca

ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.575308000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.575308000 s
econds
[Time delta fro
m previous captured
frame: 0.062015000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06201500
0 seconds]
[Time since ref
erence or first fra
me: 9.525378000 sec
onds]
Frame Number: 2
56
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf1fe (61950)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum

: 0x3a2c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 153396, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 153396 (relati
ve sequence number)
[Next sequence
number: 154656 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xfd0
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2081]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 fe 4
0 00 31 06 3a 2c 4a
7c 0c 8a c0 a8 .
...@.1.:,J|....
0020 01 0b 00 50 c
1 a6 2b ca b9 61 9e
87 4e aa 50 10 .
..P..+..a..N.P.
0030 00 2e fd 05 0
0 00 84 a7 78 f9 b6
b2 f1 48 c4 47 .
.......x....H.G
0040 0c 08 95 4d 0
b 80 d9 b3 71 7f 4f
d9 7b 93 73 8e .
..M....q.O.{.s.
0050 ea a0 10 24 e
a 7f f5 2e fc c8 4c
69 99 6f bb 9d .
..$......Li.o..
0060 bf 56 7a a2 d
7 6b a6 9c 75 9c ed
12 4e 2e 8a 82 .
Vz..k..u...N...
0070 43 33 8d 52 6
1 27 f4 d9 69 50 1a
34 93 32 9a ee C
3.Ra'..iP.4.2..
0080 cf 5f 46 6c 6
2 c9 1c 85 d2 58 83
d3 68 c3 ff fb .
_Flb....X..h...
0090 92 04 e8 8f f
2 ee 2e 55 03 3a 5a
60 5a 25 1a a0 .
......U.:Z`Z%..
00a0 65 e6 4a 0c 5
8 c7 52 0c e9 6b 81
79 1c ea 41 87 e

.J.X.R..k.y..A.
00b0 a1 70 c3 de a
7 fb e3 bd 0c 84 2c
18 0d 75 b8 eb .
p........,..u..
00c0 ab f6 8e d6 1
c 77 ee 89 2c 1d f7
ac 0c ab b0 78 .
....w..,......x
00d0 90 dc 99 44 e
2 aa 33 2a 5a 59 89
3c fc 59 b5 cb .
..D..3*ZY.<.Y..
00e0 77 ee ca 69 a
a 8a b9 f1 22 50 78
d0 e0 c1 c6 d0 w
..i...."Px.....
00f0 86 26 35 54 d
2 01 a8 b8 f7 56 82
7b 72 44 d7 77 .
&5T.....V.{rD.w
0100 4b 2e c5 c9 3
e db 0a bc b3 36 33
24 61 01 11 60 K
...>....63$a..`
0110 32 1e 03 97 1
4 36 2b 5d f6 d8 9f
a2 88 60 19 a6 2
....6+].....`..
0120 14 ba 57 2b 0
1 47 50 d6 ec 2d fb
6e ad 06 66 2e .
.W+.GP..-.n..f.
0130 7a 41 2a a6 6
2 53 d5 e1 81 0a 49
f1 6b 09 14 aa z
A*.bS....I.k...
0140 30 55 19 56 6
b bc 99 ee 5f 6e b2
7b 9e 52 43 2a 0
U.Vk..._n.{.RC*
0150 b5 cf 24 97 2
d 1c 95 13 0c 9d b2
9a 3e 4b 08 38 .
.$.-.......>K.8
0160 63 85 b3 98 1
f b9 45 7f 98 ca dd
34 a5 ef 3f 60 c
.....E....4..?`
0170 59 da 1f 99 6
8 fd 4c 11 32 90 b0
44 a2 5c 96 58 Y
...h.L.2..D.\.X
0180 c0 59 21 16 5
8 ac 0d 19 7d aa 66
80 19 3e 8b f8 .
Y!.X...}.f..>..
0190 31 a2 c5 59 3
c 90 83 82 03 1b b5
69 03 4e db 14 1
..Y<......i.N..
01a0 52 b6 47 83 9
b 5d 1f 65 da 4f 88
67 aa d9 21 08 R
.G..].e.O.g..!.
01b0 e9 f1 20 82 2
3 6d a2 d3 da 09 c3
fa 25 57 4f e8 .
. .#m......%WO.

01c0 9a eb 68 88 a
d e6 df b8 83 d0 a2
e0 ab 17 4b 40 .
.h...........K@
01d0 ee b4 54 44 f
c ad 7e 46 02 3d 83
7e 17 5a 73 88 .
.TD..~F.=.~.Zs.
01e0 61 04 b0 c8 d
c c4 e1 cd f7 ae 76
a7 4c e3 b8 b3 a
.........v.L...
01f0 54 52 53 05 7
5 c2 c9 f2 87 2b 64
99 45 04 cb a3 T
RS.u....+d.E...
0200 8d 72 92 30 e
e 66 56 f5 0a 0e 20
41 0e c9 2c 88 .
r.0.fV... A..,.
0210 dc f7 d5 ea a
0 59 ef a6 28 09 b3
88 f1 2d 14 21 .
....Y..(....-.!
0220 66 17 7b 17 5
3 74 41 07 55 a6 58
4c e3 8f 34 28 f
.{.StA.U.XL..4(
0230 ff fb 92 04 e
b 0f f2 f3 2b d4 83
59 4a 60 63 65 .
.......+..YJ`ce
0240 fa 80 67 08 4
c 0b 8c bf 52 0d 65
69 81 76 19 69 .
.g.L...R.ei.v.i
0250 c1 87 a1 70 f
2 dc fc ca 3d e9 ff
ff a1 b5 9a 38 .
..p....=......8
0260 81 4e a7 7d 4
d a9 9a eb 0f 60 8e
03 fd d1 77 04 .
N.}M....`....w.
0270 d2 ac 9d 91 0
7 e3 8a 7c 4e d8 c9
6c 24 4b e9 cb .
......|N..l$K..
0280 32 4e f9 38 7
4 32 1f 88 c3 8d 75
5a 14 12 44 19 2
N.8t2....uZ..D.
0290 8a 62 6a 5a 7
2 1b 84 a7 6d 90 49
fe 6c 14 a7 27 .
bjZr...m.I.l..'
02a0 d9 28 aa ab c
9 02 d9 fd 23 53 76
b1 bd 70 18 46 .
(......#Sv..p.F
02b0 41 01 d1 23 8
d ad 78 a3 0a bd de
b6 e4 3b ff ea A
..#..x......;..
02c0 75 44 60 01 6
0 93 85 6e a0 91 53
9f 40 05 e8 71 u
D`.`..n..S.@..q
02d0 26 13 22 45 8

9 c0 85 24 45 4b 24
d0 6b 6c 00 35 &
."E...$EK$.kl.5
02e0 3e e1 aa 68 b
5 34 b6 24 4c 87 b7
26 bb 45 9d 1f >
..h.4.$L..&.E..
02f0 0a 8e 2a a0 3
3 06 97 8a d1 dc 92
0d f1 f4 22 52 .
.*.3........."R
0300 3d 3b 95 03 7
9 65 65 ba 03 fc 99
af 85 2b ec 72 =
;..yee......+.r
0310 27 4e c0 04 9
c cb 89 bf f1 4d 5f
ad f2 42 70 7e '
N.......M_..Bp~
0320 9f 86 b8 04 0
2 ea 16 5a 8c 39 22
40 05 48 da 7c .
......Z.9"@.H.|
0330 5f 5b 07 0a 5
0 d9 2e 4b c1 fe 8c
53 29 57 93 a6 _
[..P..K...S)W..
0340 18 db d1 22 3
4 5c 63 9d 53 09 40
85 14 04 68 58 .
.."4\c.S.@...hX
0350 3f 41 83 6e 8
5 c4 19 d6 4c 01 24
5b 26 78 2c db ?
A.n....L.$[&x,.
0360 18 1e da f7 5
1 5d 42 71 f3 aa c3
1a 6b b0 b2 d4 .
...Q]Bq....k...
0370 b3 ed dc 1e d
3 d4 08 fa 15 8c 15
03 30 48 22 25 .
...........0H"%
0380 f2 19 48 73 0
3 c9 b2 02 a0 75 9e
1c 1c 1b 5c e3 .
.Hs.....u....\.
0390 46 72 a3 dd 2
c cd 74 0c 34 c5 a5
79 56 fb d5 c9 F
r..,.t.4..yV...
03a0 81 d4 14 c9 e
b 51 41 fa 50 c9 86
88 b9 31 f9 16 .
....QA.P....1..
03b0 31 8c 7a 35 f
4 fd 6a 65 74 d3 65
68 a6 6e 83 0b 1
.z5..jet.eh.n..
03c0 6a 28 46 e3 b
3 df 94 9c 2a 78 50
fc 34 6c c3 61 j
(F.....*xP.4l.a
03d0 b9 d5 ff fb 9
2 04 ec 0f f3 16 2d
d4 83 39 5a 60 .
.........-..9Z`
03e0 63 45 8a 70 6
5 e9 4c 0b 78 af 52

0d 65 29 81 72 c
E.pe.L.x.R.e).r
03f0 17 aa 01 87 a
1 30 a9 77 77 6b 95
6b 88 36 66 c0 .
....0.wwk.k.6f.
0400 0a 20 6b d4 7
8 63 2a d8 58 43 31
28 20 65 d8 fd .
k.xc*.XC1( e..
0410 0b f8 c6 f1 2
5 5a 80 16 29 c3 45
1b 44 e2 3d 3a .
...%Z..).E.D.=:
0420 50 82 5a 31 c
c 3c de 28 0d 6b 95
8c 68 60 73 64 P
.Z1.<.(.k..h`sd
0430 c3 2a 0e ed 7
b 88 6e 77 7f 67 3f
34 7e 24 9d f0 .
*..{.nw.g?4~$..
0440 f7 20 db 5b 8
e 5d ac da e8 77 15
63 31 7c 0b b8 .
.[.]...w.c1|..
0450 d2 95 8f ed 5
5 6a be 7f 55 f8 5f
ee fe eb 18 a2 .
...Uj..U._.....
0460 8d 9b 21 a1 c
2 51 a9 5a c4 66 0f
b8 b2 e1 c5 e1 .
.!..Q.Z.f......
0470 a7 b1 fc 6a 6
7 50 8c 5b df 07 56
69 bb 82 42 56 .
..jgP.[..Vi..BV
0480 88 5d 49 4c d
5 95 3b 4b 1b b4 cd
4a a4 6e 73 12 .
]IL..;K...J.ns.
0490 85 68 9c bb 4
7 b2 31 ab 17 87 49
e5 be 31 e0 b3 .
h..G.1...I..1..
04a0 75 ab 4d 18 3
7 a5 f7 07 bd cf 32
6e ac 55 d7 2a u
.M.7.....2n.U.*
04b0 99 7b d5 58 7
1 e3 10 5d 13 34 22
86 a7 77 d5 20 .
{.Xq..].4"..w.
04c0 55 30 38 25 a
4 08 7d 34 d9 20 b0
25 52 5b f5 50 U
08%..}4. .%R[.P
04d0 12 a5 f9 b4 1
1 88 ac 05 92 12 f8
b7 97 e3 91 47 .
..............G
04e0 2b d4 16 4d d
1 8d 33 78 be 78 51
38 e0 42 3d 40 +
..M..3x.xQ8.B=@
04f0 30 b5 96 08 1
6 21 09 05 3e af 91
69 b0 51 09 6a 0

....!..>..i.Q.j
0500 cb 4b 3d 7c 3
5 4b b3 3c dc 4c 54
8c 45 0d 28 33 .
K=|5K.<.LT.E.(3
0510 2e 24 26 87 d
2 d7 bb 40 87 75 6a
6b a4 00 08 07 .
$&....@.ujk....
0520 a2 41
.
A
No. Time
Source
Destination
Protocol
Length Info
257 9.525564000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=154656 Win=37800 L
en=0
Frame 257: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.575494000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.575494000 s
econds
[Time delta fro
m previous captured
frame: 0.000186000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018600
0 seconds]
[Time since ref
erence or first fra
me: 9.525564000 sec
onds]
Frame Number: 2
57
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)

[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f7a (20346)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 15465
6, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 154656 (
relative ack number
)
Header Length:
20 bytes

.... 0000 0001

0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37800
[Calculated win
dow size: 37800]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 256]
[The RTT to
ACK the segment wa
s: 0.000186000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 7a 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(Oz@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca be 4d 50 10 .
....P..N.+..MP.

0030 93 a8 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
258 9.667383000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=15465
6 Ack=1 Win=46 Len=
1260
Frame 258: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.717313000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.717313000 s
econds
[Time delta fro
m previous captured
frame: 0.141819000
seconds]
[Time delta fro
m previous displaye
d frame: 0.14181900
0 seconds]
[Time since ref
erence or first fra
me: 9.667383000 sec
onds]
Frame Number: 2
58
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 1
300
Identification:
0xf1ff (61951)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a2b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 154656, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 154656 (relati
ve sequence number)
[Next sequence
number: 155916 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .

... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x7ef
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f1 ff 4
0 00 31 06 3a 2b 4a
7c 0c 8a c0 a8 .
...@.1.:+J|....
0020 01 0b 00 50 c
1 a6 2b ca be 4d 9e
87 4e aa 50 10 .
..P..+..M..N.P.
0030 00 2e 7e f5 0
0 00 31 92 fe 98 66
a7 85 02 69 b0 .
.~...1...f...i.
0040 77 95 bf 67 4
e 38 bf 71 79 86 ad
7b 27 2c 75 55 w
..gN8.qy..{',uU
0050 61 6f f2 b7 c

c d0 fd 18 6a 76 7e
66 1a ce 71 24 a
o......jv~f..q$
0060 8b 4c fb 62 b
7 9c 73 5d 23 80 8f
ff d2 23 d5 0b .
L.b..s]#....#..
0070 83 69 2b 0e 7
1 f7 20 c4 bd 19 f4
a9 ad f7 e2 b8 .
i+.q. .........
0080 b6 11 30 13 7
0 b0 32 8e ff fb 92
04 eb 8f f2 f0 .
.0.p.2.........
0090 2c 54 83 39 5
a 60 63 85 2a 60 65
ec 4c 4c 0c b9 ,
T.9Z`c.*`e.LL..
00a0 52 0d 65 69 8
1 6e 16 69 c1 97 a1
30 e4 55 d7 6f R
.ei.n.i...0.U.o
00b0 7a 19 28 58 0
5 c3 2c c9 8c 05 d0
57 ae cb 51 81 z
.(X..,....W..Q.
00c0 93 e0 c6 37 9
e a9 d3 b0 0e 64 31
16 82 11 73 94 .
..7.....d1...s.
00d0 3b 61 a9 d5 5
2 9c 8d b0 17 27 fb
d4 fa 69 e8 74 ;
a..R....'...i.t
00e0 40 7c 1c bd 8
8 02 24 ad ac 48 8a
04 16 79 24 00 @
|....$..H...y$.
00f0 ad 05 a3 a1 f
7 70 dd 8c 14 f5 59
e5 35 dc 69 ee .
....p....Y.5.i.
0100 14 32 40 e8 b
1 27 84 9e f9 64 30
63 8d d2 ee d7 .
2@..'...d0c....
0110 df d2 f6 b2 2
1 a9 63 80 11 75 47
01 ac 4f 61 81 .
...!.c..uG..Oa.
0120 00 59 44 20 7
8 2b 2a 76 83 cc 42
1b a2 94 c9 ef .
YD x+*v..B.....
0130 c3 89 5b 07 b
1 6b 6f 95 1d a2 51
29 c3 84 dc 8e .
.[..ko...Q)....
0140 6e 9a 96 72 0
d c9 c6 26 ca 83 c7
d4 32 7f 06 c6 n
..r...&....2...
0150 cb ff 03 b0 e
3 0f 5f a0 43 31 8a
7c 13 eb 89 e1 .
....._.C1.|....
0160 24 fe 3b 44 b
1 94 15 54 94 f3 d4

7b 24 ba ba bb $
.;D...T...{$...
0170 3a 9a e2 b3 1
5 d2 0a 60 a2 01 d5
13 41 de 1d 37 :
......`....A..7
0180 06 ea 1c 0b 6
0 7f d9 fc 1a f8 b5
25 41 29 89 33 .
...`......%A).3
0190 16 7e c6 26 5
b 2c ba 81 59 05 a7
52 57 0b db 75 .
~.&[,..Y..RW..u
01a0 84 3d 55 29 e
1 e9 2d 6b 8d 23 03
41 2d f0 78 a8 .
=U)..-k.#.A-.x.
01b0 3c df 1a a6 4
6 ce 77 ac 84 53 df
0d 48 ef 0c 9a <
...F.w..S..H...
01c0 83 5b 6f e7 0
e 33 96 39 cd e3 ee
61 20 ab 6f e9 .
[o..3.9...a .o.
01d0 de b4 55 7b 2
5 a1 86 2c e4 69 19
af 18 f0 81 c9 .
.U{%..,.i......
01e0 08 89 02 43 9
2 24 25 47 11 08 4f
25 22 bb 8a 13 .
..C.$%G..O%"...
01f0 c2 35 0c a5 5
3 8c a7 36 a9 69 9f
a0 b0 28 59 29 .
5..S..6.i...(Y)
0200 95 c5 27 99 6
c ae 5e a1 f4 8d e9
83 69 e4 10 77 .
.'.l.^.....i..w
0210 a6 70 ff f8 1
e 5b bb da 52 c9 69
b7 c1 0b c3 1d .
p...[..R.i.....
0220 cc 25 3f e9 9
6 f1 b4 95 49 e6 ff
fb 92 04 eb 8f .
%?.....I.......
0230 f2 f2 2c 54 0
3 59 4a 60 60 a5 8a
60 61 e8 4c 0b .
.,T.YJ``..`a.L.
0240 ec b3 4e 0d 6
9 69 81 83 99 e9 41
9c 2d 70 81 e8 .
.N.ii....A.-p..
0250 c3 c5 c6 6b a
f a1 c4 50 d2 fa 94
14 0d 74 17 26 .
..k...P.....t.&
0260 42 7d a6 05 d
a 11 21 36 28 79 9c
33 a8 c1 41 56 B
}....!6(y.3..AV
0270 6d 88 39 b8 4
8 49 99 4b 04 c2 72
66 03 42 e5 5a m

.9.HI.K..rf.B.Z
0280 4c eb 42 63 f
3 93 f3 5f 3b c6 bd
0e 19 03 f1 b6 L
.Bc..._;.......
0290 74 c0 96 3f 9
9 8d 23 0c 92 6e a6
28 ba 08 ad 05 t
..?..#..n.(....
02a0 51 bc d2 b6 4
5 bc a9 1e cb ef 65
ba cf a8 3e bb Q
...E.....e...>.
02b0 b0 c8 7a ed 2
b 80 b0 10 d3 1b 72
4c 30 08 a0 56 .
.z.+.....rL0..V
02c0 11 8f 3e 80 a
8 3d e7 24 0d e0 8e
94 a2 f9 29 da .
.>..=.$......).
02d0 94 65 b6 f8 a
a 2b 8e 89 75 2d 4f
d7 b6 94 38 db .
e...+..u-O...8.
02e0 9d c9 61 af c
5 9b 67 c7 83 28 0c
89 04 82 d6 c5 .
.a...g..(......
02f0 2b 67 ef f3 a
a 35 6e 0f 2b 2f e4
9f 70 c3 f3 5f +
g...5n.+/..p.._
0300 2d 4e ef f4 8
9 af 11 32 38 1e 34
71 e3 0e f5 4a N.....28.4q...J
0310 eb 96 5f 8f a
1 b8 e8 63 20 66 86
21 67 a1 0f 0b .
._....c f.!g...
0320 05 0a 7b 0b 8
2 cb 9d e2 db 65 68
0a 1b 10 54 69 .
.{......eh...Ti
0330 37 90 98 3c d
a 2e 3d 99 2a 93 9f
17 b7 21 ae aa 7
..<..=.*....!..
0340 f1 58 02 26 d
8 cf b7 4d a3 2d 96
09 60 cf dc b1 .
X.&...M.-..`...
0350 6d af f4 a4 4
2 5d 3c b6 5a fd 66
cf 9f 1a 5f ce m
...B]<.Z.f..._.
0360 f5 6f f4 df 9
d ff 9b 45 df c5 a4
96 5a 41 e1 e4 .
o.....E....ZA..
0370 97 ac bd 4d b
1 ff d4 6d 4b cc 11
34 ba 84 40 a1 .
..M...mK..4..@.
0380 50 13 0a 0a 1
f 13 48 f7 cd e9 4c
f7 29 f6 05 5e P
.....H...L.)..^

0390 55 2d 45 18 a
4 a7 30 b2 15 db 5e
9c 95 49 e5 6e U
-E...0...^..I.n
03a0 9b eb 27 bd 0
9 a4 5c 92 a8 a9 be
93 4e d0 ed 44 .
.'...\.....N..D
03b0 6e 0f 47 2f 3
4 16 96 5b 26 44 60
72 bd b1 86 87 n
.G/4..[&D`r....
03c0 26 a1 54 d4 c
f 24 8b ff d6 6d fe
58 ff fb 92 04 &
.T..$...m.X....
03d0 ea 8f f2 f6 2
c d3 03 79 5a 60 5e
a6 8a 50 63 0d .
...,..yZ`^..Pc.
03e0 5c 0b b4 b1 4
a 0d 65 69 81 93 97
69 01 9c 3d 30 \
...J.ei...i..=0
03f0 1b b0 2d bc 7
3 ab e0 47 2d 8e 0c
80 ff 16 c4 1d .
.-.s..G-.......
0400 46 48 f9 01 e
8 0e 2b f4 fa 2e e5
a5 17 1c 4c 29 F
H....+.......L)
0410 c7 2f 14 4e 5
3 1d 4a 72 f2 34 d8
a4 1b 26 be a2 .
/.NS.Jr.4...&..
0420 8c d7 3b cf 6
c a6 03 8b c5 59 5f
c1 40 d5 b0 ad .
.;.l....Y_.@...
0430 66 6e 1d 39 b
e 91 6c 0e 7a be ee
7f 2d e2 36 28 f
n.9..l.z...-.6(
0440 f2 9e d4 6b 4
b 62 91 ed 06 ff ff
59 f1 ff 54 cb .
..kKb.....Y..T.
0450 50 5c f2 96 8
4 52 8d 5b d6 ea 15
47 33 e2 6d 49 P
\...R.[...G3.mI
0460 87 57 21 57 4
1 65 26 fb b6 b5 12
05 87 2d 41 c4 .
W!WAe&......-A.
0470 57 8e 33 48 0
6 eb 77 50 a7 4e 1b
9b 9a a0 82 19 W
.3H..wP.N......
0480 c3 ca d0 f2 1
7 e3 1c e2 24 ea 78
68 79 97 1e f8 .
.......$.xhy...
0490 4f 2d 61 ca 2
e 73 1b b3 e2 47 0d
44 a4 08 98 8b O
-a..s...G.D....
04a0 0d fc da db d

9 66 ef 7c db 80 f2
8e 36 94 84 d4 .
....f.|....6...
04b0 64 5c fb 4e 5
a fa b2 0f c2 76 aa
65 ae ac 22 2c d
\.NZ....v.e..",
04c0 12 88 aa b9 b
6 dd d0 73 96 42 c2
21 84 0e dd 52 .
......s.B.!...R
04d0 26 8e 12 eb c
9 11 71 ab d0 c7 65
10 54 d1 13 57 &
.....q...e.T..W
04e0 bf 51 ed 6b b
4 07 be 16 72 13 84
6a 57 a6 03 49 .
Q.k....r..jW..I
04f0 91 a7 8e b0 f
9 f0 be 0a 28 d3 02
93 94 69 12 f7 .
.......(....i..
0500 e3 e7 dc 58 d
f 95 7d c8 d8 58 b3
99 f2 ef 11 21 .
..X..}..X.....!
0510 49 0f d0 54 4
1 c5 23 34 66 2a 96
34 70 ec 09 05 I
..TA.#4f*.4p...
0520 9a 2d
.
No. Time
Source
Destination
Protocol
Length Info
259 9.673380000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
462 http49
574 [PSH, ACK] Seq=
155916 Ack=1 Win=46
Len=408
Frame 259: 462 byte
s on wire (3696 bit
s), 462 bytes captu
red (3696 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.723310000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]

Epoch Time: 141

5615222.723310000 s
econds
[Time delta fro
m previous captured
frame: 0.005997000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00599700
0 seconds]
[Time since ref
erence or first fra
me: 9.673380000 sec
onds]
Frame Number: 2
59
Frame Length: 4
62 bytes (3696 bits
)
Capture Length:
462 bytes (3696 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
48
Identification:
0xf200 (61952)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d7e [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 155916, Ack:
1, Len: 408
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 408]
Sequence number
: 155916 (relati
ve sequence number)
[Next sequence
number: 156324 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x10e
9 [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1668]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 c0 f2 00 4
0 00 31 06 3d 7e 4a
7c 0c 8a c0 a8 .
...@.1.=~J|....
0020 01 0b 00 50 c
1 a6 2b ca c3 39 9e
87 4e aa 50 18 .
..P..+..9..N.P.
0030 00 2e 10 e9 0
0 00 03 23 45 c8 5f
c0 74 a6 c4 64 .
......#E._.t..d
0040 4b 29 c0 43 c
8 95 1c 82 13 35 f5
89 d8 79 20 ff K
).C.....5...y .
0050 c2 1c 83 52 2
4 b3 75 9f 76 d5 63
43 eb 59 ac a9 .
..R$.u.v.cC.Y..
0060 42 b3 51 e3 b
d 96 78 d1 df d3 39
9a b6 9f 39 6e B
.Q...x...9...9n
0070 63 ee 5b 8f 5
8 5a f6 cc d0 61 33
40 a6 3e 20 b5 c
.[.XZ...a3@.> .
0080 53 77 ff fb 9
2 04 e9 8f f2 ee 2b
d2 83 78 5a 60 S
w........+..xZ`
0090 60 25 8a 40 6
3 0f 4c 0b d0 9f 50
0c e1 e9 41 87 `
%.@c.L...P...A.
00a0 94 a9 81 8c 3
1 30 ff 38 ac 2e 54
38 7e 91 6c 5b .
...10.8..T8~.l[
00b0 67 54 82 44 9
4 2f 8c 71 95 0b 75
3e d5 b0 1c ea g
T.D./.q..u>....
00c0 65 84 49 a8 a
a 3b 8f 2a bb 90 97
30 ed 3b 3e 5d e
.I..;.*...0.;>]
00d0 11 bc e2 b2 c
8 e8 80 2a 3b 1e 89
ae d6 54 99 d2 .
......*;....T..
00e0 a6 9a e2 0c 4
7 4f 63 a9 58 e1 b7
b9 39 d3 39 70 .

...GOc.X...9.9p
00f0 bc 69 ef 96 0
8 b3 bb dc 78 b0 a9
fc f9 ae 29 8a .
i......x.....).
0100 49 f1 96 ca 6
f ff 58 95 60 84 38
8a 5e f8 b7 ea I
...o.X.`.8.^...
0110 a2 5f 04 42 1
a 01 2a d5 fc f1 07
89 00 a8 d2 0a .
_.B..*.........
0120 2e db 33 05 4
8 a5 12 94 1e 96 c5
da 6a e4 4e 19 .
.3.H.......j.N.
0130 cc 29 28 e3 1
1 f4 b4 77 21 d7 9a
44 bc da d5 20 .
)(....w!..D...
0140 9e 01 e0 a2 5
f 1e 13 27 87 82 f8
cb 96 f4 4d 4e .
..._..'......MN
0150 9a 97 dd 24 9
0 d4 75 91 51 92 34
13 59 a9 d6 ba .
..$..u.Q.4.Y...
0160 ae 64 7d 70 9
9 50 20 a9 10 51 cf
72 b5 39 94 2b .
d}p.P ..Q.r.9.+
0170 ff e9 bc d1 0
b b8 62 02 50 85 4a
e3 d2 db 63 4a .
.....b.P.J...cJ
0180 58 e5 7d 00 1
1 ce c4 45 5b 9f 89
7b ab 20 58 b4 X
.}....E[..{. X.
0190 98 58 a6 9c a
a a5 10 ba 57 5a 1f
52 b8 6a 60 68 .
X......WZ.R.j`h
01a0 01 e6 1b b4 a
5 d9 d6 25 87 3f fa
a4 38 af f7 6b .
......%.?..8..k
01b0 44 ff 12 d3 3
8 85 5a 42 ce 35 7f
fe 33 bb 4f 58 D
...8.ZB.5..3.OX
01c0 b8 f0 20 ac 4
8 66 d4 0b c7 32 41
1f af 45
.
. .Hf...2A..E
No. Time
Source
Destination
Protocol
Length Info
260 9.673546000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h

ttp [ACK] Seq=1 Ack

=156324 Win=38115 L
en=0
Frame 260: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.723476000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.723476000 s
econds
[Time delta fro
m previous captured
frame: 0.000166000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00016600
0 seconds]
[Time since ref
erence or first fra
me: 9.673546000 sec
onds]
Frame Number: 2
60
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f7b (20347)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 15632
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 156324 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 259]
[The RTT to
ACK the segment wa
s: 0.000166000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 7b 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O{@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca c4 d1 50 10 .
....P..N.+...P.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
261 9.723386000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=15632
4 Ack=1 Win=46 Len=
1260
Frame 261: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.773316000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.773316000 s
econds
[Time delta fro
m previous captured
frame: 0.049840000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04984000
0 seconds]
[Time since ref
erence or first fra
me: 9.723386000 sec
onds]
Frame Number: 2
61
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf201 (61953)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a29 [validatio
n disabled]
[Good: Fals

e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 156324, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 156324 (relati
ve sequence number)
[Next sequence
number: 157584 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x339
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 01 4
0 00 31 06 3a 29 4a
7c 0c 8a c0 a8 .
...@.1.:)J|....
0020 01 0b 00 50 c
1 a6 2b ca c4 d1 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 33 9e 0
0 00 52 2e 82 a8 2f
76 51 87 41 52 .
.3...R.../vQ.AR
0040 74 9b 84 de a
7 6a 64 b7 15 8a d2
24 ba bd 69 47 t
....jd....$..iG
0050 18 6b 6d 95 5
5 b2 d1 b7 51 69 d7
2b 2e 63 50 8b .
km.U...Qi.+.cP.
0060 13 4d 9d b9 1
7 1d bf 45 b6 af d2
8d bf 5d fb fe .
M.....E.....]..
0070 d3 a5 ba 3f 4
f db 4b 9b 95 83 35
9b ad 40 89 13 .
..?O.K...5..@..
0080 eb 20 16 10 2
4 22 a3 e7 da 0c d6
aa ff fb 92 04 .
..$"..........
0090 e9 0f f2 fd 2
d 55 83 18 7a 60 5e
65 8a a0 63 0f .
...-U..z`^e..c.
00a0 4c 0c 40 a7 5
a 0c e6 29 81 6e 94
eb 41 8c 3d 30 L
.@.Z..).n..A.=0
00b0 17 c8 0e 30 a
a f5 d5 8e 60 5d 05

11 b2 ca 5d 53 .
..0....`]....]S
00c0 a5 43 0a 21 5
e 62 1d 31 41 cc 44
bd 11 92 7a b2 .
C.!^b.1A.D...z.
00d0 d2 85 18 36 8
8 f1 ce 2d d4 ac d0
60 4d 55 96 73 .
..6...-...`MU.s
00e0 79 4a f6 04 3
6 38 9a 22 2e e0 8d
4e c4 1e b3 49 y
J..68."...N...I
00f0 ec 77 cc f7 0
9 ce eb 6e 3f 76 6e
f7 df b4 4b 6f .
w.....n?vn...Ko
0100 ce ed 2e cd 1
f 61 fb 3f 4d 6a 6c
a1 cb 9a 92 ea .
....a.?Mjl.....
0110 68 61 0c eb f
f fa 23 0d f2 04 78
9c 49 32 54 28 h
a....#...x.I2T(
0120 8e e6 98 b3 c
3 19 9b 20 12 9c 57
91 56 9a 72 98 .
...... ..W.V.r.
0130 9b 95 94 b6 a
c c7 bd 0f ae a6 25
61 23 0d 80 c3 .
.........%a#...
0140 c3 fb d3 cb 6
a 10 96 c6 39 3f a9
b5 8f dc f2 cb .
...j...9?......
0150 a3 1e 17 52 a
4 98 e1 83 01 86 1c
b8 61 30 00 78 .
..R........a0.x
0160 71 51 71 20 d
2 c7 c8 96 0c 00 64
13 36 c0 2b 85 q
Qq ......d.6.+.
0170 75 a0 59 b7 b
6 9f ee bd 9e 8a 2c
87 96 46 49 4d u
.Y.......,..FIM
0180 09 0e 3f 53 d
3 9e 4a 3a b1 87 c1
0d 82 d3 0a 11 .
.?S..J:........
0190 a4 42 cd 27 c
e 3a 9b a7 de c2 78
eb 94 30 b8 3c .
B.'.:....x..0.<
01a0 3e 6f 7d e5 b
4 96 4b 63 18 cf f5
5b c6 f6 3f e2 >
o}...Kc...[..?.
01b0 74 63 c2 ea 5
4 71 8e a6 18 30 c3
8a 72 89 98 24 t
c..Tq...0..r..$
01c0 38 a8 b8 90 6
9 63 e4 4b 06 00 32
09 9b 38 b7 33 8

...ic.K..2..8.3
01d0 2e 8b 6f 68 7
d bf eb 9c fa 10 21
8b 86 85 ee 17 .
.oh}.....!.....
01e0 0d 97 16 ee f
c f6 66 94 28 6b 2f
d4 96 7d 31 88 .
.....f.(k/..}1.
01f0 72 26 b5 16 9
c a8 f1 e4 f2 7b ec
48 16 78 b5 21 r
&.......{.H.x.!
0200 52 a6 3b be 9
e 52 07 92 ed 4b 75
12 ea b1 17 34 R
.;..R...Ku....4
0210 3b da f4 5e d
a 28 c1 a1 ac 20 62
26 6c 00 99 10 ;
..^.(... b&l...
0220 ba 58 d1 ca 1
0 8b c6 b4 5f 34 28
ad 43 91 ff fb .
X......_4(.C...
0230 92 04 ea 0f f
2 f0 29 d8 81 ef 62
60 5e 46 eb 10 .
.....)...b`^F..
0240 3d e6 5c 0c 8
0 9b 66 07 e1 29 41
7e 93 ec c0 f7 =
.\...f..)A~....
0250 a5 28 28 aa 7
b 1d 55 4f 59 4c 8c
34 36 b0 bc 84 .
((.{.UOYL.46...
0260 3f 3e ec 29 0
b 52 0e 9a af 26 51
77 00 d2 a0 c7 ?
>.).R...&Qw....
0270 16 9e 69 24 3
f f6 26 06 f6 50 88
d7 cb 4b 9a 84 .
.i$?.&..P...K..
0280 73 3e 93 d5 6
1 c0 5e 05 12 64 95
d5 64 3a 43 1e s
>..a.^..d..d:C.
0290 cd a2 ec d1 0
8 aa 97 fa 42 29 85
0a ca 1c 79 40 .
.......B)....y@
02a0 3d e3 e7 94 4
a 84 0b b7 cc f4 54
99 3f e4 7a 11 =
...J.....T.?.z.
02b0 8c 47 71 0e 7
1 2c 93 aa 41 f3 01
90 d5 66 8e 1a .
Gq.q,..A....f..
02c0 12 e5 1b 7a e
0 14 4a 02 6b 78 d0
a1 89 c1 8d 7a .
..z..J.kx.....z
02d0 bd aa 99 5f 4
b 1a d4 bd e8 e7 c2
4c 3d 58 39 e4 .
.._K......L=X9.

02e0 c2 06 5a bd a
2 29 aa e7 7e 0a 89
83 26 9c d9 d5 .
.Z..)..~...&...
02f0 91 2c 78 99 5
d 1d 72 3b a3 1c bd
c4 96 2a 19 28 .
,x.].r;.....*.(
0300 b1 71 39 a0 d
2 ee 2c d2 57 de c7
36 96 43 9f 4f .
q9...,.W..6.C.O
0310 41 a1 79 71 1
c 7d a5 2c 29 4c 70
0c 18 a3 8b 3b A
.yq.}.,)Lp....;
0320 6e 20 fc 41 1
1 63 f9 09 8d 49 36
da 1d 4e 7e 0d n
.A.c...I6..N~.
0330 5b 19 e9 94 1
6 b3 78 11 f0 54 77
99 18 3a be 1c [
.....x..Tw..:..
0340 ab 97 6a 97 2
2 8f 2e 63 5f b6 1c
de cf ca fb 57 .
.j."..c_......W
0350 49 5d 63 78 e
d 1f 1f 3d cf 7d bf
89 3d ad 0d 18 I
]cx...=.}..=...
0360 8d 3a 20 78 b
a 58 1a 5d a9 79 a9
e6 30 8b 98 f7 .
: x.X.].y..0...
0370 ec ae 01 fa 1
8 67 15 eb 48 52 80
66 89 03 f8 c1 .
....g..HR.f....
0380 03 95 4f 99 4
3 57 94 9d 97 cd ca
56 64 09 4d 6e .
.O.CW.....Vd.Mn
0390 9a c2 8a 34 3
c b0 ed 5c 64 53 73
2f 36 f5 4d c8 .
..4<..\dSs/6.M.
03a0 ae 58 75 5b 5
4 d3 7e 98 34 c5 ce
af ce 6e d6 b1 .
Xu[T.~.4....n..
03b0 9b 8a 77 69 2
4 f2 df 71 92 ed 93
b9 3e db 37 1d .
.wi$..q....>.7.
03c0 fd 25 db 77 2
f 92 5f fb d1 15 20
f7 a8 c8 3d c5 .
%.w/._... ...=.
03d0 ff fb 92 04 e
9 0f f2 d5 2d 5a 81
8f 42 60 56 a6 .
.......-Z..B`V.
03e0 9b 40 31 83 5
c 0c 2c f1 64 07 bc
6b 81 84 9c 2c .
@1.\.,.d..k...,
03f0 80 c7 99 70 6

7 d2 59 f6 3a cf a7
a4 53 1f 2d b0 .
..pg.Y.:...S.-.
0400 20 98 e6 63 3
7 17 79 03 5d 89 f9
04 65 7a a2 c4
..c7.y.]...ez..
0410 36 33 f4 e4 b
4 68 2d d1 13 b1 2a
a3 6c 88 11 17 6
3...h-...*.l...
0420 10 8b df 5a 1
0 db 59 a9 f9 61 af
5b 22 d0 84 e3 .
..Z..Y..a.["...
0430 b2 e3 2c e6 3
5 ba 88 8d a0 44 a2
5a 95 ac 60 12 .
.,.5....D.Z..`.
0440 e3 95 9b 21 8
d 47 06 38 4c 94 88
69 48 1f 54 df .
..!.G.8L..iH.T.
0450 fd fd 7f 0e 7
7 e3 ef ef ff ff 0b
f2 94 36 1c 5c .
...w........6.\
0460 01 96 a0 26 a
7 9a bb 00 98 9d b4
70 45 9a 07 26 .
..&.......pE..&
0470 bd a9 87 8d 3
3 15 a6 f6 74 dc 51
e6 9d cb 5d ce .
...3...t.Q...].
0480 c6 18 41 31 6
c b7 fb 86 ac b3 ab
c5 4a bb 35 90 .
.A1l.......J.5.
0490 30 a8 a2 e7 4
5 cc 62 be 3f bf ef
9a a6 fe 9b 6b 0
...E.b.?......k
04a0 d6 3d 44 64 a
9 db 51 c0 00 64 50
70 8d e3 85 a2 .
=Dd..Q..dPp....
04b0 76 97 12 d6 3
3 da 69 56 7a 1f 6a
5a f2 f8 e6 31 v
...3.iVz.jZ...1
04c0 bd 2e e9 ed 8
0 0c a8 7c 4e de c8
5c 60 de 16 0b .
......|N..\`...
04d0 01 b5 16 ed 5
4 5d 0f 0d 49 bc 9c
eb 32 29 5f 61 .
...T]..I...2)_a
04e0 fd ad 2b d6 3
d 1f 15 31 db d8 41
f4 e7 5c b1 05 .
.+.=..1..A..\..
04f0 7e 8b a8 1e 6
f fd ce 13 1b e9 98
ec 6e f5 13 33 ~
...o.......n..3
0500 92 db 39 91 1
6 d1 ad ef 3e 14 12

0e 83 e4 92 0a .
.9.....>.......
0510 b4 54 c6 ca c
5 4e 9a 66 5d 6b 57
fa 2a 71 56 08 .
T...N.f]kW.*qV.
0520 60 b4
`
.
No. Time
Source
Destination
Protocol
Length Info
262 9.821390000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1305 http49
574 [PSH, ACK] Seq=
157584 Ack=1 Win=46
Len=1251
Frame 262: 1305 byt
es on wire (10440 b
its), 1305 bytes ca
ptured (10440 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.871320000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.871320000 s
econds
[Time delta fro
m previous captured
frame: 0.098004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09800400
0 seconds]
[Time since ref
erence or first fra
me: 9.821390000 sec
onds]
Frame Number: 2
62
Frame Length: 1
305 bytes (10440 bi
ts)
Capture Length:
1305 bytes (10440
bits)
[Frame is marke
d: False]

[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)

.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
291
Identification:
0xf202 (61954)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a31 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 157584, Ack:
1, Len: 1251
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1251]
Sequence number
: 157584 (relati
ve sequence number)
[Next sequence
number: 158835 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)

Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4eb
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2511]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0b f2 02 4
0 00 31 06 3a 31 4a
7c 0c 8a c0 a8 .
...@.1.:1J|....
0020 01 0b 00 50 c
1 a6 2b ca c9 bd 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 4e b2 0
0 00 14 a3 e4 58 8b
98 c1 75 92 a3 .

.N......X...u..
0040 6a d9 02 fe d
e db 75 a7 7e 92 c8
d0 1d 9e cf e5 j
.....u.~.......
0050 6d 27 a9 6e 7
2 9b e8 65 b9 81 a3
f1 42 8b 09 75 m
'.nr..e....B..u
0060 7b 96 74 13 7
1 94 cb 4c 8b 55 28
a9 4a b1 d5 7c {
.t.q..L.U(.J..|
0070 b0 cb 4a 95 1
f 53 51 65 a1 54 eb
64 b0 90 cd bb .
.J..SQe.T.d....
0080 b0 3b 3f 07 d
f 9e ff fb 92 04 ee
0f f3 2e 3c d8 .
;?...........<.
0090 01 f8 32 e0 5
e 84 7b 00 3d e9 4a
4b e0 cf 5e 07 .
.2.^.{.=.JK..^.
00a0 e0 cb 81 8c 1
d 6b 81 87 99 70 e3
ff bf f9 7e 4e .
....k...p....~N
00b0 9e 23 0e 11 5
2 59 30 13 40 fb 9a
c8 18 ee 2c 59 .
#..RY0.@.....,Y
00c0 3f 20 5c a3 1
8 da 88 23 a2 b0 49
69 af ea 9d 3b ?
\....#..Ii...;
00d0 9e 19 25 8b 5
7 58 4c a6 64 53 56
96 3c 7e 8f e6 .
.%.WXL.dSV.<~..
00e0 0d bb d7 f7 7
3 25 a5 c6 d1 da 8b
73 95 28 da b5 .
...s%.....s.(..
00f0 59 66 95 f9 c
b 40 8f 7f b6 b7 fd
ec bc f3 36 4d Y
f...@........6M
0100 c7 85 02 35 6
5 8e 99 4a fa c4 ba
b7 fb be f7 c7 .
..5e..J........
0110 fb 2d 24 00 d
d d4 84 5d 27 1a 79
12 d2 72 37 a2 .
-$....]'.y..r7.
0120 d8 d2 4a c0 7
9 8b cd da b9 9d f6
78 50 05 19 b7 .
.J.y......xP...
0130 5e 96 d9 54 8
d 0f b2 75 88 1e 44
45 34 cd 96 2a ^
..T...u..DE4..*
0140 0a 2a 09 8e 3
3 64 95 1d 6d d6 a1
1d d3 3e d3 72 .
*..3d..m....>.r

0150 d7 43 fd 4b b
a a9 e0 f0 19 94 b0
63 1e e1 a4 05 .
C.K.......c....
0160 4a b9 21 c4 0
5 cd d9 14 94 d0 b4
7f fa 9e 66 39 J
.!...........f9
0170 98 79 b9 ab 1
1 21 79 07 21 66 e7
2f 0a 9e cc d3 .
y...!y.!f./....
0180 4f a4 ec d1 0
a 91 81 42 f2 96 e3
b6 14 8c 53 f5 O
......B......S.
0190 6c f2 76 17 d
1 0c 99 03 b9 63 62
9b 71 d5 0f 31 l
.v......cb.q..1
01a0 e6 c3 fc be a
a 47 8b e7 d1 15 9d
74 2b f2 ac b7 .
....G.....t+...
01b0 e6 8b 9c e8 f
f e2 2a 22 57 dc cc
94 e2 ae c6 68 .
.....*"W......h
01c0 b6 46 8d d3 b
f 49 9d ae e3 a2 a6
31 8d 38 5d 61 .
F...I.....1.8]a
01d0 94 17 95 60 9
2 0d a9 43 01 78 5a
86 8e 7a cb 8c .
..`...C.xZ..z..
01e0 12 49 4f a7 5
c 3a 28 5d d9 ef a8
4a c5 0b dd 2d .
IO.\:(]...J...01f0 7a 49 ac a6 9
3 28 18 74 c6 47 de
b0 93 dc fb 6b z
I...(.t.G.....k
0200 5e 55 fb fc c
2 73 8d 6d ea d9 52
cd ad da fb 92 ^
U...s.m..R.....
0210 35 69 ac de 5
9 a7 c8 08 91 e5 9e
54 71 01 76 c4 5
i..Y......Tq.v.
0220 27 50 8d 1b c
5 af 76 86 ff fb 92
04 e9 8f f2 d3 '
P....v.........
0230 2e d7 01 f8 4
2 62 62 46 0a d0 3f
0c 4c 4b 74 a3 .
...BbbF..?.LKt.
0240 5a 0c 61 69 4
1 6e 98 6b 40 fc 2d
31 6d ff eb 9d Z
.aiAn.k@.-1m...
0250 b0 bf da 4a 8
8 ac b9 08 d2 92 b9
8b 54 39 e1 fe .
..J........T9..
0260 6f 8f 06 8b 4

d a5 a4 a2 57 34 2a
60 98 a9 2a 6a o
...M...W4*`..*j
0270 6f a0 8b 2c 3
5 8b 34 f5 1e 88 1a
3a 3c 89 4e aa o
..,5.4....:<.N.
0280 e7 93 97 54 c
f ec a5 a2 69 7c a3
24 1b 25 d4 e7 .
..T....i|.$.%..
0290 9a 1b fb ed 9
0 70 ed 33 d1 23 5a
2d 97 d2 55 f1 .
....p.3.#Z-..U.
02a0 0e 92 f6 0a 0
d 1a 95 1d 71 d7 58
75 12 ec 4d f1 .
.......q.Xu..M.
02b0 c4 7d 50 88 0
4 46 f7 f1 4e 18 7a
4c 15 f8 2c 98 .
}P..F..N.zL..,.
02c0 13 85 82 e6 e
1 f3 0a 7e 3e 0b 0b
62 b4 54 42 e8 .
......~>..b.TB.
02d0 00 18 d5 99 7
6 77 48 4a 60 d9 76
2d 9a 87 de 9d .
...vwHJ`.v-....
02e0 7a 47 61 9b 5
6 16 cc 43 7c e7 19
c9 72 a4 62 f6 z
Ga.V..C|...r.b.
02f0 c3 e8 10 23 6
b da 24 af b7 7d c5
ce 1c b3 9d db .
..#k.$..}......
0300 79 5d b8 ee f
c 19 ab b1 ce db 48
69 da dc 7f d1 y
]........Hi....
0310 cf ff dd e3 2
9 21 ae ac ab a6 06
6b 2e 1b 76 19 .
...)!.....k..v.
0320 3e 1c 00 5e 7
e 1e 05 cf df 62 f8
d4 b9 02 85 c2 >
..^~....b......
0330 6e 2d 4b 16 b
b 9e 64 58 b3 2b 95
4d c0 f8 44 a7 n
-K...dX.+.M..D.
0340 36 b0 fb d1 6
2 24 3a 66 35 92 75
5b ad b1 0a af 6
...b$:f5.u[....
0350 b1 af 68 32 9
0 26 28 78 d7 c3 e7
1c ef 56 df 8f .
.h2.&(x.....V..
0360 ed fe 30 d7 a
d 63 14 dc b1 b2 75
46 6d 51 d4 f6 .
.0..c....uFmQ..
0370 5d 7a f3 6a 8
7 1e 91 14 5a 13 4b

2a b4 bd 80 ea ]
z.j....Z.K*....
0380 85 15 8c 68 5
0 49 1c 16 64 d1 4f
46 44 9d c8 f4 .
..hPI..d.OFD...
0390 c8 10 74 4f e
5 7a d1 4e 95 4a 7b
75 5a b5 75 cb .
.tO.z.N.J{uZ.u.
03a0 76 3e 5c 1f 5
4 9a cc 80 7a ec 16
dc 48 42 57 db v
>\.T...z...HBW.
03b0 dd 8a b6 bb 8
f 69 e6 ed 22 df 3d
57 93 33 01 ad .
....i..".=W.3..
03c0 1e 9c 9e c7 5
d 15 46 72 10 ad ff
fb 92 04 ee 8f .
...].Fr........
03d0 f3 10 29 d5 8
3 18 7a 60 63 66 0a
a0 63 0b 4c 0c .
.)...z`cf..c.L.
03e0 50 a5 54 0c 6
5 e9 89 7a 18 6a 81
8c 3d 30 ef 49 P
.T.e..z.j..=0.I
03f0 29 64 65 27 5
f 19 13 3c c8 69 05
dc 9d 8e 0a a2 )
de'_..<.i......
0400 1e 92 9c 14 e
a d3 0f 0e e5 35 d1
02 cb b3 3b d9 .
........5....;.
0410 88 a6 df 01 e
e cb b0 ff 56 1c 9e
32 08 8c 58 20 .
.......V..2..X
0420 73 00 ae 55 3
2 5b 72 04 82 ed f4
89 71 9b 6a 59 s
..U2[r.....q.jY
0430 6d 20 47 c9 8
6 f0 42 10 8e fe 0e
a9 7c 3f 45 9f m
G...B.....|?E.
0440 f3 79 9e 70 3
8 ea 6f 26 a5 fa e1
0f 58 c0 e4 c3 .
y.p8.o&....X...
0450 25 d1 79 4c b
3 01 e9 83 86 57 d9
08 c3 76 47 40 %
.yL.....W...vG@
0460 1c c8 35 08 4
2 83 87 49 ac 3f 44
2b 8b 00 d5 7f .
.5.B..I.?D+....
0470 bf d2 18 64 7
4 43 87 49 31 4f 93
d5 10 63 d0 55 .
..dtC.I1O...c.U
0480 7a 90 76 1b 5
a 97 e8 16 95 9c 78
0c 0d d2 b5 e0 z

.v.Z.....x.....
0490 d1 79 d9 06 9
5 89 0c a0 70 50 4f
7f 86 04 d1 75 .
y......pPO....u
04a0 4f 88 2e d5 d
b b4 de 93 d8 cb 07
51 74 50 f8 c9 O
..........QtP..
04b0 35 30 e0 da 4
3 67 79 96 c2 01 c0
a2 5e cf f8 8d 5
0..Cgy.....^...
04c0 37 90 68 09 7
b e6 a3 a8 26 a2 ad
07 92 94 02 85 7
.h.{...&.......
04d0 8f d4 98 83 a
5 21 51 de 1c ed 5b
ac 82 d0 c3 72 .
....!Q...[....r
04e0 7d ab d0 58 c
2 e4 19 3c d6 ab b7
8d 08 f5 8d eb }
..X...<........
04f0 6c d9 0c d7 f
f 19 23 2b 3f 14 a4
04 e3 2e ff eb l
.....#+?.......
0500 d1 97 e3 fd 5
a 1c 48 16 d6 2b ab
37 b9 7a 7d 5a .
...Z.H..+.7.z}Z
0510 92 f3 83 57 a
6 5a 35 1a aa
.
..W.Z5..
No. Time
Source
Destination
Protocol
Length Info
263 9.821572000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=158835 Win=38115 L
en=0
Frame 263: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.871502000 Romance
Standard Time
[Time shift for

this packet: 0.000

000000 seconds]
Epoch Time: 141
5615222.871502000 s
econds
[Time delta fro
m previous captured
frame: 0.000182000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018200
0 seconds]
[Time since ref
erence or first fra
me: 9.821572000 sec
onds]
Frame Number: 2
63
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f7c (20348)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 15883
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 158835 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]

Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 262]
[The RTT to
ACK the segment wa
s: 0.000182000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 7c 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O|@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca ce a0 50 10 .
....P..N.+...P.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
264 9.934393000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=15883
5 Ack=1 Win=46 Len=
1260
Frame 264: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
2.984323000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615222.984323000 s
econds
[Time delta fro
m previous captured
frame: 0.112821000
seconds]

[Time delta fro

m previous displaye
d frame: 0.11282100
0 seconds]
[Time since ref
erence or first fra
me: 9.934393000 sec
onds]
Frame Number: 2
64
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf203 (61955)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a27 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 158835, Ack:
1, Len: 1260

Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 158835 (relati
ve sequence number)
[Next sequence
number: 160095 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x46c
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 03 4
0 00 31 06 3a 27 4a
7c 0c 8a c0 a8 .
...@.1.:'J|....
0020 01 0b 00 50 c
1 a6 2b ca ce a0 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 46 c0 0
0 00 7e 20 35 30 46
35 40 20 31 23 .
.F...~ 50F5@ 1#
0040 c7 e6 2c 2a e
e 3f ac 9a 0d 91 9e
54 d0 b5 81 12 .
.,*.?.....T....
0050 69 5a 41 68 c
2 ab 1d 1a d0 a6 e5
d8 d3 8e 10 26 i
ZAh...........&
0060 0f 63 18 ec 6
9 c5 55 0e 35 e8 38
c0 b7 32 31 c6 .
c..i.U.5.8..21.
0070 8b 8f d8 da 7
e 28 f1 76 7d 63 5f
0f 13 ff 5e ce .
...~(.v}c_...^.
0080 bb 33 97 8b f
d 61 bc 88 04 ff fb
92 04 ea 0f f2 .
3...a..........
0090 c4 2c 55 03 1
9 62 60 59 c6 0a a0
63 0b 4c 0c a8 .
,U..b`Y...c.L..
00a0 cf 50 0c e9 0
b 81 a3 1a 2a 01 8c
bd 70 84 4e 17 .
P......*...p.N.
00b0 14 22 f4 28 2
2 42 fe ed 3d 50 25
74 ff 61 c8 e0 .
".("B..=P%t.a..
00c0 dc 5d 32 93 8
e b6 c3 c2 ad 90 63
4b 36 e9 24 73 .
]2.......cK6.$s
00d0 05 09 64 5d e
9 87 82 28 15 be c6
c7 d7 11 0f 51 .
.d]...(.......Q
00e0 9b fb d4 dd 7
9 44 36 78 87 50 fe
98 1e 58 d0 d9 .
...yD6x.P...X..
00f0 ec b4 86 f5 f
5 20 a4 6c 26 c7 10
88 f6 16 6c 9e .
.... .l&.....l.
0100 6c 15 3a 9f 5
b 73 43 3f 9e 10 3e

a3 60 50 cb a5 l
.:.[sC?..>.`P..
0110 02 0e fd 12 0
a 00 43 97 73 a2 21
50 e3 c9 00 0c .
.....C.s.!P....
0120 03 ab 10 1e 2
9 02 31 93 ac 3f 15
b0 0e 53 0f 6e .
...).1..?...S.n
0130 c1 98 18 01 1
3 5a 2f 7e de 25 82
c3 4a f0 d6 17 .
....Z/~.%..J...
0140 24 1c e6 41 4
a 79 35 2d 44 7e 05
57 ef 64 a5 ad $
..AJy5-D~.W.d..
0150 2a 81 6b 79 a
5 18 62 d2 f8 c6 13
2e 5a ef 67 dc *
.ky..b.....Z.g.
0160 15 ac e3 fb 4
1 75 13 06 8f a8 bb
6e 15 0c 32 94 .
...Au.....n..2.
0170 ac 3d 4a 0b 1
0 f4 8e c0 64 80 f8
06 e2 55 34 71 .
=J.....d....U4q
0180 c4 20 d3 98 6
e 28 94 89 1f 7e 9a
6c cc 09 32 23 .
..n(...~.l..2#
0190 e3 53 f2 cb f
9 2b 3b 12 c7 bf 04
bd 2f b3 3a 97 .
S...+;...../.:.
01a0 c2 b9 22 b1 2
5 77 fc 36 04 78 a5
c9 61 7e 05 c5 .
.".%w.6.x..a~..
01b0 67 d0 be b0 f
1 d0 69 c9 c5 89 2c
2b 3d 2f 29 63 g
.....i...,+=/)c
01c0 26 b7 ff 71 5
3 d5 79 f1 a6 3e 79
65 36 ca 53 b2 &
..qS.y..>ye6.S.
01d0 ff f5 d5 7c 9
4 78 28 c3 0c 54 60
d3 4c 03 45 c1 .
..|.x(..T`.L.E.
01e0 0a 84 db 53 1
5 95 96 34 43 92 42
b1 08 05 63 9b .
..S...4C.B...c.
01f0 93 b9 46 16 6
1 86 27 4b 66 45 fb
25 20 35 6e 8e .
.F.a.'KfE.% 5n.
0200 97 50 6a 98 3
e cd 01 13 02 0f 9f
00 b0 72 67 50 .
Pj.>........rgP
0210 d7 18 65 54 3
e d7 a3 32 85 a6 3c
d8 cc 16 b3 82 .

.eT>..2..<.....
0220 b4 96 26 64 5
8 8d f3 7d e1 aa 27
ff fb 92 04 e8 .
.&dX..}..'.....
0230 8f f2 fb 28 d
4 83 3a 7a 50 5a 05
8a 90 63 4b 4c .
..(..:zPZ...cKL
0240 0b 98 a3 52 0
c 69 e9 41 88 19 ea
00 fd 25 70 df .
..R.i.A.....%p.
0250 cd 37 25 82 3
7 6a bd c9 7d d4 d2
f6 bd 4b 41 da .
7%.7j..}....KA.
0260 1e 9b 07 72 4
4 f2 3a 67 6a 7d 35
27 23 c7 fa 52 .
..rD.:gj}5'#..R
0270 86 34 2c 75 7
b 4e d0 8f 60 0a 6d
9b 0c eb 67 15 .
4,u{N..`.m...g.
0280 4f 8a 2a ff 5
5 1f 21 a6 82 40 98
12 4e b9 e3 69 O
.*.U.!..@..N..i
0290 e6 2b ba 56 2
d 26 33 a4 da 09 94
f8 54 f2 60 12 .
+.V-&3.....T.`.
02a0 5e f3 17 ed 1
e 47 ce 5e f8 70 f8
ff dc d4 f7 f7 ^
....G.^.p......
02b0 0f a2 ce 25 2
2 94 72 50 2b 46 00
88 99 0c 78 28 .
..%".rP+F....x(
02c0 d2 f7 a0 f8 e
a 62 d0 58 18 ae fc
7c ee a5 bf a3 .
....b.X...|....
02d0 26 4a 1d bf 4
a 10 39 dc 8b 4c 96
df 9d b2 5f 62 &
J..J.9..L...._b
02e0 3c e5 d3 39 e
6 f7 45 5e 3a f1 49
9b 19 d7 79 e5 <
..9..E^:.I...y.
02f0 00 d0 2c 36 f
1 80 b6 9e 29 43 b3
8a 61 f2 2d 80 .
.,6....)C..a.-.
0300 0c 68 b0 7e a
a 34 07 3d 55 72 57
5e b1 44 f3 d3 .
h.~.4.=UrW^.D..
0310 f6 9f f7 9e 6
f e8 81 78 81 04 f9
61 49 ea e9 04 .
...o..x...aI...
0320 5c 42 36 da c
a 3f f5 cb 3a 19 9b
68 e2 cd cb 69 \
B6..?..:..h...i

0330 26 50 1c 0c 3
4 68 4a 92 eb d2 95
b0 80 79 56 1b &
P..4hJ......yV.
0340 ac f3 c8 67 d
9 3c 65 16 4a 8f 4c
5a 7e 7d 30 fe .
..g.<e.J.LZ~}0.
0350 50 cc ea ad 2
a c1 5f db 70 f6 2f
b2 42 c5 61 5c P
...*._.p./.B.a\
0360 73 17 74 ed 1
b f9 9e db 33 f3 bb
7a e3 bb c1 37 s
.t.....3..z...7
0370 ee 93 84 c0 6
1 27 12 ac 34 9f c8
4b 2f 32 8e 5f .
...a'..4..K/2._
0380 71 02 da 69 2
c c0 1b a1 38 24 66
88 24 be 6d f8 q
..i,...8$f.$.m.
0390 15 72 0a e2 3
4 d2 23 28 99 c0 94
28 98 29 2c 9d .
r..4.#(...(.),.
03a0 e4 bc 9a 30 c
b 54 8d 48 6b 44 ef
d3 a2 6d 93 c8 .
..0.T.HkD...m..
03b0 34 f3 9c 15 d
4 d2 66 e1 e0 06 d1
b7 5a 72 3b 58 4
.....f.....Zr;X
03c0 7c 94 79 99 4
1 3a 96 fe 0c 3b e5
b7 45 ff fb 92 |
.y.A:...;..E...
03d0 04 eb 0f f3 1
f 2c 54 03 3a 7a 60
5c 86 1a 80 63 .
....,T.:z`\...c
03e0 2b 4c 0b d4 c
f 50 0c 65 0b 81 70
18 2a 01 8c b1 +
L...P.e..p.*...
03f0 30 f1 cd 7d f
d ff 9f 3d 43 b5 d5
5c 26 65 13 95 0
..}...=C..\&e..
0400 a4 59 30 c2 9
9 8c 8a 72 42 ea 09
41 f7 7d 8c 5e .
Y0....rB..A.}.^
0410 1c 45 17 33 0
6 ce 1d 8d 15 0b 08
84 6c 8a 2b 95 .
E.3........l.+.
0420 70 be 26 13 f
f 46 f2 54 67 b3 32
aa d0 ed 48 8e p
.&..F.Tg.2...H.
0430 f2 ad 62 07 c
4 7b 78 ac 8d 3b cd
c3 f8 e1 1b bb .
.b..{x..;......
0440 4d 20 44 21 9

c 6c 37 f9 40 fd 4b
7f 07 17 bf d4 M
D!.l7.@.K.....
0450 59 7e 5b 50 6
8 ef ff 3e 9c 3d da
b7 22 1d 6e e3 Y
~[Ph..>.=..".n.
0460 85 56 96 38 8
e d0 10 ba 55 2d 48
b8 04 ac 32 a2 .
V.8....U-H...2.
0470 e6 77 4a c5 5
9 46 14 ae e1 f9 01
2b 30 35 82 26 .
wJ.YF.....+05.&
0480 31 4b d5 2e 1
2 8f 12 4d 4d 9d 2d
67 a2 0f 70 e5 1
K.....MM.-g..p.
0490 f9 d6 e8 29 d
4 8a 8c c6 33 98 99
cf f5 7f 0b c7 .
..)....3.......
04a0 a5 6b b5 e7 b
1 a4 4a 7f 0d 09 c5
f5 5c e2 07 d7 .
k....J.....\...
04b0 ff 12 b0 70 f
6 f3 6e 95 7d 4e a1
f9 a7 56 c5 40 .
..p..n.}N...V.@
04c0 1c 76 e4 f5 0
7 c5 6a c8 61 41 d3
be c4 c9 60 b0 .
v....j.aA....`.
04d0 56 14 14 23 2
7 7f e5 05 40 60 a7
82 d1 5d ce 53 V
..#'...@`...].S
04e0 75 b8 97 92 8
3 72 9b 4f a4 2b 1b
35 70 cb 0d 41 u
....r.O.+.5p..A
04f0 74 68 26 a6 7
5 92 a4 13 b5 22 48
97 54 6e 68 8a t
h&.u...."H.Tnh.
0500 26 41 44 62 6
c 74 71 26 a1 98 e9
82 6c 8a d4 62 &
ADbltq&....l..b
0510 7f ae 66 82 9
e b9 53 7e 7f df a5
75 1e b0 61 60 .
.f...S~...u..a`
0520 f6 0e
.
.
No. Time
Source
Destination
Protocol
Length Info
265 9.970399000
cust-74-124-12138.dllstx01.corexc
hange.com pc13.home

TCP
1294 http49
574 [PSH, ACK] Seq=
160095 Ack=1 Win=46
Len=1240
Frame 265: 1294 byt
es on wire (10352 b
its), 1294 bytes ca
ptured (10352 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.020329000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.020329000 s
econds
[Time delta fro
m previous captured
frame: 0.036006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03600600
0 seconds]
[Time since ref
erence or first fra
me: 9.970399000 sec
onds]
Frame Number: 2
65
Frame Length: 1
294 bytes (10352 bi
ts)
Capture Length:
1294 bytes (10352
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
280
Identification:
0xf204 (61956)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a3a [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 160095, Ack:
1, Len: 1240
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1240]
Sequence number
: 160095 (relati
ve sequence number)
[Next sequence
number: 161335 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd6b
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2500]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 00 f2 04 4
0 00 31 06 3a 3a 4a
7c 0c 8a c0 a8 .
...@.1.::J|....
0020 01 0b 00 50 c
1 a6 2b ca d3 8c 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e d6 b3 0
0 00 ff b7 40 eb ad
69 c9 78 28 84 .
.......@..i.x(.
0040 0e d1 0e 73 c
5 2e 5b 26 3c 94 62
5d 25 0b c3 33 .
..s..[&<.b]%..3
0050 81 1a 3e 56 7
3 ba 48 34 78 3c ed
7e e6 fb 6d f8 .
.>Vs.H4x<.~..m.
0060 b7 ac b9 c8 9
f ee 90 f0 ea 3e 5e
9e 79 cb 9e a5 .
........>^.y...
0070 92 26 ab bc 5
d 8a 5d 74 b5 2e c9
6a c6 f7 c4 0f .
&..].]t...j....
0080 bd ff ee ff f
b 92 04 ec 8f f3 2d
34 53 83 1a 5a .

.........-4S..Z
0090 e0 61 26 7a 7
0 63 2b 5c 0b c0 b1
50 0c 69 e9 81 .
a&zpc+\...P.i..
00a0 80 1a 29 c1 8
d 35 70 cb d4 2e a7
69 45 67 b5 67 .
.)..5p....iEg.g
00b0 ff ad e4 ae c
4 14 e1 6d 53 ba 41
33 45 2d 57 1e .
......mS.A3E-W.
00c0 36 1f 86 8c c
6 9a 74 06 6c 89 18
93 c0 a2 13 4d 6
.....t.l......M
00d0 c2 96 0d ea a
f 4d 55 98 13 99 15
af 49 6e 1e ce .
....MU.....In..
00e0 09 73 e8 93 2
e 11 0b 98 e8 5a 68
7d 10 0d 7d d3 .
s.......Zh}..}.
00f0 87 a3 44 da e
8 c6 f3 4a 91 b5 ee
05 06 6c f7 b1 .
.D....J.....l..
0100 02 e5 ef e1 a
2 2c f1 35 98 35 32
84 ff 7d 9f d5 .
....,.5.52..}..
0110 21 99 82 78 b
7 ea b4 b1 29 2e 38
71 dd 26 45 3a !
..x....).8q.&E:
0120 fa 9e 73 74 5
5 42 2a bf 71 27 f4
ab 8d 10 8a c9 .
.stUB*.q'......
0130 c0 75 f9 99 5
0 18 b3 f8 32 3b 5e
5d 15 8f c4 9b .
u..P...2;^]....
0140 5c d6 99 3e c
4 92 79 d1 11 1b 63
d1 96 33 1b df \
..>..y...c..3..
0150 69 4e 19 ed 6
8 b0 54 ea 26 df 56
59 58 e3 ef 53 i
N..h.T.&.VYX..S
0160 7f b8 da a6 6
f 6d 49 78 da 79 41
38 90 31 55 95 .
...omIx.yA8.1U.
0170 3b ae 5b 0d 2
b 71 44 11 35 f6 53
b2 d1 2d 78 c3 ;
.[.+qD.5.S..-x.
0180 da 18 34 b2 f
9 9e 3d f8 0c a3 17
fd f6 71 49 6b .
.4...=......qIk
0190 2f e1 35 f4 6
f fd bb a9 bc 98 af
04 76 ec ba 1d /
.5.o.......v...

01a0 8f b8 8d ec e
d 2c 9e c3 db 4e 6d
91 60 bf c4 44 .
....,...Nm.`..D
01b0 ac 38 be 36 9
2 73 fb 45 70 6f 3b
d4 ff 1b bd dc .
8.6.s.Epo;.....
01c0 96 b1 af f6 d
c b3 6c de d4 6a a4
6a 5a 9e ed 42 .
.....l..j.jZ..B
01d0 07 44 79 75 7
4 61 88 d9 07 1f a6
f1 3f 74 3b 53 .
Dyuta......?t;S
01e0 4d 71 82 d1 c
b 03 f9 25 6e 4c de
a3 70 87 52 a5 M
q.....%nL..p.R.
01f0 33 89 87 0e c
d 5b 9b a5 1e 14 b6
66 72 47 9c ae 3
....[.....frG..
0200 03 33 23 f4 c
a 00 36 08 07 9a 25
61 49 1d 55 64 .
3#...6...%aI.Ud
0210 dd 2c 66 ac d
b ad 84 31 7f 56 48
e4 fb ba dc 9c .
,f....1.VH.....
0220 6f 2b 75 d5 2
4 ff fb 92 04 e9 0f
f2 f6 2c d4 03 o
+u.$........,..
0230 1a 7a 60 5e 2
5 fa 70 63 2b 4c 0c
3c b9 50 0c 69 .
z`^%.pc+L.<.P.i
0240 e9 81 87 17 e
a 01 8c bd 30 c0 e1
26 37 7d 29 bc .
.......0..&7}).
0250 87 e8 af ff f
f eb 71 16 70 5f 96
d4 c8 fa 48 8c .
.....q.p_....H.
0260 d1 ba 9a 6b 8
d 66 d4 40 b6 91 17
49 9b c6 19 83 .
..k.f.@...I....
0270 fa d2 61 e2 8
3 43 34 19 c7 da 23
9d 4b 29 90 41 .
.a..C4...#.K).A
0280 f8 47 dd b3 3
2 3e b3 22 86 c1 01
86 90 a0 40 92 .
G..2>."......@.
0290 38 f5 5c d6 6
4 22 6d da e1 47 7d
a0 a6 d6 5a ed 8
.\.d"m..G}...Z.
02a0 2d c6 a3 3c a
d d5 75 a4 f4 42 02
1f 8a 2a f7 b7 ..<..u..B...*..
02b0 6f ff ff ff 9

7 1d 93 f0 5a 8d 6d
26 94 22 51 74 o
.......Z.m&."Qt
02c0 54 90 34 e8 1
6 3c 3c 7a b2 56 2d
0e c5 1d a2 42 T
.4..<<z.V-....B
02d0 16 21 55 2e e
1 ed 84 79 43 d3 8d
93 d9 65 c6 37 .
!U....yC....e.7
02e0 b7 b9 75 8c 5
7 35 cf b4 23 f0 51
a2 50 01 30 e8 .
.u.W5..#.Q.P.0.
02f0 7c 14 5a 1d 2
b 5b 92 5f 72 96 27
45 47 05 0b cc |
.Z.+[._r.'EG...
0300 1c 55 36 06 1
c e7 b7 51 8b a9 53
bf 18 41 cd a4 .
U6....Q..S..A..
0310 40 7d 15 4e 8
3 5d a9 0c 50 ac 0e
93 42 48 08 53 @
}.N.]..P...BH.S
0320 2b 11 3f 7a b
e 9e 52 b8 27 86 92
d9 15 2e 33 7b +
.?z..R.'.....3{
0330 21 51 b1 58 0
5 d2 3a b6 71 5b 14
38 63 aa cd 8c !
Q.X..:.q[.8c...
0340 21 ea b5 49 9
5 55 20 68 98 0e 55
8f 72 90 76 12 !
..I.U h..U.r.v.
0350 8f 6b 90 c4 8
b eb 21 63 c8 10 dd
69 43 b9 7d 8a .
k....!c...iC.}.
0360 92 d4 e5 6d 2
2 92 0a 38 4c 9e 95
14 72 d5 98 b2 .
..m"..8L...r...
0370 3d 96 db 8e 3
5 c4 44 73 12 88 a5
82 e2 08 07 c8 =
...5.Ds........
0380 b3 a2 1c 18 6
3 3d 90 8a a4 3c d8
dc 31 a8 f6 83 .
...c=...<..1...
0390 07 bc a5 1a b
4 35 f2 0e a5 fb 8d
54 e1 33 94 a5 .
....5.....T.3..
03a0 29 e0 bf cf e
9 fb ff 3c 3f 97 eb
6e 8a e7 b1 55 )
......<?..n...U
03b0 8f 76 ce af a
6 5d 57 57 ef d8 a7
c7 c5 8e b6 aa .
v...]WW........
03c0 90 38 21 5f f
f a9 f4 ff fb 92 04

e7 8f f2 f0 2d .
8!_...........03d0 57 01 f8 4a 6
0 5f e5 ba d0 3f 09
4c 0b 90 6b 60 W
..J`_...?.L..k`
03e0 07 e1 e7 01 6
b 90 ab c0 f7 a1 28
32 fd 73 b5 12 .
...k.....(2.s..
03f0 88 68 19 1e a
5 0f cc 87 f3 f4 69
24 0b c7 47 24 .
h........i$..G$
0400 7a b2 43 8d 5
1 27 65 31 a9 1f 39
6c 35 ad 75 82 z
.C.Q'e1..9l5.u.
0410 4b 0c ec f8 5
5 6a 5d e7 dc dc e7
de 7e dc dc 35 K
...Uj].....~..5
0420 07 51 21 5b 1
e 98 aa 9b 52 83 ea
68 54 2a 82 ae .
Q![....R..hT*..
0430 0e b8 2c e0 f
d 24 05 d6 09 28 cb
6c 5a 50 39 ae .
.,..$...(.lZP9.
0440 18 27 70 9d d
f d5 14 68 c5 80 25
04 d4 07 00 d2 .
'p....h..%.....
0450 50 38 8e 26 e
0 f4 29 79 a3 5f df
81 9c 36 ad ad P
8.&..)y._...6..
0460 d8 95 ad 96 6
5 81 29 fd de bf 92
1d 2b 6c a2 46 .
...e.).....+l.F
0470 82 72 dc d9 e
0 ea 62 29 cf 2c db
9c 55 df 59 44 .
r....b).,..U.YD
0480 d8 9d 88 f6 0
e 5b 99 f6 2b fe 37
f4 4b da 6f ea .
....[..+.7.K.o.
0490 4a 8b a7 5b a
4 3f ea 59 2e 4c ba
63 be e4 8f 1d J
..[.?.Y.L.c....
04a0 c6 ac 75 bf c
2 bf 7e 86 46 51 75
4e 9b fc a0 6c .
.u...~.FQuN...l
04b0 25 d6 52 e9 e
3 44 82 19 79 b1 b6
b8 6c 26 6b 56 %
.R..D..y...l&kV
04c0 2d 15 cc d1 8
2 32 4e 90 79 d6 f6
b8 31 af 03 1d ....2N.y...1...
04d0 b1 be fc ae 2
4 1c d8 fa 8e 69 dc
c1 68 fa a2 08 .

...$....i..h...
04e0 34 6b 4a d9 8
b 75 75 67 e8 bb e3
ec 00 99 0d 91 4
kJ..uug........
04f0 24 b2 21 a8 9
a f4 1e cc a6 78 4a
eb 88 95 3a fc $
.!......xJ...:.
0500 64 73 cb 07 4
3 97 a1 a6 14 1d 8b
56 a1 55
d
s..C......V.U
No. Time
Source
Destination
Protocol
Length Info
266 9.970580000
pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=161335 Win=38115 L
en=0
Frame 266: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.020510000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.020510000 s
econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 9.970580000 sec
onds]
Frame Number: 2
66
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)

[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f7d (20349)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 16133
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 161335 (
relative ack number
)
Header Length:
20 bytes

.... 0000 0001

0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 265]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 7d 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O}@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca d8 64 50 10 .
....P..N.+..dP.

0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
267 10.07340100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=16133
5 Ack=1 Win=46 Len=
1260
Frame 267: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.123331000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.123331000 s
econds
[Time delta fro
m previous captured
frame: 0.102821000
seconds]
[Time delta fro
m previous displaye
d frame: 0.10282100
0 seconds]
[Time since ref
erence or first fra
me: 10.073401000 se
conds]
Frame Number: 2
67
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 1
300
Identification:
0xf205 (61957)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a25 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 161335, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 161335 (relati
ve sequence number)
[Next sequence
number: 162595 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .

... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa67
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 05 4
0 00 31 06 3a 25 4a
7c 0c 8a c0 a8 .
...@.1.:%J|....
0020 01 0b 00 50 c
1 a6 2b ca d8 64 9e
87 4e aa 50 10 .
..P..+..d..N.P.
0030 00 2e a6 72 0
0 00 8a 0e d1 2a 99
6a bb 05 25 25 .
..r.....*.j..%%
0040 dc a4 62 88 6
8 a0 cc 33 81 a0 6c
fc bf 8c d2 66 .
.b.h..3..l....f
0050 01 67 c1 78 8

1 61 c8 b5 10 ad 4f
c1 51 05 60 2d .
g.x.a....O.Q.`0060 4e 5b 9a 82 2
0 1c 57 83 c7 5a 88
39 5b 65 4d a0 N
[.. .W..Z.9[eM.
0070 99 65 a9 d9 a
2 53 b6 5f 43 44 e6
ee a5 0d 9b 51 .
e...S._CD.....Q
0080 73 c7 fc b9 7
7 df b2 f2 05 8b 21
3e b4 53 3b 59 s
...w.....!>.S;Y
0090 df ff fb 92 0
4 eb 8f f2 f0 26 58
81 ef 1a 52 5c .
........&X...R\
00a0 64 2b 00 31 e
6 4a 0c 34 93 5e 07
e0 e9 49 7e 18 d
+.1.J.4.^...I~.
00b0 2b c0 f7 95 3
0 f2 c2 55 d8 ef fc
b4 84 a9 e8 9a +
...0..U........
00c0 9d ad d5 01 6
a 43 e9 87 20 8e 94
0c 9a ac 21 29 .
...jC.. .....!)
00d0 3b 10 4d 7a 1
a 76 e4 3b 20 28 19
44 70 a5 c7 70 ;
.Mz.v.; (.Dp..p
00e0 f3 9d 7e cd b
9 ab 0f ac 0f 3e 1f
45 ac 88 fd 56 .
.~......>.E...V
00f0 b6 be a8 a2 8
9 e2 6b 75 75 3e 73
7b b6 15 ba f5 .
.....kuu>s{....
0100 8f 5c df 3a f
f d6 0c ff d3 3b 5f
d7 f8 df cc 4e .
\.:.....;_....N
0110 a8 94 34 e2 4
7 9d 27 fb cb 7f d7
d2 b7 70 54 20 .
.4.G.'......pT
0120 75 2b 95 4b 9
1 1a 18 09 05 90 5c
7f 08 9b bc 73 u
+.K......\....s
0130 c6 66 fd d9 4
2 a1 7e 66 5e 13 3e
b4 cb 10 26 1e .
f..B.~f^.>...&.
0140 fe 52 6e 96 5
6 4c 96 8a c7 c1 8a
37 11 6d f9 d3 .
Rn.VL.....7.m..
0150 e5 50 5c 05 a
f ad 60 ae a1 09 ea
6c d4 a6 68 d5 .
P\...`....l..h.
0160 56 56 63 48 3
e ae 65 72 f9 f3 17

2d 91 cf 26 e9 V
VcH>.er...-..&.
0170 de ea 36 19 9
b 00 a4 50 80 94 86
f5 7d 0e 20 ac .
.6....P....}. .
0180 c4 50 04 04 9
6 ac 00 40 60 e0 f0
7e 9f 71 6e ef .
P.....@`..~.qn.
0190 38 e6 17 f9 2
c b2 df 33 59 d9 49
db 59 c8 31 33 8
...,..3Y.I.Y.13
01a0 f2 c8 e5 eb 2
a 2a b3 e1 1f 9c a9
1e ec c2 ea ea .
...**..........
01b0 38 e0 5e ae f
3 ed 2d d4 8a 51 59
8b 40 a9 6d b2 8
.^...-..QY.@.m.
01c0 ff 18 9c 09 b
5 55 66 d3 2b 1f c9
a6 49 73 2b d5 .
....Uf.+...Is+.
01d0 e8 90 ed f3 3
7 cc 5b 61 c2 83 44
4e 99 bb 46 e1 .
...7.[a..DN..F.
01e0 7f 42 75 57 7
8 1c 15 e8 44 c0 f0
8c a8 2c 4b f9 .
BuWx...D....,K.
01f0 9e 03 ce 6d 3
8 24 12 97 fc 16 85
f0 04 99 ba 98 .
..m8$..........
0200 ab 28 0a 26 2
d 59 dc a7 83 41 26
c6 80 ef e9 a0 .
(.&-Y...A&.....
0210 c7 22 6a 61 5
3 67 b6 53 02 d7 28
b3 59 42 5a d2 .
"jaSg.S..(.YBZ.
0220 cb 3a 5c 4f f
8 d6 50 66 d9 5c 9d
a8 4e 8d a7 bd .
:\O..Pf.\..N...
0230 eb 7d cc ff f
b 92 04 ec 8f f3 0d
2b d5 03 1a 5a .
}.........+...Z
0240 60 60 e6 0a a
0 63 4f 4c 0c 1c af
50 0c e9 89 81 `
`...cOL...P....
0250 91 18 29 c1 9
c b1 30 2a 7f 2d 15
12 aa 87 3b 4d .
.)...0*.-....;M
0260 db 3f ae 12 5
e e0 56 11 c4 63 87
12 2c 5d 76 29 .
?..^.V..c..,]v)
0270 11 82 4a 12 3
b 50 69 8f 3c df b0
94 b0 7d a0 56 .

.J.;Pi.<....}.V
0280 7a 61 b2 a8 1
0 f0 ec f2 d5 58 15
2c b1 ca 35 36 z
a.......X.,..56
0290 dd ad 36 88 9
7 93 45 68 8e 26 44
ea 96 ce 36 1e .
.6...Eh.&D...6.
02a0 5b a6 6a 5d 5
3 25 5b 19 82 69 73
85 94 12 b3 72 [
.j]S%[..is....r
02b0 a3 cd a9 35 9
e ed 90 ee 70 b9 d4
78 be 8b aa 64 .
..5....p..x...d
02c0 a3 bb 0c 2b 1
0 58 ae dd a2 3d 82
82 e8 d0 19 dd .
..+.X...=......
02d0 0d 39 06 55 7
1 a9 28 43 11 e8 65
c6 4f 11 b0 8a .
9.Uq.(C..e.O...
02e0 c7 9f b7 59 d
3 0c 42 33 6b 3c eb
2c e9 43 93 bb .
..Y..B3k<.,.C..
02f0 9b fc 13 f6 9
7 e9 a8 1a d5 0f c4
6d ce 2b 3a 6d .
..........m.+:m
0300 73 c1 f9 93 f
8 ec 1a 24 a8 15 bd
b5 e9 bf d8 d6 s
......$........
0310 9b ad 7c f5 b
a fe 9c e9 d0 7d b6
21 d5 ff d0 d9 .
.|......}.!....
0320 84 71 27 0a 4
8 a0 91 5d 85 8a 01
53 5a 81 e1 c0 .
q'.H..]...SZ...
0330 08 cd 89 a5 1
d 0b b7 ce 8a 06 c4
30 87 8c c0 05 .
..........0....
0340 c6 2b 16 57 4
1 ca 64 3c 12 8e 9b
75 e6 d6 35 97 .
+.WA.d<...u..5.
0350 c5 66 1b cb e
c 13 a9 94 c6 4d 39
9d 5b 87 b1 a2 .
f.......M9.[...
0360 76 c2 44 90 8
2 b6 4c 4e dc a3 39
5b 92 b6 7b 5b v
.D...LN..9[..{[
0370 0a 96 df 37 5
2 a3 c8 16 eb d4 8a
69 a4 97 8a a2 .
..7R......i....
0380 5d 30 36 cd 2
1 32 58 82 13 a4 70
49 00 2f 6c 38 ]
06.!2X...pI./l8

0390 14 8a 16 9b 8
6 00 ef 73 ae d8 89
54 1e ac bf 56 .
......s...T...V
03a0 6a 51 d2 bb 2
f b5 d9 8c 25 71 59
c9 ab 8c eb 9a j
Q../...%qY.....
03b0 03 95 ec f9 a
d 1f 90 2a 38 e7 b9
1a 76 6a 1a b0 .
......*8...vj..
03c0 34 2e b1 e8 7
7 da c3 d3 9c d3 9e
6a 7a 9f 55 b1 4
...w......jz.U.
03d0 6b 9f f3 98 a
1 ff fb 92 04 e7 8f
f2 e6 2c d4 03 k
............,..
03e0 3a 5a 60 5c 4
6 0a 80 67 4d 4c 0b
fc d1 4e 0c 65 :
Z`\F..gML...N.e
03f0 6b 81 6e 97 e
9 c1 8c ad 30 a0 78
f6 bd b7 ff 24 k
.n.....0.x....$
0400 de 90 bd 08 2
b 1a 26 02 10 05 17
49 c2 26 fd 8d .
...+.&....I.&..
0410 a2 0c 09 16 3
6 ea 24 4d 80 38 63
85 03 af 20 6c .
...6.$M.8c... l
0420 44 82 52 e9 6
b 46 bd 81 28 02 67
d2 69 46 a3 e9 D
.R.kF..(.g.iF..
0430 8b 0e 32 6c 4
3 bd 7b 59 cf a8 58
de f7 42 7d 37 .
.2lC.{Y..X..B}7
0440 bc 19 ba 37 3
1 77 25 57 03 16 36
df 29 31 e3 eb .
..71w%W..6.)1..
0450 14 8b f2 b9 b
6 71 ba ca 91 68 de
71 bf 46 8f 50 .
....q...h.q.F.P
0460 d1 31 6e da d
b 30 58 b4 6a 16 0c
15 83 61 51 a1 .
1n..0X.j....aQ.
0470 32 06 8f a6 9
6 b3 48 eb 56 21 8e
06 65 43 dd 54 2
.....H.V!..eC.T
0480 87 9a 60 28 b
7 32 2b 45 1f a3 95
53 0f 11 53 5b .
.`(.2+E...S..S[
0490 a2 b1 39 95 3
7 30 a6 c7 26 e9 6a
44 61 ee 8a 07 .
.9.70..&.jDa...
04a0 1a c5 8d 13 a

7 e8 25 0a b5 50 a0
b8 92 36 47 25 .
.....%..P...6G%
04b0 a1 4d 8e c6 6
2 87 9d 98 7b ed a9
61 95 7d 9f e2 .
M..b...{..a.}..
04c0 df e8 75 44 5
9 a6 0a 5d 25 db 64
21 68 dc 05 30 .
.uDY..]%.d!h..0
04d0 a4 33 ed 22 2
3 1f 3b a3 a7 4a 60
20 f4 30 f4 e9 .
3."#.;..J` .0..
04e0 ab 09 59 8f 2
c 82 00 84 5f 6e 44
cb 50 f7 3b 2f .
.Y.,..._nD.P.;/
04f0 5b bd 02 3f 9
6 34 48 b7 16 97 3c
ee 0c 3d c0 87 [
..?.4H...<..=..
0500 7c 43 bc 7d b
8 7a 5b f6 a0 df 7d
a8 29 aa 6b 51 |
C.}.z[...}.).kQ
0510 71 6f fb c8 f
f 74 fa 89 36 fd b3
e0 33 fb 8a 80 q
o...t..6...3...
0520 0d ff
.
.
No. Time
Source
Destination
Protocol
Length Info
268 10.11740000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
468 http49
574 [PSH, ACK] Seq=
162595 Ack=1 Win=46
Len=414
Frame 268: 468 byte
s on wire (3744 bit
s), 468 bytes captu
red (3744 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.167330000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]

Epoch Time: 141

5615223.167330000 s
econds
[Time delta fro
m previous captured
frame: 0.043999000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04399900
0 seconds]
[Time since ref
erence or first fra
me: 10.117400000 se
conds]
Frame Number: 2
68
Frame Length: 4
68 bytes (3744 bits
)
Capture Length:
468 bytes (3744 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
54
Identification:
0xf206 (61958)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d72 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 162595, Ack:
1, Len: 414
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 414]
Sequence number
: 162595 (relati
ve sequence number)
[Next sequence
number: 163009 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xfce
9 [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1674]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 c6 f2 06 4
0 00 31 06 3d 72 4a
7c 0c 8a c0 a8 .
...@.1.=rJ|....
0020 01 0b 00 50 c
1 a6 2b ca dd 50 9e
87 4e aa 50 18 .
..P..+..P..N.P.
0030 00 2e fc e9 0
0 00 ff 5d 72 04 48
2c f2 ba 2f ab .
......]r.H,../.
0040 4c 18 10 e1 5
3 06 09 7b d7 bf 5c
c0 65 93 4e 19 L
...S..{..\.e.N.
0050 7c 2d 3f 90 5
8 81 97 be 72 dc 4b
75 60 24 f9 a4 |
-?.X...r.Ku`$..
0060 a1 ab 48 fb 4
0 b2 ce 52 5b 9b ff
6e d7 b2 a5 b2 .
.H.@..R[..n....
0070 63 e0 2c 50 5
3 97 8c 4a cd d6 8e
68 2f bc e8 c0 c
.,PS..J...h/...
0080 9e 44 66 25 a
a 5e 91 a2 ac d4 49
ff fb 90 04 ec .
Df%.^....I.....
0090 0f f3 07 2f d
3 03 39 5a 60 64 66
0a 60 6b 4f 4c .
../..9Z`df.`kOL
00a0 0b b8 cf 4c 0
c e5 4b 81 86 98 29
81 9c bd 30 17 .
..L..K...)...0.
00b0 99 ec fa fa 0
8 28 fe ca 7a 5f d5
21 0b 02 ac 4a .
....(..z_.!...J
00c0 85 3a 90 14 4
0 30 0c b6 4d 4f 04
b3 36 c7 64 d9 .
:..@0..MO..6.d.
00d0 aa 33 01 8d 8
c e2 44 a0 30 26 e8
94 de 57 8b 46 .
3....D.0&...W.F
00e0 6a b1 a5 5d 4
9 5e 87 25 14 97 b9
a6 93 63 7a 01 j

..]I^.%.....cz.
00f0 32 4a a3 65 a
0 ea 21 d1 59 a1 d2
32 d4 ba 89 e1 2
J.e..!.Y..2....
0100 ce 5d 34 2a 4
c b1 d4 9d 44 44 19
4b e3 c3 5e b2 .
]4*L...DD.K..^.
0110 95 74 a9 ff 4
5 3e 87 30 92 20 b0
0d 48 cd 01 21 .
t..E>.0. ..H..!
0120 e1 41 2f 16 8
2 3a ac ec 37 68 09
02 dd 4e 17 a3 .
A/..:..7h...N..
0130 98 dc 9c d7 1
8 2c 65 0a 97 ea 04
91 c8 db a3 58 .
....,e........X
0140 92 d7 96 d1 2
c 1a b9 81 12 48 da
cd 5e 19 1a b9 .
...,....H..^...
0150 63 cf 65 08 8
6 15 07 9b 23 42 f0
dd e9 93 1b aa c
.e.....#B......
0160 3a cb 6c ac a
f 83 fe 56 dd d7 e8
12 03 0e 08 9c :
.l....V........
0170 5e 01 35 3f c
b 50 ea 0e 04 80 7c
92 05 39 48 41 ^
.5?.P....|..9HA
0180 0d 7a 56 e7 b
3 15 34 6b 6b 2c d4
c6 6d eb 34 86 .
zV...4kk,..m.4.
0190 79 dc c8 c1 8
8 90 f2 d2 d8 db b1
02 51 b6 21 e0 y
...........Q.!.
01a0 e0 fc 7b 84 0
c e4 bd e4 92 8b d4
5c 7b 0b 44 19 .
.{........\{.D.
01b0 35 1e 33 38 7
2 e9 22 c2 d2 75 ae
62 0f 99 34 98 5
.38r."..u.b..4.
01c0 83 93 4d 14 b
4 b3 e6 89 52 ce 92
ad 6d 12 83 2f .
.M.....R...m../
01d0 9f f9 09 55
.
..U
No. Time
Source
Destination
Protocol
Length Info
269 10.11757700
0 pc13.home

cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=163009 Win=38430 L
en=0
Frame 269: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.167507000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.167507000 s
econds
[Time delta fro
m previous captured
frame: 0.000177000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017700
0 seconds]
[Time since ref
erence or first fra
me: 10.117577000 se
conds]
Frame Number: 2
69
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90

:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f7e (20350)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =

More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 16300
9, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 163009 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 268]
[The RTT to
ACK the segment wa
s: 0.000177000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 7e 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O~@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca de ee 50 10 .
....P..N.+...P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
270 10.15740300
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=16300
9 Ack=1 Win=46 Len=
1260
Frame 270: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.207333000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.207333000 s
econds
[Time delta fro
m previous captured
frame: 0.039826000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03982600
0 seconds]
[Time since ref
erence or first fra
me: 10.157403000 se
conds]
Frame Number: 2
70
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf207 (61959)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)

Header checksum
: 0x3a23 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 163009, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 163009 (relati
ve sequence number)
[Next sequence
number: 164269 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x0b9
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 07 4
0 00 31 06 3a 23 4a
7c 0c 8a c0 a8 .
...@.1.:#J|....
0020 01 0b 00 50 c
1 a6 2b ca de ee 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 0b 9b 0
0 00 6f 41 a4 14 85
00 dd 10 40 32 .
.....oA......@2
0040 32 09 4b e7 d
a ab 0a 97 33 08 0a
9a 1c 4f d7 e2 2
.K.....3....O..
0050 05 94 05 dd 0
7 5f ad 0a 73 a1 d6
8c c4 62 5d 96 .
...._..s....b].
0060 ca 52 95 c1 e
4 b2 ba d5 b0 ad 4b
6a 7d 5a b6 33 .
R........Kj}Z.3
0070 0a 5d 63 6f e
4 81 68 11 be 64 70
c7 5f 61 71 a1 .
]co..h..dp._aq.
0080 e8 fb e1 de 6
d ab fd 6b fe 8d 9b
d4 e5 d4 ff fb .
...m..k........
0090 92 04 e8 0f f
2 f7 35 53 03 19 6a
e0 5b a6 0a 70 .
.....5S..j.[..p
00a0 67 2d 4c 0b e
c b1 4c 0c e1 69 81

76 98 29 c1 9c g
-L...L..i.v.)..
00b0 b5 30 2e 1e b
7 b7 f5 b6 82 34 36
ec 08 bf a9 a6 .
0.......46.....
00c0 c8 4f c4 46 0
a e3 01 60 76 ea be
8c 9d 67 59 98 .
O.F...`v....gY.
00d0 12 95 a6 8c b
a 40 1a 09 21 3d 0d
34 a9 1c b5 e2 .
....@..!=.4....
00e0 1e 45 dc 5e e
c 9f 97 16 1a 6f 95
c3 50 a5 1b 29 .
E.^.....o..P..)
00f0 49 2e d7 bd c
a 92 65 a5 3c 3d c3
d6 60 6a 0a f1 I
.....e.<=..`j..
0100 bb 4e da 7b e
7 73 b7 f9 6d 8d 1e
f5 be 2b fd 52 .
N.{.s..m....+.R
0110 bf fd 56 03 2
f 5c 9b bd d4 2b 08
8c f2 dc 20 e0 .
.V./\...+.... .
0120 24 73 10 35 0
5 17 30 02 0c 21 2d
d6 9d e7 68 bb $
s.5..0..!-...h.
0130 9c 65 e0 ad 3
5 88 3e 94 bc ea 46
c6 e5 0f 75 f5 .
e..5.>...F...u.
0140 12 6a 6c 77 9
5 ec 2b 89 7c 86 96
3f 8e 59 d4 68 .
jlw..+.|..?.Y.h
0150 d6 91 99 29 c
c 01 88 82 85 65 e3
88 a6 64 85 cb .
..).....e...d..
0160 c3 dd 71 fc 9
1 9f 27 a3 a4 b6 2a
dd a6 64 f2 03 .
.q...'...*..d..
0170 6d 5a 7a dd 7
5 39 db 51 c8 4a 33
df a1 cd 40 5a m
Zz.u9.Q.J3...@Z
0180 5a 52 43 c3 4
0 a6 88 69 b3 d6 94
4d db c5 4d 8c Z
RC.@..i...M..M.
0190 2d e1 11 60 0
8 d3 11 7b 26 39 e5
0e cf 50 ba 4f ..`...{&9...P.O
01a0 7d ab 64 c3 e
1 cc b0 63 4c 55 7e
45 6f d6 2f 94 }
.d....cLU~Eo./.
01b0 ea a6 f5 af c
4 8c 43 3f fe d9 54
0d e0 6b f8 61 .

.....C?..T..k.a
01c0 db 3d 2e cc e
f 11 63 7c c5 c6 d8
63 e6 96 f9 6c .
=....c|...c...l
01d0 50 ff ff da d
e d6 f6 84 4f 5b f4
2a 68 22 95 6a P
.......O[.*h".j
01e0 a8 aa 0b 70 3
c c9 ec b4 c2 1c f4
ad b6 b4 fe 2f .
..p<........../
01f0 92 e1 d5 69 6
c a6 96 0f 97 8c 16
86 cf 6f 3d d3 .
..il........o=.
0200 ad 91 c6 8b d
4 a4 ba 34 29 d7 b2
e4 76 de 3c 80 .
......4)...v.<.
0210 17 45 22 87 0
e 55 d8 6c bd 7b 4d
80 c5 1a d7 9a .
E"..U.l.{M.....
0220 13 8f 48 bc 7
7 6d 20 8d 6a 4e 32
9d fb 9c a9 e2 .
.H.wm .jN2.....
0230 ff fb 92 04 e
b 0f f2 e9 2d 53 03
18 7a 60 62 06 .
.......-S..z`b.
0240 0a 50 63 4f 4
c 0c 74 d3 4a 0c e1
ab 81 79 98 29 .
PcOL.t.J....y.)
0250 81 9c bd 30 9
a e2 b9 af ef 87 59
f3 9f a5 f1 ff .
..0......Y.....
0260 d6 d9 87 2a d
6 5e d6 b2 ba 80 30
50 74 4f e5 2a .
..*.^....0PtO.*
0270 d6 8c 97 fc c
6 8e 6a f3 69 d3 76
06 7c 42 d0 59 .
.....j.i.v.|B.Y
0280 1f 2a bf 10 a
9 6b 33 22 77 1b f8
f5 94 13 ae 97 .
*...k3"w.......
0290 56 13 0b 95 7
5 a2 34 b1 02 0d 35
89 18 54 59 be V
...u.4...5..TY.
02a0 6e b8 2f 16 d
c 5f 83 dc 82 57 c0
50 62 57 6e b5 n
./.._...W.PbWn.
02b0 f5 4a 24 2d f
7 5f d7 a6 ff 1a f2
bc f7 96 5b fe .
J$-._........[.
02c0 fd df ad a6 3
1 50 e2 e0 30 37 01
20 03 80 2e 39 .
...1P..07. ...9

02d0 45 4e c3 48 7
3 d0 20 50 07 9a da
89 93 3e 67 29 E
N.Hs. P.....>g)
02e0 7d 24 0f 8d c
8 23 09 a7 6e 29 24
c2 95 e3 65 34 }
$...#..n)$...e4
02f0 31 93 34 c5 4
1 21 c1 a0 56 39 9a
1d 88 7f 42 f8 1
.4.A!..V9....B.
0300 16 46 dc f4 6
7 a7 39 d9 33 2e 53
5a 35 a9 dd 5d .
F..g.9.3.SZ5..]
0310 7f 7a 95 c9 d
f 9d b3 10 25 fa 61
43 ce f4 d3 f4 .
z......%.aC....
0320 37 8a 02 a5 2
c 79 51 17 80 69 03
c7 77 a1 c4 ec 7
...,yQ..i..w...
0330 90 c1 ad 9c 7
a ad 07 38 1a 1d ca
98 88 05 13 c7 .
...z..8........
0340 38 6f b5 8b 0
3 29 93 bd 85 ba 74
04 c7 da 1b f5 8
o...)....t.....
0350 25 18 31 41 e
e db 33 3b fd e9 4e
d7 79 59 37 a6 %
.1A..3;..N.yY7.
0360 a5 4f ce 3f 8
a 31 62 51 a8 f3 cf
64 87 f1 1f 36 .
O.?.1bQ...d...6
0370 5d 44 ff ff 0
1 d6 fe ff a2 cf a9
62 ae a7 5d 67 ]
D.........b..]g
0380 09 29 0f b0 c
0 40 50 1e 6b c8 b4
98 6f 53 04 d8 .
)...@P.k...oS..
0390 2a 81 10 24 0
d 02 9e 38 3a 55 74
70 39 47 d1 2b *
..$...8:Utp9G.+
03a0 4e 8f c2 42 5
6 2c af 2e a5 31 5f
ba 4c 2c 4b 30 N
..BV,...1_.L,K0
03b0 b8 a9 0b 64 4
6 81 07 61 d2 db 05
6d 63 66 bc e1 .
..dF..a...mcf..
03c0 88 d8 15 c4 4
7 31 f9 12 a7 56 f4
d4 8c 7f fe ca .
...G1...V......
03d0 da a5 ff fb 9
2 04 e9 0f f3 07 35
52 83 18 5a e0 .
.........5R..Z.
03e0 61 e6 0a 50 6

3 4f 4c 0b ac b1 4c
0c e1 89 81 7a a
..PcOL...L....z
03f0 18 29 81 8c 3
d 30 08 ad d8 c1 67
26 db d8 55 1e .
)..=0....g&..U.
0400 87 50 2c c6 b
0 d8 d5 81 43 c0 e3
22 93 d1 1e 65 .
P,.....C.."...e
0410 4a 59 51 3e 8
3 2f cb 52 48 44 85
aa 08 b0 70 b7 J
YQ>./.RHD....p.
0420 8a 87 d2 bd 8
5 51 4a 1a 81 6b 46
38 be bb 1c 9b .
....QJ..kF8....
0430 89 4e e3 bb 5
3 19 df 1a 96 ab f2
bb 96 f8 d2 e9 .
N..S...........
0440 93 c0 c7 ce 8
5 ae f7 a4 2b 65 f5
3e 3b fd c3 ae .
.......+e.>;...
0450 33 4f 89 1c 3
f b7 f8 67 ff 1f 3a
91 0e a7 5b f0 3
O..?..g..:...[.
0460 88 49 f0 e8 1
1 2c de 0e 62 1c 5a
64 3e 0b 42 fa .
I...,..b.Zd>.B.
0470 f9 1a 40 20 3
6 1e 15 2d e4 8f 72
2a 94 78 48 1f .
.@ 6..-..r*.xH.
0480 5a 58 09 f9 c
6 fc 1e d2 c9 95 49
39 8b e9 61 d0 Z
X........I9..a.
0490 47 28 93 f1 e
9 ac 4f 8a 2b 3a 64
e9 93 13 44 f9 G
(....O.+:d...D.
04a0 e5 22 6a 83 4
e 20 51 04 43 69 b9
9d 02 99 79 06 .
"j.N Q.Ci....y.
04b0 56 d5 9a a6 7
d 55 3f ba de ce 60
7b 3c 84 68 37 V
...}U?...`{<.h7
04c0 08 19 93 a0 a
6 0d 25 f9 31 5c ac
69 7a fc 0c 95 .
.....%.1\.iz...
04d0 cc 6e 8d a1 1
6 31 80 09 83 8c 46
74 1c 62 82 48 .
n...1....Ft.b.H
04e0 e6 54 c6 37 c
6 12 8d 52 da f0 7c
7d a9 d1 31 cd .
T.7...R..|}..1.
04f0 1f 94 78 4b 9
a 8d 5d 6f 2c 50 6f

44 f4 f2 ea d7 .
.xK..]o,PoD....
0500 7c 9a 81 87 1
f 83 bc 9b 61 e2 53
55 8f 16 6f 78 |
.......a.SU..ox
0510 72 c7 6f de b
e 73 66 0c f8 52 6b
dd c9 fa 80 3b r
.o..sf..Rk....;
0520 08 2a
.
*
No. Time
Source
Destination
Protocol
Length Info
271 10.26740700
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1304 http49
574 [PSH, ACK] Seq=
164269 Ack=1 Win=46
Len=1250
Frame 271: 1304 byt
es on wire (10432 b
its), 1304 bytes ca
ptured (10432 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.317337000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.317337000 s
econds
[Time delta fro
m previous captured
frame: 0.110004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11000400
0 seconds]
[Time since ref
erence or first fra
me: 10.267407000 se
conds]
Frame Number: 2
71
Frame Length: 1
304 bytes (10432 bi
ts)
Capture Length:

1304 bytes (10432

bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))

0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
290
Identification:
0xf208 (61960)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a2c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 164269, Ack:
1, Len: 1250
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1250]
Sequence number
: 164269 (relati
ve sequence number)
[Next sequence
number: 165519 (
relative sequence n

umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb50
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2510]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0a f2 08 4
0 00 31 06 3a 2c 4a
7c 0c 8a c0 a8 .
...@.1.:,J|....
0020 01 0b 00 50 c
1 a6 2b ca e3 da 9e
87 4e aa 50 18 .

..P..+.....N.P.
0030 00 2e b5 0b 0
0 00 00 58 24 a5 0f
57 ad 12 2e 6a .
......X$..W...j
0040 70 d5 93 96 9
9 23 1f 86 66 e0 89
5a 27 95 a8 ed p
....#..f..Z'...
0050 8a 37 81 ab 4
a a5 2e db ba d4 d4
d2 b4 66 62 5e .
7..J........fb^
0060 c4 53 8e a4 6
d 6c 25 80 1c eb 87
74 51 60 f7 d9 .
S..ml%....tQ`..
0070 ff 59 79 76 6
8 ce 31 3d cd 6d c0
ba 9a 43 b0 fb .
Yyvh.1=.m...C..
0080 ed 42 e3 9f d
d 79 9d 81 ff fb 92
04 e8 8f f2 ec .
B...y..........
0090 2c 53 83 0f 4
a 60 5e 26 6a 60 63
2f 5c 0c 28 cf ,
S..J`^&j`c/\.(.
00a0 50 0c e1 ab 8
1 85 17 e9 c1 8c 3d
30 94 87 62 ea P
.........=0..b.
00b0 38 24 34 19 7
1 ee 99 40 05 0a e4
1c b6 92 99 d2 8
$4.q..@........
00c0 26 ca 97 d0 8
a a4 09 be 5d 76 6a
4e 27 a5 47 97 &
.......]vjN'.G.
00d0 3c b6 9a 1f 2
0 ba cd 95 44 63 57
1c e5 48 b3 a1 <
... ...DcW..H..
00e0 d8 e4 12 ee a
9 7e 6e db 89 85 80
ac 38 2b 6d d3 .
....~n.....8+m.
00f0 42 51 0a da 6
1 1a 4c d2 02 38 29
19 d9 70 62 c0 B
Q..a.L..8)..pb.
0100 75 52 4e da a
4 d2 d5 65 07 46 75
ed 16 e6 cb 2a u
RN....e.Fu....*
0110 2e ea 48 38 3
c c9 4d 34 d0 55 e2
7f 55 84 36 65 .
.H8<.M4.U..U.6e
0120 dc 54 04 41 a
f 43 ca 40 40 28 b8
03 09 a6 e1 9a .
T.A.C.@@(......
0130 bb 6b 57 1d 4
2 d1 1d d1 b2 ce d6
e8 c8 52 c8 bb .
kW.B........R..

0140 5a 34 95 67 b
3 8c 46 e2 b6 1d b5
1f a6 22 e3 19 Z
4.g..F......"..
0150 ce 29 17 1f c
7 a4 18 f0 b6 d9 12
1a eb ef ce 8f .
)..............
0160 e9 86 24 c9 d
4 58 8e 00 6b 6f af
f6 ed 4f 0a b8 .
.$..X..ko...O..
0170 0b 88 b7 85 f
0 50 46 1c 5e 47 95
ea 81 9a cc 98 .
....PF.^G......
0180 46 38 6c 49 9
3 8f 55 bd c7 64 51
08 03 95 56 9b F
8lI..U..dQ...V.
0190 8f 66 1c 94 4
4 7c ae 6e 1d 46 1d
1a a0 58 a0 e2 .
f..D|.n.F...X..
01a0 c7 0e d8 2e 3
9 57 fa b8 79 0a f5
fb cc 3b 7c a5 .
...9W..y....;|.
01b0 96 9c 12 12 1
8 51 a8 6e 5e 38 50
60 02 01 08 0b .
....Q.n^8P`....
01c0 e0 e2 10 23 a
7 fa 77 00 a4 08 b6
a8 b5 10 dc 60 .
..#..w........`
01d0 a0 93 a5 80 d
1 21 6b 61 e1 56 2c
e1 54 17 0b ec .
....!ka.V,.T...
01e0 a8 78 be 98 e
6 36 5f c7 2c dc cc
14 34 e7 27 ac .
x...6_.,...4.'.
01f0 e9 37 db a8 4
4 22 0c f2 81 d2 26
ab 08 43 6b b7 .
7..D"....&..Ck.
0200 af e9 24 27 c
e 56 b5 69 09 66 cf
1a 23 35 2b 8b .
.$'.V.i.f..#5+.
0210 eb ac 38 d7 1
b bd a2 e7 19 ce e9
99 31 ab eb ef .
.8.........1...
0220 15 c4 1e 1d 6
0 78 4c f3 54 ba ff
fb 92 04 e8 0f .
...`xL.T.......
0230 f2 ec 2c 55 0
3 18 62 60 61 66 0a
90 63 09 4c 0a .
.,U..b`af..c.L.
0240 ac 91 5a 0c 3
d e9 49 62 92 ab 01
8c 31 29 95 7d .
.Z.=.Ib....1).}
0250 f5 21 1e c6 0

2 02 fa d7 91 af 15
ce c1 e5 8c 98 .
!..............
0260 ba 40 0c 55 7
8 e6 50 1d 6a 03 d4
fb a0 e4 55 b7 .
@.Ux.P.j.....U.
0270 b5 b2 aa a7 4
e a1 67 6e 59 e3 bd
4e 96 09 08 19 .
...N.gnY..N....
0280 74 8c a3 73 9
3 4a 59 e4 56 ed 77
36 6f e2 30 c7 t
..s.JY.V.w6o.0.
0290 f1 99 a0 42 a
f 5d 4b 33 a8 33 63
4f ed 3c 08 d6 .
..B.]K3.3cO.<..
02a0 8d e9 6a d2 d
b b5 a1 4b 42 ab 59
80 98 d7 06 98 .
.j....KB.Y.....
02b0 0d 5f 67 f4 0
1 22 41 90 e4 08 b0
05 00 58 04 98 .
_g.."A......X..
02c0 98 be 8e 23 2
7 21 8e 3e d0 27 f4
99 a4 35 62 09 .
..#'!.>.'...5b.
02d0 dc a5 f5 3c f
1 95 5a 83 7a 10 d9
3a 41 69 f0 9e .
..<..Z.z..:Ai..
02e0 67 42 b2 ff 1
d f9 4c 7b ed 37 05
e7 af d3 f3 6d g
B....L{.7.....m
02f0 be 34 aa 3c 7
a 92 bc 27 20 10 06
5e 50 c0 01 92 .
4.<z..' ..^P...
0300 a9 21 21 6d d
5 17 0d e9 d0 b7 6d
ab bb 69 77 7f .
!!m......m..iw.
0310 f8 7d 21 25 1
c 67 13 23 69 a4 37
05 28 d1 42 54 .
}!%.g.#i.7.(.BT
0320 6a 96 b5 1a 9
4 86 ce aa 96 69 0f
44 bf 6b 73 6e j
........i.D.ksn
0330 56 5a 19 8f f
0 0d aa 70 36 4c 72
ed 0b 8a d2 93 V
Z.....p6Lr.....
0340 dc aa e7 eb 9
b 9e bb 29 1c db be
b9 31 c6 df 5b .
......)....1..[
0350 6b 08 26 55 8
7 18 38 99 07 66 9a
30 d1 0b 6e a8 k
.&U..8..f.0..n.
0360 bb 93 4c 8b 8
d 9b c7 55 f1 03 08

ba af 57 ea 16 .
.L....U.....W..
0370 43 f8 b9 2b 9
3 a3 84 c6 39 15 4c
28 b6 83 39 24 C
..+....9.L(..9$
0380 50 b8 2c c1 c
2 83 69 20 a3 fc bc
58 77 68 aa c8 P
.,...i ...Xwh..
0390 c6 d2 27 3a c
8 f0 61 2d e5 91 1c
b9 41 01 f9 c4 .
.':..a-....A...
03a0 3d 85 41 e3 6
6 8a bd d6 a8 43 37
5d f2 32 6d 25 =
.A.f....C7].2m%
03b0 49 37 38 7a 6
f 60 0c 42 94 bb 02
20 d0 f0 c0 95 I
78zo`.B... ....
03c0 d7 02 06 e6 4
9 f4 82 e7 45 06 29
03 ff fb 92 04 .
...I...E.).....
03d0 f0 8f f3 36 2
f d6 03 0f 7a 60 62
65 ca e0 61 ef .
..6/...z`be..a.
03e0 4c 0b c8 93 6
0 07 bd 89 41 72 92
6c 00 f7 b1 28 L
...`...Ar.l...(
03f0 ed 08 8e 45 d
e 0e 97 02 d0 83 a5
0e 68 6c 73 e1 .
..E........hls.
0400 0e 12 74 63 2
a d5 14 18 5d 16 0d
d4 d9 9d 86 1e .
.tc*...].......
0410 5c 9e 4f 08 b
4 88 5a 6a 68 59 46
ee 35 3a 8b 19 \
.O...ZjhYF.5:..
0420 71 0e 63 b7 f
1 76 ee 2a 37 c5 b4
f3 8f 2c bb 85 q
.c..v.*7....,..
0430 0e 99 a4 5c 9
a d4 79 63 d6 e8 f3
48 49 21 c9 a0 .
..\..yc...HI!..
0440 f9 f7 90 b1 a
e 32 66 b4 14 0c 7b
fc 19 59 41 46 .
....2f...{..YAF
0450 24 ed 8e 26 5
c d4 44 79 37 11 30
de 2c 28 f0 83 $
..&\.Dy7.0.,(..
0460 58 ab 5f 4b a
3 4b ac 64 b3 84 89
5a e4 d4 dd 46 X
._K.K.d...Z...F
0470 9c 58 57 84 e
9 a4 08 71 01 49 78
54 4b b3 3b 96 .

XW....q.IxTK.;.
0480 be d2 84 ce a
f c5 f2 cb b8 f9 42
bf a4 76 5a 81 .
.........B..vZ.
0490 cf 59 13 8e 8
6 4c 8b 25 d4 3c 55
81 99 a7 9c 84 .
Y...L.%.<U.....
04a0 d4 26 14 48 c
5 d3 17 22 e7 8b 98
7d 2f 17 53 11 .
&.H..."...}/.S.
04b0 70 7f 8f b1 0
4 1d 14 72 9e 25 cd
db 53 08 a5 cc p
......r.%..S...
04c0 b9 4b b5 a1 e
3 f7 0a a3 56 01 e3
a8 e8 0b 58 a1 .
K......V.....X.
04d0 5b e7 aa d3 a
7 1a 84 4a 05 87 dc
f2 d6 6d 3b 2b [
......J.....m;+
04e0 3d ee 73 a5 6
e 1d 2d ad 93 fa c4
f2 67 ed cf 56 =
.s.n.-.....g..V
04f0 5e f1 af ff b
3 68 92 fe c5 f0 b3
d7 da b8 ad 4d ^
....h.........M
0500 60 54 7a d0 9
f 29 d2 f9 d2 b3 cd
ed 08 da 62 c9 `
Tz..)........b.
0510 cf c6 b7 ff c
b bc 7f d7
.
.......
No. Time
Source
Destination
Protocol
Length Info
272 10.26758400
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=165519 Win=37802 L
en=0
Frame 272: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:27:0

3.317514000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.317514000 s
econds
[Time delta fro
m previous captured
frame: 0.000177000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017700
0 seconds]
[Time since ref
erence or first fra
me: 10.267584000 se
conds]
Frame Number: 2
72
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f7f (20351)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.

com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 16551
9, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 165519 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37802
[Calculated win
dow size: 37802]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]

[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 271]
[The RTT to
ACK the segment wa
s: 0.000177000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 7f 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca e8 bc 50 10 .
....P..N.+...P.
0030 93 aa 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
273 10.36141000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=16551
9 Ack=1 Win=46 Len=
1260
Frame 273: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.411340000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.411340000 s
econds

[Time delta fro

m previous captured
frame: 0.093826000
seconds]
[Time delta fro
m previous displaye
d frame: 0.09382600
0 seconds]
[Time since ref
erence or first fra
me: 10.361410000 se
conds]
Frame Number: 2
73
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf209 (61961)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a21 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por

t: http (80), Dst P

ort: 49574 (49574),
Seq: 165519, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 165519 (relati
ve sequence number)
[Next sequence
number: 166779 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb26
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]

Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 09 4
0 00 31 06 3a 21 4a
7c 0c 8a c0 a8 .
...@.1.:!J|....
0020 01 0b 00 50 c
1 a6 2b ca e8 bc 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e b2 6e 0
0 00 0a 0d 84 ae f6
3e a9 03 a8 84 .
..n.......>....
0040 4d d4 be 74 c
9 3a d9 85 5a a5 a8
74 97 b8 93 ed M
..t.:..Z..t....
0050 81 a8 e7 8b 2
c a3 83 53 f2 bd 59
c6 ad 20 b2 70 .
...,..S..Y.. .p
0060 89 8e aa 47 c
2 3b c8 99 f1 75 5a
29 1d 88 d0 12 .
..G.;...uZ)....
0070 cb 95 ce ef 3
e ed af 6c df f6 bf
5f ef 96 2a 4d .
...>..l..._..*M
0080 bf 9b ef c7 a
4 bc 26 ed c8 15 33
87 ff fb 92 04 .
.....&...3.....
0090 ed 8f f2 f9 1
8 59 01 ef 61 c0 61
c4 7b 10 3d eb .
....Y..a.a.{.=.
00a0 4a 0c 10 93 6
2 07 bd 69 41 8e 90
ac 00 f7 ad 29 J
...b..iA......)
00b0 a4 bd 1b 72 a
7 5f 1f f5 b7 fb 69
10 0e 1c 86 65 .
..r._....i....e
00c0 2d f2 e8 5c e
c 15 b8 c1 cd ee 58
57 8c 2b 28 0c ..\......XW.+(.
00d0 b3 d1 51 8a a
3 23 b7 95 25 3a e4
a9 db 2e 97 8a .
.Q..#..%:......
00e0 d5 ca b9 6a 3
1 82 a1 db ed ab d1
51 ad 1a eb 5a .
..j1......Q...Z
00f0 ab 47 93 16 a
e fd b5 ff 79 fe 62

6a 06 26 da ce .
G......y.bj.&..
0100 17 3f 9f ee 4
2 11 c3 cb ff b2 54
5b 1e ed 46 2d .
?..B.....T[..F0110 5b be 91 13 8
6 03 05 25 60 d9 4d
21 01 94 00 11 [
......%`.M!....
0120 2a 35 92 46 9
1 68 18 f7 18 b3 72
45 0f b6 dd 94 *
5.F.h....rE....
0130 df 07 6d 50 3
1 fa 51 02 fd fe 66
0f ab cf 00 ff .
.mP1.Q...f.....
0140 11 05 69 da 6
3 9f a2 1e 6a 46 78
de ac c9 13 13 .
.i.c...jFx.....
0150 bf 60 49 aa 3
7 e0 56 5d cd 6b 7b
d6 ef 73 f7 13 .
`I.7.V].k{..s..
0160 08 4c b3 6b 3
a 7b 3e 63 10 71 43
c1 c7 12 ea 53 .
L.k:{>c.qC....S
0170 58 fe e2 57 6
9 14 24 29 8d 34 24
14 53 70 20 10 X
..Wi.$).4$.Sp .
0180 74 c8 e8 d4 0
2 34 a7 d5 35 97 cc
bd 91 af 27 79 t
....4..5.....'y
0190 a7 e3 06 af c
6 87 2d 5a 2a 73 2e
5a 2c 9d fa a4 .
.....-Z*s.Z,...
01a0 a6 51 89 2c 7
d bf 5a 17 93 11 ac
f1 d6 14 0e c5 .
Q.,}.Z.........
01b0 67 11 d5 02 8
a 26 bb 5b 5b 6e e3
05 58 a6 dd 45 g
....&.[[n..X..E
01c0 bb 17 42 b1 7
5 b6 d5 9a db a7 2d
33 19 75 af 8a .
.B.u.....-3.u..
01d0 da 53 e6 35 a
a 43 36 8e 5a 84 0c
08 38 c0 00 62 .
S.5.C6.Z...8..b
01e0 99 5a 90 12 f
9 54 61 65 44 80 c8
bc dc 98 bc cb .
Z...TaeD.......
01f0 06 9b 21 3b 4
1 a6 ac 91 d7 ab ba
0f d4 51 8c 63 .
.!;A........Q.c
0200 20 14 51 1d c
1 0d 12 d2 d0 99 25
74 25 f5 e2 a0

.Q.......%t%...
0210 62 96 17 78 9
6 9a f2 c8 fb 55 96
1b 16 fe 22 d9 b
..x.....U....".
0220 f5 29 fc 28 3
3 c0 ac b1 05 06 af
41 c6 df ff fb .
).(3......A....
0230 92 04 ea 0f f
3 08 28 d6 83 18 7a
50 57 84 ba d0 .
.....(...zPW...
0240 61 ef 4a 0c 5
0 a3 54 0c 61 e9 41
7c 97 2a 81 8c a
.J.P.T.a.A|.*..
0250 31 30 b1 82 6
2 01 52 aa 30 ab 9a
f2 44 ae c2 cd 1
0..b.R.0...D...
0260 93 49 46 de e
9 f5 cf 1d 2b 28 80
93 8c 21 4c 68 .
IF.....+(...!Lh
0270 96 b5 74 ff 6
5 b2 ab 51 f8 6a 0d
69 23 c6 7e 6e .
.t.e..Q.j.i#.~n
0280 3c 8b 46 6c b
9 68 9e 8c cc 42 60
53 2c 9a fa db <
.Fl.h...B`S,...
0290 d2 b5 80 e7 5
b c4 b3 4d 0e 5b d3
d7 36 77 0f e2 .
...[..M.[..6w..
02a0 3e 1b b5 8f f
5 dd 52 e0 c8 48 a9
74 01 90 10 a8 >
.....R..H.t....
02b0 f5 c8 39 56 9
f 6d 65 f1 7a 10 d1
79 a1 12 76 80 .
.9V.me.z..y..v.
02c0 f2 af 9d 36 d
9 78 16 88 66 05 00
30 97 69 3f 05 .
..6.x..f..0.i?.
02d0 41 72 cc 56 0
6 23 39 5c 85 b0 2d
04 4a 72 46 b9 A
r.V.#9\..-.JrF.
02e0 20 ae 48 f8 1
b 6c 07 aa 53 ef 4b
9c 92 48 b6 5e
.H..l..S.K..H.^
02f0 4a ae 0e 9b 7
8 ba d5 bc 3b ea ed
ad b1 7f d4 7b J
...x...;......{
0300 2a 73 4d e1 a
e b3 c8 b7 92 13 95
25 48 55 eb 1f *
sM........%HU..
0310 bb 90 00 05 0
5 8b e7 1b 2b 7a 55
ae c2 d1 0c c5 .
.......+zU.....

0320 f9 68 a9 0c a
c e2 d3 0a ae aa 6f
bb 53 2d 72 a3 .
h........o.S-r.
0330 71 af 20 ce b
3 cb 83 3f 50 a7 ea
eb 31 db 63 97 q
. ....?P...1.c.
0340 5b b9 21 2b 6
9 77 11 67 8e 94 7b
86 07 53 ae 56 [
.!+iw.g..{..S.V
0350 37 2b ad 66 b
1 da b5 69 6b ab 5f
c1 ec 3b ae fc 7
+.f...ik._..;..
0360 90 2d 6d ea f
f 1f 14 cf d4 6e e1
33 59 11 dd 4b .
-m......n.3Y..K
0370 2a f5 55 19 1
0 b3 00 41 41 d3 a1
42 42 04 fc b8 *
.U....AA..BB...
0380 4c f0 55 85 9
7 23 d8 34 e5 31 0c
a3 cc a1 91 39 L
.U..#.4.1.....9
0390 b4 a0 99 41 b
9 13 99 30 8f 93 0e
9d 49 7b a9 14 .
..A...0....I{..
03a0 4f 19 d3 f7 5
8 8c 63 1a 91 5b cf
d6 08 e4 ee 1c O
...X.c..[......
03b0 c9 24 02 60 e
f a7 85 bf 57 39 a0
e3 2d 4b b5 15 .
$.`....W9..-K..
03c0 6d 98 90 16 b
5 17 e9 89 ee ee e4
b3 a1 36 01 56 m
............6.V
03d0 ff fb 92 04 e
b 8f f2 e3 28 55 83
18 7a 50 61 05 .
.......(U..zPa.
03e0 0a 90 63 0f 4
a 0b 74 a1 56 0c 61
e9 41 80 97 6a .
.c.J.t.V.a.A..j
03f0 41 8c 3d 30 3
8 6b 64 c9 5a 5b 50
62 ee 94 3e 14 A
.=08kd.Z[Pb..>.
0400 41 98 ec 8d 4
b 11 e0 2a f0 c2 01
6c ed a6 f9 72 A
...K..*...l...r
0410 c6 12 52 63 0
0 a0 f4 10 4a 6e 30
d8 f5 79 86 a1 .
.Rc....Jn0..y..
0420 52 27 59 f7 5
b 64 c6 5c 38 ae cb
ae 25 1c 1d b3 R
'Y.[d.\8...%...
0430 a4 c4 7a df 4

0 d0 32 d4 ad f1 0c
e4 a4 ca 72 b3 .
.z.@.2.......r.
0440 d6 94 b4 2a d
e 4d e6 45 c4 5f bb
51 9b 31 2b fc .
..*.M.E._.Q.1+.
0450 b3 43 66 a8 9
5 c0 dc 32 27 03 3d
49 49 e2 ec aa .
Cf....2'.=II...
0460 ca d3 25 4d 1
8 e1 7a 90 a5 00 e2
f4 a7 28 10 89 .
.%M..z......(..
0470 c6 37 0d 95 2
5 55 a2 cb 4e 12 82
cd a6 1b 9d 38 .
7..%U..N......8
0480 58 08 f4 56 e
1 7c d4 e2 18 d5 ba
7c 1b 9d a8 2b X
..V.|.....|...+
0490 50 8e 09 93 1
2 7a d2 24 82 90 fe
0b 9b 85 89 7c P
....z.$.......|
04a0 7a 6f 7f c0 6
a 6a cf b2 7e 5d fd
df 08 6d 6b 8b z
o..jj..~]...mk.
04b0 c1 a4 f0 ef b
f 5f 29 c5 04 eb 2e
37 72 cb 9d d0 .
...._)....7r...
04c0 30 75 63 33 0
9 e0 2b 42 b3 80 88
11 14 36 5a cb 0
uc3..+B.....6Z.
04d0 46 0c 4d f2 8
b 0b 0e 30 a5 72 ea
68 1e 84 70 8d F
.M....0.r.h..p.
04e0 72 4d 75 bb f
6 71 90 a7 14 3f 94
13 48 e1 54 83 r
Mu..q...?..H.T.
04f0 9a 8f 83 11 d
c 17 87 5e ca c7 6f
54 4e b2 34 d6 .
......^..oTN.4.
0500 73 f1 e9 12 1
5 7f ed 6f 7f d4 90
94 b0 69 9a 7c s
......o.....i.|
0510 57 34 b6 b3 b
f 28 aa 0f 93 72 17
39 16 7a a9 42 W
4...(...r.9.z.B
0520 43 ee
C
.
No. Time
Source
Destination
Protocol
Length Info

274 10.41541200
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1302 http49
574 [PSH, ACK] Seq=
166779 Ack=1 Win=46
Len=1248
Frame 274: 1302 byt
es on wire (10416 b
its), 1302 bytes ca
ptured (10416 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.465342000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.465342000 s
econds
[Time delta fro
m previous captured
frame: 0.054002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05400200
0 seconds]
[Time since ref
erence or first fra
me: 10.415412000 se
conds]
Frame Number: 2
74
Frame Length: 1
302 bytes (10416 bi
ts)
Capture Length:
1302 bytes (10416
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64

:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
288
Identification:
0xf20a (61962)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =

Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a2c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 166779, Ack:
1, Len: 1248
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1248]
Sequence number
: 166779 (relati
ve sequence number)
[Next sequence
number: 168027 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .

... = ECN-Echo: Not

set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb52
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2508]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 08 f2 0a 4
0 00 31 06 3a 2c 4a
7c 0c 8a c0 a8 .
...@.1.:,J|....
0020 01 0b 00 50 c
1 a6 2b ca ed a8 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e b5 2a 0
0 00 24 70 40 0b 9c
40 20 6d 49 ae .
..*..$p@..@ mI.
0040 fc 31 66 92 2
c 31 cc af f0 ea d2
a9 d2 5c 52 44 .
1f.,1.......\RD
0050 aa 0a a9 5e 4
8 2b 92 66 ec fe 77
a9 b8 d2 4a 44 .
..^H+.f..w...JD
0060 a3 8b 71 00 0
d cf 02 c8 f6 b1 7f
1a 85 5e 72 5f .
.q..........^r_
0070 56 f6 c1 7c e
6 bb 9f 5f b7 b9 6e
b0 e0 40 49 45 V

..|..._..n..@IE
0080 df fb 6d 8d 0
5 6e ff fb 92 04 ed
8f f3 34 28 d4 .
.m..n.......4(.
0090 83 38 7a 50 6
3 c5 2a 70 63 0f 4c
0b d4 ad 54 0c .
8zPc.*pc.L...T.
00a0 e5 e9 81 7c 9
5 ea 01 8c 3d 30 0b
8a 43 71 41 67 .
..|....=0..CqAg
00b0 d5 a1 94 16 8
0 ca b0 81 24 8a eb
59 45 be 44 33 .
.......$..YE.D3
00c0 d5 5b c8 6d 2
b e4 22 ca 17 63 ea
a3 8c 7d f2 95 .
[.m+."..c...}..
00d0 58 56 e5 41 4
9 80 8c aa d7 3d 25
5c 6f f5 4b d2 X
V.AI....=%\o.K.
00e0 c4 58 8b 2d 8
2 7e 1e 30 f1 74 4e
21 8d 7d bc 16 .
X.-.~.0.tN!.}..
00f0 78 30 11 ac b
8 54 6f 56 9a 76 2f
fc d1 2d ad ac x
0...ToV.v/..-..
0100 c4 53 3d df f
1 6f 89 6a 3c 99 03
00 f1 b2 af 2b .
S=..o.j<......+
0110 91 a1 1a 66 9
f e6 ea 66 82 34 ca
67 08 83 07 ca .
..f...f.4.g....
0120 8e 40 84 5e d
6 c0 d0 8a 83 4a 31
ef cb 97 6a ed .
@.^.....J1...j.
0130 dc 6e 84 42 7
6 29 26 ea 5e aa f8
2e 86 fc a7 15 .
n.Bv)&.^.......
0140 57 84 5a cf 1
5 86 2f 0a 82 06 c8
0e 04 45 52 94 W
.Z.../......ER.
0150 4e 92 68 0d 6
2 48 e1 b9 a3 ca 88
11 e9 e3 3e dc N
.h.bH........>.
0160 9d 3e 2c f6 7
7 a2 c5 f2 b5 96 b5
53 3d cd dd f0 .
>,.w......S=...
0170 36 cd ab 8a b
f 4d cc ea 95 ba cf
94 4d 6a 06 38 6
....M......Mj.8
0180 01 68 6c 64 6
f 65 66 fc fa 1c 04
01 5a 9c 86 e9 .
hldoef.....Z...

0190 c4 61 73 64 1
9 20 85 2c e4 b0 6b
37 8a cc b2 98 .
asd. .,..k7....
01a0 11 d1 ed 2e 0
4 24 44 68 e4 7a 1f
b4 3c 1e 59 0d .
....$Dh.z..<.Y.
01b0 55 e1 5f 89 3
7 69 f0 e3 46 7f e0
43 64 cf 89 19 U
._.7i..F..Cd...
01c0 f1 ff ba 5f c
6 f7 7d f5 ac fd d3
7f 32 48 d2 db .
.._..}.....2H..
01d0 22 fc 2a 62 9
2 e5 32 1d 06 1c 07
0c 47 9a 86 22 "
.*b..2.....G.."
01e0 f3 a8 8e c9 3
4 fe af 73 20 a9 4b
b4 9c 5b 7d b8 .
...4..s .K..[}.
01f0 ab 65 0f 6e 4
2 90 46 2a 7a 0b 75
b2 7e 6f 3e 98 .
e.nB.F*z.u.~o>.
0200 e0 4a 82 0b 8
5 a4 98 4e 12 65 e1
1b 1b a8 50 83 .
J.....N.e....P.
0210 d2 88 b9 14 5
9 32 5a 4d 44 db 9a
e9 8b 49 49 3c .
...Y2ZMD....II<
0220 d8 a2 3e 99 1
5 52 29 1a ff fb 92
04 e8 8f f2 e1 .
.>..R).........
0230 28 55 03 38 7
a 50 61 25 1a 70 63
0f 4a 0b fc bb (
U.8zPa%.pc.J...
0240 54 0c e2 49 8
1 7b 16 ea 01 8c 3d
30 bd f3 5a 26 T
..I.{....=0..Z&
0250 67 c2 ce 49 4
d 42 f0 ab b5 d4 ab
05 58 83 e9 1e g
..IMB......X...
0260 a1 ea a4 1d 3
4 11 1c e7 0d 12 1a
24 38 c9 b3 27 .
...4......$8..'
0270 03 d0 ea 0b 2
9 6c ad 58 ad a4 8c
34 d9 b4 a2 c8 .
...)l.X...4....
0280 c5 2f a2 73 e
2 f9 2d ab a3 99 fe
a6 03 69 13 4a .
/.s..-......i.J
0290 b3 38 bb 47 6
6 c4 80 ae ba aa ad
4d 7f 14 55 b6 .
8.Gf......M..U.
02a0 37 ff 08 fd 3

e ad df c4 52 c9 fe
af 12 04 3d ec 7
...>...R.....=.
02b0 31 00 66 a4 7
3 c8 7b 8a 3b 9c 77
e9 47 28 c1 8a 1
.f.s.{.;.w.G(..
02c0 11 16 89 08 b
2 0f 64 ac 23 24 05
fe d8 99 53 30 .
.....d.#$....S0
02d0 5d 80 02 e0 a
f 65 f6 1b bf b1 37
e1 ed 94 0e a9 ]
....e....7.....
02e0 fe 96 4d e7 8
e 4c c1 f2 76 a0 4b
1c 09 12 f7 af .
.M..L..v.K.....
02f0 64 84 e5 c3 3
9 28 a6 e8 9a d5 ba
24 1f 0b c0 89 d
...9(.....$....
0300 fa 46 6d fc d
2 43 eb 5e 9e 90 b7
1f d3 5e 7e 29 .
Fm..C.^.....^~)
0310 2c 49 0e 4c b
0 6f eb a0 70 04 aa
0a 4b 50 b5 01 ,
I.L.o..p...KP..
0320 05 64 a0 af e
b 8a d4 08 8c 43 1a
a2 02 c7 1a 4d .
d.......C.....M
0330 58 3e 33 19 d
3 0e 83 1e dd a0 da
85 cb 59 1c f5 X
>3..........Y..
0340 af 52 a9 03 1
f 98 d5 75 67 9d c3
38 61 81 4e 87 .
R.....ug..8a.N.
0350 8d 60 a8 87 4
6 56 3e 54 f9 6b 8d
8d 3f 29 32 e6 .
`..FV>T.k..?)2.
0360 d5 28 21 5b b
9 73 f3 4b f5 e7 b9
6f 6c ae 3b fa .
(![.s.K...ol.;.
0370 fd 6d d9 fa 2
6 ea 84 a1 3d 0a 4b
a4 dc df a0 1c .
m..&...=.K.....
0380 41 60 4b df 4
1 19 5e e3 0a 28 a9
c4 d9 29 ba e8 A
`K.A.^..(...)..
0390 ea c8 aa c8 6
0 48 16 f0 05 ad 02
a4 76 fd 8a a5 .
...`H......v...
03a0 d7 79 22 ef e
6 65 40 6e 3f 4c d2
cf 07 76 58 26 .
y"..e@n?L...vX&
03b0 0e f6 15 52 5
f ad b0 e7 97 9a f4

b2 6c f4 ed 20 .
..R_.......l..
03c0 1f 94 53 66 e
5 24 04 db 33 94 ff
fb 92 04 e9 8f .
.Sf.$..3.......
03d0 f3 17 2c 54 8
3 38 9a 60 61 e5 0a
70 63 2f 4a 4b .
.,T.8.`a..pc/JK
03e0 80 ad 54 0c e
1 e9 81 76 1a 2a 01
8c ad 70 fc 53 .
.T....v.*...p.S
03f0 59 c7 d8 c1 4
5 54 67 b2 5e f6 6a
69 0c f5 2e 20 Y
...ETg.^.ji...
0400 98 8a ea 23 1
0 39 25 96 7f 86 1c
50 b0 b2 64 4b .
..#.9%....P..dK
0410 8a 4d a6 4e 2
c 05 0c 19 86 e3 8e
65 c5 d0 96 73 .
M.N,......e...s
0420 28 77 a0 c6 0
1 43 37 f6 37 49 66
a1 7d 60 7e 63 (
w...C7.7If.}`~c
0430 1e 51 7b 83 c
8 fe 68 2c 06 eb 59
57 b6 f9 29 65 .
Q{...h,..YW..)e
0440 78 da 9d b1 a
e 50 7e 39 cc 1a be
a3 eb 87 77 d3 x
....P~9......w.
0450 16 dd 35 31 7
f cc ad d2 ca 0b be
63 42 d6 08 a2 .
.51.......cB...
0460 77 c2 65 07 0
e 4d 24 51 d8 7f 10
c8 af 46 25 cb w
.e..M$Q.....F%.
0470 d7 23 29 d2 a
a d9 82 e5 0e 64 bc
c5 97 5e 9d b0 .
#)......d...^..
0480 d4 b7 75 5c c
a e5 75 b1 26 81 05
46 1a 14 11 4c .
.u\..u.&..F...L
0490 6e 32 45 e1 1
7 38 44 0d 16 55 a9
65 e4 cb 28 d0 n
2E..8D..U.e..(.
04a0 62 bb d4 a4 0
7 82 7d 1d 87 c3 32
1d d6 9f 30 3e b
.....}...2...0>
04b0 45 25 5d 56 d
b e4 d2 a0 a8 91 12
e0 46 7e 86 a4 E
%]V........F~..
04c0 e5 80 d1 66 2
c 3a 63 5c 6c 25 65
82 67 97 a9 82 .

..f,:c\l%e.g...
04d0 03 73 57 35 1
b 83 e9 02 fa f2 6f
a5 24 22 c5 28 .
sW5......o.$".(
04e0 e5 29 ab 0a 6
7 15 aa be 08 5a d7
f0 91 09 66 eb .
)..g....Z....f.
04f0 41 9c 87 69 e
5 f2 ea 15 29 ac a8
75 e8 b9 ac fa A
..i....)..u....
0500 91 62 03 44 f
4 ce 60 eb 5f e3 db
39 80 e0 61 cf .
b.D..`._..9..a.
0510 3e 66 b0 f7 5
f 4d
>
f.._M
No. Time
Source
Destination
Protocol
Length Info
275 10.41559100
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=168027 Win=38115 L
en=0
Frame 275: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.465521000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.465521000 s
econds
[Time delta fro
m previous captured
frame: 0.000179000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017900
0 seconds]
[Time since ref
erence or first fra
me: 10.415591000 se

conds]
Frame Number: 2
75
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes

Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f80 (20352)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 16802
7, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number

: 1 (relative se
quence number)
Acknowledgment
number: 168027 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 274]
[The RTT to
ACK the segment wa
s: 0.000179000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.

0010 00 28 4f 80 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca f2 88 50 10 .
....P..N.+...P.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
276 10.50341700
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=16802
7 Ack=1 Win=46 Len=
1260
Frame 276: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.553347000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.553347000 s
econds
[Time delta fro
m previous captured
frame: 0.087826000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08782600
0 seconds]
[Time since ref
erence or first fra
me: 10.503417000 se
conds]
Frame Number: 2
76
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)

[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf20b (61963)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a1f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 168027, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 168027 (relati
ve sequence number)
[Next sequence
number: 169287 (
relative sequence n
umber)]
Acknowledgment

number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x57c
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 0b 4
0 00 31 06 3a 1f 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b ca f2 88 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 57 c3 0

0 00 8c 83 40 26 00
59 10 e1 18 71 .
.W.....@&.Y...q
0040 1e e3 a0 21 3
1 9b aa 84 64 2f 91
ae 0a da 58 fb .
..!1...d/....X.
0050 ac e9 63 2e c
a 4c e8 46 e3 83 2e
a6 9a 7e 5e 49 .
.c..L.F.....~^I
0060 53 63 a5 52 e
2 48 4a 70 1a c2 cf
5b 60 2f 90 89 S
c.R.HJp...[`/..
0070 ec 5d 24 d0 e
a 1b 73 65 a7 19 ac
d0 64 df bb 31 .
]$...se....d..1
0080 a5 13 b5 45 8
0 a3 82 e1 c4 e6 16
e4 ff fb 92 04 .
..E............
0090 e9 0f f3 08 2
e 54 83 38 62 60 5c
e6 aa 80 63 2b .
....T.8b`\...c+
00a0 5c 0b cc b9 5
2 0c e2 69 81 7d 95
ea 01 8c bd 30 \
...R..i.}.....0
00b0 92 20 16 1c 0
6 a2 93 9a f2 ef 4c
91 7e c3 51 b8 .
........L.~.Q.
00c0 79 5f 03 ee a
d 88 e3 12 49 e6 49
4a 1c 91 9d 15 y
_......I.IJ....
00d0 1b 4f 22 7e 8
9 6f 71 ee 56 08 dd
69 b9 88 f0 e0 .
O"~.oq.V..i....
00e0 2b 72 55 62 d
8 7f 21 f8 92 38 50
c8 7e fe 0e c6 +
rUb..!..8P.~...
00f0 05 4c d6 4c b
7 45 4c 6b b3 49 bb
44 91 c7 fb d1 .
L.L.ELk.I.D....
0100 8a df 19 91 9
e 0c df 34 45 ed 66
12 82 85 dc f3 .
......4E.f.....
0110 86 b0 d6 1b 2
9 4b fa 15 10 2e 51
40 23 44 91 02 .
...)K....Q@#D..
0120 0f a0 98 00 b
a 6d 99 ce 56 11 c8
5d 90 b8 6f 2b .
....m..V..]..o+
0130 d4 f6 ca 63 3
8 a5 fb 78 d5 eb 8c
8f 84 a6 d4 46 .
..c8..x.......F
0140 ed c5 f5 29 8
8 df b6 5d 02 e4 40

e9 49 a2 54 9d .
..)...]..@.I.T.
0150 12 e5 28 8f 1
b c4 79 0e 5a d1 74
90 4e 9e 53 23 .
.(...y.Z.t.N.S#
0160 88 ba 2f 59 9
1 1c b3 34 d3 28 14
1a a6 ad 35 24 .
./Y...4.(....5$
0170 89 e0 90 e8 5
8 3b 42 72 cd aa 64
16 da 28 34 05 .
...X;Br..d..(4.
0180 84 07 e1 50 3
3 7a 24 f6 1a 4b be
46 33 fe 5a b6 .
..P3z$..K.F3.Z.
0190 45 a8 da b4 d
5 19 6a ad 50 a9 a9
2c b2 19 49 56 E
.....j.P..,..IV
01a0 9b 11 bc 59 6
6 f1 68 cf 45 e5 11
d1 b7 1b 2f 8b .
..Yf.h.E...../.
01b0 7a c9 32 77 8
5 39 5b 11 49 fa 76
d1 a9 7c 2f 6f z
.2w.9[.I.v..|/o
01c0 d5 a9 b6 f8 f
3 d9 5d 95 dd e3 43
65 df c5 3d f5 .
.....]...Ce..=.
01d0 f1 79 b5 2e 9
8 55 47 fc d3 33 1f
5a 65 2e 51 41 .
y...UG..3.Ze.QA
01e0 65 62 a5 99 7
c 84 eb 42 31 19 90
d8 c9 d4 d9 66 e
b..|..B1......f
01f0 2b f0 54 5d 7
9 95 27 37 72 ba 98
c1 af 77 51 52 +
.T]y.'7r....wQR
0200 8b 29 0c 6a d
6 4c a5 86 86 77 09
c0 2f 2c 57 a4 .
).j.L...w../,W.
0210 18 0f 85 3f 3
5 6f 4d 2e 51 10 6b
0b fb 56 14 5f .
..?5oM.Q.k..V._
0220 e2 e0 fb 8d a
f bb 37 ee 05 f7 07
11 70 2a ff fb .
.....7.....p*..
0230 92 04 ea 0f f
3 05 25 d4 83 38 7a
50 5b 04 fa 80 .
.....%..8zP[...
0240 63 2f 4a 0c 5
8 b3 54 0c e6 29 81
8d 17 29 c1 8c c
/J.X.T..)...)..
0250 3d 30 34 00 5
8 c8 ab d0 ae c9 64
7f 5b 92 e2 a6 =

04.X.....d.[...
0260 3c fb 07 51 a
1 af a3 19 33 9b 0b
3b 4e 89 60 f2 <
..Q....3..;N.`.
0270 e0 f1 5b 7a 8
5 a5 7e d7 f6 62 20
5d 36 85 6e 0d .
.[z..~..b ]6.n.
0280 90 53 37 58 1
2 d4 da f9 96 33 08
7e 28 e0 ac 36 .
S7X.....3.~(..6
0290 5c d3 0f 06 c
1 5c b4 a4 71 61 82
6d 11 1c 75 c6 \
....\..qa.m..u.
02a0 ee 8e f4 c4 1
9 0d d1 cc ad d1 7b
95 63 23 bd fa .
.........{.c#..
02b0 47 26 a5 66 9
6 bf cb 21 62 af 34
32 12 29 5a a5 G
&.f...!b.42.)Z.
02c0 04 e8 ba 45 d
3 72 d9 62 b5 90 b1
fc 0a 9a 30 d3 .
..E.r.b......0.
02d0 d9 74 ae 86 8
e 21 0d d8 80 c1 21
93 7d 24 e4 76 .
t...!....!.}$.v
02e0 51 31 60 52 4
1 65 78 4a 06 d5 67
b3 05 51 29 68 Q
1`RAexJ..g..Q)h
02f0 8c 2e 2d ea c
8 1e 0c 3b c0 8c af
c6 32 dd 85 ea .
.-....;....2...
0300 6e d1 7a ed 8
f 5a cd a4 06 57 db
de c8 50 cb 4e n
.z..Z...W...P.N
0310 e1 15 ae 39 4
3 ee 66 d4 15 2d d4
51 9e 38 4e f9 .
..9C.f..-.Q.8N.
0320 4a 5c a8 29 f
7 99 5a ab 4c 8c 67
16 43 8c dc 59 J
\.)..Z.L.g.C..Y
0330 d7 60 b9 7b b
0 ef d8 8d b8 76 72
8a 31 c8 ff 13 .
`.{.....vr.1...
0340 06 91 85 52 d
e 10 01 50 c6 eb 9c
2d dc a6 f1 e5 .
..R...P...-....
0350 43 d5 e5 e1 9
5 fe f1 dd f5 5d 93
2c 90 35 b7 25 C
........].,.5.%
0360 b3 f3 3c 82 b
4 a2 fb 76 74 ed ed
1f 20 5a 70 52 .
.<....vt... ZpR

0370 18 03 39 36 e
e 42 6a 06 b2 70 4a
0d 1e 1e 7d 14 .
.96.Bj..pJ...}.
0380 f0 64 4a c0 a
f 5f 91 d2 30 e5 32
26 4a 01 64 10 .
dJ.._..0.2&J.d.
0390 4d bc e4 b7 7
3 70 e3 93 88 1b 3f
19 78 69 29 e7 M
...sp....?.xi).
03a0 86 96 bb cd 2
f 0e 16 bd 45 8a 7e
b0 a4 15 5a 3b .
.../...E.~...Z;
03b0 f6 fd 39 02 f
0 a3 67 78 bb 9f dc
07 90 73 f7 1a .
.9...gx.....s..
03c0 46 f5 ab ff a
7 94 8b c2 05 85 aa
30 21 7d f3 f2 F
..........0!}..
03d0 ff fb 92 04 e
8 0f f2 e5 28 55 03
38 7a 50 5b 25 .
.......(U.8zP[%
03e0 ca 80 63 2b 4
c 0b f0 9d 56 0c e1
e9 49 7c 16 6a .
.c+L...V...I|.j
03f0 41 8c 31 30 2
b 7b eb 6f b6 cf ff
ff 86 02 a8 9c A
.10+{.o........
0400 90 85 41 7b a
5 8d a0 38 65 60 80
9f 17 0d 6a 36 .
.A{...8e`....j6
0410 34 6b 05 16 3
1 1f 5f 94 71 fb 32
87 de 31 51 dc 4
k..1._.q.2..1Q.
0420 85 c3 33 6c d
2 87 18 6e 17 5a 31
82 41 e0 97 e9 .
.3l...n.Z1.A...
0430 52 07 3a b8 f
b 83 bb d5 a3 0b 14
af b6 d6 f1 55 R
.:............U
0440 ad cb 59 db c
0 c5 d5 5e 96 b2 cc
77 62 b1 16 06 .
.Y....^...wb...
0450 12 f2 22 e5 0
d cd eb 3e fc c7 89
c7 26 00 03 40 .
."....>....&..@
0460 5d 0a 7a 9d 3
3 5c d8 0a 18 23 0a
d1 b2 1e 06 73 ]
.z.3\...#.....s
0470 1b 5c 96 72 3
d 64 cb b6 a0 67 31
62 2f 89 01 f4 .
\.r=d...g1b/...
0480 68 71 75 b3 4

8 af bd 1f 53 69 09
b2 c1 bd 22 a2 h
qu.H...Si....".
0490 e6 7d eb 78 f
5 c7 c3 eb 53 e6 27
6d 8f af 8f 05 .
}.x....S.'m....
04a0 69 17 02 db 4
1 42 0f df 31 7d ff
8a 28 c3 3f f7 i
...AB..1}..(.?.
04b0 d8 ad 8a bc 5
d 5b d7 5d 64 11 10
12 91 a7 40 f1 .
...][.]d.....@.
04c0 97 95 f9 89 d
e 3d d9 51 23 6c 22
af 86 d8 51 d1 .
....=.Q#l"...Q.
04d0 2d 53 46 6e 2
7 c8 55 5b d2 91 20
5a 24 da 62 01 SFn'.U[.. Z$.b.
04e0 27 ca bb 19 5
2 29 72 18 37 6b 5d
21 62 b6 64 f3 '
...R)r.7k]!b.d.
04f0 79 13 d0 e4 0
d 48 b8 46 48 ca 2f
3e 7f 52 23 8b y
....H.FH./>.R#.
0500 d1 6d ab a4 5
9 db 95 fb 01 f3 8a
dd 08 b2 d0 fd .
m..Y...........
0510 78 7d 04 ea 0
0 58 4f 49 c1 1c 8b
4c 01 89 8d 7d x
}...XOI...L...}
0520 46 ac
F
.
No. Time
Source
Destination
Protocol
Length Info
277 10.56241900
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
881 http49
574 [PSH, ACK] Seq=
169287 Ack=1 Win=46
Len=827
Frame 277: 881 byte
s on wire (7048 bit
s), 881 bytes captu
red (7048 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t

ype: Ethernet (1)

Arrival Time: N
ov 10, 2014 11:27:0
3.612349000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.612349000 s
econds
[Time delta fro
m previous captured
frame: 0.059002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05900200
0 seconds]
[Time since ref
erence or first fra
me: 10.562419000 se
conds]
Frame Number: 2
77
Frame Length: 8
81 bytes (7048 bits
)
Capture Length:
881 bytes (7048 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa

gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
67
Identification:
0xf20c (61964)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bcf [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0

1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 169287, Ack:
1, Len: 827
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 827]
Sequence number
: 169287 (relati
ve sequence number)
[Next sequence
number: 170114 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win

dow size: 46]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb86
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2087]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 63 f2 0c 4
0 00 31 06 3b cf 4a
7c 0c 8a c0 a8 .
c..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b ca f7 74 9e
87 4e aa 50 18 .
..P..+..t..N.P.
0030 00 2e b8 67 0
0 00 54 0a 7a 00 e8
99 99 ed 95 d7 .
..g..T.z.......
0040 48 9f bb a9 2
3 8d 9c fd 69 9a bb
ff 46 0e 3f ad H
...#...i...F.?.
0050 38 48 32 ee 7
1 01 dd f2 14 e7 ba
ee ae 51 e4 5b 8
H2.q........Q.[
0060 af db f5 fa 5
9 10 8d 47 5e ac ea
93 6a 8e ea 4a .
...Y..G^...j..J
0070 64 61 78 c3 7
9 7b 19 4e 1a 81 fa
fd ad fc 33 df d
ax.y{.N......3.
0080 af ab 7c f9 e
3 09 ff fb 92 04 eb
8f f3 12 28 d6 .
.|...........(.
0090 03 38 7a 50 5
e 05 3a b0 67 0c 4c
0b a4 9d 5e 0c .
8zP^.:.g.L...^.
00a0 3d e9 41 6b 9
2 ab 81 87 a1 28 b4
aa 08 00 d0 e7 =
.Ak.....(......
00b0 89 2d d4 43 9
9 cd 08 84 46 74 da
45 0b c7 15 b4 .
-.C....Ft.E....
00c0 bb 04 2b 94 2
9 1f 75 33 ea a4 dd
4d 57 27 b9 bf .

.+.).u3...MW'..
00d0 d7 de 2d 57 9
5 18 3a ef 0a 79 66
63 20 98 b9 e6 .
.-W..:..yfc ...
00e0 5a 3b a1 05 c
8 aa f2 db 6d aa 4f
e4 a2 11 8e 87 Z
;......m.O.....
00f0 5e a4 79 18 8
b 39 1d d5 a8 b2 28
fc b3 7d a8 fe ^
.y..9....(..}..
0100 54 89 49 bc 0
1 4e bb c4 59 fe ed
bb 2e 32 8f bd T
.I..N..Y....2..
0110 82 76 03 32 5
6 07 71 97 b7 d0 ca
62 b7 dc 87 54 .
v.2V.q....b...T
0120 c8 d2 02 95 2
c 70 59 99 e7 79 4a
4b f6 86 b4 c3 .
...,pY..yJK....
0130 c6 ef 12 54 f
4 64 07 06 ad a1 83
36 f2 23 5c e7 .
..T.d.....6.#\.
0140 35 4e f9 11 d
a 6c 1b fe 6f 89 b6
d9 eb 8d b6 1a 5
N...l..o.......
0150 f1 bd fd f7 1
d 21 0c 5a fe ec 1a
ef 39 13 df ee .
....!.Z....9...
0160 55 ce f1 5d 8
3 b3 7a 89 fd ec a6
7e 3e df 1f f1 U
..]..z....~>...
0170 46 6c a6 9c 9
7 3c af 2b b3 24 43
34 5d 54 6a 82 F
l...<.+.$C4]Tj.
0180 1e 23 75 8c e
9 4d 34 25 21 d8 f5
a5 65 56 9d 8d .
#u..M4%!...eV..
0190 b2 6f 3f 59 5
7 75 86 6c eb 6c 3c
e2 67 2b fc f7 .
o?YWu.l.l<.g+..
01a0 3c af b9 5d 3
9 a9 a2 3b bc f1 2a
c6 79 fe 92 25 <
..]9..;..*.y..%
01b0 e6 a9 55 6d 0
6 85 48 55 f0 cd 4d
af a6 12 5f a0 .
.Um..HU..M..._.
01c0 88 a7 05 ef 1
3 1c fd 1c e3 be 69
ea c9 76 ea 32 .
.........i..v.2
01d0 ad 8a 28 c0 f
b d4 b1 bf 2c f3 38
46 45 6e 83 13 .
.(.....,.8FEn..

01e0 e1 80 bc a8 2
9 4b 43 27 b7 0f d8
70 e2 32 2b 85 .
...)KC'...p.2+.
01f0 81 45 ac 4c 5
f c1 72 d3 31 b4 f3
53 02 32 d3 b6 .
E.L_.r.1..S.2..
0200 e7 3c 09 7f f
3 02 ad 3b df f7 53
6c 2c af 38 f2 .
<.....;..Sl,.8.
0210 28 3c 68 19 2
8 7b 0e ac 48 64 d0
ab 86 03 67 b6 (
<h.({..Hd....g.
0220 2d 6a 02 c8 9
d 45 9a 18 ff fb 92
04 ee 0f f3 08 j...E..........
0230 42 d8 81 ef 2
a e2 65 68 4a f0 3d
e5 5c 4b bc 83 B
...*.ehJ.=.\K..
0240 62 0c 3d 49 4
9 78 0b 2b c1 87 a4
e1 f2 3d 05 9e b
.=IIx.+.....=..
0250 0a b9 a5 9f 7
2 3f fa 8c 29 0a 85
22 20 c5 03 5d .
...r?..).." ..]
0260 6a 34 d4 14 8
c 1f 10 57 4a 38 ad
60 ea 4d cc 3c j
4.....WJ8.`.M.<
0270 31 67 5f 15 2
b 83 65 d2 bb 33 7d
ab 96 4f 12 26 1
g_.+.e..3}..O.&
0280 30 72 d9 08 5
e 76 cd 87 51 98 7d
af f1 73 9e 7e 0
r..^v..Q.}..s.~
0290 b8 b9 8a 9b 3
c f8 e2 53 13 24 06
18 14 22 68 fb .
...<..S.$..."h.
02a0 dd 3e 19 2b 5
c a9 d7 81 8f 42 a7
79 60 68 4b 22 .
>.+\....B.y`hK"
02b0 a0 ef 0e 95 e
9 fb b6 96 a8 ce 8c
c6 08 0a 38 14 .
.............8.
02c0 42 d0 b2 00 6
1 63 46 a0 3d 83 be
a3 c5 49 c6 a2 B
...acF.=....I..
02d0 5e b9 0c 1b 0
0 5c 77 73 69 2f 4c
8a 61 5f 31 4a ^
....\wsi/L.a_1J
02e0 08 f7 2c e7 4
7 17 a4 bf b7 01 10
47 a6 6c 30 08 .
.,.G......G.l0.
02f0 01 46 3f d4 2

e 0e 86 0c 93 a9 4a
34 7c c0 64 29 .
F?.......J4|.d)
0300 6c 92 c7 c2 8
2 d4 f4 59 5e aa cd
4a 0b dc 30 01 l
......Y^..J..0.
0310 5a dc 42 51 4
4 ec 20 6a eb 4d 5a
4e ca 23 33 07 Z
.BQD. j.MZN.#3.
0320 46 8d 40 f8 e
5 3d 2b c9 83 1c 43
95 03 7d 2a 7e F
.@..=+...C..}*~
0330 27 d7 eb ef 9
5 c6 c9 7a d4 93 0a
28 0d cc 4d 50 '
......z...(..MP
0340 3c 30 fe 3e f
7 76 34 21 e1 fd bf
fe 50 c8 cf e2 <
0.>.v4!....P...
0350 6f 71 ac de d
b fd f0 e1 bd 3d 9f
11 2a c0 68 8f o
q.......=..*.h.
0360 b2 69 9f 00 f
d 1b be 3e bd 20 2b
7f 87 7f ff fd .
i.....>. +.....
0370 d5
.
No. Time
Source
Destination
Protocol
Length Info
278 10.56259800
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=170114 Win=38430 L
en=0
Frame 278: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.612528000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141

5615223.612528000 s
econds
[Time delta fro
m previous captured
frame: 0.000179000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017900
0 seconds]
[Time since ref
erence or first fra
me: 10.562598000 se
conds]
Frame Number: 2
78
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f81 (20353)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por

t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 17011
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 170114 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys

is]
[This is an
ACK to the segment
in frame: 277]
[The RTT to
ACK the segment wa
s: 0.000179000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 81 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
ca fa af 50 10 .
....P..N.+...P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
279 10.57141700
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=17011
4 Ack=1 Win=46 Len=
1260
Frame 279: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.621347000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.621347000 s
econds
[Time delta fro
m previous captured
frame: 0.008819000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00881900

0 seconds]
[Time since ref
erence or first fra
me: 10.571417000 se
conds]
Frame Number: 2
79
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),

Dst: pc13.home (192

.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf20d (61965)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a1d [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 170114, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por

t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 170114 (relati
ve sequence number)
[Next sequence
number: 171374 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x014
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 0d 4
0 00 31 06 3a 1d 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b ca fa af 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 01 47 0
0 00 20 70 99 40 10
e0 f1 07 97 71 .
..G.. p.@.....q
0040 41 b2 2a 70 2
1 a9 9a b2 d0 18 54
52 2c 06 13 9e A
.*p!.....TR,...
0050 a4 6a b7 d8 a
3 7b ff 5a 56 58 ab
fb 6e a4 fc bf .
j...{.ZVX..n...
0060 35 c9 6a b7 7
6 43 00 8e 09 e5 2d
21 63 28 06 5d 5
.j.vC....-!c(.]
0070 24 fc 63 86 f
4 bd 54 ae c4 d2 4f
28 0e d6 a6 5b $
.c...T...O(...[
0080 50 bb 49 76 2
e 20 7d 7e b7 33 75
ac ed 06 09 ff P
.Iv. }~.3u.....
0090 fb 92 04 eb 8
f f3 22 24 56 03 18
5a 50 61 84 7a .
....."$V..ZPa.z
00a0 b0 63 0b 4a 0
b c4 b1 54 0c e1 a9
81 65 12 6a 41 .
c.J...T....e.jA
00b0 8c 3d 29 3b 7
9 9a eb ff f5 10 68
24 ac 6d bd 12 .
=);y.....h$.m..
00c0 03 49 6e 41 c
e 48 06 96 82 35 cc
88 6d f9 c8 d6 .
InA.H...5..m...
00d0 de 27 33 19 9
c 1a bc 4e fd 77 5a
13 4c a3 92 8a .
'3....N.wZ.L...
00e0 7b f0 c4 00 f
f ef 27 83 01 a7 7a
98 85 c5 33 63 {
.....'...z...3c
00f0 ff 9c ab 26 c
d af 4a eb 5a b7 aa
7a 2f f0 f5 a6 .
..&..J.Z..z/...
0100 f8 df 36 61 9
2 6c fc 5f d6 3e a2
54 2c f2 63 de .
.6a.l._.>.T,.c.
0110 a2 88 8b 32 f

2 aa ea 2d fa 8b ee
fa 99 28 1c 83 .
..2...-.....(..
0120 a1 90 d0 65 8
b c3 9a 18 51 7d 16
1a 92 25 56 13 .
..e....Q}...%V.
0130 60 31 74 53 4
f 7d 13 6b 55 74 a5
dc e5 b0 a0 d1 `
1tSO}.kUt......
0140 6e de 72 7e 1
3 62 4e 70 75 9d 71
d6 17 06 2e 33 n
.r~.bNpu.q....3
0150 79 4c 91 2a 0
1 19 d0 d8 c9 14 4b
87 2e 9a cb bc y
L.*......K.....
0160 9a 3d 98 2c c
0 59 85 53 67 4a 46
9f 6b 55 71 77 .
=.,.Y.SgJF.kUqw
0170 13 0b 17 94 0
c 39 8b 23 02 bf 40
54 2d c1 90 27 .
....9.#..@T-..'
0180 c1 54 65 b2 0
4 b5 10 8e 24 65 41
60 87 0c 44 51 .
Te.....$eA`..DQ
0190 63 19 53 38 f
8 21 5c cb c9 9a ed
56 3b 17 1a c4 c
.S8.!\....V;...
01a0 09 55 58 e2 9
7 17 62 97 43 4e 1e
5d 92 a2 1f 2d .
UX...b.CN.]...01b0 df 20 94 a2 2
d e9 fb 62 9a ed 91
f7 bb 43 92 15 .
..-..b.....C..
01c0 ff 85 1b e6 d
1 ee ea 0f dd 1b ad
13 2b 68 e0 54 .
...........+h.T
01d0 b1 1d 83 1e e
3 16 35 e8 6d 2a 30
00 5a e6 32 03 .
.....5.m*0.Z.2.
01e0 9e 0f 62 b0 1
2 59 00 88 27 40 58
e0 e2 0f b9 36 .
.b..Y..'@X....6
01f0 0b 28 ea b4 4
7 92 50 ef e6 58 32
fe 94 d3 08 ac .
(..G.P..X2.....
0200 e7 52 d0 c0 d
5 65 6d 75 e9 72 bb
40 95 0b 80 29 .
R...emu.r.@...)
0210 ee 47 07 8e c
2 83 68 bf dd 4d e9
02 d6 c4 68 6f .
G....h..M....ho
0220 7e f6 a6 8b b
f dd f5 a6 6f 8a 37

35 cf ff f6 be ~
.......o.75....
0230 23 ff fb 92 0
4 eb 8f f2 f9 2d d4
83 38 9a 60 60 #
........-..8.``
0240 25 9a 80 63 0
f 4c 0c 2c 9f 50 0c
e2 09 41 7b 14 %
..c.L.,.P...A{.
0250 29 c1 8c 3d 2
8 8c 13 c9 55 1a 20
af cd 89 10 1b )
..=(...U. .....
0260 26 6e fd 81 b
c 98 21 10 1b 00 a7
d4 6c 60 c5 fa &
n....!.....l`..
0270 5c a3 de 18 4
3 f3 48 2c e8 c2 75
cf 10 31 93 47 \
...C.H,..u..1.G
0280 65 ca 54 c5 6
9 51 e6 5c f2 dd 4f
98 05 65 7c 14 e
.T.iQ.\..O..e|.
0290 81 06 40 34 e
b 01 c1 58 fc 4e 64
af c5 94 de 14 .
.@4...X.Nd.....
02a0 2f b8 34 84 d
f f7 cd e8 da ce 5f
65 5c e5 fe f4 /
.4......._e\...
02b0 ed d7 fb ff 5
2 84 a1 ca 52 2d 63
95 67 4a 63 17 .
...R...R-c.gJc.
02c0 2d 0e 01 df 2
2 92 14 8c 5a 24 ca
fd 66 b0 b5 ec ..."...Z$..f...
02d0 01 19 34 4b 2
7 4a c2 9a dd 47 52
e1 02 1d 4e d8 .
.4K'J...GR...N.
02e0 2e 72 e0 94 5
6 7f 69 b1 80 a3 f1
9c 26 08 20 11 .
r..V.i.....&. .
02f0 c0 89 1f 2c 1
0 e3 72 88 60 42 d9
e7 9d 33 64 8b .
..,..r.`B...3d.
0300 e7 a9 93 68 9
8 3a 44 c1 b1 a5 66
c6 88 8f 92 22 .
..h.:D...f...."
0310 9a 12 6c c5 d
5 d6 c8 1d 62 df 3a
da 59 76 b5 be .
.l.....b.:.Yv..
0320 bc 20 28 64 c
8 e6 9a 4c e0 71 40
1a 64 21 7b 29 .
(d...L.q@.d!{)
0330 b2 29 14 6c 0
2 1b 33 2b 53 aa 19
51 77 39 94 78 .

).l..3+S..Qw9.x
0340 3f a8 b3 28 8
e c7 6d da 62 55 52
36 fd 24 99 a5 ?
..(..m.bUR6.$..
0350 30 6c e8 29 a
2 35 40 a1 74 5f 9d
ea 8e 6a a7 bd 0
l.).5@.t_...j..
0360 d0 f4 13 bf d
a 45 35 66 89 99 a1
93 39 e6 74 16 .
....E5f....9.t.
0370 f8 ae 1f 1b 6
f b8 d3 db 6d 75 06
0a 9f a6 a0 e5 .
...o...mu......
0380 e2 36 40 64 e
1 5f 82 13 65 ab 61
0d dd f2 eb 91 .
6@d._..e.a.....
0390 30 32 10 3b 7
6 42 e9 12 88 de 40
3a e1 b9 06 8a 0
2.;vB....@:....
03a0 95 a6 dc a0 7
5 b9 b7 46 19 65 d8
bd 44 44 02 64 .
...u..F.e..DD.d
03b0 40 e9 c6 3c 6
c a6 21 10 c4 3e ab
20 c5 13 cd 9c @
..<l.!..>. ....
03c0 27 8e 33 94 8
d 8d 19 69 18 a6 78
98 35 54 c8 ed '
.3....i..x.5T..
03d0 f5 6a 44 ff f
b 92 04 ea 8f f2 f9
2b d4 83 18 7a .
jD........+...z
03e0 60 60 85 6a 7
0 63 0f 4c 0c 1c af
52 0c e2 29 81 `
`.jpc.L...R..).
03f0 6b 9a 29 c1 8
c 2d 70 f1 4a 4b 35
f0 b1 cb 38 9a k
.)..-p.JK5...8.
0400 fd 20 46 57 6
a 36 a0 31 6e 84 00
68 00 12 39 43 .
FWj6.1n..h..9C
0410 41 70 85 58 4
b 90 49 08 dc 11 08
d3 d4 93 b2 35 A
p.XK.I........5
0420 6f 9d 1d 2b 7
7 b7 5a 2e 4c 1a 48
2d 93 5a db c7 o
..+w.Z.L.H-.Z..
0430 3a b0 5d 6c 5
4 50 5c 2f 3e c1 f3
5a 05 86 07 a3 :
.]lTP\/>..Z....
0440 ef 84 5f b9 1
5 d8 7f c7 81 05 ec
1d d2 52 48 7c .
._..........RH|

0450 2a 5a 54 72 f
e b6 5d bf d4 5b ed
b1 35 fd a2 72 *
ZTr..]..[..5..r
0460 e9 9a 84 40 3
7 42 60 45 a1 42 92
83 07 69 0e 58 .
..@7B`E.B...i.X
0470 64 27 d8 41 4
5 bc 17 21 b8 13 52
1f 6a e7 37 1b d
'.AE..!..R.j.7.
0480 83 25 5e c8 a
0 0a d2 c6 f6 0a 1e
ce c6 79 1f e2 .
%^..........y..
0490 62 e6 ba 84 0
e 81 30 64 96 7a 46
23 26 a4 9a bc b
.....0d.zF#&...
04a0 76 78 96 a5 a
9 59 df c1 d6 2e da
e3 fd 2d 75 d2 v
x...Y.......-u.
04b0 06 9e f4 d6 f
3 ff f8 8f 4d 7c e2
75 86 16 fa ba .
.......M|.u....
04c0 69 24 cf 58 5
0 05 e1 40 14 50 3c
e5 bc 3c 94 6b i
$.XP..@.P<..<.k
04d0 42 2b a5 a0 a
2 88 92 88 03 56 45
a9 43 59 0e 75 B
+.......VE.CY.u
04e0 88 c5 f5 a2 a
b e9 b2 c8 a0 3a ae
e5 cb 2a ad 38 .
........:...*.8
04f0 1d e5 9c 8e 4
6 80 08 05 64 17 ea
4a 9d e9 ab 6a .
...F...d..J...j
0500 1b fb bb d4 7
b e7 51 af 1e 7c 66
34 fa f7 7b 5a .
...{.Q..|f4..{Z
0510 32 e7 1a c7 d
6 7f df cf 83 36 d2
75 0c 5b 24 b0 2
........6.u.[$.
0520 0e f7
.
.
No. Time
Source
Destination
Protocol
Length Info
280 10.71295200
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1305 http49
574 [PSH, ACK] Seq=

171374 Ack=1 Win=46

Len=1251
Frame 280: 1305 byt
es on wire (10440 b
its), 1305 bytes ca
ptured (10440 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.762882000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.762882000 s
econds
[Time delta fro
m previous captured
frame: 0.141535000
seconds]
[Time delta fro
m previous displaye
d frame: 0.14153500
0 seconds]
[Time since ref
erence or first fra
me: 10.712952000 se
conds]
Frame Number: 2
80
Frame Length: 1
305 bytes (10440 bi
ts)
Capture Length:
1305 bytes (10440
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
291
Identification:
0xf20e (61966)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a25 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 171374, Ack:
1, Len: 1251
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1251]
Sequence number
: 171374 (relati
ve sequence number)
[Next sequence
number: 172625 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x306
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2511]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0b f2 0e 4
0 00 31 06 3a 25 4a
7c 0c 8a c0 a8 .
...@.1.:%J|....
0020 01 0b 00 50 c
1 a6 2b ca ff 9b 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 30 66 0
0 00 7c 9a 6e 62 33
11 64 9c 20 c2 .
.0f..|.nb3.d. .
0040 a6 a9 92 42 c
0 11 ad 87 0e 11 5a
04 a8 44 87 88 .
..B......Z..D..
0050 aa 72 6f 3a 6
1 b0 7c 1c 50 8e 63
28 8b 6d d2 bb .
ro:a.|.P.c(.m..
0060 72 9f d8 25 5
1 a0 0b 98 03 60 d1
51 d3 21 c6 4c r
..%Q....`.Q.!.L
0070 87 22 5d 2a a
9 25 8e 95 a8 ba b3
cb 29 2c ab cb .
"]*.%......),..
0080 25 77 a8 aa 8
8 e0 32 49 96 ff fb
92 04 eb 8f f3 %
w....2I........
0090 1b 2c 54 03 3
8 92 60 60 e6 8a 60

67 0b 5c 0c 2c .
,T.8.``..`g.\.,
00a0 b9 52 0c bd e
9 81 80 16 69 c1 8c
3d 30 82 fe b5 .
R......i..=0...
00b0 ae 69 0f e4 7
2 dc fe 61 ff 63 05
d0 86 45 ba 5e .
i..r..a.c...E.^
00c0 d0 1c 47 c8 6
6 92 8b ac 01 49 53
e0 7d 49 d0 ea .
.G.f....IS.}I..
00d0 34 71 a2 45 9
b f8 d2 1c 16 f4 42
9d d8 22 6c bb 4
q.E......B.."l.
00e0 07 29 fb ab 4
1 07 b3 a9 0d 45 50
77 2a 5f 4b 00 .
)..A....EPw*_K.
00f0 71 a8 47 2b a
8 91 ad d8 ed a6 f9
e2 6d ba 95 77 q
.G+........m..w
0100 af 05 93 5f c
1 95 c5 b3 14 dc 0a
ee bf e3 e7 c9 .
.._............
0110 34 49 28 e7 e
f bd ea ad 3e 4c a2
08 f2 f7 41 18 4
I(.....>L....A.
0120 d4 ce bf 05 5
4 78 02 21 bc 42 46
4b d5 58 a0 f7 .
...Tx.!.BFK.X..
0130 db 2b 30 a8 b
4 78 96 d3 97 68 a9
9b f9 9c 27 ef .
+0..x...h....'.
0140 57 61 79 b8 3
4 f2 82 7c 3a 84 45
03 a9 15 4a 60 W
ay.4..|:.E...J`
0150 d4 2a 18 71 b
a 42 b9 49 9d 65 16
25 39 44 70 6e .
*.q.B.I.e.%9Dpn
0160 6e a1 8e 20 6
f 9a d3 57 aa 89 ea
3a 34 d6 c7 8d n
.. o..W...:4...
0170 56 de a0 e0 0
0 9c 0e 5a c1 0e ed
0b 8f 62 0d c8 V
......Z.....b..
0180 a8 91 4d d6 0
f 22 c2 95 e4 b8 f2
36 5e 5f f8 94 .
.M..".....6^_..
0190 62 c0 ea 9f 3
f c5 0e c2 c9 ca 9a
07 9c 95 bf f0 b
...?...........
01a0 b2 41 ce ca 1
c c4 18 e3 b4 b8 13
58 21 8d a8 16 .

A.........X!...
01b0 fd 22 7d 69 5
8 d3 6a af c4 91 a7
f9 0e 5d 7d 37 .
"}iX.j......]}7
01c0 6d 74 df bf e
5 8b 4a 7f 9a ff 6c
6f d5 ef 48 12 m
t....J...lo..H.
01d0 4a ac f2 ea 5
1 b4 2b 16 58 5b 64
3f 54 c7 34 45 J
...Q.+.X[d?T.4E
01e0 07 08 5a 6a 8
1 71 07 09 2b d4 e0
bb 98 b6 14 f9 .
.Zj.q..+.......
01f0 b2 e1 6d f7 6
3 99 64 f0 54 d7 22
d5 73 55 4b ed .
.m.c.d.T.".sUK.
0200 6a 8e 38 b1 0
8 81 1f 36 35 a0 4f
11 21 50 76 a8 j
.8....65.O.!Pv.
0210 7f 17 03 2c b
4 7a 9a 6e 6b ac 82
a3 5a 2b 3a 2d .
..,.z.nk...Z+:0220 c9 54 7c c8 c
3 d3 69 82 e2 3a e9
ff fb 92 04 e7 .
T|...i..:......
0230 8f f2 de 2c 5
4 83 0f 8a 60 60 05
8a 70 63 0f 4c .
..,T...``..pc.L
0240 0b 58 b3 50 0
c 62 09 81 86 17 69
81 8c 3d 30 ac .
X.P.b....i..=0.
0250 ef 6c aa 1d 0
0 a4 ac 28 b0 e0 a6
a1 90 d0 41 4f .
l.....(......AO
0260 88 33 2e 62 6
f 89 38 5f 32 90 c2
82 66 be d0 e1 .
3.bo.8_2...f...
0270 59 93 fa 8b 3
f 16 ad 90 0c d0 6e
4a a2 d2 ba ea Y
...?.....nJ....
0280 60 d9 e7 e3 7
4 0e 2b c1 5e 7c d5
44 4d 22 2c 36 `
...t.+.^|.DM",6
0290 0c 93 c9 91 e
1 8a 06 cb 9d ba 56
74 df 30 a4 44 .
.........Vt.0.D
02a0 9f 75 a6 ad e
9 ba d4 a9 9a 9e 26
86 32 51 66 a6 .
u........&.2Qf.
02b0 c9 94 03 09 5
8 50 5b e2 d7 9a e0
32 13 a4 d2 ff .
...XP[....2....

02c0 01 4f 02 88 2
8 12 35 11 62 84 1b
68 08 27 43 29 .
O..(.5.b..h.'C)
02d0 4b 14 ab 22 7
f 06 40 79 a4 77 26
27 81 54 5e 47 K
.."..@y.w&'.T^G
02e0 c4 cf 9d aa c
6 f5 61 e4 a2 73 07
18 70 a2 79 4b .
.....a..s..p.yK
02f0 1a c4 2a 06 8
7 95 35 73 12 9d 02
b1 3e 7c 91 4d .
.*...5s....>|.M
0300 62 dd aa 40 7
7 1b b5 92 74 9d 4c
7a 71 df 75 6f b
..@w...t.Lzq.uo
0310 d6 73 38 61 5
6 50 b8 17 60 38 e8
b8 0b 01 a4 ce .
s8aVP..`8......
0320 97 0d 10 0d 6
1 1b 80 e8 a5 08 b8
e3 f2 25 3c dc .
...a........%<.
0330 0a 1d de b1 0
9 b8 d3 14 ed c2 06
2d c8 e4 aa 5f .
..........-..._
0340 1a 96 29 94 c
b 28 bd 2a 93 da 7a
a9 69 f2 6b 17 .
.)..(.*..z.i.k.
0350 84 51 8b dd 6
f 34 6c 1b 2e fb 6c
d5 4b 11 41 fc .
Q..o4l...l.K.A.
0360 2a fc be bc e
a 84 37 d5 3d 9b 25
99 4b 7f 3a f7 *
.....7.=.%.K.:.
0370 3d 9c e8 5b e
e 55 54 68 aa 70 53
44 20 69 20 27 =
..[.UTh.pSD i '
0380 42 85 84 52 5
8 80 17 25 b2 43 47
7a 95 53 47 64 B
..RX..%.CGz.SGd
0390 ef 4a 7c 3f 4
a b8 35 85 09 76 af
7d 89 aa 7a a3 .
J|?J.5..v.}..z.
03a0 5b 9c 71 a5 4
2 55 c6 ed 8d ac c4
92 49 42 cf a0 [
.q.BU......IB..
03b0 5c 3d 1d 28 2
6 9e cf 70 7e 60 a4
b7 b8 b8 3a 5f \
=.(&..p~`....:_
03c0 37 a6 44 32 6
f 35 b6 e4 ed 70 e7
7d 54 ff fb 92 7
.D2o5...p.}T...
03d0 04 ea 8f f2 d

5 2c 53 83 38 8a 60
5f 85 ca 50 67 .
....,S.8.`_..Pg
03e0 31 4c 0c 78 d
5 4c 0c bd ab 81 8b
9a 69 41 9c 2d 1
L.x.L......iA.03f0 70 fd 46 99 e
6 4d fb 35 be 5d 90
2a 44 ae 6c 01 p
.F..M.5.].*D.l.
0400 44 a4 61 91 6
8 4e 41 e6 6c 58 6b
e5 06 11 3d d8 D
.a.hNA.lXk...=.
0410 c2 1a 47 3f 6
c 7e aa f6 67 38 3a
25 69 b5 37 a8 .
.G?l~..g8:%i.7.
0420 62 ab a3 9b 2
b 99 ef 04 8a 6b 08
9c 34 99 ad 4a b
...+....k..4..J
0430 b3 ae e8 ee a
2 21 20 f5 e6 29 92
be 1b 6a 89 fc .
....! ..)...j..
0440 62 9a fb 7f b
a fb db 2d ce 78 5b
b3 ff de 69 4f b
......-.x[...iO
0450 33 40 ed d1 a
f b5 d3 e6 93 f3 d4
8d 24 be a5 f8 3
@..........$...
0460 01 a0 10 94 8
4 7e 88 82 9b ce 3b
70 6b 0a d7 25 .
....~....;pk..%
0470 c2 a1 26 bc 8
7 9f 8e 24 65 87 1a
07 02 1c 88 9e .
.&....$e.......
0480 4c ab d4 66 8
1 33 66 3a db 18 21
a2 c9 7e 37 82 L
..f.3f:..!..~7.
0490 1d c9 9e b7 8
5 7c 22 d5 98 6b a0
9a 6d 6a 50 56 .
....|"..k..mjPV
04a0 4f 8b 9d 9c c
1 01 17 73 7d dc d7
1b 6f a9 d9 ee O
......s}...o...
04b0 a9 54 d3 9a 2
a 45 da 94 1d a2 76
1b 84 3b 63 56 .
T..*E....v..;cV
04c0 4d f3 49 11 8
4 85 f6 c6 07 2a 51
44 4a 87 63 0f M
.I......*QDJ.c.
04d0 1a 97 47 e0 2
b 2c e6 37 ab 2f 3a
ac 6e 16 28 2c .
.G.+,.7./:.n.(,
04e0 c6 b8 c0 f4 d
c ff 0e a2 43 1d da

55 41 7d ae f4 .
.......C..UA}..
04f0 c8 35 b2 64 5
5 ae 9e ea 65 ed d4
e5 4f 42 bd df .
5.dU...e...OB..
0500 9e 72 9a dc b
d 2b 73 73 51 5f 8a
49 b9 18 e3 bc .
r...+ssQ_.I....
0510 2d 13 bf 93 4
c 37 ff a2 aa
...L7...
No. Time
Source
Destination
Protocol
Length Info
281 10.71313400
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=172625 Win=37802 L
en=0
Frame 281: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.763064000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.763064000 s
econds
[Time delta fro
m previous captured
frame: 0.000182000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018200
0 seconds]
[Time since ref
erence or first fra
me: 10.713134000 se
conds]
Frame Number: 2
81
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f82 (20354)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 17262
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 172625 (
relative ack number
)
Header Length:

20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37802
[Calculated win
dow size: 37802]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 280]
[The RTT to
ACK the segment wa
s: 0.000182000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 82 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 04 7e 50 10 .

....P..N.+..~P.
0030 93 aa 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
282 10.78742700
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=17262
5 Ack=1 Win=46 Len=
1260
Frame 282: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.837357000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.837357000 s
econds
[Time delta fro
m previous captured
frame: 0.074293000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07429300
0 seconds]
[Time since ref
erence or first fra
me: 10.787427000 se
conds]
Frame Number: 2
82
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]

[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00

)
Total Length: 1
300
Identification:
0xf20f (61967)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a1b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 172625, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 172625 (relati
ve sequence number)
[Next sequence
number: 173885 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)

000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x97c
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 0f 4
0 00 31 06 3a 1b 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 04 7e 9e
87 4e aa 50 10 .
..P..+..~..N.P.
0030 00 2e 97 c8 0
0 00 7e 15 b4 b4 09
12 0a da 7b 17 .
.....~.......{.
0040 2c 70 2a 4a 9
c 2a 8e 02 72 97 07
c1 39 5e 08 e2 ,
p*J.*..r...9^..

0050 1c b4 7f ab 5
1 4f f2 46 95 87 eb
f2 6e 99 61 28 .
...QO.F....n.a(
0060 a0 a9 0a a2 5
0 9e 68 10 88 88 b6
06 05 3c 0b 21 .
...P.h......<.!
0070 96 ac 90 62 6
6 b6 73 b5 5a a5 88
ac b4 d1 af 0d .
..bf.s.Z.......
0080 c2 f0 f1 17 0
0 e9 30 28 80 46 1a
1c ff fb 90 04 .
.....0(.F......
0090 e9 0f f2 e6 3
4 d4 03 0f 5a e0 61
a5 3a 80 63 0c .
...4...Z.a.:.c.
00a0 4c 4b cc d1 5
2 0c 3d 6b 81 7a 14
2a 41 8c 31 29 L
K..R.=k.z.*A.1)
00b0 32 b6 be eb 0
c b8 fe aa 29 5b b0
f0 b5 91 92 21 2
.......)[.....!
00c0 c5 04 a8 72 8
2 4b f2 0c be 11 42
40 72 d0 24 0c .
..r.K....B@r.$.
00d0 51 d3 ed 49 e
7 f9 43 4a c5 6b 69
f6 99 a9 55 56 Q
..I..CJ.ki...UV
00e0 42 e8 68 2a 9
9 07 06 9b e2 a9 14
f2 42 64 b6 a0 B
.h*........Bd..
00f0 2b e2 78 b6 7
3 8c da fa 3c 45 65
a2 c6 cc ce 13 +
.x.s...<Ee.....
0100 de 95 f9 d2 b
e 7d d7 13 73 43 4d
3e 7d 25 4a 16 .
....}..sCM>}%J.
0110 94 75 c8 b3 b
5 0b 40 c8 61 aa 21
bc c3 e6 bb 60 .
u....@.a.!....`
0120 09 6b 77 1c 1
2 09 18 07 14 38 a9
30 28 8d 7a 4d .
kw......8.0(.zM
0130 b4 98 b6 00 c
3 76 36 38 0a cb e4
01 ba c0 ae 03 .
....v68........
0140 15 1b 4d fb f
5 e0 a5 20 cf f6 aa
bb a7 a3 82 f6 .
.M.... ........
0150 44 b1 ca f5 3
b 60 9a 43 89 13 b8
3f 58 72 52 08 D
...;`.C...?XrR.
0160 09 e2 c8 68 8

3 9f 3e 40 a3 99 28
27 79 73 4c 93 .
..h..>@..('ysL.
0170 fe ee fe cd 3
8 60 94 00 58 16 c7
d9 c2 61 18 e9 .
...8`..X....a..
0180 c7 23 9c 44 a
1 71 51 82 44 23 b5
c3 c2 fa c1 5f .
#.D.qQ.D#....._
0190 29 1a 4b 82 4
3 ef 91 8c 02 b4 eb
06 4e 04 fb 24 )
.K.C.......N..$
01a0 96 98 dc d9 e
3 8f 7d 31 48 bb 72
69 57 4b a8 ed .
.....}1H.riWK..
01b0 a7 18 9b 1f c
c cb c9 f1 31 27 d9
4f bd 9a 69 46 .
.......1'.O..iF
01c0 61 e2 07 e0 2
3 e4 08 8f d8 fe 91
1e 11 f8 67 4b a
...#.........gK
01d0 74 3c fc 1d 3
f fe ff c4 7b ff 55
1e c0 14 a1 0f t
<..?...{.U.....
01e0 08 69 dc 85 2
3 0e 63 74 03 f0 32
4a 3e 48 5b 74 .
i..#.ct..2J>H[t
01f0 56 91 04 90 3
2 a4 a4 d0 6d a5 85
a7 89 8f 90 a3 V
...2...m.......
0200 80 28 53 0c 5
9 7a 63 11 c7 29 fe
b3 49 87 ff fa .
(S.Yzc..)..I...
0210 19 da d3 e3 a
4 db b9 ee 34 2e a5
a8 a0 18 50 2c .
.......4.....P,
0220 48 c3 51 ad e
b 55 22 fc 59 92 49
4b 1d ff fb 92 H
.Q..U".Y.IK....
0230 04 e9 8f f2 e
c 25 56 03 0f 7a 50
5d e5 3a c0 61 .
....%V..zP].:.a
0240 ef 4c 0c 0c a
1 62 0c 25 89 41 92
97 2c 40 f6 2d .
L...b.%.A..,@.0250 31 63 c6 e8 3
9 b6 3b f4 31 80 00
e3 0c 56 db 72 1
c..9.;.1....V.r
0260 77 2c 5b 7d 6
d da 25 b1 f1 c6 89
ac 8e 43 51 20 w
,[}m.%......CQ
0270 c5 d8 93 42 7
6 98 17 44 18 6c 1e

6a 80 8c a8 2d .
..Bv..D.l.j...0280 32 20 a1 c7 9
4 27 2c 91 a6 77 61
b5 64 8f 39 5a 2
...',..wa.d.9Z
0290 c3 e6 63 ad c
8 54 47 63 99 08 ab
2a f1 96 d7 77 .
.c..TGc...*...w
02a0 4a 4c fa ae d
6 d2 cd fa ef 1c 1c
a5 c8 af 73 93 J
L............s.
02b0 79 0e aa 51 0
c 38 b0 2b f1 2f 9a
69 14 ed 15 d0 y
..Q.8.+./.i....
02c0 82 db b2 fb f
4 4c 55 31 d6 93 39
aa 90 47 9c ea .
....LU1..9..G..
02d0 4a ab a3 48 8
8 a3 13 3d 0e 7d 95
57 b1 cf 78 6e J
..H...=.}.W..xn
02e0 1e 6a 0b d9 f
e 38 79 49 74 31 97
1c b7 68 de 3e .
j...8yIt1...h.>
02f0 29 ad d5 3f d
6 af 4e 12 9f f9 d8
76 35 15 a9 a7 )
..?..N....v5...
0300 8f 9c 3a e7 6
c 59 fc 55 25 f6 56
e7 1d ac 8a 35 .
.:.lY.U%.V....5
0310 43 7a 54 ac 3
8 ac 91 c5 88 29 d5
48 1e 9e 21 56 C
zT.8....).H..!V
0320 24 76 3f 21 c
4 8d f4 e4 ea 30 7c
7a b4 e1 65 a0 $
v?!.....0|z..e.
0330 1e 24 eb f8 7
7 f1 aa 7c 9e fc 6a
31 dd 4e ef 7a .
$..w..|..j1.N.z
0340 b4 e8 dc 29 6
5 dc 9b b1 89 01 5a
39 5d 9d 88 46 .
..)e.....Z9]..F
0350 d3 3c be c6 f
6 9f 9d ee 09 a5 8e
25 09 aa e3 c1 .
<.........%....
0360 87 1c 56 a5 9
f 68 a1 f5 93 7b 90
85 a9 40 04 ac .
.V..h...{...@..
0370 c9 0a 5b 09 6
9 d0 24 1b 71 4c b9
c5 36 75 95 b5 .
.[.i.$.qL..6u..
0380 fa 96 3e d6 6
1 28 e6 65 db 9c 26
97 b1 98 61 94 .

.>.a(.e..&...a.
0390 08 73 04 4d d
6 14 5a a9 1f 45 52
4e 90 7d 75 44 .
s.M..Z..ERN.}uD
03a0 1b c4 89 18 c
c 58 52 e5 36 a8 60
de 38 52 20 e5 .
....XR.6.`.8R .
03b0 5d 3f 50 70 4
c 2f 32 33 ca 33 d4
ca b4 fe ce cc ]
?PpL/23.3......
03c0 bf a6 45 33 9
9 e6 50 b0 50 98 e3
ef 02 71 ce ff .
.E3..P.P....q..
03d0 fb 92 04 e8 0
f f2 c9 26 59 81 e9
62 50 5b 28 fb .
......&Y..bP[(.
03e0 30 61 25 5c 0
b e0 c7 64 0c 3d 0b
81 8e 98 ec 81 0
a%\...d.=......
03f0 86 19 70 af 2
6 d7 f9 a5 34 58 7d
8c 6b a2 c5 51 .
.p.&...4X}.k..Q
0400 a8 bb 3d 86 9
e 86 1c cd 65 d2 17
fb 1b 0d 0f 85 .
.=.....e.......
0410 e6 b0 48 f5 2
6 32 96 b4 d3 1a b6
c9 29 21 10 4c .
.H.&2......)!.L
0420 60 58 e0 80 5
5 cc 30 eb b1 f3 f5
57 ca 30 ac 55 `
X..U.0....W.0.U
0430 ac db 6f 03 a
1 93 76 a8 95 86 e1
3a 8a 7d 7c 6e .
.o...v....:.}|n
0440 42 59 62 8e 3
8 d0 0b 06 28 61 a7
30 1d 16 14 4d B
Yb.8...(a.0...M
0450 8a 73 d8 5f 8
a ad bb c5 af 08 b7
16 bf b0 55 c5 .
s._..........U.
0460 0c 32 43 4a 5
c 0a 26 ed 08 a8 dd
f2 58 d2 ee 05 .
2CJ\.&.....X...
0470 0b 9a f9 ad 9
8 2f 25 14 c8 2f 98
ad 76 f6 2c 06 .
..../%../..v.,.
0480 24 48 02 23 c
3 a1 b4 0b f7 1d 05
bc 6c ea 4c df $
H.#........l.L.
0490 dd 42 2e 85 b
b 77 d2 5b 78 cb 4d
a5 90 42 e2 06 .
B...w.[x.M..B..

04a0 52 b2 2c 90 2
e 18 b5 6d 7b 07 80
d6 2c a9 b3 2d R
.,....m{...,..04b0 11 d4 2e ea c
8 d9 b4 f3 91 99 57
9d 82 a2 3a 09 .
.........W...:.
04c0 e5 36 89 b2 1
a a0 54 2c a2 ce 17
92 8d 82 57 d2 .
6....T,......W.
04d0 86 49 21 7e 1
5 0d f1 72 6e db 5c
71 b8 49 8c e9 .
I!~...rn.\q.I..
04e0 98 07 22 8e 8
9 a8 c2 98 ec 35 13
76 aa d8 78 d5 .
."......5.v..x.
04f0 ab 50 cf 71 8
8 3d 52 d5 d9 1f 4c
f1 24 c3 ac 9e .
P.q.=R...L.$...
0500 68 03 95 16 6
3 c3 2b 1c 52 b3 2f
10 b4 70 64 eb h
...c.+.R./..pd.
0510 d6 95 b2 a6 e
c d4 06 ea 03 a1 c2
49 20 0d d1 09 .
..........I ...
0520 10 93
.
.
No. Time
Source
Destination
Protocol
Length Info
283 10.85943100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=17388
5 Ack=1 Win=46 Len=
1260
Frame 283: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.909361000 Romance
Standard Time
[Time shift for
this packet: 0.000

000000 seconds]
Epoch Time: 141
5615223.909361000 s
econds
[Time delta fro
m previous captured
frame: 0.072004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07200400
0 seconds]
[Time since ref
erence or first fra
me: 10.859431000 se
conds]
Frame Number: 2
83
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf210 (61968)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a1a [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]

[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 173885, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 173885 (relati
ve sequence number)
[Next sequence
number: 175145 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x9f0
a [validation disab
led]

[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 10 4
0 00 31 06 3a 1a 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 09 6a 9e
87 4e aa 50 10 .
..P..+..j..N.P.
0030 00 2e 9f 0a 0
0 00 45 0d 56 21 42
d8 f6 30 49 1d .
.....E.V!B..0I.
0040 a2 58 b0 5b a
3 29 09 74 24 b2 ea
0e 5b 90 d6 c8 .
X.[.).t$...[...
0050 c8 c8 e1 75 b
5 e6 ca 21 5a 96 68
31 a0 b4 71 d2 .
..u...!Z.h1..q.
0060 30 35 b6 bc b
c 80 c9 ce 19 bc 7e
22 2f aa e6 7a 0
5........~"/..z
0070 a9 65 f9 db e
5 af fe 53 13 59 42
80 51 76 43 64 .
e.....S.YB.QvCd
0080 10 c5 37 43 7
b ff fb 92 04 eb 8f
f3 23 3f d9 83 .
.7C{.......#?..
0090 0f 1a e0 60 6
6 0b 30 61 28 4c 0b
d4 9b 66 0c 3d .
..`f.0a(L...f.=
00a0 09 41 6a 98 6
c c0 f6 15 30 90 c7
67 6c 7a a4 a8 .
Aj.l...0..glz..
00b0 1d 85 20 b4 2
e e3 05 1d 54 28 6b
c3 7a c7 72 a8 .
. .....T(k.z.r.
00c0 98 6d 73 02 7
3 da 3b 22 bd 05 19
54 d1 69 d0 97 .
ms.s.;"...T.i..
00d0 90 a6 b9 95 9
5 d7 bb 56 25 d6 e8
24 1a 1c 07 64 .
......V%..$...d
00e0 62 b1 0f 51 1
1 23 91 05 4e d3 21

cc 73 09 b0 93 b
..Q.#..N.!.s...
00f0 09 14 70 98 d
6 56 75 1a 8a ae 42
dd d7 45 5e da .
.p..Vu...B..E^.
0100 22 75 b4 ad 9
5 f5 6a 2b b2 68 ef
51 54 11 9f ee "
u....j+.h.QT...
0110 46 57 ab ff 5
1 22 04 88 f4 10 f1
0f 57 82 98 56 F
W..Q"......W..V
0120 a4 86 51 f8 1
4 35 4c 51 54 f0 a3
1e be 2e b0 17 .
.Q..5LQT.......
0130 40 33 9e 17 3
e 1c b7 00 ae 6e 8e
c3 42 39 c5 78 @
3..>....n..B9.x
0140 14 80 3f 95 1
e 99 b3 4c 45 fb 3e
3e 65 28 ba 28 .
.?....LE.>>e(.(
0150 89 e9 96 9c 4
7 ac 4f 9b fc c5 56
eb fe ef df fc .
...G.O...V.....
0160 2b 48 d1 28 3
c 9a f4 28 aa e4 67
5a e4 0a 28 88 +
H.(<..(..gZ..(.
0170 bd 3b 57 ef a
1 14 27 a6 72 d0 f4
96 12 4c 3c 9d .
;W...'.r....L<.
0180 9b 02 61 25 d
8 43 37 03 b0 1e b4
2d f2 a1 2d 32 .
.a%.C7....-..-2
0190 f0 e0 f5 e4 a
6 cd 5d 4b 41 4b 85
22 48 10 d2 4d .
.....]KAK."H..M
01a0 10 dc 95 62 9
7 e1 46 7d 14 ab c8
86 42 d9 f1 17 .
..b..F}....B...
01b0 66 9d 01 99 5
8 5d b3 1f 9d 7f aa
33 27 0f 50 da f
...X].....3'.P.
01c0 79 62 a5 8f 0
d 63 9e d6 32 81 7b
ff cf 6f ea 63 y
b...c..2.{..o.c
01d0 6f 70 93 58 b
3 c6 cf 94 35 b8 56
76 dc 45 b4 fc o
p.X....5.Vv.E..
01e0 ca 91 c6 5e c
f db 24 cb 1a e5 b2
05 c2 75 2a 93 .
..^..$......u*.
01f0 cd 63 52 f8 8
c 70 e0 07 55 00 e1
60 6a ad db 32 .

cR..p..U..`j..2
0200 65 ae a1 b4 e
8 43 fa 8e cd 69 2f
06 a5 b4 9c 59 e
....C...i/....Y
0210 bf d4 f6 f3 3
4 d2 b6 a1 2c bc 46
2d 53 9c 85 b5 .
...4...,.F-S...
0220 f5 d4 73 7d e
6 55 ff ff fb 92 04
eb 8f f3 00 38 .
.s}.U.........8
0230 58 01 ef 1a e
0 64 a8 fb 10 3d e5
5c 0c 04 c1 5e X
....d...=.\...^
0240 07 bc c9 81 6
9 18 2c 00 f6 21 30
47 ea 3d 4f 51 .
...i.,..!0G.=OQ
0250 ca dc 4a c7 6
1 be 7c 75 3a b1 95
1a 85 12 56 73 .
.J.a.|u:.....Vs
0260 0c d8 82 55 7
6 a4 8a 52 f1 e5 eb
eb 1b 95 49 a4 .
..Uv..R......I.
0270 7d 68 22 07 0
0 4b 9a b7 16 10 96
2a e0 81 cf 5c }
h"..K.....*...\
0280 4b a8 cc b3 e
c 6b b9 f4 ab 58 a3
45 2b 0e c2 15 K
....k...X.E+...
0290 0d 05 4a 8e 0
4 04 e7 a8 2a 2a c7
56 d6 15 d8 b7 .
.J.....**.V....
02a0 a5 f5 80 9f a
2 ff e4 68 c2 8a c0
ac 4f 92 dc 7d .
......h....O..}
02b0 50 c1 8c 35 a
4 55 8c c1 a0 a2 e4
58 80 8d 73 90 P
..5.U.....X..s.
02c0 5e ae 81 83 5
4 98 3e 5b 62 37 f7
38 2f 68 ca c8 ^
...T.>[b7.8/h..
02d0 dc fd c1 86 6
6 e6 f7 1c e9 59 20
01 43 90 e5 a9 .
...f....Y .C...
02e0 23 06 a2 f6 a
3 84 7a a4 92 5c fb
d8 5d c5 bf 12 #
.....z..\..]...
02f0 b2 55 c3 dd f
c e6 c3 cf 88 55 a0
db 19 e9 ef f8 .
U.......U......
0300 d9 33 be 2e 6
6 c6 ab 58 0c c1 c3
d7 27 7e 85 7f .
3..f..X....'~..

0310 f4 aa 47 69 4
d 9a eb ac 4a 6a 07
4a 04 a5 36 51 .
.GiM...Jj.J..6Q
0320 a7 60 ea 1a d
1 cf c0 94 ec 64 c4
5d a1 a4 4d 10 .
`.......d.]..M.
0330 8b b9 9d aa 9
a 55 e6 d8 ab 05 52
4c 6b c8 21 41 .
....U....RLk.!A
0340 80 21 35 90 c
0 44 48 ec ca 6c 7e
c8 93 47 9b f5 .
!5..DH..l~..G..
0350 9f 7b c8 0e e
1 93 8a fd f1 9e b5
e7 f1 d4 c2 20 .
{.............
0360 98 bb b2 43 3
1 7c f3 44 e2 22 69
43 d6 d6 f7 07 .
..C1|.D."iC....
0370 55 e7 ea cf 5
1 70 94 49 65 94 15
92 21 2d 41 57 U
...Qp.Ie...!-AW
0380 84 31 29 86 c
6 84 c6 9b 08 cc 67
a6 be 00 fd 7b .
1).......g....{
0390 05 a2 16 60 d
5 82 f6 87 b2 ed 73
cd aa b9 30 27 .
..`......s...0'
03a0 71 8b 95 a8 8
0 10 04 28 1e 14 c5
8a ca a4 11 a5 q
......(........
03b0 c2 31 8e 47 b
9 77 0e 18 af d1 69
4b 29 da 41 d4 .
1.G.w....iK).A.
03c0 c8 47 7d 9e a
c 20 ee 2c 1a ff fb
92 04 eb 0f f2 .
G}.. .,........
03d0 d0 27 d7 83 1
8 4a 50 5c 65 3b 00
3d e8 4c 0c f8 .
'...JP\e;.=.L..
03e0 f5 5a 0c 3d 0
b 81 8f 18 2b 81 87
99 30 3c 75 8d .
Z.=....+...0<u.
03f0 45 83 56 6b 6
0 c5 58 97 7a 7f d2
2e c5 c0 5f 64 E
.Vk`.X.z....._d
0400 78 10 70 56 9
6 c3 ff 67 bf 30 9c
8b 0d a4 19 f8 x
.pV...g.0......
0410 18 d7 44 c3 3
1 74 87 d6 02 fc d7
ca 7a 5c c0 f9 .
.D.1t......z\..
0420 8d 3c 58 bf 3

c e0 5c 35 bd d8 79
0f 92 f1 0f 88 .
<X.<.\5..y.....
0430 34 ca 44 8e b
a 8b b0 69 45 d2 ef
52 d5 ae d5 29 4
.D....iE..R...)
0440 26 57 ce 30 3
2 05 44 48 19 22 f5
b9 a4 85 8a b9 &
W.02.DH."......
0450 63 d5 ce 0c 3
7 4a bf f6 e8 0d 93
b0 9e 2b ce 15 c
...7J.......+..
0460 f1 76 70 05 7
5 87 b8 86 84 8c 8a
03 5a e8 23 ed .
vp.u.......Z.#.
0470 c4 8e a3 20 4
7 8f f2 f8 26 90 d8
f7 37 ab f6 d3 .
.. G...&...7...
0480 a9 f3 f8 45 5
6 22 5f 2e 31 81 01
44 88 c8 14 27 .
..EV"_.1..D...'
0490 7e 26 44 41 0
0 f0 f7 a2 04 9c d3
90 6b 3c 61 4a ~
&DA........k<aJ
04a0 d3 3b 96 65 a
c e5 35 aa d6 a1 a4
65 3b e3 10 b4 .
;.e..5....e;...
04b0 f2 5e 02 0e 4
c 47 ae 31 dd 10 4b
69 70 35 a5 0a .
^..LG.1..Kip5..
04c0 73 99 90 8f 8
a 99 42 e0 56 05 ae
82 5e 84 8b 12 s
.....B.V...^...
04d0 93 32 2b 25 0
b b6 5f 45 d0 9c af
6d 75 fc c2 d5 .
2+%.._E...mu...
04e0 bd a9 8c 1c 5
1 0c 71 10 b9 22 ed
71 b9 82 a2 43 .
...Q.q..".q...C
04f0 87 03 a6 a9 8
a fc d0 7f 69 46 2c
b6 76 ab 59 ef .
.......iF,.v.Y.
0500 57 32 86 5a 8
7 79 33 3b e7 4c af
a1 cd 28 fb 5a W
2.Z.y3;.L...(.Z
0510 8f dd f4 2a 3
c 65 02 78 15 c1 34
0e 51 39 1f e2 .
..*<e.x..4.Q9..
0520 6e 99
n
.
No.

Time

Source
Destination
Protocol
Length Info
284 10.85961100
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=175145 Win=38115 L
en=0
Frame 284: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.909541000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.909541000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 10.859611000 se
conds]
Frame Number: 2
84
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0

8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f83 (20355)
Flags: 0x02 (Do
n't Fragment)
0... .... =

Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 17514
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 175145 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not

set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 283]
[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 83 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 0e 56 50 10 .
....P..N.+..VP.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
285 10.86042100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP

416 http49
574 [PSH, ACK] Seq=
175145 Ack=1 Win=46
Len=362
Frame 285: 416 byte
s on wire (3328 bit
s), 416 bytes captu
red (3328 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.910351000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.910351000 s
econds
[Time delta fro
m previous captured
frame: 0.000810000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00081000
0 seconds]
[Time since ref
erence or first fra
me: 10.860421000 se
conds]
Frame Number: 2
85
Frame Length: 4
16 bytes (3328 bits
)
Capture Length:
416 bytes (3328 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As

ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
02
Identification:
0xf211 (61969)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set

Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d9b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 175145, Ack:
1, Len: 362
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 362]
Sequence number
: 175145 (relati
ve sequence number)
[Next sequence
number: 175507 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et

.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe9a
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 362]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 92 f2 11 4
0 00 31 06 3d 9b 4a
7c 0c 8a c0 a8 .
...@.1.=.J|....
0020 01 0b 00 50 c
1 a6 2b cb 0e 56 9e
87 4e aa 50 18 .
..P..+..V..N.P.
0030 00 2e e9 a2 0
0 00 68 72 11 d1 e6
19 b7 34 59 a0 .
.....hr.....4Y.
0040 0e 3b c0 36 4
d 4c 03 99 91 a9 81
c2 0a 11 a6 c4 .
;.6ML..........
0050 a7 db 54 fd 2
d ae 35 c7 89 e8 87
da 05 6d 3b c9 .
.T.-.5......m;.
0060 a5 38 46 69 3
e a1 95 2c 4f 25 4b
55 e7 6c e6 d9 .
8Fi>..,O%KU.l..
0070 34 2d 9a 72 0
2 f7 0b c6 98 e8 fc
ef dd e6 af ff 4
-.r............
0080 fb 92 04 e9 0
f f3 0f 38 d6 83 0f
2a e0 5e 26 5a .
......8...*.^&Z

0090 e0 3d e8 5c 0
c 0c eb 5a 07 bc ab
81 67 21 ab 80 .
=.\...Z....g!..
00a0 f6 1d 70 36 3
d ce 77 3f 25 61 7f
2e 81 00 43 80 .
.p6=.w?%a....C.
00b0 d5 3e 50 62 c
6 7c a9 4f e9 18 cf
dd a5 50 9a 2a .
>Pb.|.O.....P.*
00c0 f3 00 ff 40 4
2 2a 99 1a 97 2d 16
65 3b 99 e2 39 .
..@B*...-.e;..9
00d0 47 82 dd 68 5
1 b4 dd c2 23 ca 10
fd c6 c9 30 ca G
..hQ...#.....0.
00e0 73 8a 78 70 1
2 a4 8e 29 62 6a 1c
1c 87 e2 74 87 s
.xp...)bj....t.
00f0 ab d3 bf ee a
2 bd c7 75 ea f1 cc
3f ff bf 09 d7 .
......u...?....
0100 7c 7d 14 56 5
3 53 51 fe b8 09 9f
09 3d bf 78 90 |
}.VSSQ.....=.x.
0110 4c 84 a6 ee f
8 64 4c 0e 33 30 6b
0f a7 c7 38 f0 L
....dL.30k...8.
0120 63 1c 53 b8 9
4 29 47 e1 69 86 f6
12 a3 72 55 f2 c
.S..)G.i....rU.
0130 7b 71 f0 90 2
3 3d c4 20 f2 01 68
a5 48 8c 28 6a {
q..#=. ..h.H.(j
0140 9a 44 2a ba e
f 21 26 7d a3 09 71
08 7e a2 b0 b0 .
D*..!&}..q.~...
0150 46 af f5 f4 9
a 70 36 0f dc d1 60
a0 d3 e4 1a 82 F
....p6...`.....
0160 2d 6b d6 78 e
d 72 ff af aa a6 88
63 33 f4 3c 1a k.x.r.....c3.<.
0170 c4 28 4c 28 9
a d0 83 d2 22 96 9e
5a 32 ae e4 c8 .
(L(...."..Z2...
0180 de 69 67 47 b
9 f5 3b 92 cc 4d 2c
45 81 16 13 57 .
igG..;..M,E...W
0190 8f 60 eb 6d c
d 22 48 0a 49 32 46
a2 40 57 14 ac .
`.m."H.I2F.@W..

No. Time
Source
Destination
Protocol
Length Info
286 10.93338800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=17550
7 Ack=1 Win=46 Len=
1260
Frame 286: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.983318000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.983318000 s
econds
[Time delta fro
m previous captured
frame: 0.072967000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07296700
0 seconds]
[Time since ref
erence or first fra
me: 10.933388000 se
conds]
Frame Number: 2
86
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]

Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf212 (61970)
Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a18 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 175507, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 175507 (relati
ve sequence number)
[Next sequence
number: 176767 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t

.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x3ad
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1622]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 12 4
0 00 31 06 3a 18 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 0f c0 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 3a d7 0
0 00 00 47 b9 26 53
69 bb d5 1a 6a .
.:....G.&Si...j
0040 eb 6b 05 39 6
9 56 4b ff 89 21 e1
81 50 30 22 27 .
k.9iVK..!..P0"'
0050 38 c5 07 8b 8
c 0f cb 43 40 93 56
e5 2c 59 f9 94 8
......C@.V.,Y..
0060 7e bd 75 61 2
9 5e aa 6c 40 b4 a8

e8 06 29 14 1c ~
.ua)^.l@....)..
0070 4a d9 b5 11 1
8 22 49 e3 a8 2d c1
8e aa 0c 9b 9b J
...."I..-......
0080 c2 e6 53 0a 0
a be e6 e2 bc a1 7a
a3 6a b8 fa 32 .
.S.......z.j..2
0090 d3 95 f3 f6 4
1 b4 3c 9b 60 50 fd
af 96 bf c2 ce .
...A.<.`P......
00a0 4b 24 15 94 a
3 17 94 f6 d9 47 d0
81 9f c4 8f a7 K
$.......G......
00b0 49 d3 26 c7 c
1 63 e5 59 ff fb 92
04 ea 8f f2 e4 I
.&..c.Y........
00c0 28 d6 81 ef 4
a 52 60 08 5a e0 3d
e8 5c 0c 20 bf (
...JR`.Z.=.\. .
00d0 5a 0c 3d 09 8
1 87 95 eb 41 87 a5
30 8d 9d 51 de Z
.=.....A..0..Q.
00e0 ef e9 a6 ef d
f 5b ff ff ff b2 52
83 2b 96 b6 d9 .
....[....R.+...
00f0 47 10 8a aa 1
0 ca f2 7e 64 44 19
d8 a1 ad 59 5a G
......~dD....YZ
0100 c8 67 88 b9 4
a bf 33 58 6e c6 cb
a6 f6 6a 1d 35 .
g..J.3Xn....j.5
0110 9a 3b 62 d4 4
a ed fd 41 b1 78 85
28 22 96 39 d2 .
;b.J..A.x.(".9.
0120 c4 13 e4 6d 5
3 90 3d cf 1c 5e 7d
b9 41 7e 19 9a .
..mS.=..^}.A~..
0130 ea 12 16 db 9
f 96 6d e3 5e a9 77
7f c7 2a 4f 31 .
.....m.^.w..*O1
0140 97 56 f1 a6 0
8 af 3c b6 1a c1 60
02 62 0e 85 b9 .
V....<...`.b...
0150 88 c0 b1 5c f
a 75 b7 13 64 4e 60
b1 ed 3c 6a 8a .
..\.u..dN`..<j.
0160 e3 3b ec a3 a
a b2 91 5f bc b4 98
58 fb c3 aa 2a .
;....._...X...*
0170 c4 95 15 ec c
0 a5 b0 f5 76 26 ec
4c ad 9a de 58 .

.......v&.L...X
0180 fe cf 91 c5 c
d a7 c3 1d 5f 11 d0
35 ee b4 29 fa .
......._..5..).
0190 8b 29 ef 27 8
9 9a ae aa 41 bf e7
de ce df d7 55 .
).'....A......U
01a0 bf a7 48 23 0
2 94 ab 13 d1 d6 04
81 2d 26 ab 25 .
.H#........-&.%
01b0 01 4f a8 59 1
2 ed d3 aa 3a 89 d7
84 be c3 1c e4 .
O.Y....:.......
01c0 1b 5f 0a b4 5
c a5 b7 95 26 f0 f9
25 bd fd c9 0d .
_..\...&..%....
01d0 71 a4 9d 05 5
4 a1 51 7a 2d 7c 30
f4 ab 12 2d 39 q
...T.Qz-|0...-9
01e0 6c 4d 59 f6 9
e cb 6f 87 5b 7b fa
ce 77 fb 36 af l
MY...o.[{..w.6.
01f0 be 59 6a 51 1
1 88 1e 7e 9a 87 2c
bd 5b bf a5 77 .
YjQ...~..,.[..w
0200 16 29 c0 0a a
a 96 40 14 8d 04 49
6a db 0e a8 db .
)....@...Ij....
0210 75 46 55 2d 4
1 4f 6e 22 c0 e2 3d
49 a2 6e 12 5c u
FU-AOn"..=I.n.\
0220 d5 14 1c 0f 5
7 b8 f6 17 ce d3 56
05 c3 d3 54 96 .
...W.....V...T.
0230 89 cf 04 69 5
9 b3 76 2f 6d bf e5
79 e5 da c6 c3 .
..iY.v/m..y....
0240 b3 b9 be c3 9
8 8b ba bf d4 ac 58
58 d8 04 5c f3 .
.........XX..\.
0250 57 13 d0 2e 4
6 13 1a 54 5c 79 ff
fb 92 04 e9 8f W
...F..T\y......
0260 f3 13 26 d6 0
3 18 62 52 5e 27 1a
d0 61 e8 5c 0b .
.&...bR^'..a.\.
0270 3c 8d 58 0c 6
1 89 49 75 98 eb 00
fc 2d 70 c7 bc <
.X.a.Iu....-p..
0280 50 9f 70 b9 a
b 95 7e b8 71 58 9a
43 9c e5 82 62 P
.p...~.qX.C...b

0290 5c 55 19 47 a
a 36 e4 dc 5a 8b 2f
1a 27 c1 2c e2 \
U.G.6..Z./.'.,.
02a0 3a b2 a7 60 d
7 d9 96 e9 fc bf 3b
5a 43 dd c5 ed :
..`......;ZC...
02b0 56 0f 3f b5 2
5 31 f3 e5 14 36 e3
fc 5c f6 52 66 V
.?.%1...6..\.Rf
02c0 e5 8b 56 d0 8
2 eb e9 90 79 63 9d
9e a2 ee 07 cd .
.V.....yc......
02d0 99 36 52 c1 6
0 7c 0c 07 1c 59 a9
3a e7 89 92 51 .
6R.`|...Y.:...Q
02e0 cf 4b 05 b3 4
6 47 3a df a9 fc 16
03 1c 0e 59 72 .
K..FG:.......Yr
02f0 1b 99 5a d7 7
2 4e 5b 6e ab 18 44
da 25 df 8c 4d .
.Z.rN[n..D.%..M
0300 55 e5 85 b9 b
1 61 4c 99 bc 59 78
2d fb b4 f6 bb U
....aL..Yx-....
0310 c9 05 77 27 b
8 40 48 0c 7b 65 00
a1 ca 35 b1 08 .
.w'.@H.{e...5..
0320 52 d2 f1 a4 d
4 aa 8b 88 d1 3b b6
7a cc 08 b5 07 R
........;.z....
0330 ca db 77 ca 5
d c2 c6 53 c5 d2 b1
43 a2 e2 76 15 .
.w.]..S...C..v.
0340 99 5c 91 24 3
1 53 8b a1 4f 0a 74
a4 1b 4f 6e 03 .
\.$1S..O.t..On.
0350 85 0c 75 02 7
7 cb 76 66 05 e1 62
08 bc a9 cb fc .
.u.w.vf..b.....
0360 40 fd 99 72 5
b 8f 37 22 54 e1 e4
58 b4 ba 95 0d @
..r[.7"T..X....
0370 f4 80 42 7d b
8 02 01 f1 af d0 81
47 2f 89 69 b9 .
.B}.......G/.i.
0380 90 3c 59 46 0
f 51 4a 71 f2 50 43
5b ed c7 69 3d .
<YF.QJq.PC[..i=
0390 fc d5 8c 22 1
1 63 8a 20 34 91 10
9a 4d 89 c5 c6 .
..".c. 4...M...
03a0 4a ce 21 55 f

a 95 8a 25 43 7a 19
22 e4 17 f1 5e J
.!U...%Cz."...^
03b0 a3 0b cf 16 8
6 57 b9 51 ef db b1
94 16 be 2a 27 .
....W.Q......*'
03c0 35 68 e3 ac 9
6 53 0a a4 b7 b9 4f
8e fe 2d ac 6f 5
h...S....O..-.o
03d0 ea 44 66 c7 0
4 9a 02 32 6e 9d 6c
5e 12 f7 9c 4e .
Df....2n.l^...N
03e0 79 24 12 87 d
c fd 96 b0 e4 44 0f
f2 93 1b 31 d5 y
$.......D....1.
03f0 3d 9d 32 38 d
0 c8 11 64 69 c0 a0
7c ff fb 92 04 =
.28...di..|....
0400 ec 8f f3 24 2
8 d5 83 18 62 50 61
44 da c0 63 0c .
..$(...bPaD..c.
0410 4a 0b f4 c1 5
6 0c 61 09 81 73 97
eb 01 87 a1 30 J
...V.a..s.....0
0420 6d e2 aa 2a 9
3 29 a0 82 ec ab ff
fa c9 89 61 3d m
..*.)........a=
0430 96 84 f0 03 c
2 ea 36 87 a3 ca 8b
0d a4 b0 a9 b3 .
.....6.........
0440 59 28 84 4c a
c f0 a6 22 ac 54 d2
04 63 6b d6 78 Y
(.L...".T..ck.x
0450 4c 33 fc 9d 5
4 df 91 66 29 06 3e
d3 d6 d2 2c 71 L
3..T..f).>...,q
0460 cf 54 e4 ba 5
8 48 25 16 52 6a 1a
be e2 dc 33 e5 .
T..XH%.Rj....3.
0470 f5 36 fd bb 5
9 5c 6e a6 4b 4e f5
35 f3 28 00 93 .
6..Y\n.KN.5.(..
0480 6b 56 d4 de 2
b 36 a6 b0 9d 83 a5
4a 82 d7 0e 89 k
V..+6.....J....
0490 30 99 1a c9 9
0 5c 4d 22 14 c2 ab
5e da 48 db 59 0
....\M"...^.H.Y
04a0 35 1e 8b 8d 3
a 0b 55 66 4d 56 92
dd fc 4c 72 0b 5
...:.UfMV...Lr.
04b0 83 85 22 a2 9
e c5 fb 85 10 f4 57

f9 66 f8 85 48 .
.".......W.f..H
04c0 3a f9 ae 2f 8
a b7 3c a5 e7 c4 af
2f 48 db 9e b2 :
../..<..../H...
04d0 3c c1 d6 a8 3
8 87 85 d4 f2 12 ad
0c 09 ee 58 11 <
...8.........X.
04e0 6c 43 17 a7 a
2 df fe b7 65 ed 57
2d e2 c1 10 d0 l
C......e.W-....
04f0 2a 07 2d 9d 4
2 a3 17 c1 c4 b4 29
53 68 3a 6c 60 *
.-.B.....)Sh:l`
0500 c0 48 19 68 e
a 9c 8f 33 d2 9a ce
2c b8 9f 2a 02 .
H.h...3...,..*.
0510 02 a6 ec 16 1
c 0e 02 fd 6f 18 6b
4f cd a3 c4 80 .
.......o.kO....
0520 00 02
.
.
No. Time
Source
Destination
Protocol
Length Info
287 10.93356800
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=176767 Win=39690 L
en=0
Frame 287: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
3.983498000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615223.983498000 s
econds
[Time delta fro
m previous captured

frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 10.933568000 se
conds]
Frame Number: 2
87
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: pc13

.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f84 (20356)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 17676
7, Len: 0

Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 176767 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39690
[Calculated win
dow size: 39690]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 286]

[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 84 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 14 ac 50 10 .
....P..N.+...P.
0030 9b 0a 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
288 10.99043600
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=17676
7 Ack=1 Win=46 Len=
1260
Frame 288: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.040366000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.040366000 s
econds
[Time delta fro
m previous captured
frame: 0.056868000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05686800
0 seconds]
[Time since ref
erence or first fra
me: 10.990436000 se

conds]
Frame Number: 2
88
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:

20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf213 (61971)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a17 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 176767, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le

n: 1260]
Sequence number
: 176767 (relati
ve sequence number)
[Next sequence
number: 178027 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x196
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.

0010 05 14 f2 13 4
0 00 31 06 3a 17 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 14 ac 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 19 61 0
0 00 17 d9 45 9c ea
c3 44 25 47 36 .
..a....E...D%G6
0040 4c f6 a8 b7 9
e 2e c7 ec 89 e3 c9
12 29 5d 5d 88 L
...........)]].
0050 b6 cd 96 6f a
1 6e 10 f0 f1 87 aa
a0 50 e0 64 51 .
..o.n......P.dQ
0060 a9 94 52 cc 1
4 7c 85 87 b1 17 73
44 31 b0 86 aa .
.R..|....sD1...
0070 72 34 6c 14 c
7 93 5b 25 1e 6b e0
f3 49 08 dd a9 r
4l...[%.k..I...
0080 88 4c 96 f6 8
2 e6 19 93 a6 6b 44
c5 aa 55 aa 6f .
L.......kD..U.o
0090 ca 8c 24 a2 5
a 4e e6 da 60 f3 af
38 d4 96 7c 55 .
.$.ZN..`..8..|U
00a0 4c fe fb db 3
3 fb 2f ba ae ab 97
68 e8 4a cc d8 L
...3./....h.J..
00b0 f6 a9 ff fb 9
2 04 ea 0f f3 12 30
55 83 18 5a 60 .
.........0U..Z`
00c0 5a 46 ba c0 3
d eb 5c 0c 20 9d 56
0c 61 e9 41 65 Z
F..=.\. .V.a.Ae
00d0 18 2b 01 87 a
1 30 0e c3 a4 d7 39
af d9 c6 be 46 .
+...0....9....F
00e0 2b 29 5d 8f 6
c 3d 34 0e ea f6 4e
f9 d9 4e 35 51 +
)].l=4...N..N5Q
00f0 2f 0f db b6 1
a f1 49 d5 88 c1 6f
4b b9 21 71 34 /
.....I...oK.!q4
0100 d8 d1 3e 5c f
1 1a 96 48 fc 3b b0
49 44 33 74 c5 .
.>\...H.;.ID3t.
0110 f2 fd 06 65 6
9 52 b1 61 fc d5 ae
36 2a 36 59 8a .
..eiR.a...6*6Y.
0120 ad 93 28 f5 4

f 4c 96 71 71 ee e5
40 90 99 06 85 .
.(.OL.qq..@....
0130 92 50 a9 fe f
8 9a 65 4d 49 61 45
d0 be ae ae 89 .
P....eMIaE.....
0140 42 69 91 19 3
1 51 f4 08 55 2e 54
0e d5 a3 00 1a B
i..1Q..U.T.....
0150 a4 14 8a 0d 4
4 6b 9f 6f 03 25 c0
b2 4c 31 d9 fb .
...Dk.o.%..L1..
0160 84 46 ad 6a 6
c 85 c0 15 3e ac 13
cf 8e a2 88 ea .
F.jl...>.......
0170 71 a2 91 83 5
9 ba 62 19 5d b4 d3
d9 ff 5d fb 09 q
...Y.b.]....]..
0180 c1 23 e4 5a 3
4 50 1e 43 c9 25 a0
aa a3 de 4e b2 .
#.Z4P.C.%....N.
0190 df 3e b6 50 c
7 25 ec d9 43 fa 91
eb 2d 83 be 21 .
>.P.%..C...-..!
01a0 6a a3 f3 41 7
1 20 4b cf 69 c0 35
c8 c4 67 eb 2f j
..Aq K.i.5..g./
01b0 06 2b c1 04 3
e 4c bd a5 1d cc dd
06 25 1e 6a 68 .
+..>L......%.jh
01c0 96 c2 98 e3 f
9 d5 34 c1 c8 c6 98
19 ab 0a b1 66 .
.....4........f
01d0 b0 da c4 70 f
8 4b 67 a0 37 1c 51
e6 20 2f 74 3e .
..p.Kg.7.Q. /t>
01e0 62 df 55 85 9
b e1 22 95 f9 b8 bf
9c 69 75 b2 97 b
.U...".....iu..
01f0 68 80 e7 80 a
5 66 29 46 af 57 5a
8c a8 28 19 43 h
....f)F.WZ..(.C
0200 4b 2f 6a f1 5
f 2f 0b 09 97 27 70
f4 e1 d4 e2 42 K
/j._/...'p....B
0210 bc 2a 56 86 9
2 6e d4 8a c5 14 86
23 2d b3 ab 17 .
*V..n.....#-...
0220 fe 00 d1 40 7
2 cf 0d a4 da 4d c9
a9 8c e5 5d e2 .
..@r....M....].
0230 de bb ad 2b f
c 19 e7 81 6a a4 1f

c4 be f5 3e a8 .
..+....j.....>.
0240 aa cc b0 b5 6
d 78 36 0b b9 86 81
41 51 23 e2 c3 .
...mx6....AQ#..
0250 1e 96 15 7c f
f fb 92 04 ed 8f f3
36 38 55 83 0f .
..|.......68U..
0260 5a e0 5f c5 f
a c0 61 eb 4c 0b 24
9d 58 0c 3d 29 Z
._...a.L.$.X.=)
0270 41 88 1a eb 0
1 87 a1 70 aa 28 db
68 79 35 5e 2c A
......p.(.hy5^,
0280 8d dd df a5 0
2 c0 e0 56 b4 af 4c
54 26 a7 bc 5d .
......V..LT&..]
0290 17 14 65 16 5
b 86 80 c6 20 f8 5e
42 d5 c3 3a 02 .
.e.[... .^B..:.
02a0 14 ca b4 d0 8
7 23 ea 90 ce f1 67
08 14 cd 09 22 .
....#....g...."
02b0 ec ff 12 dd 2
f 0b da af 56 3a 30
97 3e e7 d1 c1 .
.../...V:0.>...
02c0 8f 08 85 b5 8
c 39 4b 57 17 75 d2
3f 06 7c 36 3e .
....9KW.u.?.|6>
02d0 11 0a 07 56 e
2 a2 c7 03 93 65 5c
b7 ad 27 3b 1b .
..V.....e\..';.
02e0 0e d4 dd e7 b
6 90 88 a6 0a 38 23
f3 7e 9b c2 14 .
........8#.~...
02f0 33 74 30 9e 5
3 02 01 89 56 5b 1e
2b d4 a9 12 15 3
t0.S...V[.+....
0300 2a 75 12 e3 1
5 c3 33 c4 fa c4 ec
03 3c a7 27 26 *
u....3.....<.'&
0310 57 ed fc d7 5
e d7 98 7b f2 ff b9
7d ed 6b d7 df W
...^..{...}.k..
0320 f5 64 b1 7b e
b 9c 7f e0 01 e8 0f
d7 fb 29 ff e3 .
d.{.........)..
0330 a8 64 71 e9 c
f ed 1a c0 85 e7 f0
fb f7 47 ff fa .
dq..........G..
0340 45 13 b4 8f 9
1 b7 fa 4a 22 50 24
d1 75 f7 0d 03 E

......J"P$.u...
0350 a2 38 59 50 e
2 94 1d 12 ae 6c 79
48 ae 20 d4 33 .
8YP.....lyH. .3
0360 7c a5 0f ea 5
8 5f 72 62 1b 31 19
71 6b 82 4d 7a |
...X_rb.1.qk.Mz
0370 c5 67 d2 9c b
1 db eb 05 d8 7a 29
50 a1 d2 c6 e6 .
g.......z)P....
0380 67 7f f1 68 0
8 34 28 13 26 60 90
20 34 08 b7 a4 g
..h.4(.&`. 4...
0390 28 d6 4f 11 5
a 96 85 37 26 cc cf
9a e8 fb cb d5 (
.O.Z..7&.......
03a0 52 92 b0 13 d
7 23 a8 06 e3 9c 79
9d 28 60 e6 16 R
....#....y.(`..
03b0 92 aa 49 b1 1
9 52 61 6d 06 a1 c5
fe 33 59 d4 5b .
.I..Ram....3Y.[
03c0 92 6e f0 97 2
7 90 35 77 66 b9 59
c5 cd a1 fd 3e .
n..'.5wf.Y....>
03d0 de dd a8 a2 e
7 1a 3c e5 df 33 06
7a ab 39 68 9d .
.....<..3.z.9h.
03e0 2c 44 da 1f 1
5 72 87 0a ba f2 f6
94 42 9a 45 45 ,
D...r......B.EE
03f0 8e d6 7d b1 0
6 52 ff fb 92 04 eb
8f f3 26 29 55 .
.}..R.......&)U
0400 83 18 7a 60 6
2 45 2a c0 61 ec 4c
0b 68 99 5a 0c .
.z`bE*.a.L.h.Z.
0410 3d 89 49 7a 9
4 ab 41 86 25 30 a0
c1 57 90 6d a9 =
.Iz..A.%0..W.m.
0420 e8 56 72 36 9
6 33 15 81 9a 64 88
54 8a 5a bf de .
Vr6.3...d.T.Z..
0430 46 98 5d 25 5
9 10 35 3f 54 c9 da
26 05 43 c5 b0 F
.]%Y.5?T..&.C..
0440 e0 5d 72 f3 b
6 73 e8 25 f2 c3 1a
97 d5 59 6a ba .
]r..s.%.....Yj.
0450 c7 37 1b 72 3
4 db 7a 34 21 2b d3
73 db 6e 96 a6 .
7.r4.z4!+.s.n..

0460 2d 8c 40 49 c
c 58 68 38 2a 65 51
0d 63 f0 61 19 .@I.Xh8*eQ.c.a.
0470 f9 41 62 5c d
a 44 15 8f 79 46 be
fd 5d cb be be .
Ab\.D..yF..]...
0480 65 4a 43 c0 f
e 0d 13 70 69 84 20
ea 12 b1 13 a4 e
JC....pi. .....
0490 80 f7 4d 9d 4
f 69 49 3d 49 99 ba
d3 57 ae 3b ce .
.M.OiI=I...W.;.
04a0 66 b3 af 10 1
7 34 74 67 f0 a6 62
71 d3 0d 7c cb f
....4tg..bq..|.
04b0 6b b7 3b 8d 3
e 78 be e9 da 27 64
03 a5 4c 35 33 k
.;.>x...'d..L53
04c0 c7 8f b1 30 0
e c2 91 e0 29 92 a3
56 b7 6c 60 18 .
..0....)..V.l`.
04d0 d2 4f 1f 7e e
4 9a 2a e2 b5 3e a0
6a d9 91 09 7d .
O.~..*..>.j...}
04e0 2d 4b d0 fd 4
f 02 6c 5d 94 44 19
0e 10 17 b6 f8 K..O.l].D......
04f0 12 2a a6 3e 7
5 ca 82 ef 47 a3 d7
ca 16 cb 10 81 .
*.>u...G.......
0500 f1 d5 27 06 f
c a2 94 68 88 d3 33
73 6b 5a f1 30 .
.'....h..3skZ.0
0510 e3 e5 ae 1b e
2 f2 47 38 30 78 42
1a 97 20 14 3c .
.....G80xB.. .<
0520 02 a5
.
.
No. Time
Source
Destination
Protocol
Length Info
289 11.06343800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=17802
7 Ack=1 Win=46 Len=
1260
Frame 289: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.113368000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.113368000 s
econds
[Time delta fro
m previous captured
frame: 0.073002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07300200
0 seconds]
[Time since ref
erence or first fra
me: 11.063438000 se
conds]
Frame Number: 2
89
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf214 (61972)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)

Header checksum
: 0x3a16 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 178027, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 178027 (relati
ve sequence number)
[Next sequence
number: 179287 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x10e
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 14 4
0 00 31 06 3a 16 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 19 98 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 10 e9 0
0 00 4e e8 bd b4 ad
6b f1 1b 82 88 .
.....N....k....
0040 49 e3 f9 64 a
5 02 b5 9d 2b d9 b2
97 25 8c ab 20 I
..d....+...%..
0050 43 84 9a ae 4
b fe 67 6a 96 30 8b
42 98 0f 92 02 C
...K.gj.0.B....
0060 43 cb 0c 77 a
f e1 39 ec 60 97 f3
cb ae dd 6f 5e C
..w..9.`.....o^
0070 94 28 18 0f 7
1 c0 25 8d 53 ea b0
92 be d6 b5 54 .
(..q.%.S......T
0080 4f 7f dc c3 5
a c5 6e f4 9b c2 7a
a0 82 02 2c 11 O
...Z.n...z...,.
0090 80 d8 b5 0b 2
5 76 12 b4 36 f1 91
44 22 cc 53 99 .
...%v..6..D".S.
00a0 49 1d 2b 5d f
7 47 69 45 06 ef c9

16 ff fb 92 04 I
.+].GiE........
00b0 ea 0f f3 04 2
6 57 01 ec 5a 50 5c
44 ca e0 61 86 .
...&W..ZP\D..a.
00c0 4a 0b bc 99 5
e 07 bd 69 41 68 93
2b c0 f6 21 28 J
...^..iAh.+..!(
00d0 22 b5 80 8a b
1 65 3e c5 44 11 43
ab ba b9 db 0b "
....e>.D.C.....
00e0 76 96 ab 16 8
3 a5 ad 52 ed b3 33
1a 2a b7 94 26 v
......R..3.*..&
00f0 71 fd a2 c9 d
5 94 8d 02 b8 6f 5a
fe 13 6e 05 56 q
........oZ..n.V
0100 16 b1 04 6c f
e 49 d6 31 54 1c 3e
1a 2a b1 9e 58 .
..l.I.1T.>.*..X
0110 9a 62 b9 8b 4
7 a9 ab f8 e7 86 83
e8 29 68 b9 85 .
b..G.......)h..
0120 41 96 9e bb 0
8 be 59 25 c6 e9 18
76 fd 00 5d 28 A
.....Y%...v..](
0130 b0 c2 60 bb 4
f 52 99 81 cd 1c 40
b5 86 a6 59 40 .
.`.OR....@...Y@
0140 a3 98 22 b3 e
c 95 02 88 cf 15 63
19 9b 27 45 9a .
.".......c..'E.
0150 a4 12 04 72 5
f 9b 31 7e 72 ff 4f
de 90 e9 af 31 .
..r_.1~r.O....1
0160 9b ff 83 7a 1
8 4f b1 ff 5f dc ff
fc 6f c1 b5 20 .
..z.O.._...o..
0170 32 eb 77 ad a
e d7 03 20 51 e2 27
a8 15 17 4b a7 2
.w.... Q.'...K.
0180 6c 6b 92 19 2
2 70 5f 66 01 30 fb
65 7e fd e1 94 l
k.."p_f.0.e~...
0190 15 bb 6f d9 4
3 6a 3c 49 29 25 ae
90 f0 a3 69 98 .
.o.Cj<I)%....i.
01a0 0a 74 36 d2 2
2 89 f6 21 91 60 d2
9d 85 a3 0d 36 .
t6."..!.`.....6
01b0 30 96 a2 f2 d
a 7d e6 5a cb 83 75
06 a9 28 1e 44 0

....}.Z..u..(.D
01c0 e3 4f 80 90 4
6 4f 81 75 5f d6 f5
bc 0a 37 ee 29 .
O..FO.u_....7.)
01d0 dd 26 c6 87 8
1 21 e8 25 79 00 e0
68 d9 c1 44 cf .
&...!.%y..h..D.
01e0 15 32 9d 95 0
b bb 21 10 fa 6b 32
4a d6 29 78 7f .
2....!..k2J.)x.
01f0 4a 37 7b 12 9
c 02 d8 59 61 ab 2f
b2 3b 1b 62 a4 J
7{....Ya./.;.b.
0200 a4 f2 d7 6c 0
6 19 b4 63 56 19 05
47 c7 e0 db 0a .
..l...cV..G....
0210 2c aa 90 ae b
d 74 9a 99 bf 8a cb
a6 20 78 2d 28 ,
....t...... x-(
0220 85 2d e4 a1 f
0 a1 2c 43 8d 2b 7d
a6 ca 52 9c cc .
-....,C.+}..R..
0230 d5 14 ae 84 9
8 6f 72 92 44 d4 1b
3c c6 5e 91 0a .
....or.D..<.^..
0240 74 ee 5a 6a 4
a d9 65 3e fe c4 c5
9f 7d 15 ff fb t
.ZjJ.e>....}...
0250 92 04 ee 8f f
3 04 25 d6 03 0f 5a
50 65 06 3a c0 .
.....%...ZPe.:.
0260 61 e8 5c 0c 2
8 95 56 0c 3d e9 41
70 93 2b 01 87 a
.\.(.V.=.Ap.+..
0270 a1 28 e9 dd a
1 37 0a 0a 49 99 42
35 08 e4 63 6c .
(...7..I.B5..cl
0280 9e 36 ff 38 a
d 8c 5d 96 01 7a b0
93 38 eb 1e 20 .
6.8..]..z..8..
0290 ba 2a 22 e0 3
e 11 d7 6d 9e 58 6f
30 a0 8f f0 69 .
*".>..m.Xo0...i
02a0 e2 de aa 6b 8
1 62 2a 7b 83 e6 8a
27 e1 b8 88 71 .
..k.b*{...'...q
02b0 39 ba 68 b8 a
0 fe 43 e5 6a f5 8f
7e 2f ad b9 f8 9
.h...C.j..~/...
02c0 3b 4c e5 42 6
5 3c a3 1d 4a a5 da
9d 19 65 b2 2e ;
L.Be<..J....e..

02d0 5d 23 65 4b 4
9 d5 4b fe b4 2b 69
6a cb 56 5d a1 ]
#eKI.K..+ij.V].
02e0 24 42 a1 1c 0
9 29 b2 55 4b d2 7c
20 64 3c 11 61 $
B...).UK.| d<.a
02f0 06 56 e4 fe b
2 22 09 6f 04 c3 bc
17 52 b2 48 34 .
V...".o....R.H4
0300 81 74 ca 79 1
7 3d 30 59 b9 67 f8
55 0f 85 34 74 .
t.y.=0Y.g.U..4t
0310 c7 d1 c8 78 c
d 75 27 53 47 d3 74
0f d6 d1 8e 4a .
..x.u'SG.t....J
0320 65 07 3a 7b 4
3 5b db a5 ea 9e 74
5f 1b 01 76 e7 e
.:{C[....t_..v.
0330 ed 73 7b 7b 6
b a1 d2 ba a2 b0 e1
30 8b d2 3d 14 .
s{{k......0..=.
0340 ac 1d 70 b6 2
0 47 12 0d 4d c5 f5
1e c4 68 d7 63 .
.p. G..M....h.c
0350 ab 09 97 2a a
c 3b 9b ab ac 8e 47
94 c6 55 2b d4 .
..*.;....G..U+.
0360 9c 9e b5 be 3
f ba c7 e6 a8 69 41
42 f6 fa a6 a8 .
...?....iAB....
0370 ef 7f 17 c4 5
0 2e fa f9 7e 4b 67
8d 2e 95 b9 ab .
...P...~Kg.....
0380 99 ea 36 4f f
3 c6 8d 42 cd b4 f9
d8 ba d6 c9 bc .
.6O...B........
0390 e9 bd e9 ee 3
a 55 b4 4b 2e d6 2e
af d5 4b 50 26 .
...:U.K.....KP&
03a0 52 ec 25 08 c
a 30 d3 6e d3 31 34
e6 94 34 7b a7 R
.%..0.n.14..4{.
03b0 c8 7a 0e 96 7
7 e9 1a a2 da c4 84
68 23 36 da 56 .
z..w......h#6.V
03c0 de 5a da 88 6
4 31 2d 4f 43 64 a4
b7 95 3f 38 45 .
Z..d1-OCd...?8E
03d0 cc 11 e5 64 9
b 32 b3 64 dd 17 27
94 8c df 32 62 .
..d.2.d..'...2b
03e0 50 df 29 a9 3

3 26 4d ec d5 b3 6e
8f b9 96 5a a5 P
.).3&M...n...Z.
03f0 ff fb 92 04 e
c 0f f2 e6 26 d5 03
18 6a 50 64 66 .
.......&...jPdf
0400 4a a0 65 e8 5
c 0c 08 c7 52 0c bd
ab 81 8e 19 2a J
.e.\...R......*
0410 41 8c 2d 70 6
b 7e d5 37 6f fe 8f
42 f1 6e 08 a8 A
.-pk~.7o..B.n..
0420 5e 91 e2 41 b
5 b1 54 a1 51 57 61
32 99 f8 9e 22 ^
..A..T.QWa2..."
0430 c1 aa b7 08 4
3 70 a0 86 0f 96 97
08 62 42 2f e1 .
...Cp......bB/.
0440 a7 99 35 d6 6
6 51 df 34 5d 3a c7
b3 9c e0 2e 68 .
.5.fQ.4]:.....h
0450 df 91 44 cd e
9 c5 d9 e7 b9 b8 b4
6b 33 ad 24 a8 .
.D........k3.$.
0460 b4 f5 63 23 8
6 eb 6f 75 fe cf 87
ff 57 da 15 4b .
.c#..ou....W..K
0470 36 1f b6 f6 2
9 7a 5a ed bf d4 39
d5 1a 68 50 02 6
...)zZ...9..hP.
0480 fd 12 11 55 a
7 8d 29 c1 6f 57 ed
38 d5 d3 dd 97 .
..U..).oW.8....
0490 25 d3 60 7b 5
b 13 e8 cb 2f ae c7
d9 8e d3 cd 50 %
.`{[.../......P
04a0 de a1 ab 3d c
8 3e 5a 9e 30 8d 2c
c4 56 74 18 74 .
..=.>Z.0.,.Vt.t
04b0 29 04 50 cd 1
d 43 f9 83 a5 52 d4
b3 53 79 34 96 )
.P..C...R..Sy4.
04c0 49 f4 14 5e 3
9 51 06 66 66 c9 36
ec 8b 35 46 6d I
..^9Q.ff.6..5Fm
04d0 c8 b1 64 27 f
a 78 cd 0c 35 45 91
49 4d 82 03 15 .
.d'.x..5E.IM...
04e0 d5 61 23 ea 5
1 7e 1a 4a 02 51 4f
3f 56 fa b5 a5 .
a#.Q~.J.QO?V...
04f0 8f be 6d 21 f
a bb 9b 88 50 38 26

66 4d 0f e5 3d .
.m!....P8&fM..=
0500 66 0e ef ee 5
f 07 77 0a 8f e6 81
b0 41 9f a3 92 f
..._.w.....A...
0510 28 f9 51 51 4
7 a4 ec 1e 86 fe 59
08 9e a0 82 84 (
.QQG.....Y.....
0520 84 8c
.
.
No. Time
Source
Destination
Protocol
Length Info
290 11.06361600
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=179287 Win=39690 L
en=0
Frame 290: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.113546000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.113546000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 11.063616000 se
conds]
Frame Number: 2
90
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f85 (20357)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 17928
7, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 179287 (
relative ack number
)
Header Length:

20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39690
[Calculated win
dow size: 39690]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 289]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 85 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 1e 84 50 10 .

....P..N.+...P.
0030 9b 0a 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
291 11.07943800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
71 [TCP segm
ent of a reassemble
d PDU]
Frame 291: 71 bytes
on wire (568 bits)
, 71 bytes captured
(568 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.129368000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.129368000 s
econds
[Time delta fro
m previous captured
frame: 0.015822000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01582200
0 seconds]
[Time since ref
erence or first fra
me: 11.079438000 se
conds]
Frame Number: 2
91
Frame Length: 7
1 bytes (568 bits)
Capture Length:
71 bytes (568 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 5

7
Identification:
0xf215 (61973)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3ef0 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 179287, Ack:
1, Len: 17
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 17]
Sequence number
: 179287 (relati
ve sequence number)
[Next sequence
number: 179304 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xaa1
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 17]
TCP segment dat
a (17 bytes)
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 39 f2 15 4
0 00 31 06 3e f0 4a
7c 0c 8a c0 a8 .
9..@.1.>.J|....
0020 01 0b 00 50 c
1 a6 2b cb 1e 84 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e aa 17 0
0 00 71 ae 9d 9a 6b
9b f2 27 4d 0f .
.....q...k..'M.
0040 fa fe f4 fe b
f 2a 8a
.
....*.

No. Time
Source
Destination
Protocol
Length Info
292 11.20244300
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=17930
4 Ack=1 Win=46 Len=
1260
Frame 292: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.252373000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.252373000 s
econds
[Time delta fro
m previous captured
frame: 0.123005000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12300500
0 seconds]
[Time since ref
erence or first fra
me: 11.202443000 se
conds]
Frame Number: 2
92
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http

2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf216 (61974)

Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a14 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 179304, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 179304 (relati
ve sequence number)
[Next sequence
number: 180564 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xfad
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1277]
TCP segment dat
a (1260 bytes)
[2 Reassembled TCP
Segments (1277 byte
s): #291(17), #292(
1260)]
[Frame: 291, pa
yload: 0-16 (17 byt
es)]
[Frame: 292, pa
yload: 17-1276 (126
0 bytes)]
[Segment count:
2]
[Reassembled TC
P length: 1277]
[Reassembled TC
P Data: 71ae9d9a6b9
bf2274d0ffafef4febf
2a8a7914802c00a928.
..]
Frame (1314 bytes):
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .

`n.dx..;.....E.
0010 05 14 f2 16 4
0 00 31 06 3a 14 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 1e 95 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e fa df 0
0 00 79 14 80 2c 00
a9 28 3c 92 27 .
.....y..,..(<.'
0040 e9 a0 e3 81 2
9 45 e2 46 70 c2 2a
1d 60 22 9c 87 .
...)E.Fp.*.`"..
0050 99 39 61 38 6
1 04 09 3a 2a 67 71
41 41 5f 80 e3 .
9a8a..:*gqAA_..
0060 c3 f5 4c 32 e
0 7d 97 45 4d 7d 13
d8 09 30 e4 4b .
.L2.}.EM}...0.K
0070 58 d6 2d 54 5
6 9b 2c ac f9 30 be
c7 46 e2 de 5f X
.-TV.,..0..F.._
0080 91 4a 48 a4 3
d 8d 0b a5 ae cd ad
1b 6a 75 ee 9a .
JH.=.......ju..
0090 47 52 dd 3a 1
c ff fb 92 04 e8 8f
f2 d5 31 d4 83 G
R.:.........1..
00a0 0f 6a e0 5f 2
6 4a 80 65 eb 5c 0b
94 b9 50 0c 61 .
j._&J.e.\...P.a
00b0 a9 81 6c 21 e
a 01 9c 29 70 65 a8
4f 7b 44 c9 1b .
.l!...)pe.O{D..
00c0 01 8f 3e 18 9
8 41 44 50 8b e6 56
48 70 4e 75 32 .
.>..ADP..VHpNu2
00d0 62 0c b2 2e 9
5 b0 88 ca 66 fb a1
48 42 08 71 b7 b
.......f..HB.q.
00e0 a6 2a 18 a1 5
3 73 72 69 45 a6 63
93 32 9c d7 62 .
*..SsriE.c.2..b
00f0 92 ba bb a9 0
3 e4 1f 82 28 73 5a
c9 54 0a d3 65 .
.......(sZ.T..e
0100 98 c9 87 4f 0
d 22 b8 bf a8 a7 59
f4 cb c1 5c 50 .
..O."....Y...\P
0110 2a 20 ac f2 0
e d6 b7 37 3b bb cf
9e 69 0a 80 c3 *
.....7;...i...

0120 2b f9 9c 8f f
e a7 f1 12 03 c0 27
b5 aa 4b 43 70 +
.........'..KCp
0130 15 b8 1d f9 e
5 17 31 a5 45 d5 d2
45 42 57 b3 bd .
.....1.E..EBW..
0140 04 ae 8a a9 b
e b6 5c de 46 a8 ef
6e a5 8a 76 a9 .
.....\.F..n..v.
0150 2b 5a d2 fc 8
d 41 60 4f 51 32 79
79 c0 2e 21 df +
Z...A`OQ2yy..!.
0160 e3 6b f4 2f c
b 2d d5 94 10 ff c3
b2 04 c9 ce 04 .
k./.-..........
0170 34 5f b6 9d f
c a8 75 2f c5 7d 3d
2f fe 9e 3f fd 4
_....u/.}=/..?.
0180 97 7b bf a5 9
8 b0 c4 a3 91 b7 a1
68 94 1d d0 4e .
{.........h...N
0190 f9 f4 77 4a 9
2 54 e2 38 90 d5 b7
cb b5 1b ad ac .
.wJ.T.8........
01a0 be 78 48 86 7
3 6c 7d 4d 0d 49 43
0e 1e 26 13 a3 .
xH.sl}M.IC..&..
01b0 1e d0 d9 e3 d
0 10 c5 3a fd 15 f4
2f c8 5d cd a2 .
......:.../.]..
01c0 40 5c 8f ee 8
7 ab 4e 4c 09 cd 5a
d6 e7 be 78 6f @
\....NL..Z...xo
01d0 53 7f 4d f4 6
2 a7 8a 51 ff 80 1f
f4 55 3f 00 9c S
.M.b..Q....U?..
01e0 28 c2 b9 18 3
e 00 5b 17 8a f6 54
a0 4b 89 ea 5c (
...>.[...T.K..\
01f0 b0 b1 b5 30 b
f 4e e5 72 51 df 45
de 24 06 5d 4f .
..0.N.rQ.E.$.]O
0200 58 4f 4a cb 6
d 9e 54 15 2d 59 59
12 6a 4d 7f ef X
OJ.m.T.-YY.jM..
0210 af 6d f8 19 d
d f3 db 1d cf fe f5
2c 7d e3 4a c1 .
m.........,}.J.
0220 f4 2d 08 ef e
3 d9 8a be c5 8a ce
39 64 c4 2f 97 .
-.........9d./.
0230 7b d6 7c 09 2

3 53 ae ff fb 92 04
ee 8f f3 23 32 {
.|.#S........#2
0240 53 83 2f 6a e
0 67 26 3a 60 67 0d
5c 0b c8 af 52 S
./j.g&:`g.\...R
0250 0c 61 69 81 6
1 99 2a 41 97 ad 70
b3 99 9c 72 d7 .
ai.a.*A..p...r.
0260 30 f2 8d 43 8
3 4c fd c3 b2 a0 4b
10 18 93 0f 23 0
..C.L....K....#
0270 01 1e e6 42 9
c f0 38 5f bf 6f eb
3a 5d a5 26 e9 .
..B..8_.o.:].&.
0280 31 af 87 be 7
6 95 1d 20 cb ac dc
86 10 50 e8 35 1
...v.. .....P.5
0290 26 0f 20 81 f
e 56 5f ba f4 26 df
39 00 66 be f8 &
. ..V_..&.9.f..
02a0 89 7f 58 90 2
3 20 5e 42 be ed da
ef 64 23 d3 08 .
.X.# ^B....d#..
02b0 81 e9 bd 6f b
c 07 d7 b1 3b 6e 69
7c 5e 36 51 d0 .
..o....;ni|^6Q.
02c0 4f e2 ff a5 6
3 a6 82 e0 e4 3a 2c
4b 40 6c 1d a9 O
...c....:,K@l..
02d0 c5 11 72 77 3
1 af b8 d4 4e 2f c8
f1 5a eb 10 fc .
.rw1...N/..Z...
02e0 55 04 21 e2 a
6 d3 90 5e 77 ce 35
11 42 79 fd ab U
.!....^w.5.By..
02f0 fe 6f 92 5e 3
0 e7 18 df 5b bf 23
9c 9d b4 58 36 .
o.^0...[.#...X6
0300 c2 8f 7a 8a 9
8 f0 f8 a0 00 d3 9a
81 54 35 e1 da .
.z.........T5..
0310 e9 a2 2a e8 9
a 0c 8b 35 64 77 a2
f4 1a 32 92 aa .
.*....5dw...2..
0320 87 54 28 98 8
8 14 a8 9f 88 0b 29
6e 49 12 df 4e .
T(.......)nI..N
0330 30 0a 9f c5 1
6 7b 99 a6 e1 0c 32
d7 e6 2c 0f 45 0
....{....2..,.E
0340 11 c6 b8 82 2
6 1b 90 2f 87 00 fd

7c 12 3a d3 ca .
...&../...|.:..
0350 22 94 cb 03 1
3 e2 ee 55 69 80 3d
b6 d5 21 fa 53 "
......Ui.=..!.S
0360 42 0e b3 5e 7
0 00 95 38 f8 4d c2
c3 9c 1e b2 2e B
..^p..8.M......
0370 28 fa ce 28 5
c 06 f8 13 b5 37 21
ea 6b 06 2a 56 (
..(\....7!.k.*V
0380 c6 8e 4d a0 f
2 91 2c 08 50 eb a3
9b 8d 2e 15 32 .
.M...,.P......2
0390 f4 85 c5 53 1
6 9a 6d f6 be fb fa
95 58 8c d9 61 .
..S..m.....X..a
03a0 f4 5b ad 85 1
a 62 51 58 72 19 25
2c a1 8e 8e 5f .
[...bQXr.%,..._
03b0 6d 85 b3 c7 e
6 77 6d 36 e9 70 e6
2a 74 aa 3c 6b m
....wm6.p.*t.<k
03c0 b7 fa 53 3d 6
d 2a 3d 90 18 68 69
00 d3 17 b6 28 .
.S=m*=..hi....(
03d0 77 22 15 70 f
0 56 b3 ba eb ff fb
92 04 ec 0f f3 w
".p.V..........
03e0 15 26 56 01 e
f 7a 50 5b 24 ca b0
61 eb 4a 0c 50 .
&V..zP[$..a.J.P
03f0 99 5a 0c 3d 2
9 41 73 93 6b 00 f6
21 28 3a 22 89 .
Z.=)As.k..!(:".
0400 71 2c 43 4f d
f e8 fe b8 42 d5 56
88 75 40 c9 33 q
,CO....B.V.u@.3
0410 1d 01 51 ae f
8 58 63 8b 09 3f 09
81 c2 ce e6 cf .
.Q..Xc..?......
0420 76 37 ec 71 3
1 cc d4 14 18 b6 de
0f dd ca 82 82 v
7.q1...........
0430 64 c0 61 96 6
a 7f 2e 0c 1f f0 ca
a3 0a d0 29 a8 d
.a.j.........).
0440 6b 86 e2 61 7
5 70 db 49 d1 81 23
bb e9 f5 cf af k
..aup.I..#.....
0450 9d 7b e5 e2 8
0 77 44 4f 96 6b 56
77 24 76 25 75 .

{...wDO.kVw$v%u
0460 7b f3 a8 4f b
5 5d 2e fd 22 80 15
4d 39 66 10 1e {
..O.].."..M9f..
0470 6b 14 08 3e 9
d 7b 8e 16 ea 88 ca
56 41 d4 bd a9 k
..>.{.....VA...
0480 ad 14 a6 74 6
6 59 15 d8 eb 66 fb
a9 53 8e 0e ac .
..tfY...f..S...
0490 b6 cb 73 4c 0
5 1a 0a 8f 4d 01 8b
b9 57 0a 9d 09 .
.sL....M...W...
04a0 c9 93 f5 f5 b
8 d0 5b f3 8b 5e d0
eb a3 0f 6a df .
.....[..^....j.
04b0 9c 57 af 47 f
2 1c a0 11 44 a1 1a
d6 30 6d de 5b .
W.G....D...0m.[
04c0 e3 3f ff 6f 6
b 11 28 a2 61 a9 21
42 9c e6 d3 a9 .
?.ok.(.a.!B....
04d0 58 09 52 2a 9
9 95 91 15 c7 73 6a
3c d4 b2 8b af X
.R*.....sj<....
04e0 bc 0d 16 a5 5
1 d7 ba ec 56 fe 3d
80 bb 00 3e 78 .
...Q...V.=...>x
04f0 59 7a 97 ad f
d f1 a0 70 41 42 42
8e e9 14 96 4d Y
z.....pABB....M
0500 5c 90 3c 91 9
d 41 5e 38 0a f5 9b
4e 23 2a 10 73 \
.<..A^8...N#*.s
0510 44 2b 41 2d d
d 06 eb 57 cd 3c cc
f6 fa db 45 14 D
+A-...W.<....E.
0520 00 c7
.
.
Reassembled TCP (12
77 bytes):
0000 71 ae 9d 9a 6
b 9b f2 27 4d 0f fa
fe f4 fe bf 2a q
...k..'M......*
0010 8a 79 14 80 2
c 00 a9 28 3c 92 27
e9 a0 e3 81 29 .
y..,..(<.'....)
0020 45 e2 46 70 c
2 2a 1d 60 22 9c 87
99 39 61 38 61 E
.Fp.*.`"...9a8a
0030 04 09 3a 2a 6
7 71 41 41 5f 80 e3

c3 f5 4c 32 e0 .
.:*gqAA_....L2.
0040 7d 97 45 4d 7
d 13 d8 09 30 e4 4b
58 d6 2d 54 56 }
.EM}...0.KX.-TV
0050 9b 2c ac f9 3
0 be c7 46 e2 de 5f
91 4a 48 a4 3d .
,..0..F.._.JH.=
0060 8d 0b a5 ae c
d ad 1b 6a 75 ee 9a
47 52 dd 3a 1c .
......ju..GR.:.
0070 ff fb 92 04 e
8 8f f2 d5 31 d4 83
0f 6a e0 5f 26 .
.......1...j._&
0080 4a 80 65 eb 5
c 0b 94 b9 50 0c 61
a9 81 6c 21 ea J
.e.\...P.a..l!.
0090 01 9c 29 70 6
5 a8 4f 7b 44 c9 1b
01 8f 3e 18 98 .
.)pe.O{D....>..
00a0 41 44 50 8b e
6 56 48 70 4e 75 32
62 0c b2 2e 95 A
DP..VHpNu2b....
00b0 b0 88 ca 66 f
b a1 48 42 08 71 b7
a6 2a 18 a1 53 .
..f..HB.q..*..S
00c0 73 72 69 45 a
6 63 93 32 9c d7 62
92 ba bb a9 03 s
riE.c.2..b.....
00d0 e4 1f 82 28 7
3 5a c9 54 0a d3 65
98 c9 87 4f 0d .
..(sZ.T..e...O.
00e0 22 b8 bf a8 a
7 59 f4 cb c1 5c 50
2a 20 ac f2 0e "
....Y...\P* ...
00f0 d6 b7 37 3b b
b cf 9e 69 0a 80 c3
2b f9 9c 8f fe .
.7;...i...+....
0100 a7 f1 12 03 c
0 27 b5 aa 4b 43 70
15 b8 1d f9 e5 .
....'..KCp.....
0110 17 31 a5 45 d
5 d2 45 42 57 b3 bd
04 ae 8a a9 be .
1.E..EBW.......
0120 b6 5c de 46 a
8 ef 6e a5 8a 76 a9
2b 5a d2 fc 8d .
\.F..n..v.+Z...
0130 41 60 4f 51 3
2 79 79 c0 2e 21 df
e3 6b f4 2f cb A
`OQ2yy..!..k./.
0140 2d d5 94 10 f
f c3 b2 04 c9 ce 04
34 5f b6 9d fc -

..........4_...
0150 a8 75 2f c5 7
d 3d 2f fe 9e 3f fd
97 7b bf a5 98 .
u/.}=/..?..{...
0160 b0 c4 a3 91 b
7 a1 68 94 1d d0 4e
f9 f4 77 4a 92 .
.....h...N..wJ.
0170 54 e2 38 90 d
5 b7 cb b5 1b ad ac
be 78 48 86 73 T
.8.........xH.s
0180 6c 7d 4d 0d 4
9 43 0e 1e 26 13 a3
1e d0 d9 e3 d0 l
}M.IC..&.......
0190 10 c5 3a fd 1
5 f4 2f c8 5d cd a2
40 5c 8f ee 87 .
.:.../.]..@\...
01a0 ab 4e 4c 09 c
d 5a d6 e7 be 78 6f
53 7f 4d f4 62 .
NL..Z...xoS.M.b
01b0 a7 8a 51 ff 8
0 1f f4 55 3f 00 9c
28 c2 b9 18 3e .
.Q....U?..(...>
01c0 00 5b 17 8a f
6 54 a0 4b 89 ea 5c
b0 b1 b5 30 bf .
[...T.K..\...0.
01d0 4e e5 72 51 d
f 45 de 24 06 5d 4f
58 4f 4a cb 6d N
.rQ.E.$.]OXOJ.m
01e0 9e 54 15 2d 5
9 59 12 6a 4d 7f ef
af 6d f8 19 dd .
T.-YY.jM...m...
01f0 f3 db 1d cf f
e f5 2c 7d e3 4a c1
f4 2d 08 ef e3 .
.....,}.J..-...
0200 d9 8a be c5 8
a ce 39 64 c4 2f 97
7b d6 7c 09 23 .
.....9d./.{.|.#
0210 53 ae ff fb 9
2 04 ee 8f f3 23 32
53 83 2f 6a e0 S
........#2S./j.
0220 67 26 3a 60 6
7 0d 5c 0b c8 af 52
0c 61 69 81 61 g
&:`g.\...R.ai.a
0230 99 2a 41 97 a
d 70 b3 99 9c 72 d7
30 f2 8d 43 83 .
*A..p...r.0..C.
0240 4c fd c3 b2 a
0 4b 10 18 93 0f 23
01 1e e6 42 9c L
....K....#...B.
0250 f0 38 5f bf 6
f eb 3a 5d a5 26 e9
31 af 87 be 76 .
8_.o.:].&.1...v

0260 95 1d 20 cb a
c dc 86 10 50 e8 35
26 0f 20 81 fe .
. .....P.5&. ..
0270 56 5f ba f4 2
6 df 39 00 66 be f8
89 7f 58 90 23 V
_..&.9.f....X.#
0280 20 5e 42 be e
d da ef 64 23 d3 08
81 e9 bd 6f bc
^B....d#.....o.
0290 07 d7 b1 3b 6
e 69 7c 5e 36 51 d0
4f e2 ff a5 63 .
..;ni|^6Q.O...c
02a0 a6 82 e0 e4 3
a 2c 4b 40 6c 1d a9
c5 11 72 77 31 .
...:,K@l....rw1
02b0 af b8 d4 4e 2
f c8 f1 5a eb 10 fc
55 04 21 e2 a6 .
..N/..Z...U.!..
02c0 d3 90 5e 77 c
e 35 11 42 79 fd ab
fe 6f 92 5e 30 .
.^w.5.By...o.^0
02d0 e7 18 df 5b b
f 23 9c 9d b4 58 36
c2 8f 7a 8a 98 .
..[.#...X6..z..
02e0 f0 f8 a0 00 d
3 9a 81 54 35 e1 da
e9 a2 2a e8 9a .
......T5....*..
02f0 0c 8b 35 64 7
7 a2 f4 1a 32 92 aa
87 54 28 98 88 .
.5dw...2...T(..
0300 14 a8 9f 88 0
b 29 6e 49 12 df 4e
30 0a 9f c5 16 .
....)nI..N0....
0310 7b 99 a6 e1 0
c 32 d7 e6 2c 0f 45
11 c6 b8 82 26 {
....2..,.E....&
0320 1b 90 2f 87 0
0 fd 7c 12 3a d3 ca
22 94 cb 03 13 .
./...|.:.."....
0330 e2 ee 55 69 8
0 3d b6 d5 21 fa 53
42 0e b3 5e 70 .
.Ui.=..!.SB..^p
0340 00 95 38 f8 4
d c2 c3 9c 1e b2 2e
28 fa ce 28 5c .
.8.M......(..(\
0350 06 f8 13 b5 3
7 21 ea 6b 06 2a 56
c6 8e 4d a0 f2 .
...7!.k.*V..M..
0360 91 2c 08 50 e
b a3 9b 8d 2e 15 32
f4 85 c5 53 16 .
,.P......2...S.
0370 9a 6d f6 be f

b fa 95 58 8c d9 61
f4 5b ad 85 1a .
m.....X..a.[...
0380 62 51 58 72 1
9 25 2c a1 8e 8e 5f
6d 85 b3 c7 e6 b
QXr.%,..._m....
0390 77 6d 36 e9 7
0 e6 2a 74 aa 3c 6b
b7 fa 53 3d 6d w
m6.p.*t.<k..S=m
03a0 2a 3d 90 18 6
8 69 00 d3 17 b6 28
77 22 15 70 f0 *
=..hi....(w".p.
03b0 56 b3 ba eb f
f fb 92 04 ec 0f f3
15 26 56 01 ef V
...........&V..
03c0 7a 50 5b 24 c
a b0 61 eb 4a 0c 50
99 5a 0c 3d 29 z
P[$..a.J.P.Z.=)
03d0 41 73 93 6b 0
0 f6 21 28 3a 22 89
71 2c 43 4f df A
s.k..!(:".q,CO.
03e0 e8 fe b8 42 d
5 56 88 75 40 c9 33
1d 01 51 ae f8 .
..B.V.u@.3..Q..
03f0 58 63 8b 09 3
f 09 81 c2 ce e6 cf
76 37 ec 71 31 X
c..?......v7.q1
0400 cc d4 14 18 b
6 de 0f dd ca 82 82
64 c0 61 96 6a .
..........d.a.j
0410 7f 2e 0c 1f f
0 ca a3 0a d0 29 a8
6b 86 e2 61 75 .
........).k..au
0420 70 db 49 d1 8
1 23 bb e9 f5 cf af
9d 7b e5 e2 80 p
.I..#......{...
0430 77 44 4f 96 6
b 56 77 24 76 25 75
7b f3 a8 4f b5 w
DO.kVw$v%u{..O.
0440 5d 2e fd 22 8
0 15 4d 39 66 10 1e
6b 14 08 3e 9d ]
.."..M9f..k..>.
0450 7b 8e 16 ea 8
8 ca 56 41 d4 bd a9
ad 14 a6 74 66 {
.....VA......tf
0460 59 15 d8 eb 6
6 fb a9 53 8e 0e ac
b6 cb 73 4c 05 Y
...f..S.....sL.
0470 1a 0a 8f 4d 0
1 8b b9 57 0a 9d 09
c9 93 f5 f5 b8 .
..M...W........
0480 d0 5b f3 8b 5
e d0 eb a3 0f 6a df

9c 57 af 47 f2 .
[..^....j..W.G.
0490 1c a0 11 44 a
1 1a d6 30 6d de 5b
e3 3f ff 6f 6b .
..D...0m.[.?.ok
04a0 11 28 a2 61 a
9 21 42 9c e6 d3 a9
58 09 52 2a 99 .
(.a.!B....X.R*.
04b0 95 91 15 c7 7
3 6a 3c d4 b2 8b af
bc 0d 16 a5 51 .
...sj<........Q
04c0 d7 ba ec 56 f
e 3d 80 bb 00 3e 78
59 7a 97 ad fd .
..V.=...>xYz...
04d0 f1 a0 70 41 4
2 42 8e e9 14 96 4d
5c 90 3c 91 9d .
.pABB....M\.<..
04e0 41 5e 38 0a f
5 9b 4e 23 2a 10 73
44 2b 41 2d dd A
^8...N#*.sD+A-.
04f0 06 eb 57 cd 3
c cc f6 fa db 45 14
00 c7
.
.W.<....E...
No. Time
Source
Destination
Protocol
Length Info
293 11.20262100
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=180564 Win=39370 L
en=0
Frame 293: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.252551000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.252551000 s
econds
[Time delta fro
m previous captured

frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 11.202621000 se
conds]
Frame Number: 2
93
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: pc13

.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f86 (20358)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 18056
4, Len: 0

Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 180564 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39370
[Calculated win
dow size: 39370]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 292]

[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 86 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 23 81 50 10 .
....P..N.+.#.P.
0030 99 ca 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
294 11.27644800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18056
4 Ack=1 Win=46 Len=
1260
Frame 294: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.326378000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.326378000 s
econds
[Time delta fro
m previous captured
frame: 0.073827000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07382700
0 seconds]
[Time since ref
erence or first fra
me: 11.276448000 se

conds]
Frame Number: 2
94
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:

20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf217 (61975)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a13 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 180564, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le

n: 1260]
Sequence number
: 180564 (relati
ve sequence number)
[Next sequence
number: 181824 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb12
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.

0010 05 14 f2 17 4
0 00 31 06 3a 13 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 23 81 9e
87 4e aa 50 10 .
..P..+.#...N.P.
0030 00 2e b1 21 0
0 00 54 1a 31 1c c0
af 42 fd 0b 4c .
..!..T.1...B..L
0040 83 a6 11 4d 6
4 71 b4 e5 1c 7b 8e
ba 59 ac 94 58 .
..Mdq...{..Y..X
0050 52 c7 46 c3 d
3 15 b1 72 35 7f 4e
ff 26 30 74 76 R
.F....r5.N.&0tv
0060 f8 36 7c e7 d
3 f9 8b fe e0 c6 6d
54 d1 2b ed 7f .
6|.......mT.+..
0070 eb 66 d9 37 9
c 38 da 0d e8 7e b9
27 bf cd 3a e1 .
f.7.8...~.'..:.
0080 9b b7 18 d7 d
c fe 16 35 8d 66 b9
f9 87 af ac ff .
......5.f......
0090 fb 92 04 ec 0
f f3 24 27 54 83 18
62 50 60 e5 9a .
.....$'T..bP`..
00a0 90 65 eb 4c 0
b 60 99 4c 0c e1 e9
49 6d 1a 29 c1 .
e.L.`.L...Im.).
00b0 8c 35 70 db d
f 74 ff 50 29 b8 57
a9 76 16 61 42 .
5p..t.P).W.v.aB
00c0 09 81 8f 24 3
1 12 8c 58 a6 ba 87
ce d0 c0 d2 f1 .
..$1..X........
00d0 8a 68 1e 4d 5
4 aa 86 05 ab 04 c4
5b ac 11 da 1e .
h.MT......[....
00e0 df bb 6a 79 5
3 72 03 e5 ac 47 51
4f f2 b8 55 45 .
.jySr...GQO..UE
00f0 2e 83 f1 79 f
4 5c b8 64 9b 8f c4
aa 6c 99 a0 80 .
..y.\.d....l...
0100 8b 62 4b 3b a
0 95 41 22 33 37 3f
48 d3 a9 dd d4 .
bK;..A"37?H....
0110 61 b2 9b 37 e
b 59 ec b3 dc b7 fa
18 00 04 33 50 a
..7.Y........3P
0120 13 94 00 ff c

9 04 28 25 56 a0 39
9b 25 aa de 25 .
.....(%V.9.%..%
0130 2b 1e 7d a8 a
4 c9 01 b9 ab ee 1d
8e 7c bb b3 34 +
.}.........|..4
0140 d9 db b8 68 7
0 28 2d 6a a3 a4 25
aa e3 aa 98 1c .
..hp(-j..%.....
0150 5b 49 96 1a 6
5 fa bd 06 f9 72 b5
80 9c 4d dd ba [
I..e....r...M..
0160 99 6a 99 75 2
f 63 d0 a3 e2 84 1a
53 0d 35 4e b0 .
j.u/c.....S.5N.
0170 31 b2 bb 4b 6
9 48 c0 41 01 70 d0
ec ad e2 18 8c 1
..KiH.A.p......
0180 61 cb e2 32 9
c e2 62 06 14 6e 86
ea 39 60 c4 09 a
..2..b..n..9`..
0190 d7 ca 57 31 e
a c4 37 83 00 2c cd
37 d0 9c e0 1b .
.W1..7..,.7....
01a0 aa d5 12 ab 2
c c7 43 c8 ae 6c d1
94 a7 40 60 7d .
...,.C..l...@`}
01b0 67 9e 28 40 b
c d5 72 a5 64 78 6b
58 09 c7 5b b1 g
.(@..r.dxkX..[.
01c0 6d 46 28 f0 2
5 35 25 19 f3 3f 70
d7 6c 67 b2 6f m
F(.%5%..?p.lg.o
01d0 cc 6a 79 95 f
5 27 f8 8d 7b 05 97
3a 0f 22 50 71 .
jy..'..{..:."Pq
01e0 84 87 0b 09 7
4 95 36 a1 1d 48 31
d2 b0 f9 f6 f9 .
...t.6..H1.....
01f0 fc 89 d1 d2 4
5 20 49 0d 25 86 c2
f3 b5 a6 d3 76 .
...E I.%......v
0200 b2 bb 10 61 f
0 b9 ba a6 5a 26 80
8b 12 5e 58 fd .
..a....Z&...^X.
0210 14 45 48 0b 7
e b6 90 db 3e cc bf
01 93 d1 a5 27 .
EH.~...>......'
0220 31 db 5f 93 a
6 50 94 4c cc cf 4f
b9 59 d7 1b b1 1
._..P.L..O.Y...
0230 a1 ff fb 92 0
4 ed 0f f3 26 34 d2

83 38 7a e0 5f .
.......&4..8z._
0240 86 aa 60 69 e
d 5c 0b 38 9d 4c 0c
e1 89 41 8b 1a .
.`i.\.8.L...A..
0250 69 41 97 ad 7
0 6d 30 8f 70 a3 d4
d3 15 58 4a 61 i
A..pm0.p....XJa
0260 c4 23 30 4a 8
d 4a 96 19 8c e8 8c
a9 6f 0a 19 38 .
#0J.J......o..8
0270 5d 08 b3 95 1
4 b4 c1 a3 0a 96 1c
9f c5 de 66 cc ]
.............f.
0280 9a 43 4d 2e 8
9 38 39 43 34 75 f8
d8 b2 27 88 07 .
CM..89C4u...'..
0290 63 68 58 2d 9
e 45 9a 61 56 90 ed
5b 3c db d5 bc c
hX-.E.aV..[<...
02a0 06 4e 73 27 d
f 49 9f 92 b4 2b 9f
99 b4 cf 4c f4 .
Ns'.I...+....L.
02b0 c1 8b 32 5c 1
d 71 21 7a eb 6a fe
45 80 95 84 5c .
.2\.q!z.j.E...\
02c0 05 34 1a ac 7
c 90 49 f2 0c 33 c2
1f 69 33 b4 b5 .
4..|.I..3..i3..
02d0 41 8c a7 14 f
2 70 a6 c1 bc 70 e5
f9 ca 96 3a 19 A
....p...p....:.
02e0 11 b2 a9 df e
0 87 a5 dc 58 e0 4e
b9 71 b1 fd 1f .
.......X.N.q...
02f0 af 3d cf 87 0
2 9b b6 b3 ac fc c7
73 81 85 8c 9f .
=.........s....
0300 fb d3 fb d3 f
6 dd 49 47 41 f1 a4
e2 a0 40 c0 e3 .
.....IGA....@..
0310 91 ff 4e cd 4
5 2d 5f ff fe a8 75
09 68 5c aa 30 .
.N.E-_...u.h\.0
0320 a1 00 d7 c2 8
2 30 26 6e 96 98 4e
91 aa f6 03 91 .
....0&n..N.....
0330 00 9f 75 09 4
6 1d 29 be 9d 4d b4
0f 42 c5 df aa .
.u.F.)..M..B...
0340 dc d5 4c fa 2
e 8d 3d 12 ec f0 81
12 59 34 d0 5f .

.L...=.....Y4._
0350 ab d8 64 32 c
9 82 10 46 c0 7b 27
ee 6b 1a 42 a3 .
.d2...F.{'.k.B.
0360 3f bb df b7 b
7 b7 6d 08 1c 28 b0
fa 75 52 2e 7c ?
.....m..(..uR.|
0370 40 ee c0 7f 0
4 3d 6a 77 41 08 71
99 23 6e 8c c8 @
....=jwA.q.#n..
0380 ca fe ba 8c 4
0 0d a6 da 4c e7 71
6a 32 61 27 96 .
...@...L.qj2a'.
0390 1d 33 fa 39 2
e 61 55 85 c9 0b 5b
60 20 0a 45 39 .
3.9.aU...[` .E9
03a0 a0 c9 01 9d 5
d 8c c9 bf 22 5a 36
a8 d8 df ef ad .
...]..."Z6.....
03b0 df 0e 36 f6 d
f 85 86 ca 9f 69 91
e1 c7 02 09 68 .
.6......i.....h
03c0 40 06 54 6b 1
e 2c e7 35 0b 01 87
1e d7 35 93 96 @
.Tk.,.5.....5..
03d0 30 ce 1f ff f
b 92 04 eb 8f f2 f7
2e 53 03 38 62 0
...........S.8b
03e0 60 60 e5 ba 6
0 63 0c 4c 0b b8 9f
52 0c 3d e9 41 `
`..`c.L...R.=.A
03f0 73 98 2a c1 8
7 99 30 85 df a2 df
d8 41 df d7 2c s
.*...0.....A..,
0400 33 01 33 94 d
9 6e 21 31 a6 53 c7
53 00 0c 8e e2 3
.3..n!1.S.S....
0410 79 14 75 d0 6
a 11 d8 48 58 e8 68
51 78 94 7d a7 y
.u.j..HX.hQx.}.
0420 2f 1f 89 c1 c
0 10 30 1a 87 02 8e
69 ec e3 07 94 /
.....0....i....
0430 81 15 f0 44 c
b a8 bc 98 64 6c c8
33 2a b4 e1 0f .
..D....dl.3*...
0440 0f 9c 68 82 0
1 01 a6 0b 88 85 45
94 e6 97 59 90 .
.h.......E...Y.
0450 19 f4 23 45 2
9 81 10 fd ec dd 46
de b4 80 b1 38 .
.#E).....F....8

0460 07 87 44 41 2
0 e4 25 b9 61 67 86
bc 99 3f 8b 1b .
.DA .%.ag...?..
0470 2b 13 e9 87 7
a 39 b6 25 e9 fc cf
5f 0f c6 6b 4b +
...z9.%..._..kK
0480 37 5b 5d a3 2
d 29 7e 5c db 7f f6
53 6f ad da 38 7
[].-)~\...So..8
0490 fd b9 f8 80 a
8 0e 18 3c a5 a8 07
35 48 49 ad 61 .
......<...5HI.a
04a0 23 52 f7 00 a
3 b1 33 6e 3c 19 4c
e3 98 a3 4a b2 #
R....3n<.L...J.
04b0 2d fa 58 bb c
b ae a2 00 55 2e b2
ae 51 21 6a 16 .X.....U...Q!j.
04c0 a5 3a c1 10 b
a 4c 43 1e 85 ef 9d
2a e2 e8 97 fd .
:...LC....*....
04d0 af 59 fe 5a f
2 b5 6d ad f0 1e 88
06 c2 58 58 8a .
Y.Z..m......XX.
04e0 ce d8 89 69 0
7 61 cf 0e 1c 75 b1
af 6a b2 e5 0d .
..i.a...u..j...
04f0 43 15 ad e5 8
0 0d 3d 44 82 4e 19
0c 98 7b dc 3c C
.....=D.N...{.<
0500 a9 38 61 55 1
3 1e c5 b0 c9 f2 cd
16 cd 3d 39 95 .
8aU.........=9.
0510 18 60 9b 97 e
9 e6 ba 88 67 25 10
b2 da c8 48 5a .
`......g%....HZ
0520 8b 02
.
.
No. Time
Source
Destination
Protocol
Length Info
295 11.34845100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18182
4 Ack=1 Win=46 Len=
1260
Frame 295: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.398381000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.398381000 s
econds
[Time delta fro
m previous captured
frame: 0.072003000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07200300
0 seconds]
[Time since ref
erence or first fra
me: 11.348451000 se
conds]
Frame Number: 2
95
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf218 (61976)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)

Header checksum
: 0x3a12 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 181824, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 181824 (relati
ve sequence number)
[Next sequence
number: 183084 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .

0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa43
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 18 4
0 00 31 06 3a 12 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 28 6d 9e
87 4e aa 50 10 .
..P..+.(m..N.P.
0030 00 2e a4 38 0
0 00 83 fb 15 8c b5
d6 90 e2 f6 45 .
..8...........E
0040 8a 46 48 b5 c
a b9 d6 93 6a 43 b1
b8 b4 f1 2f 05 .
FH.....jC..../.
0050 29 06 1e ab 1
9 8e 33 76 6d bf 8c
42 87 9a 5f fc )
.....3vm..B.._.
0060 c7 fa 96 05 6
0 e4 50 e3 50 1e 2c
26 03 82 65 80 .
...`.P.P.,&..e.
0070 c7 ce db 1e b
9 f1 45 12 72 45 50
60 2a e8 98 8a .
.....E.rEP`*...
0080 50 c0 d5 a2 7
b ad b1 a9 29 ff fb
92 04 ed 0f f3 P
...{...).......
0090 1f 22 d6 03 0
f 7a 50 5d a4 ba e0
61 88 4a 0b 40 .
"...zP]...a.J.@
00a0 85 64 06 3d 8
9 41 7a 14 ac 80 f6

0d 30 7b 5a bb .
d.=.Az.....0{Z.
00b0 9b 55 a9 62 0
6 98 41 2b 31 0f 25
72 34 bc cc 51 .
U.b..A+1.%r4..Q
00c0 f2 80 62 f5 9
8 27 49 40 84 ed 6a
8b b4 1c 2c 56 .
.b..'I@..j...,V
00d0 3c 8e 36 59 9
1 21 a4 06 d5 16 8d
e5 ea 6b 91 4e <
.6Y.!.......k.N
00e0 4d af 99 ad d
e 5f e9 af e3 37 39
59 82 8a 12 b0 M
...._...79Y....
00f0 3d 2c b0 98 8
8 2c 54 27 13 b0 59
96 28 60 f1 b6 =
,...,T'..Y.(`..
0100 0c a5 24 4f d
3 22 4b 4a 3c 2a da
f1 ee a2 4b 8e .
.$O."KJ<*....K.
0110 45 4a 55 40 a
5 ae 10 f3 f0 b9 31
06 66 c2 4c 84 E
JU@......1.f.L.
0120 49 15 48 8f 1
2 a2 5f b2 b0 8e a3
56 33 84 77 69 I
.H..._....V3.wi
0130 05 5b 59 ad 6
7 cc 84 01 69 b1 2b
6a 76 ed ed dd .
[Y.g...i.+jv...
0140 dc f7 6f 48 1
2 3b b5 fc 9f 34 f9
d5 3d 71 e1 d4 .
.oH.;...4..=q..
0150 ea c2 65 5c 1
9 42 cd 0d 32 c7 a3
69 51 cb ce 2d .
.e\.B..2..iQ..0160 96 9e 2b 32 3
d b8 99 b7 58 29 f5
f2 58 65 54 a9 .
.+2=...X)..XeT.
0170 b0 dc 4f 9e 1
1 94 47 15 c9 c4 41
66 4e 40 54 c5 .
.O...G...AfN@T.
0180 4b 96 d1 57 b
6 5c 13 33 e6 ce 9d
ad b7 25 e1 a0 K
..W.\.3.....%..
0190 ac 61 44 48 3
4 b6 32 c1 df 93 15
76 38 4f 64 84 .
aDH4.2....v8Od.
01a0 30 44 8f b7 c
6 7a 6a af 43 65 ef
9f 9e 66 ea 22 0
D...zj.Ce...f."
01b0 fb 8e 22 bf 6
9 99 7a ff fd 6a 99
d1 62 a6 f5 5d .

.".i.z..j..b..]
01c0 fe 57 db 4d 3
a 7b 82 b4 84 5e b4
b9 8f 5d b6 b6 .
W.M:{...^...]..
01d0 85 2b 31 11 d
8 aa 6d 4e 1c e2 a1
48 3b 47 8a f0 .
+1...mN...H;G..
01e0 61 b3 47 e1 d
9 ab 4c 21 4b 91 4d
ad 6e 17 36 30 a
.G...L!K.M.n.60
01f0 77 ee c5 ea f
d cd d6 ae f2 41 32
ea 55 61 21 16 w
........A2.Ua!.
0200 48 9a 96 ba 9
e 91 bb 6e 71 87 8e
56 c7 df ad 3e H
......nq..V...>
0210 29 3d 7d 7f f
8 ff c3 70 b8 19 e1
d9 53 ba ba df )
=}....p....S...
0220 8b 5e bb 47 c
2 06 5a 4e 8f b4 f5
ff fb 92 04 ef .
^.G..ZN........
0230 0f f3 41 22 5
8 81 f8 7a 50 5c 44
4b 20 3d e9 4a .
.A"X..zP\DK =.J
0240 0b cc 8f 60 0
7 bd e9 41 97 23 2c
00 f7 a1 70 37 .
..`...A.#,...p7
0250 7c bf 7c 8d b
4 cc 0a 9a 91 4e 23
30 0a fd d2 97 |
.|......N#0....
0260 49 c3 60 74 b
1 38 11 81 8c 5e ce
e8 e9 76 d0 db I
.`t.8...^...v..
0270 38 e7 9a 68 d
0 10 a8 69 5c 97 fb
2f 46 48 2a 35 8
..h...i\../FH*5
0280 09 51 87 e7 6
1 28 5a e1 47 88 11
dc a8 88 90 68 .
Q..a(Z.G......h
0290 b0 70 a5 3c c
b 7d ba ad 4b 63 f0
a4 46 85 bd 1c .
p.<.}..Kc..F...
02a0 2a 7a ba 9e 5
0 ab 5f 69 28 14 4a
3e 88 b5 ed 7b *
z..P._i(.J>...{
02b0 e3 68 e8 ef e
d a5 52 30 45 b0 74
a1 26 30 ad 8a .
h....R0E.t.&0..
02c0 2d 2c a8 ef 2
0 4d cb 6e 12 bf 52
4a d3 9b 35 9a ,.. M.n..RJ..5.

02d0 06 29 5f 45 7
e 67 0c 60 49 53 6f
50 30 ad 9e 8b .
)_E~g.`ISoP0...
02e0 09 84 dd cd a
d 6e 44 e3 f6 b7 da
7b 89 37 6b 41 .
....nD....{.7kA
02f0 97 79 83 b9 8
6 82 a7 0f b0 48 2c
41 64 18 ab 8d .
y.......H,Ad...
0300 1f 0b 01 9b b
1 72 c1 bb 5e fe 4f
7a f7 1b 3a 92 .
....r..^.Oz..:.
0310 ce ab d9 ec a
d d2 82 dd 6f 4b fa
99 7e 9b 1d 4d .
.......oK..~..M
0320 e1 69 78 2e c
5 80 ec 74 c4 4d c3
9c 89 b9 e3 83 .
ix....t.M......
0330 84 3a b3 dc f
1 2a b1 a9 36 c0 7a
8c 7a a2 12 33 .
:...*..6.z.z..3
0340 b2 27 7e 1c 7
a 1d b9 68 b1 9f cf
d7 7f 6b 67 fa .
'~.z..h.....kg.
0350 16 d9 ba 88 f
8 e3 9a 0b 2d 02 8b
7c d1 d3 03 dd .
.......-..|....
0360 ad 52 c2 85 8
8 a9 ed 98 2c 58 5f
00 f5 b5 28 ff .
R......,X_...(.
0370 fd d9 2a 88 5
c 42 a0 a7 29 c6 61
d0 aa 01 f4 b6 .
.*.\B..).a.....
0380 b0 2d 9c aa 2
8 a2 6d b9 ca 58 fe
e9 e7 bc 59 e7 .
-..(.m..X....Y.
0390 12 ad f9 bf a
0 7f 6c 3a 86 00 56
0b 83 a0 6c 16 .
.....l:..V...l.
03a0 05 18 9a 27 6
8 24 40 8c 89 82 46
4c 1b 4e 31 c4 .
..'h$@...FL.N1.
03b0 14 cb 41 48 a
d 49 17 cb a7 0f d7
30 9d 0a 3c 68 .
.AH.I.....0..<h
03c0 a2 58 3d 83 b
7 ae d4 d7 a6 ea 98
f5 c7 ff fb 92 .
X=.............
03d0 04 e9 8f f2 d
9 26 58 01 f8 7a 50
60 a5 4a f0 61 .
....&X..zP`.J.a
03e0 e8 4c 0c 54 7

b 5c 07 e1 e9 41 68
91 6b c0 f7 b1 .
L.T{\...Ah.k...
03f0 28 2b 47 b9 7
f f9 d6 2d f6 29 12
c6 4d 86 b2 3c (
+G....-.)..M..<
0400 c9 2d 11 e1 b
1 11 54 08 81 76 29
0a b5 b0 35 13 .
-....T..v)...5.
0410 38 3e f0 3d 8
4 d9 c6 33 8e 1b a6
70 54 48 29 d2 8
>.=...3...pTH).
0420 1d cb 16 35 a
c b3 f1 8b 52 02 cf
52 43 d4 8e 14 .
..5....R..RC...
0430 87 f5 9a 43 c
f a6 e5 ac 27 2f 9c
3a 0c 01 9a 48 .
..C....'/.:...H
0440 49 7c 48 a0 8
1 a3 be 1d 95 68 da
16 f1 12 4f 09 I
|H......h....O.
0450 52 f1 e4 da 0
6 49 aa e8 dc f5 91
86 1e d4 ad 4f R
....I.........O
0460 36 8c c4 95 d
d f2 1a c5 27 1c e5
0e 4f 0a cc 31 6
.......'...O..1
0470 82 bf d9 3c 9
1 32 a3 ea 56 ed 8b
77 1c f9 63 07 .
..<.2..V..w..c.
0480 b2 42 98 4b f
e e6 52 bc d6 a0 4c
71 c6 21 d9 4e .
B.K..R...Lq.!.N
0490 3a 9a bd f5 b
b 86 15 7b 96 ee 65
bf a9 f9 6b 5d :
......{..e...k]
04a0 b9 a2 6b 3a 7
c 39 41 03 a7 58 52
4e ce fc 8d 8c .
.k:|9A..XRN....
04b0 a6 5b ed 4a 9
a b4 15 f9 04 52 fd
1f 59 ba 75 93 .
[.J.....R..Y.u.
04c0 13 6c ca 17 2
1 12 80 1f 6f 43 1c
3a 4b f0 22 27 .
l..!...oC.:K."'
04d0 27 00 0c 9d d
6 3c 6c 46 8b 92 c4
65 ad 27 0e 27 '
....<lF...e.'.'
04e0 45 ee 28 5a d
c 70 7d 29 55 4f 96
35 5a c1 9e 5c E
.(Z.p})UO.5Z..\
04f0 e0 ee 47 d9 f
7 dc 4b fc 7c e3 e2

24 68 f4 be a0 .
.G...K.|..$h...
0500 49 37 f5 8a 5
c 44 31 c4 a3 45 d0
2a 4f f4 26 5b I
7..\D1..E.*O.&[
0510 65 f0 69 33 2
6 51 91 bf 21 73 aa
65 dd ff 45 94 e
.i3&Q..!s.e..E.
0520 37 04
7
.
No. Time
Source
Destination
Protocol
Length Info
296 11.34862600
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=183084 Win=38740 L
en=0
Frame 296: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.398556000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.398556000 s
econds
[Time delta fro
m previous captured
frame: 0.000175000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 11.348626000 se
conds]
Frame Number: 2
96
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f87 (20359)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 18308
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 183084 (
relative ack number
)
Header Length:

20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38740
[Calculated win
dow size: 38740]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 295]
[The RTT to
ACK the segment wa
s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 87 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 2d 59 50 10 .

....P..N.+.-YP.
0030 97 54 18 d4 0
0 00
.
T....
No. Time
Source
Destination
Protocol
Length Info
297 11.34944100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
879 http49
574 [PSH, ACK] Seq=
183084 Ack=1 Win=46
Len=825
Frame 297: 879 byte
s on wire (7032 bit
s), 879 bytes captu
red (7032 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.399371000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.399371000 s
econds
[Time delta fro
m previous captured
frame: 0.000815000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00081500
0 seconds]
[Time since ref
erence or first fra
me: 11.349441000 se
conds]
Frame Number: 2
97
Frame Length: 8
79 bytes (7032 bits
)
Capture Length:
879 bytes (7032 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]

[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00

)
Total Length: 8
65
Identification:
0xf219 (61977)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bc4 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 183084, Ack:
1, Len: 825
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 825]
Sequence number
: 183084 (relati
ve sequence number)
[Next sequence
number: 183909 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)

000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x8a0
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 825]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 61 f2 19 4
0 00 31 06 3b c4 4a
7c 0c 8a c0 a8 .
a..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cb 2d 59 9e
87 4e aa 50 18 .
..P..+.-Y..N.P.
0030 00 2e 8a 06 0
0 00 51 7a 94 8b 84
9a 91 80 43 a6 .
.....Qz......C.
0040 41 c0 a2 37 c
2 d8 3e 46 60 3a cd
a7 e7 db 70 02 A
..7..>F`:....p.

0050 42 f5 0a d2 7
5 da 89 95 0c ba e3
72 08 c4 be 70 B
...u......r...p
0060 5f 1f 7a 71 6
5 13 37 11 76 2b 94
9f 8b f2 73 b2 _
.zqe.7.v+....s.
0070 d4 cc ba ff 9
f f9 cc 9d b4 b2 e4
86 ee a3 96 7b .
..............{
0080 fe 94 29 ff f
b 90 04 ec 0f f3 16
24 d7 01 f8 92 .
.)........$....
0090 50 61 44 8a e
0 3d ef 4a 0c 34 8f
5a 0c 63 09 41 P
aD..=.J.4.Z.c.A
00a0 88 13 2b 40 f
7 bd 28 6a b9 3b ec
a2 ff fe 83 f5 .
.+@..(j.;......
00b0 26 d0 5a 0b c
4 00 78 4a 04 31 84
94 2d 72 4a 96 &
.Z...xJ.1..-rJ.
00c0 0d d5 f2 22 b
3 8b 76 45 a7 82 1b
9c ec ec b6 27 .
.."..vE.......'
00d0 12 9d 8a 4c 0
c 93 1d 0e 1d 40 b9
2e 79 08 24 92 .
..L.....@..y.$.
00e0 38 17 1e 99 0
2 dd 6d f5 97 0c aa
9a bd 5f b5 09 8
.....m......_..
00f0 7a af 16 39 4
9 c2 ae ff e7 ab ef
db 4d 92 46 39 z
..9I.......M.F9
0100 d9 0f f5 bb 0
3 00 70 c6 80 18 36
ca 98 f7 43 36 .
.....p...6...C6
0110 c4 90 44 d3 5
2 7d 18 49 08 1c 12
a0 10 1f d6 6b .
.D.R}.I.......k
0120 60 23 4d 72 b
e 36 b2 a7 63 93 ae
39 40 06 61 3c `
#Mr.6..c..9@.a<
0130 23 31 88 74 4
6 82 f6 b4 23 9c c4
68 da 37 25 4d #
1.tF...#..h.7%M
0140 65 25 97 4c d
1 e7 4c f3 87 87 b7
41 23 75 18 bb e
%.L..L....A#u..
0150 2c d5 41 e2 8
5 96 97 0a 12 9c 33
4f 5e db 37 ea ,
.A.......3O^.7.
0160 7b d7 ad c4 a

1 bf 77 a1 84 88 13
01 68 28 4b 98 {
.....w.....h(K.
0170 6f d4 24 6c 4
3 05 5f 2d 1d 18 55
99 3a 4c 40 4d o
.$lC._-..U.:L@M
0180 7c 59 ad 52 c
2 15 cd 3e af d9 be
da 4a 61 f6 02 |
Y.R...>....Ja..
0190 64 f8 9f 9f 5
9 2f 0b bc 7a 51 45
16 2a d4 74 9a d
...Y/..zQE.*.t.
01a0 11 56 ec 65 a
f 5f fc b8 eb c9 06
36 b1 6b c0 94 .
V.e._.....6.k..
01b0 f0 84 8b 9c 9
6 cc 31 cc 65 af 5e
aa 8f 2b b9 96 .
.....1.e.^..+..
01c0 e1 42 ae 47 6
7 e8 d0 6b 08 84 3d
20 51 4b cc 92 .
B.Gg..k..= QK..
01d0 e1 61 33 63 6
5 54 b4 54 f4 44 a1
28 23 26 63 80 .
a3ceT.T.D.(#&c.
01e0 78 a5 35 33 4
2 87 87 c8 88 92 6b
b1 b8 d3 c1 07 x
.53B.....k.....
01f0 4a da 60 c6 0
2 37 50 79 4c d0 10
29 03 18 08 a2 J
.`..7PyL..)....
0200 59 1c b2 d0 e
a 2f 11 12 3c 64 18
e1 55 16 7a 94 Y
..../..<d..U.z.
0210 62 5d d7 66 a
9 9c c9 24 56 5e cc
10 02 b1 af a1 b
].f...$V^......
0220 1e a2 9b 7a f
f fb 92 04 e6 8f f2
bc 27 d6 83 0f .
..z........'...
0230 62 50 54 a5 0
a e0 3f 09 4a 0c 94
9b 56 0c 62 29 b
PT...?.J...V.b)
0240 41 7c 92 2b 0
0 fc 3d 28 fd ae 39
fb ab f5 ba 88 A
|.+..=(..9.....
0250 76 00 7b 5d b
1 eb 3f a3 40 85 24
8b a2 bc 54 b8 v
.{]..?.@.$...T.
0260 42 32 22 3b c
e e0 88 e9 ed 93 1f
ba d8 87 91 39 B
2";...........9
0270 30 d9 6a 46 2
0 4b 2e 22 90 d6 74

36 61 c1 2b 48 0
.jF K."..t6a.+H
0280 3b 45 6b d7 d
c 6b 01 95 b4 54 45
84 e3 56 49 fe ;
Ek..k...TE..VI.
0290 30 f2 2f f9 7
6 a7 ce f1 a6 a7 db
cf b5 e7 18 3d 0
./.v..........=
02a0 83 8d 29 75 2
a 99 17 59 c5 53 ee
76 de df bf fa .
.)u*..Y.S.v....
02b0 9a 43 2f 05 6
c ae ca 25 8e 18 e6
b5 82 0b 1b 74 .
C/.l..%.......t
02c0 c1 4c f5 0d 4
d 82 f6 2f f0 f7 a6
2d 3b 04 c0 6e .
L..M../...-;..n
02d0 65 00 bd 67 7
5 ab b4 e8 ba eb 2f
e0 39 9d 62 9a e
..gu...../.9.b.
02e0 63 ae 8a 57 1
7 b8 78 bb 3d 79 df
15 91 f2 56 69 c
..W..x.=y....Vi
02f0 35 e4 89 f1 7
d 40 a7 63 95 05 ab
57 e1 b6 ff 31 5
...}@.c...W...1
0300 78 5c e3 54 8
1 13 ae f6 2b 41 1f
41 d5 3f ff 25 x
\.T....+A.A.?.%
0310 e8 84 b7 8b 7
9 0d d1 42 2e 06 bc
40 94 8f 73 3c .
...y..B...@..s<
0320 6a e3 89 45 9
6 00 db 80 b4 c8 65
eb d2 64 46 12 j
..E......e..dF.
0330 82 f7 05 1e b
3 0d bf d9 b5 f6 71
3b 55 8d 93 cd .
.........q;U...
0340 24 78 a3 1c 7
d 21 1f bc f7 8b 10
f6 39 6d 26 b2 $
x..}!......9m&.
0350 ba d7 c6 e4 8
f 4d 43 b3 76 f1 5e
f9 1e 4c a8 2e .
....MC.v.^..L..
0360 2c b3 a9 e8 6
1 77 53 d9 55 3a ff
fe 26 fd 15
,
...awS.U:..&..
No. Time
Source
Destination
Protocol
Length Info
298 11.48845500

0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18390
9 Ack=1 Win=46 Len=
1260
Frame 298: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.538385000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.538385000 s
econds
[Time delta fro
m previous captured
frame: 0.139014000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13901400
0 seconds]
[Time since ref
erence or first fra
me: 11.488455000 se
conds]
Frame Number: 2
98
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)

Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf21a (61978)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se

t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a10 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 183909, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 183909 (relati
ve sequence number)
[Next sequence
number: 185169 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not

set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x7fc
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2085]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 1a 4
0 00 31 06 3a 10 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 30 92 9e
87 4e aa 50 10 .
..P..+.0...N.P.
0030 00 2e 7f cb 0
0 00 74 02 a3 12 10
78 8b c6 8c 80 .
.....t....x....
0040 05 34 d0 15 d
3 18 2d 44 91 f5 26
11 42 87 83 31 .
4....-D..&.B..1
0050 84 67 d1 a6 b
7 d3 41 35 3d 5b 5b
9d a7 78 a6 d4 .
g....A5=[[..x..
0060 a1 e9 31 2a 7
d d9 53 96 c5 66 42
c9 31 c6 4b 63 .
.1*}.S..fB.1.Kc
0070 b2 8a 29 8c 5
d ff c3 5a cf f7 87
79 4b f9 59 92 .
.).]..Z...yK.Y.

0080 d0 f7 fb 96 5
7 3b 9e 76 f2 ae 5d
6f d8 ff fb 92 .
...W;.v..]o....
0090 04 ed 8f f3 2
4 28 55 03 18 92 50
60 c4 ea b0 63 .
...$(U...P`...c
00a0 0f 4a 0c 18 9
b 54 0c e1 e9 41 75
92 2a c1 8c 3d .
J...T...Au.*..=
00b0 28 41 1e a7 e
e a7 55 76 7a 23 0b
31 83 a0 18 39 (
A....Uvz#.1...9
00c0 a5 dc 01 61 b
3 20 1d da 51 27 f9
ae 94 08 d4 d3 .
..a. ..Q'......
00d0 64 3b 15 dd 5
9 7f db 1c 85 8a d3
7b 96 d0 1f 68 d
;..Y......{...h
00e0 32 ab 38 a8 1
3 09 73 a4 87 2f 46
2e a3 a2 b5 c5 2
.8...s../F.....
00f0 36 d8 e9 b2 3
0 4f c6 a5 ac ce eb
3b f9 66 dd a0 6
...0O.....;.f..
0100 cb bd 7b 59 b
d 5d 7b de 33 66 44
7c ce 21 58 73 .
.{Y.]{.3fD|.!Xs
0110 53 cc ad 3d 5
5 7d 76 7e ce 55 4e
c0 25 a8 52 89 S
..=U}v~.UN.%.R.
0120 60 ed 32 e0 b
b 68 cd 97 5e a6 39
14 52 1a 1a ab `
.2..h..^.9.R...
0130 f0 1c a3 1b d
4 d6 5e bc 23 67 7c
b9 d4 78 ca f5 .
.....^.#g|..x..
0140 2c 7e 2e 30 3
2 d8 2d 24 d0 29 8e
24 c2 14 71 03 ,
~.02.-$.).$..q.
0150 c6 6e 77 a5 b
6 6f b4 37 31 9a d1
a3 bc 82 df 8c .
nw..o.71.......
0160 42 fe 2d f3 0
2 46 2c 66 fb ec fb
f9 92 a2 51 d5 B
.-..F,f......Q.
0170 0b be a4 0a f
1 16 af ff e8 71 18
2b 09 4c 41 e9 .
........q.+.LA.
0180 8d 1c da fa a
6 20 b5 d6 97 1b 61
44 4e bb 02 c1 .
.... ....aDN...
0190 1d 20 b2 d8 6

d 1f 33 2a 4a a8 ef
dd 5d 8d 99 a0 .
..m.3*J...]...
01a0 43 98 3a 6c a
2 88 e8 33 0f 25 d2
d0 a5 8b d7 5d C
.:l...3.%.....]
01b0 e4 6b a4 d9 2
1 13 33 2a 3e 2b 63
d7 e3 5d ad d6 .
k..!.3*>+c..]..
01c0 73 13 2d f8 f
4 aa 46 1e f5 99 1b
c1 57 9e 51 2e s
.-...F.....W.Q.
01d0 d6 00 65 99 f
6 ec e9 fa 7a 15 7d
50 0e 1e 09 32 .
.e.....z.}P...2
01e0 81 ce 28 b8 8
1 85 62 19 7a 26 0d
ac 78 17 08 98 .
.(...b.z&..x...
01f0 50 40 2b 5c c
1 10 99 ac 1b bf 43
bd 42 f7 bb 6e P
@+\......C.B..n
0200 e4 0f 34 d7 7
1 69 4d 10 aa bc 4a
82 c2 99 93 c5 .
.4.qiM...J.....
0210 d7 ae bd e9 8
0 69 9c 2b 54 f1 da
6c 6e ce 55 c3 .
....i.+T..ln.U.
0220 3e 6b ff 0c b
b 95 d8 5f e7 ac 77
6b d6 0b 93 ff >
k....._..wk....
0230 fb 92 04 ea 8
f f2 fa 27 55 03 19
c2 50 61 24 ea .
......'U...Pa$.
0240 a0 63 2f 4a 0
b d4 9b 52 0c 61 e9
41 81 13 6a 41 .
c/J...R.a.A..jA
0250 8c bd 28 7b a
0 37 0a 1d 60 45 74
6c ff a1 e0 6c .
.({.7..`Etl...l
0260 ab d0 ba 29 c
c ba 0d 16 71 86 70
e7 35 57 be 2c .
..)....q.p.5W.,
0270 51 d0 a0 5c 7
3 50 8a 05 40 c3 ef
a0 84 6c 72 2a Q
..\sP..@....lr*
0280 57 59 9a b7 d
1 5a 57 89 b4 1e aa
51 14 77 1c cb W
Y...ZW....Q.w..
0290 4e aa 75 b6 e
7 50 14 db 6f 3f 44
02 2c 57 1d a2 N
.u..P..o?D.,W..
02a0 27 d6 33 2a a
3 1b 9d 5e e5 bd e7

6d af 38 d0 50 '
.3*...^...m.8.P
02b0 9b c3 30 2b 8
e b5 34 d0 cd a6 69
f4 d4 ca 4b dc .
.0+..4...i...K.
02c0 47 c0 d4 00 8
2 97 a4 37 6f 8b 66
e7 18 46 a1 1c G
......7o.f..F..
02d0 ca dc 03 06 c
4 05 c9 05 39 71 94
41 46 2c 0f dd .
.......9q.AF,..
02e0 35 f6 65 3d 2
e 7b f2 56 18 08 02
4a 64 de 7b 26 5
.e=.{.V...Jd.{&
02f0 95 fb 96 de 6
7 52 ac c5 a7 56 ec
85 f1 c7 71 39 .
...gR...V....q9
0300 da bd d7 7f f
5 ff f7 31 97 77 2e
6a a4 67 3d 7d .
......1.w.j.g=}
0310 40 41 29 a4 5
4 aa 0e 2c 61 2a 9d
a7 fa d7 65 12 @
A).T..,a*....e.
0320 aa 37 52 8a 8
c 0c c3 96 ae 05 7c
35 2d 55 ec 6c .
7R.......|5-U.l
0330 8a 88 b6 b1 0
4 49 07 22 e3 48 86
80 1c 2b 5d 4a .
....I.".H...+]J
0340 74 db 84 36 0
7 bb 36 bb 20 8a 70
65 1e 12 96 ab t
..6..6. .pe....
0350 c8 cc d2 13 5
e 10 32 b2 ae cb be
92 71 1f a7 bf .
...^.2.....q...
0360 f5 84 db fd 3
9 fd 8b 53 70 0f 18
f8 f0 24 c1 b5 .
...9..Sp....$..
0370 3e b5 dc 99 2
a b5 2a 4f 52 5a 23
83 86 27 79 a0 >
...*.*ORZ#..'y.
0380 0c 1b 54 bd c
0 41 02 35 2c 46 82
1c 08 60 00 e5 .
.T..A.5,F...`..
0390 c0 c6 d8 6e e
f 8a 5b b9 31 8b d1
87 ea 46 bd a5 .
..n..[.1....F..
03a0 49 e4 de 50 b
4 12 e0 88 82 3c ca
31 9b ba c1 81 I
..P.....<.1....
03b0 32 09 69 0e 5
c bf 8e 89 ae 9d 56
d7 b5 a0 fc 52 2

.i.\.....V....R
03c0 8d 1b ff 2e 4
e e4 af 86 ff 06 83
d3 2f 11 a1 23 .
...N......./..#
03d0 02 ff fb 92 0
4 e9 8f f2 fe 24 d4
83 39 c2 50 5f .
........$..9.P_
03e0 24 9a 90 63 0
f 4a 0c 0c 99 52 0c
67 09 41 63 93 $
..c.J...R.g.Ac.
03f0 aa 41 8c 3d 2
8 ec df 9b b1 3e b5
f1 00 40 22 4e .
A.=(....>...@"N
0400 45 74 f6 18 f
5 92 86 ae d7 5d de
40 b2 86 4c 00 E
t.......].@..L.
0410 53 e1 3f 00 c
4 e6 cf e2 06 0d 94
74 58 bd b5 e2 S
.?........tX...
0420 2c ea 54 d4 a
1 87 5a da b8 50 65
06 17 e4 36 f1 ,
.T...Z..Pe...6.
0430 6c 5d ee 7d a
d 21 c6 c8 b5 4e 6e
b9 ea 1c 5c 6f l
].}.!...Nn...\o
0440 7b 47 fc 53 5
0 e2 ff 96 e5 b8 59
c4 37 fe 70 18 {
G.SP.....Y.7.p.
0450 9d 13 83 98 f
2 e2 d5 11 ff ed 52
5a 8a ac 52 18 .
.........RZ..R.
0460 49 61 70 08 4
6 02 22 c5 09 02 ac
15 71 70 b5 a6 I
ap.F.".....qp..
0470 a0 95 c6 00 2
7 ba 43 d1 bf af 44
e1 40 34 ef 6e .
...'.C...D.@4.n
0480 2a 1c e5 40 3
0 e4 6e 11 64 60 ed
b8 e9 55 0b e2 *
..@0.n.d`...U..
0490 ff 92 16 bd 6
f c6 03 f6 cd 4b 38
fe 53 64 e2 73 .
...o....K8.Sd.s
04a0 3a 6f fc 79 3
3 49 ff 6e a5 9e eb
52 ea 48 a7 d8 :
o.y3I.n...R.H..
04b0 dd cb 55 0b 9
b 9b 3a a0 d1 e0 f7
2e 71 57 56 b9 .
.U...:.....qWV.
04c0 1a 12 3d 89 0
8 58 ce 20 5f 72 c0
4e 16 7a 5b a4 .
.=..X. _r.N.z[.

04d0 19 09 ca 28 5
a a4 35 12 f9 37 dc
96 c1 2d 78 d4 .
..(Z.5..7...-x.
04e0 26 72 52 9c f
2 f7 1d c0 8b d2 dc
1a 28 58 ba 91 &
rR.........(X..
04f0 29 96 b0 c7 8
3 1b dc a0 d2 69 eb
21 ca 7d e9 95 )
........i.!.}..
0500 37 d5 15 fa d
4 ca ad fd d1 35 f1
df 24 29 4a 67 7
........5..$)Jg
0510 10 b5 38 99 2
5 94 7d 49 2e e4 66
aa 72 ea 42 6a .
.8.%.}I..f.r.Bj
0520 9d 01
.
.
No. Time
Source
Destination
Protocol
Length Info
299 11.48863400
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=185169 Win=38219 L
en=0
Frame 299: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.538564000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.538564000 s
econds
[Time delta fro
m previous captured
frame: 0.000179000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017900
0 seconds]

[Time since ref

erence or first fra
me: 11.488634000 se
conds]
Frame Number: 2
99
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)

Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f88 (20360)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 18516
9, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]

[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 185169 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38219
[Calculated win
dow size: 38219]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 298]
[The RTT to
ACK the segment wa
s: 0.000179000 seco
nds]
0000 90 01 3b d0 1

7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 88 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 35 7e 50 10 .
....P..N.+.5~P.
0030 95 4b 18 d4 0
0 00
.
K....
No. Time
Source
Destination
Protocol
Length Info
300 11.56246000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18516
9 Ack=1 Win=46 Len=
1260
Frame 300: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.612390000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.612390000 s
econds
[Time delta fro
m previous captured
frame: 0.073826000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07382600
0 seconds]
[Time since ref
erence or first fra
me: 11.562460000 se
conds]
Frame Number: 3
00
Frame Length: 1
314 bytes (10512 bi
ts)

Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf21b (61979)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a0f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 185169, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 185169 (relati
ve sequence number)
[Next sequence
number: 186429 (

relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x7f0
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 1b 4
0 00 31 06 3a 0f 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 35 7e 9e

87 4e aa 50 10 .
..P..+.5~..N.P.
0030 00 2e 7f 0d 0
0 00 e3 05 24 35 c2
f8 11 b0 db 05 .
.......$5......
0040 c3 54 97 89 a
0 2a 57 45 eb 10 4c
cc 62 83 43 6c .
T...*WE..L.b.Cl
0050 c7 81 5b 37 9
2 9a d1 c8 54 51 b5
8c 21 bc 9c 56 .
.[7....TQ..!..V
0060 52 a1 00 f8 d
8 ea 52 d3 6f f2 75
b4 c5 f1 90 38 R
.....R.o.u....8
0070 54 9b 78 e4 1
b bf 63 f5 3f 72 e7
ee 86 7a 77 bd T
.x...c.?r...zw.
0080 bf cd cb f0 d
e 13 96 ff fb 92 04
ec 0f f2 fc 27 .
..............'
0090 54 03 19 7a 5
0 60 24 fa 80 63 2f
4a 0c 88 9d 4e T
..zP`$..c/J...N
00a0 0c e7 09 41 7
9 93 ea 01 8c 3d 28
ee 75 74 5b 08 .
..Ay....=(.ut[.
00b0 c7 3b 25 97 6
5 0a 5e 5c 35 ba a4
12 d8 72 26 6e .
;%.e.^\5....r&n
00c0 17 a5 88 38 8
8 fc 29 d4 45 4b 51
02 41 ac 1a 14 .
..8..).EKQ.A...
00d0 36 bc 64 82 2
7 27 0c be 95 a6 c6
a9 1d 48 b2 b1 6
.d.''.......H..
00e0 b3 00 3a 48 0
5 4c 15 3a c9 39 56
6b d0 fd 70 77 .
.:H.L.:.9Vk..pw
00f0 a5 85 b4 67 2
a db a6 55 ba fe 1e
d0 af 96 b7 6a .
..g*..U.......j
0100 7d ef 74 5c 6
7 1b a3 a8 34 17 6d
c9 6c f9 65 bf }
.t\g...4.m.l.e.
0110 6c 8a 98 ab 7
9 77 8d 48 6e 2c 25
f9 65 8c d5 26 l
...yw.Hn,%.e..&
0120 1a 2b 51 66 3
1 b7 d1 98 09 f5 0b
dc 88 0a 32 92 .
+Qf1.........2.
0130 f2 d8 c5 49 a
8 94 62 31 84 fa 1e
4f d0 d5 13 c7 .

..I..b1...O....
0140 05 82 ad d5 e
f 1e 2c 44 aa e9 5a
4f e5 9d 5f 36 .
.....,D..ZO.._6
0150 b4 f2 26 63 e
a 5a ef ee 25 7e b7
7c 77 98 bc 84 .
.&c.Z..%~.|w...
0160 4f a2 bb d2 c
2 c1 13 96 ad 6a d0
cf fe 70 3c 8d O
........j...p<.
0170 09 19 bc 05 8
2 48 54 89 c9 2c 15
01 70 30 46 5e .
....HT..,..p0F^
0180 40 1b 2d 11 c
0 23 cb 43 7f 25 53
0b 9d 92 cb f9 @
.-..#.C.%S.....
0190 0d 3e 93 8f a
6 13 61 b0 c0 b1 a7
12 18 01 dd 73 .
>....a........s
01a0 9c d8 24 40 5
4 1f 08 6b 6e c4 30
85 b7 7d 79 dc .
.$@T..kn.0..}y.
01b0 e1 7e 13 44 4
5 8a 04 cb 9c 0f 86
32 63 40 80 98 .
~.DE......2c@..
01c0 d9 c4 97 10 2
5 a2 01 01 32 0d d1
cb 81 02 27 ff .
...%...2.....'.
01d0 f9 3a a2 05 2
a 46 19 a4 2a 57 a6
ec 54 78 55 0e .
:..*F..*W..TxU.
01e0 5e c1 8e 3e c
c 92 c6 4e c7 20 0b
68 18 71 d2 65 ^
..>...N. .h.q.e
01f0 b4 e6 66 56 9
c 09 55 95 0e 98 a2
92 09 a0 af 42 .
.fV..U........B
0200 f1 3c 45 1f 6
9 01 fc 22 a6 44 f7
21 79 2a c8 71 .
<E.i..".D.!y*.q
0210 63 b5 82 ee c
1 ab 2d 59 e7 5e 72
7f 5d 8d dc 8a c
.....-Y.^r.]...
0220 73 33 68 b7 0
3 00 73 27 8a ff fb
92 04 e9 8f f2 s
3h...s'........
0230 f0 27 d4 03 3
8 c2 50 5d a4 ea 80
67 0f 4a 0b a8 .
'..8.P]...g.J..
0240 9b 56 0c 61 e
9 41 8a 91 eb 40 fc
25 28 98 75 62 .
V.a.A...@.%(.ub

0250 e8 55 cb dd e
b 80 08 a2 a6 e8 09
91 33 36 e8 da .
U..........36..
0260 25 53 7c 92 c
e 3b 49 86 e1 b9 82
ed ce cb ef d0 %
S|..;I.........
0270 96 07 1c 91 5
7 94 c2 77 33 4d 4d
95 cd d3 d4 b5 .
...W..w3MM.....
0280 9e 26 0e 45 8
9 39 82 63 c3 b1 c0
eb 0d 6a 7d 86 .
&.E.9.c.....j}.
0290 db d0 c7 84 4
f c6 43 bc 13 66 da
7f cc 13 0c 36 .
...O.C..f.....6
02a0 64 32 89 91 a
2 a8 2a 85 79 3d 6f
4d a9 ff fa 92 d
2....*.y=oM....
02b0 d1 28 4a e1 3
8 2e 63 5c 5f ed 0d
2d dd 42 c2 42 .
(J.8.c\_..-.B.B
02c0 c7 71 16 4d 1
c 80 2a 12 89 b6 45
02 b1 56 a6 55 .
q.M..*...E..V.U
02d0 a1 c8 d6 77 f
0 95 85 30 be c0 7e
90 63 63 fa 58 .
..w...0..~.cc.X
02e0 71 31 f1 49 e
3 53 b2 db 65 f3 b8
a6 f9 44 cd 4a q
1.I.S..e....D.J
02f0 dc 85 9e 9f c
6 73 3b bd 8e 00 00
cb 34 38 5c 6b .
....s;.....48\k
0300 f6 16 68 bd 9
4 21 1a ff fd 2b 11
11 2f 00 e5 2e .
.h..!...+../...
0310 d3 d2 af 53 9
d 4f a1 ce 50 48 25
61 a5 8d 31 08 .
..S.O..PH%a..1.
0320 ba 4a 31 47 e
a 29 2c 46 d5 45 10
d6 2a 7a e5 3c .
J1G.),F.E..*z.<
0330 6a 82 13 08 d
7 eb 0b 95 9b 43 5b
75 de f5 a7 61 j
........C[u...a
0340 17 42 ad d4 8
f d3 17 4c 3b 89 67
7b e2 b5 1a 8b .
B.....L;.g{....
0350 81 c3 27 43 c
c 11 0e 24 d0 74 b0
a5 eb 41 ca 55 .
.'C...$.t...A.U
0360 26 d1 01 fe 9

6 9e 43 3d f2 35 6c
11 32 96 97 bb &
.....C=.5l.2...
0370 35 6c 4c e1 d
7 4c 48 80 7c 4a 39
0d b2 c6 86 80 5
lL..LH.|J9.....
0380 c0 4a e6 7f 3
8 1a 92 53 a7 22 be
66 86 9d b0 20 .
J..8..S.".f...
0390 5c a5 c9 13 0
9 20 d9 29 0d 07 1b
c9 b4 9e b2 0d \
.... .)........
03a0 df 4f b7 b9 c
e 8a 51 7e d9 ea 50
7c aa c6 16 7a .
O....Q~..P|...z
03b0 0e 22 69 d1 7
9 77 b4 11 27 59 37
26 23 37 0f b5 .
"i.yw..'Y7&#7..
03c0 75 eb 16 47 d
b fc bf b4 9a 03 0a
ff fb 92 04 ea u
..G............
03d0 8f f2 f8 2b d
6 83 2f 62 60 5a 45
7b 00 63 08 4c .
..+../b`ZE{.c.L
03e0 0b 58 9b 58 0
d 3d 89 41 7d 92 ab
41 8c 31 28 a4 .
X.X.=.A}..A.1(.
03f0 2c 20 d9 33 9
7 fd b9 27 a3 ce e8
45 05 38 da 73 ,
.3...'...E.8.s
0400 86 2d e4 b4 7
e a1 ec 27 5e c0 78
1f ca cc a2 4a .
-..~..'^.x....J
0410 cd b3 37 a4 6
3 47 66 fd 31 e1 c0
bd a7 31 0b 19 .
.7.cGf.1....1..
0420 f5 cc a0 62 5
7 b9 ae bf cd 95 47
3d 9f 7f b4 e2 .
..bW.....G=....
0430 90 1b c3 65 0
5 48 a8 84 c1 91 3d
c7 66 c4 a0 02 .
..e.H....=.f...
0440 6d ac 89 76 6
c 9f b7 98 17 67 a9
9f fe a4 d1 40 m
..vl....g.....@
0450 ac 27 31 49 f
5 12 81 9d bb 8a 7d
f3 1d 42 8c 30 .
'1I......}..B.0
0460 05 fe e2 41 0
b 9d 3a a7 e2 d8 12
c1 42 29 73 83 .
..A..:.....B)s.
0470 22 d2 e9 ee c
5 94 0d ce 20 c2 b3

a3 cc 4d c2 6c "
....... ....M.l
0480 20 62 56 26 6
d ad fc b5 09 bb b9
83 58 a7 f5 0c
bV&m.......X...
0490 94 9c 09 8e 5
9 d3 2a 5a 81 23 78
85 46 77 cf 13 .
...Y.*Z.#x.Fw..
04a0 7b 2c 48 16 6
d da 16 ea d9 99 30
7d 7a 39 54 a9 {
,H.m.....0}z9T.
04b0 66 8e b3 4b 3
f 62 a2 44 6d 1c 49
5a 7b e0 8a cf f
..K?b.Dm.IZ{...
04c0 7a a9 13 15 f
1 7e da e4 d3 3a 71
a1 b9 55 81 52 z
....~...:q..U.R
04d0 4a 31 9f 80 6
0 48 b4 bb 39 72 cb
39 3a 2e e1 5e J
1..`H..9r.9:..^
04e0 fd 50 87 06 6
5 6c 06 63 bb 4a e7
8a 97 7b b7 88 .
P..el.c.J...{..
04f0 72 7f 21 08 4
e 5f 58 0f 8a 98 00
1c 0b 1f 20 90 r
.!.N_X....... .
0500 29 d1 80 a9 8
7 c5 de 58 98 1a 1a
b4 99 d6 9a dc )
......X........
0510 ea 94 6a ad b
6 d9 ed b0 70 bb 95
a1 90 16 50 29 .
.j.....p.....P)
0520 5b 00
[
.
No. Time
Source
Destination
Protocol
Length Info
301 11.62546500
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18642
9 Ack=1 Win=46 Len=
1260
Frame 301: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8

8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.675395000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.675395000 s
econds
[Time delta fro
m previous captured
frame: 0.063005000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06300500
0 seconds]
[Time since ref
erence or first fra
me: 11.625465000 se
conds]
Frame Number: 3
01
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco

m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf21c (61980)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a0e [validatio
n disabled]
[Good: Fals
e]
[Bad: False

]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 186429, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 186429 (relati
ve sequence number)
[Next sequence
number: 187689 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set

Window size val

ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x88a
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 1c 4
0 00 31 06 3a 0e 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 3a 6a 9e
87 4e aa 50 10 .
..P..+.:j..N.P.
0030 00 2e 88 a2 0
0 00 5d cd 25 7e 3a
88 4d 76 61 a2 .
.....].%~:.Mva.
0040 6c 2d 07 19 b
9 d2 b3 a6 d6 9e 4d
82 39 94 16 bc l
-........M.9...
0050 eb 74 bf 57 b
7 67 26 01 0f 23 92
ad 88 50 c6 d2 .
t.W.g&..#...P..
0060 6e 25 75 35 0
2 38 5d d3 77 7d 55
6c b6 92 48 d9 n
%u5.8].w}Ul..H.
0070 41 c1 33 41 e
1 04 23 16 1e d5 38
89 e9 e6 a1 0e A
.3A..#...8.....
0080 23 ff fb 92 0
4 ef 8f f3 03 24 d6
83 2f 5a 50 60 #
........$../ZP`
0090 84 8a d0 61 e
c 4a 0c 98 97 5a 0c
e1 69 41 a0 93 .
..a.J...Z..iA..
00a0 ab 41 8c 25 2
8 3a d3 c7 9d a6 e2
4d 43 a8 b5 96 .
A.%(:.....MC...
00b0 1e ff af a6 5
5 43 49 a0 55 6a 30
b6 92 15 28 7d .
...UCI.Uj0...(}

00c0 49 57 0c 22 c
0 e2 48 55 45 dd 84
20 a7 85 db 62 I
W."..HUE.. ...b
00d0 19 46 a3 8b a
2 f8 e9 1a c1 2b 85
8f 9c 24 fa 30 .
F.......+...$.0
00e0 b9 71 40 3e 4
7 81 c2 f4 d9 b5 56
db 16 65 5b 51 .
q@>G.....V..e[Q
00f0 55 b2 84 0f 1
6 68 40 00 51 8c 0c
8b d0 74 0d 2c U
....h@.Q....t.,
0100 d7 b9 0d 95 1
e 58 b7 2a c5 d6 e3
0a ca 92 55 bb .
....X.*......U.
0110 b0 37 90 64 0
b 58 f5 50 a1 04 56
62 22 43 3b b1 .
7.d.X.P..Vb"C;.
0120 57 14 2b 71 e
e 3e 10 a8 e5 b8 8c
ae 29 2e 99 14 W
.+q.>......)...
0130 cb ab 4d 11 7
f b3 97 4a b5 1a ae
a1 ff 2c b7 4a .
.M....J.....,.J
0140 3e 41 32 d5 8
2 45 07 24 92 8d 97
a8 ae 8e 86 3a >
A2..E.$.......:
0150 ac 68 a2 8c 8
a ba 16 ea 29 9b 9a
e7 e4 97 6e 1f .
h......).....n.
0160 41 34 ae 35 8
a 37 03 72 d5 9b 4b
c2 cb 81 b2 66 A
4.5.7.r..K....f
0170 89 24 b4 56 0
d c9 12 03 83 06 89
21 e1 bf 1c 89 .
$.V.......!....
0180 a2 33 eb 08 7
f ac bf 8f ad 89 97
79 d5 83 e3 d8 .
3.........y....
0190 e5 37 19 bb 5
b 54 b6 16 11 8b 5c
c1 e1 c4 92 c2 .
7..[T....\.....
01a0 13 da 30 a3 d
1 51 2f 4e c8 5a 44
ce 23 52 f8 c9 .
.0..Q/N.ZD.#R..
01b0 bb a9 95 ac 9
7 01 54 1b 34 eb 63
c5 1c 4d 80 6a .
.....T.4.c..M.j
01c0 b2 ce 4f 29 4
e b4 7b d7 fc ba 55
63 4a 06 77 08 .
.O)N.{...UcJ.w.
01d0 0e 35 90 a3 6

0 f0 0d b3 68 d8 c6
35 86 de f9 5d .
5..`...h..5...]
01e0 3d 88 25 bb 6
e 04 c9 1f 1b 6a 79
74 62 9e ed 4a =
.%.n....jytb..J
01f0 b0 03 78 70 4
0 64 8f 9e ad 47 bf
88 a7 73 6c 3a .
.xp@d...G...sl:
0200 fb 54 29 f3 3
6 a0 41 fe 67 17 f7
70 db 7e 59 2b .
T).6.A.g..p.~Y+
0210 8b d6 91 f3 8
c c7 a6 66 70 91 20
b4 7c e0 14 a0 .
......fp. .|...
0220 e4 b2 b1 ff f
b 92 04 e7 8f f3 06
21 56 03 38 4a .
..........!V.8J
0230 50 5e 44 7a c
0 61 e6 4a 0a f4 af
54 0c e1 09 81 P
^Dz.a.J...T....
0240 7e 95 ea c1 8
c 21 30 8c 52 92 43
b5 17 25 e9 66 ~
....!0.R.C..%.f
0250 23 85 1f a2 9
9 b9 69 1c d3 a4 49
cd 3c c4 51 c5 #
.....i...I.<.Q.
0260 c7 b1 25 87 0
8 a9 27 c3 3b b1 88
ce ed 30 97 96 .
.%...'.;....0..
0270 51 49 4b 35 6
3 c8 9a 87 db 70 5e
dd 1b 49 87 f2 Q
IK5c....p^..I..
0280 98 a4 18 d5 b
e bb 5f 3f 16 1f c5
f8 b9 15 f3 79 .
....._?.......y
0290 6a 3a 8a 88 d
0 85 30 5e 68 36 d1
11 81 52 65 4e j
:....0^h6...ReN
02a0 cb 99 5a 61 8
a 17 22 f6 93 a4 ad
c9 5a 55 55 7f .
.Za..".....ZUU.
02b0 4c 9d 0e e2 b
a 39 43 16 4c 60 34
dc 12 3d 97 01 L
....9C.L`4..=..
02c0 40 71 c0 0d 1
e 93 6d 3f 52 fe 2b
f6 ab df 29 2e @
q....m?R.+...).
02d0 93 d9 5e f3 8
5 17 dd 49 4c a5 48
2e 74 da 36 8f .
.^....IL.H.t.6.
02e0 ae 3f b0 d1 c
a e8 c9 94 8a f1 4b

2f 72 69 9b 5a .
?........K/ri.Z
02f0 bd 3e cb 66 b
d 9d b2 79 04 ec 52
24 b9 e7 96 e0 .
>.f...y..R$....
0300 e9 54 84 48 b
4 da 56 91 1c b2 2f
a9 36 c8 bd 9e .
T.H..V.../.6...
0310 af ff a0 dd 0
e 42 06 22 62 1a 0f
64 b7 1f 34 3d .
....B."b..d..4=
0320 c1 68 24 ea 9
4 92 1c 05 b6 57 a8
75 86 c2 12 e7 .
h$......W.u....
0330 01 20 e9 53 a
a ef 25 40 cb e4 d3
40 dc 24 90 68 .
.S..%@...@.$.h
0340 d3 1f 06 93 9
6 b5 8a ff f5 ed 7d
f8 61 aa 74 cb .
.........}.a.t.
0350 e6 7f 70 ee b
5 22 93 a4 56 2a 11
70 58 1f 33 99 .
.p.."..V*.pX.3.
0360 8b 29 43 df 8
c 6c 57 ed c5 fd fe
4e 8d 0a 61 86 .
)C..lW....N..a.
0370 14 98 3c 91 3
3 b2 ef a5 79 11 96
72 9e ac 00 45 .
.<.3...y..r...E
0380 41 f5 2a 82 b
f 69 2b be 25 0d d0
d5 94 8a 66 f5 A
.*..i+.%.....f.
0390 ac 25 b2 2b f
8 56 ad 75 7d 6b 1c
f5 94 38 8b fa .
%.+.V.u}k...8..
03a0 8f 34 54 2a a
d fa ff 37 ad 66 db
55 2d 02 5f 23 .
4T*...7.f.U-._#
03b0 e8 99 b6 e9 e
3 db 59 bc 08 73 53
3f 5f 76 cc dc .
.....Y..sS?_v..
03c0 c2 48 c0 c2 3
7 ff fb 92 04 eb 0f
f3 00 27 d4 83 .
H..7........'..
03d0 39 7a 50 63 6
4 9a a0 63 0c 4a 0c
0c 9b 52 0c e1 9
zPcd..c.J...R..
03e0 89 41 6a 93 e
a c0 f7 a5 28 80 e5
21 11 96 50 41 .
Aj.....(..!..PA
03f0 2b 16 ab ad f
f e8 7e 59 62 39 be
10 f8 f1 d4 e2 +

.....~Yb9......
0400 1d 5f 4e 48 a
9 52 25 3b e3 ae cb
77 47 68 6e bb .
_NH.R%;...wGhn.
0410 b3 48 8f 6c b
6 45 52 1e 6f 67 aa
e5 5d 37 9b 10 .
H.l.ER.og..]7..
0420 ef e0 58 39 b
d 86 ad 25 3e 45 85
ce 63 66 2b 51 .
.X9...%>E..cf+Q
0430 b0 5d 2d b3 c
5 8c fa 6a e3 92 5c
00 48 e8 80 59 .
]-....j..\.H..Y
0440 46 4f c8 87 0
1 a1 28 06 2a 51 a1
1b c8 ba 06 09 F
O....(.*Q......
0450 d9 ff a3 5f f
8 c7 60 2a c8 0f 86
58 5d a4 43 05 .
.._..`*...X].C.
0460 0c f0 ac 03 2
8 10 dd 61 27 a4 4c
a9 fe 8a bb 19 .
...(..a'.L.....
0470 e5 3e 5c c9 1
6 38 b7 49 3e f9 49
84 42 86 12 ab .
>\..8.I>.I.B...
0480 54 a1 ea 5a f
f 2b 96 10 9a 4f 6a
67 33 f9 b3 6a T
..Z.+...Ojg3..j
0490 5b 30 7d 58 2
1 45 d5 33 17 c1 a6
72 d8 0f 84 14 [
0}X!E.3...r....
04a0 a0 29 84 e1 4
7 30 95 ec 15 6a bd
15 97 ca 3e 86 .
)..G0...j....>.
04b0 90 e0 a9 40 f
1 29 5a 8b 2e 7f e5
f0 21 29 5e e5 .
..@.)Z.....!)^.
04c0 93 c7 fa 50 3
5 17 fb 52 a8 24 60
31 7b 56 62 6d .
..P5..R.$`1{Vbm
04d0 9a 4f 53 79 5
1 24 f8 ee 65 51 c2
e9 e1 ef 47 b0 .
OSyQ$..eQ....G.
04e0 aa 25 d5 ad 3
1 ae 83 f8 66 6f b2
5a 48 b8 99 62 .
%..1...fo.ZH..b
04f0 e5 26 88 92 d
f 2e 31 31 75 0a f7
21 c3 2a 6b 52 .
&....11u..!.*kR
0500 e4 b6 e7 53 e
8 67 fa 6a 77 58 71
c4 16 3c f0 31 .
..S.g.jwXq..<.1

0510 8c 32 8e 24 4
0 da 7b 49 00 90 5b
0b aa 58 a5 2f .
2.$@.{I..[..X./
0520 53 e3
S
.
No. Time
Source
Destination
Protocol
Length Info
302 11.62565700
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=187689 Win=38745 L
en=0
Frame 302: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.675587000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.675587000 s
econds
[Time delta fro
m previous captured
frame: 0.000192000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00019200
0 seconds]
[Time since ref
erence or first fra
me: 11.625657000 se
conds]
Frame Number: 3
02
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f

rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not

-ECT (Not ECN-Capab

le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f89 (20361)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 18768
9, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 187689 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38745
[Calculated win
dow size: 38745]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 301]
[The RTT to
ACK the segment wa
s: 0.000192000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 89 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 3f 56 50 10 .
....P..N.+.?VP.
0030 97 59 18 d4 0
0 00
.
Y....

No. Time
Source
Destination
Protocol
Length Info
303 11.63946400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
879 http49
574 [PSH, ACK] Seq=
187689 Ack=1 Win=46
Len=825
Frame 303: 879 byte
s on wire (7032 bit
s), 879 bytes captu
red (7032 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.689394000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.689394000 s
econds
[Time delta fro
m previous captured
frame: 0.013807000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01380700
0 seconds]
[Time since ref
erence or first fra
me: 11.639464000 se
conds]
Frame Number: 3
03
Frame Length: 8
79 bytes (7032 bits
)
Capture Length:
879 bytes (7032 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]

Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
65
Identification:
0xf21d (61981)
Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bc0 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 187689, Ack:
1, Len: 825
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 825]
Sequence number
: 187689 (relati
ve sequence number)
[Next sequence
number: 188514 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t

.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x1e2
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 825]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 61 f2 1d 4
0 00 31 06 3b c0 4a
7c 0c 8a c0 a8 .
a..@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cb 3f 56 9e
87 4e aa 50 18 .
..P..+.?V..N.P.
0030 00 2e 1e 28 0
0 00 25 82 1d 47 41
9b 2e 08 9d f6 .
..(..%..GA.....
0040 89 0b b1 4d 6
7 2c 97 e3 d4 93 d0
f6 70 3b 45 54 .
..Mg,......p;ET
0050 ff 2a 96 33 f
9 97 70 b3 1b 4e 77
85 8f f1 26 f5 .
*.3..p..Nw...&.
0060 a8 54 79 ad 5
2 db 6c 8f 6b c7 f2

ba a9 89 31 08 .
Ty.R.l.k.....1.
0070 a0 57 24 28 3
c 28 b9 bb 44 af 7b
ff fb 92 04 ea .
W$(<(..D.{.....
0080 8f f3 20 2c d
4 03 58 7a 60 5f 84
8a a0 63 0b 4a .
. ,..Xz`_...c.J
0090 0b 40 99 52 0
c e5 e9 41 5f 13 6a
c1 8c 2d 28 d3 .
@.R...A_.j..-(.
00a0 6e 4b a5 3f e
c fa 89 e3 e2 94 32
48 c8 5f 97 91 n
K.?......2H._..
00b0 d6 43 0e 54 2
6 b7 ca 1f 6d 90 b7
23 48 62 8d 12 .
C.T&...m..#Hb..
00c0 f4 a8 b9 8d 3
a de 2d 15 f8 ad 85
4b 2c 21 36 ce .
...:.-....K,!6.
00d0 97 a8 60 7d 1
c e3 0b cb ce f8 d4
50 7a 9d 8a e7 .
.`}.......Pz...
00e0 eb 89 9d c9 b
7 3d fd 4b be e7 8f
0b 03 37 2c fa .
....=.K.....7,.
00f0 2d bd 40 b3 5
a d2 68 ad ae 8f e7
52 e2 87 bb bf .@.Z.h....R....
0100 fb fd 0c 04 0
a a4 e2 08 40 80 a8
f4 37 66 b4 92 .
.......@...7f..
0110 ae 42 c8 4b c
3 09 27 d2 53 17 2e
5d c8 6e e2 a8 .
B.K..'.S..].n..
0120 3c 99 bf b4 8
f dc a2 3d 22 cb af
a4 85 b4 a6 89 <
......=".......
0130 11 43 92 56 e
c 74 68 56 79 f4 7b
f1 1f a5 71 ae .
C.V.thVy.{...q.
0140 c6 18 c9 62 2
6 7b 6f 4e b7 d3 59
7f 6b 7d d9 a6 .
..b&{oN..Y.k}..
0150 4e 45 f2 d6 4
9 94 16 20 b6 68 75
94 de d4 27 ff N
E..I.. .hu...'.
0160 a1 d8 72 85 a
e 8b 6d 65 37 12 c9
dc 4d 47 c1 a4 .
.r...me7...MG..
0170 09 39 31 e1 a
5 1a 5e 61 96 6e f0
45 5c 04 28 5d .

91...^a.n.E\.(]
0180 92 ec df 17 e
2 1c b9 2e b7 c0 e1
d1 68 16 1c 38 .
...........h..8
0190 c6 f6 88 a0 4
e 49 d1 04 34 a1 ee
62 70 ce ba 9f .
...NI..4..bp...
01a0 52 b6 b2 e7 0
3 d2 f9 ed be 27 17
28 44 47 63 84 R
........'.(DGc.
01b0 c2 90 55 e5 4
5 9e f2 30 c1 47 53
b4 8b fb fd ec .
.U.E..0.GS.....
01c0 bf a7 be 6e 5
a 29 bc 42 00 c5 80
fc 5c 20 da 94 .
..nZ).B....\ ..
01d0 31 61 2b 11 8
1 8a 0c 63 ac 12 6c
05 df e9 25 32 1
a+....c..l...%2
01e0 1e 52 c3 99 7
a ae 3a 46 7b 9a 6a
c7 9b 48 a5 60 .
R..z.:F{.j..H.`
01f0 90 cd 5f a1 f
0 cb 6a 17 b8 58 d4
0d 5a 25 6d 9d .
._...j..X..Z%m.
0200 5e db dc 8c b
4 d5 60 e6 90 dc f5
db 2f 5a 6b e7 ^
.....`...../Zk.
0210 fc 7f 6d fd c
1 81 50 db 4c 8d 25
2f ff ff fb 92 .
.m...P.L.%/....
0220 04 ee 8f f3 3
2 28 54 03 58 7a 50
5c 24 9a a0 3f .
...2(T.XzP\$..?
0230 0c 4a 0b cc b
9 50 0c 61 89 81 8c
13 aa 41 8c 25 .
J...P.a.....A.%
0240 28 ea 63 19 f
f ac b6 06 c8 47 82
cc d0 43 ca 51 (
.c......G...C.Q
0250 10 32 4b 72 4
a 42 53 9e 12 dd df
51 f0 4b aa 3f .
2KrJBS....Q.K.?
0260 91 d4 11 c5 3
b 62 51 09 7c b2 9c
e7 3a e2 7b 4c .
...;bQ.|...:.{L
0270 f0 50 18 cb 4
8 66 22 91 3e 0d 84
79 c5 75 8c 95 .
P..Hf".>..y.u..
0280 f8 be fd 2a 8
3 2e 3d 15 b7 9d 49
8b 39 ea 36 f4 .
..*..=...I.9.6.

0290 b4 b8 68 cd a
6 18 77 b3 00 7f fe
cf fa b4 37 ac .
.h...w.......7.
02a0 50 12 06 89 a
8 0f 4c 2c f4 0c 69
a0 ac e8 4e 4b P
.....L,..i...NK
02b0 f6 a8 86 a8 c
c fd 0c 32 55 0d b1
ce 31 bb ec 25 .
......2U...1..%
02c0 b5 e5 35 4a 5
9 35 49 2d 7c db af
14 db 6f 48 fa .
.5JY5I-|....oH.
02d0 05 00 7d 28 6
6 24 f8 88 1d 5a db
cd 06 f6 3e ff .
.}(f$...Z....>.
02e0 76 91 a5 b3 7
7 3d 3b 8b bd f3 1f
82 f8 27 f6 de v
...w=;......'..
02f0 93 5c 9c fa 4
5 49 c8 b4 08 f1 10
20 54 a3 79 95 .
\..EI..... T.y.
0300 08 61 3d 05 e
8 ee 4b 30 70 c9 b0
bb 90 89 09 48 .
a=...K0p......H
0310 31 3c 8f 2d c
5 69 2c 74 ed 6d 14
31 59 85 07 0e 1
<.-.i,t.m.1Y...
0320 c3 b3 f6 cb c
a a7 e8 a9 a6 da cd
99 8a bc f8 32 .
..............2
0330 77 1e c9 55 2
5 02 dc d9 7e b5 87
58 94 b3 d7 6c w
..U%...~..X...l
0340 6e bb bd c2 d
4 55 c5 69 f1 32 b6
25 f7 75 2d 7e n
....U.i.2.%.u-~
0350 28 df 4c db 5
e 2b 8b b9 e9 7a de
04 39 11 a8 f4 (
.L.^+...z..9...
0360 7a 85 0c b1 7
4 23 c6 ff 56 96 59
f6 f5 a2 56
z
...t#..V.Y...V
No. Time
Source
Destination
Protocol
Length Info
304 11.76846600
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18851

4 Ack=1 Win=46 Len=

1260
Frame 304: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.818396000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.818396000 s
econds
[Time delta fro
m previous captured
frame: 0.129002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12900200
0 seconds]
[Time since ref
erence or first fra
me: 11.768466000 se
conds]
Frame Number: 3
04
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf21e (61982)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a0c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 188514, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 188514 (relati
ve sequence number)
[Next sequence
number: 189774 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x2e6
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2085]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 1e 4
0 00 31 06 3a 0c 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 42 8f 9e
87 4e aa 50 10 .
..P..+.B...N.P.
0030 00 2e 2e 63 0
0 00 0b 05 2c 12 3a
6c 41 20 89 86 .
..c....,.:lA ..
0040 83 05 9a 20 e
5 63 44 63 5d 07 09
05 4b 69 0b 06 .
.. .cDc]...Ki..
0050 9e 33 76 3f 5
5 a3 54 9b 96 d3 d8
86 a5 b3 97 25 .
3v?U.T........%
0060 56 ac dd 10 8
6 e8 d9 7a 5d 81 af
19 b2 33 e8 25 V
......z]....3.%
0070 89 5b 2d 75 f
0 96 ac b9 cc 18 18
79 6e bb ac fa .
[-u.......yn...
0080 b6 22 75 6e 7
e 54 ff fb 92 04 eb
8f f2 ee 2e 54 .
"un~T.........T
0090 03 0f 7a 60 5
a 04 da a0 3f 09 4a

0c dc bb 4c 0c .
.z`Z...?.J...L.
00a0 e1 89 81 a0 9
4 aa 41 8c 3d 30 da
26 f3 f0 13 8a .
.....A.=0.&....
00b0 11 34 78 63 a
0 bb d0 96 74 46 15
88 81 68 b2 8e .
4xc....tF...h..
00c0 c5 d5 66 68 0
2 42 64 3a 8d ec 15
94 af d6 07 42 .
.fh.Bd:.......B
00d0 46 a6 99 75 e
4 95 0a 21 be 94 ea
95 f7 8b eb 2b F
..u...!.......+
00e0 3b 8d 11 97 a
f ea 04 d5 d3 f7 b0
63 78 c5 4c 7b ;
..........cx.L{
00f0 ae d4 34 85 9
b 52 b0 b5 ad 5d aa
17 fb 8c f2 0c .
.4..R...]......
0100 a1 06 a5 30 3
c 65 2f 6b d0 d5 d5
bb 76 9d cc fb .
..0<e/k....v...
0110 ef 75 1d d7 d
9 fd c9 45 11 43 22
75 83 16 03 97 .
u.....E.C"u....
0120 97 54 0c f9 9
4 0d 04 59 02 4e 16
c0 01 1a c4 91 .
T.....Y.N......
0130 2c 99 50 72 a
6 a5 de 9b 8f f2 e1
66 58 9d 1a c0 ,
.Pr.......fX...
0140 7f d4 cd 4b 1
d 81 65 1e 13 7a 89
f0 d1 62 ff f2 .
..K..e..z...b..
0150 e8 b7 a8 15 f
2 b2 f5 76 bb 6b 3c
ff c2 8f 8a 2c .
......v.k<....,
0160 ef b2 cd 97 2
c 0e b1 67 1a 8a ec
26 73 e4 ba 37 .
...,..g...&s..7
0170 25 a6 a8 ca 3
9 0d 05 0b 54 9b 90
9e 85 63 54 c4 %
...9...T....cT.
0180 a9 9f 59 af 6
b a0 c2 40 50 65 3a
7c e5 a8 06 73 .
.Y.k..@Pe:|...s
0190 6d da 94 48 9
c ee f3 fd 4f 17 fc
be 8d 6a a7 ac m
..H....O....j..
01a0 9c 46 3c 4f 4
9 0e 46 fe 88 67 84
ca cb da 9d 8e .

F<OI.F..g......
01b0 f8 76 39 dc b
b dd d3 8c f0 6d 42
c6 c7 b2 f5 08 .
v9......mB.....
01c0 91 3e 7f 26 6
b a2 3a 63 37 b5 7f
d1 be a6 7a 3e .
>.&k.:c7.....z>
01d0 56 60 a6 67 e
7 b2 c7 52 24 c5 89
10 60 1e 06 34 V
`.g...R$...`..4
01e0 b4 cc d8 75 a
e 00 80 cb 71 4d a0
46 c6 d3 65 6f .
..u....qM.F..eo
01f0 44 ae 18 c3 5
8 41 93 53 9a cf 86
0d e8 16 e8 55 D
...XA.S.......U
0200 83 e5 6b e9 5
c c6 84 95 f5 99 c1
92 09 71 9b d5 .
.k.\........q..
0210 3d 2a 77 5e e
f 7f e5 6d 2e d2 29
d1 f9 7d 5e c7 =
*w^...m..)..}^.
0220 08 41 51 a0 4
5 24 30 7a ff fb 92
04 e7 0f f2 f9 .
AQ.E$0z........
0230 26 d3 03 58 7
a 50 5d e4 8a 90 63
0f 4a 0b 38 9d &
..XzP]...c.J.8.
0240 4c 0d 3d e9 4
1 80 13 6a 01 8c 31
28 11 72 f6 20 L
.=.A..j..1(.r.
0250 fa b5 3b b0 0
9 88 8e 8a db 16 e2
00 d5 e9 21 e3 .
.;...........!.
0260 e4 05 4e 29 3
6 31 e5 f0 02 8b 4e
ec 52 3a 54 4c .
.N)61....N.R:TL
0270 e6 53 b0 44 3
d df ff f8 55 d6 7d
85 52 71 a1 a3 .
S.D=...U.}.Rq..
0280 d1 07 2a 44 8
b 4f 0b ea 0c 45 23
71 ce b4 12 37 .
.*D.O...E#q...7
0290 1f 4e b1 e4 0
e 3d 9c d8 7d 76 ac
f9 a2 93 7a 9a .
N...=..}v....z.
02a0 ed 4f 30 72 a
8 52 18 71 57 5b 58
72 ba 53 52 35 .
O0r.R.qW[Xr.SR5
02b0 71 1b 77 5d e
8 66 86 38 29 d4 08
21 16 2c 70 80 q
.w].f.8)..!.,p.

02c0 51 00 c8 21 0
9 ac fc bf b4 02 12
22 4d 9a 8c 66 Q
..!......."M..f
02d0 1e e5 bb 51 1
b 97 2f 43 f1 4e db
a1 e5 03 ce d8 .
..Q../C.N......
02e0 5b 1e b6 7e 2
5 1c b4 b2 cc 2c 2b
0c 98 99 60 0f [
..~%....,+...`.
02f0 2a b3 1f 7b a
d 82 b7 9c 29 9b 6f
23 75 73 a8 a9 *
..{....).o#us..
0300 cb 16 64 73 3
d fb f7 62 38 68 b1
50 b9 d6 8d 3d .
.ds=..b8h.P...=
0310 46 f6 b0 77 4
b 92 89 c3 c1 16 7a
71 29 f4 84 7a F
..wK.....zq)..z
0320 0a 8a 95 b0 c
4 f2 80 ab e6 dd 83
d6 e2 76 0f c9 .
............v..
0330 7e b5 7c 32 8
2 a4 92 0c 3b ae 43
b7 5d 1e 7a 96 ~
.|2....;.C.].z.
0340 5b 79 81 3a 8
d 0f 40 24 07 5e 35
2c 81 b3 98 9c [
y.:..@$.^5,....
0350 30 ce 2d 24 c
b 2a 26 ca 2d 66 35
ab 23 7e df e4 0
.-$.*&.-f5.#~..
0360 e5 97 16 87 d
6 2c e1 ec 10 d8 7d
8e 6a 0d f7 7a .
....,....}.j..z
0370 9f e5 bf 46 9
a 43 04 e1 6b e4 f3
4f f4 ac 35 cd .
..F.C..k..O..5.
0380 cb 59 cc 9c 8
c 1c 80 cf 13 00 e8
26 62 6e 5c 30 .
Y.........&bn\0
0390 b4 d8 98 47 d
a 02 74 b9 ae 5b 96
1e c7 22 d3 a4 .
..G..t..[..."..
03a0 f2 2a a2 d3 1
c cf 55 8b b5 32 45
fb 22 8e 03 ce .
*....U..2E."...
03b0 85 37 4d 59 6
9 e6 f6 a6 31 2c 68
af e7 9f c7 dc .
7MYi...1,h.....
03c0 57 d1 df e2 7
e 17 79 90 e0 90 ff
fb 92 04 ea 8f W
...~.y.........
03d0 f2 e9 27 52 8

3 38 62 50 62 e5 ba
80 63 0d 4c 0b .
.'R.8bPb...c.L.
03e0 f4 b1 4a 0d 6
1 89 81 7f 96 2a 01
8c 2d 30 9a 1c .
.J.a....*..-0..
03f0 c4 45 76 1f 5
d 4f 2b 5e 38 85 67
3c a9 50 80 37 .
Ev.]O+^8.g<.P.7
0400 4c 1c 77 bc 1
2 47 13 7b 92 30 99
88 20 4e cc f1 L
.w..G.{.0.. N..
0410 80 1c 4a 6d 6
d 4f 92 68 f3 54 70
95 84 aa 32 ba .
.JmmO.h.Tp...2.
0420 22 e3 94 68 1
8 54 ce 97 1a 8d a4
1a f6 3b 7e 5f "
..h.T.......;~_
0430 90 1e 52 96 b
a 2e fc f5 ff 95 b7
d5 77 c7 45 07 .
.R.........w.E.
0440 92 8d 28 ea 9
f 46 fa aa c9 ba 9e
cb fa aa ff d4 .
.(..F..........
0450 d2 15 ca 19 b
6 e6 50 06 24 e1 21
bb a5 43 4f 0e .
.....P.$.!..CO.
0460 5d a3 91 20 5
1 5a 3b ae 16 04 f8
f1 b0 3e ef 4c ]
.. QZ;......>.L
0470 2a a5 80 2c 2
5 fe 71 dd a8 12 42
34 c5 2a 41 08 *
..,%.q...B4.*A.
0480 7a ae 14 83 0
0 bf a4 02 b2 5b 53
0d ac 0e ec e2 z
........[S.....
0490 76 27 e0 3f 6
7 6c 43 22 a9 e7 78
e3 02 55 1e d7 v
'.?glC"..x..U..
04a0 d1 f5 de 77 8
c 6b 31 81 8d e8 08
82 6a 4f 2e 7a .
..w.k1.....jO.z
04b0 2c e8 b3 d0 c
f a6 a2 00 00 4d 03
10 16 72 66 23 ,
........M...rf#
04c0 a9 43 ee aa 4
6 ce ca e3 2a 10 9c
ad c6 81 fb 85 .
C..F...*.......
04d0 cc 52 c5 20 e
9 4a d7 9d 76 2f a8
fa d6 9f 45 09 .
R. .J..v/....E.
04e0 5b 5e 11 84 d
a bd 74 3f 1f 3e 84

ee 3a a1 4c dd [
^....t?.>..:.L.
04f0 33 32 3d b1 7
6 e6 c0 74 54 ff 99
e5 70 f1 3f 3c 3
2=.v..tT...p.?<
0500 58 d9 f7 df a
6 65 ce 29 e9 f5 bb
db 1a 87 9c a2 X
....e.)........
0510 ce b5 0f 14 3
0 a7 1b d7 7f 23 45
d8 16 20 18 0c .
...0....#E.. ..
0520 40 13
@
.
No. Time
Source
Destination
Protocol
Length Info
305 11.76864600
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=189774 Win=38223 L
en=0
Frame 305: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.818576000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.818576000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 11.768646000 se
conds]
Frame Number: 3
05

Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f8a (20362)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 18977
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment

number: 189774 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38223
[Calculated win
dow size: 38223]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 304]
[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 8a 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .

(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 47 7b 50 10 .
....P..N.+.G{P.
0030 95 4f 18 d4 0
0 00
.
O....
No. Time
Source
Destination
Protocol
Length Info
306 11.83946900
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=18977
4 Ack=1 Win=46 Len=
1260
Frame 306: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.889399000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.889399000 s
econds
[Time delta fro
m previous captured
frame: 0.070823000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07082300
0 seconds]
[Time since ref
erence or first fra
me: 11.839469000 se
conds]
Frame Number: 3
06
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor

ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =

Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf21f (61983)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a0b [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 189774, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 189774 (relati
ve sequence number)
[Next sequence
number: 191034 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:

20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc89
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 1f 4
0 00 31 06 3a 0b 4a
7c 0c 8a c0 a8 .
...@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 47 7b 9e
87 4e aa 50 10 .
..P..+.G{..N.P.
0030 00 2e c8 9c 0
0 00 a5 42 ba e5 30
db c4 c3 0a 0e .
......B..0.....

0040 ce 69 b4 a3 3
2 b8 0a 5a dc f3 d6
61 49 a9 39 1c .
i..2..Z...aI.9.
0050 55 5d 51 a7 6
d 25 28 79 e8 da 40
e8 12 23 a4 e7 U
]Q.m%(y..@..#..
0060 50 26 f0 77 d
e 12 2a 13 aa c6 a4
f0 5f 48 e5 06 P
&.w..*....._H..
0070 24 48 d4 c3 e
8 52 93 f6 19 f5 0f
f9 73 8f 6d 7c $
H...R......s.m|
0080 ff fb 92 04 e
9 8f f2 e3 28 53 83
0f 7a 50 5a 84 .
.......(S..zPZ.
0090 fa 80 61 ec 4
a 0c 20 9d 54 0c 65
e9 41 9c 16 ea .
.a.J. .T.e.A...
00a0 01 8c 3d 30 e
3 5b c6 f1 af 0a b6
0c a8 3a 9e e5 .
.=0.[.......:..
00b0 b2 96 8e 22 4
0 93 1a 32 bc 1d 13
15 16 53 fa 39 .
.."@..2.....S.9
00c0 d0 e5 96 b2 d
a a2 26 c0 96 3b c9
d3 f2 47 58 d0 .
.....&..;...GX.
00d0 8e 45 86 26 5
2 0c b4 a2 6c d3 44
53 b6 d2 1b c9 .
E.&R...l.DS....
00e0 c8 06 27 39 0
7 e5 01 e7 24 ad 5a
77 1a 2c 3b 43 .
.'9....$.Zw.,;C
00f0 4d 35 16 ab 7
a 41 2e a9 86 ea 55
86 e5 36 b5 5c M
5..zA....U..6.\
0100 a0 2e 20 0e 2
c ab c7 38 e5 e2 43
8d fb db 44 c4 .
. .,..8..C...D.
0110 10 84 e1 22 b
4 97 06 04 5b b1 78
a1 d0 aa 33 0f .
.."....[.x...3.
0120 25 33 9a bc c
6 64 67 7e 86 2b 5a
99 c4 f1 3c fd %
3...dg~.+Z...<.
0130 e1 8a f8 81 a
b 5b 0b 06 1f 2a 4d
f5 b6 49 23 4b .
....[...*M..I#K
0140 24 19 d5 0f 3
7 0d 73 0f 79 9f 0f
75 9a 53 1e f7 $
...7.s.y..u.S..
0150 8e e1 70 38 1

0 e8 20 08 39 e6 cb
a7 2a 6c 0e 97 .
.p8.. .9...*l..
0160 a8 00 b7 fa 1
c be 28 ec 67 fe 8f
cb c1 4a 02 18 .
.....(.g....J..
0170 02 15 f1 92 4
8 04 c4 58 cd 03 11
0a 3f 26 62 47 .
...H..X....?&bG
0180 a7 cb d2 32 f
0 d4 0a 56 05 5a 78
c8 db 01 35 66 .
..2...V.Zx...5f
0190 19 6a 1a 10 c
a 2b 9c 5e 2d 4d 24
6b d2 b1 99 1e .
j...+.^-M$k....
01a0 4f 96 d7 f2 6
a d8 61 d6 75 4b 56
fb 8f 37 dd f7 O
...j.a.uKV..7..
01b0 ad 6a 94 81 a
0 40 d0 1c b9 7c b9
b0 38 3e 7c 80 .
j...@...|..8>|.
01c0 d9 f5 9f d4 e
5 be a0 c7 04 1d 6a
7f 12 2a d3 47 .
.........j..*.G
01d0 06 9a 08 86 e
5 8a db 1e a0 8e 61
52 3e a1 2e 56 .
.........aR>..V
01e0 da da 2d 03 b
9 47 d3 60 6d 1d 11
a1 25 df 02 a3 .
.-..G.`m...%...
01f0 93 60 77 12 5
a 6a 42 d9 84 42 67
56 f6 a6 83 9b .
`w.ZjB..BgV....
0200 d4 bd 8c 7c c
7 67 58 ab ce cf 6a
b8 e1 11 63 60 .
..|.gX...j...c`
0210 41 f0 3d e3 0
5 82 a2 81 a0 f3 18
22 b1 fb 8b 85 A
.=........"....
0220 cc d8 ff fb 9
2 04 e9 0f f3 01 2d
d6 03 18 7a 60 .
.........-...z`
0230 5e 84 8a b0 6
1 f8 4a 0b b0 8b 62
0c 3d e9 41 84 ^
...a.J...b.=.A.
0240 13 eb c0 f7 b
d 28 ea 2c ae da 7a
ff cf d4 66 03 .
....(.,..z...f.
0250 94 ba 80 f4 7
5 27 5c 0d d7 24 82
41 b1 bd 3d 19 .
...u'\..$.A..=.
0260 8d 6d ad 61 c
b 3b 57 b9 cd 09 b9

59 3c 24 73 e2 .
m.a.;W....Y<$s.
0270 85 a6 c8 5e a
d 16 32 37 10 b7 5b
89 46 6a e1 19 .
..^..27..[.Fj..
0280 71 26 3a 20 b
b 36 12 81 dc 4d 8c
eb 27 0e c7 37 q
&: .6...M..'..7
0290 43 be 6f e7 9
4 b1 ac 4c 87 2b 00
56 3e e1 70 18 C
.o....L.+.V>.p.
02a0 5c c9 16 35 b
9 c4 ae 9c 83 03 17
75 bb fa 54 82 \
..5.......u..T.
02b0 ac 1c 43 fc d
1 65 18 8a cb b7 d8
a6 3c 0e 9a f2 .
.C..e......<...
02c0 5c 81 2e 15 f
9 77 01 31 85 21 50
ac 8c fb 22 07 \
....w.1.!P...".
02d0 97 30 22 58 d
b 08 bf 7b 13 2d 93
56 1b 39 c6 5b .
0"X...{.-.V.9.[
02e0 93 61 2b 8c a
7 2f 3f 70 4f 3a 8e
15 07 80 63 cd .
a+../?pO:....c.
02f0 26 69 22 40 7
d 48 18 75 e6 80 80
9e 92 cb 36 a7 &
i"@}H.u......6.
0300 27 69 f8 b0 f
1 c3 68 13 8c 04 f1
7d 0d 41 2e c7 '
i....h....}.A..
0310 54 f0 a6 12 0
2 9c e5 50 97 87 07
6c 63 60 fb 0c T
......P...lc`..
0320 2e d1 56 18 4
e b6 08 98 2c 24 8a
ec bc 5e f0 02 .
.V.N...,$...^..
0330 cf 51 4c 92 0
4 9a 43 c6 95 3d e3
6e e6 b7 2f 0e .
QL...C..=.n../.
0340 79 ab af 7d f
0 bc e6 65 11 c6 0f
9d cf db 9b 03 y
..}...e........
0350 3e 8d 41 de d
5 00 3f fd ef 9d f2
7b ff b9 fe 7f >
.A...?....{....
0360 73 2a fe fa 9
a fe de 6f ea b7 fa
df cd 73 b3 d5 s
*.....o.....s..
0370 37 1d 98 03 3
a 0e cc b4 6a 92 ac
f1 16 50 0b ce 7

...:...j....P..
0380 50 63 b9 ae 2
e ea 65 0d c5 36 d0
f7 78 b0 09 e0 P
c....e..6..x...
0390 2b 89 e1 74 7
1 69 13 31 68 fc 71
db 90 8d 6c 2e +
..tqi.1h.q...l.
03a0 2c db 75 ab 6
f b8 a7 97 2a ea 63
0d 63 c3 b1 33 ,
.u.o...*.c.c..3
03b0 66 89 86 10 4
9 ce 2f 6b de a1 55
ac 46 f4 14 cf f
...I./k..U.F...
03c0 c4 44 40 40 f
f fb 92 04 e9 0f f2
f0 25 59 83 0f .
D@@........%Y..
03d0 5a 50 5e 46 c
b 20 3d e3 5c 0c 54
9b 68 07 b1 29 Z
P^F. =.\.T.h..)
03e0 41 79 13 ad 0
0 f4 99 29 22 45 8b
6e 72 b6 29 ec A
y.....)"E.nr.).
03f0 5e fd 04 84 c
5 e0 64 be c3 b9 34
e5 4b 48 c5 2d ^
.....d...4.KH.0400 14 34 a9 a3 6
1 e5 e2 84 33 a1 71
24 e4 bb 11 09 .
4..a...3.q$....
0410 e0 7f ce 1a 4
6 85 a2 ca c6 87 3e
65 e4 67 ac 73 .
...F.....>e.g.s
0420 48 f5 b5 1d 5
c b9 b7 ba ae 62 b1
fc 36 e5 56 77 H
...\....b..6.Vw
0430 a7 ff ee 3e c
6 7c 7c cf 9f 9e c6
87 83 ea 0a ad .
..>.||.........
0440 62 37 a0 a5 8
1 e7 88 8b 38 24 81
40 b5 c5 9c af b
7......8$.@....
0450 7f d9 d4 34 9
9 0f 03 29 54 71 97
83 2d 56 7b 46 .
..4...)Tq..-V{F
0460 54 14 8c 3e 0
2 5d 60 29 de 99 ad
09 03 74 1e 4c T
..>.]`).....t.L
0470 c0 a8 8e 98 2
3 41 4a ce 1d 6a a1
48 64 04 73 71 .
...#AJ..j.Hd.sq
0480 6d ab 8a 3f 6
c 84 a6 4d 97 9a eb
49 26 ee 6b 64 m
..?l..M...I&.kd

0490 ec 81 46 03 2
1 d5 97 2e b0 4c 78
a1 c2 a5 54 81 .
.F.!....Lx...T.
04a0 ad 80 d2 d6 0
b 58 e8 2a 44 89 bc
ab b4 7f 67 6d .
....X.*D.....gm
04b0 64 69 38 e0 b
c c4 ce 84 23 d7 08
80 58 16 05 4d d
i8.....#...X..M
04c0 52 20 ba 12 c
5 e6 29 9d ac 0b 9f
26 82 d8 0e 13 R
....)....&....
04d0 a6 09 69 56 5
e 4e ab 10 63 50 4e
17 b0 d9 fa a8 .
.iV^N..cPN.....
04e0 bf b1 89 6d 9
6 7c e1 71 8d 29 1b
5b b1 67 05 84 .
..m.|.q.).[.g..
04f0 0c b5 cf 2f 1
0 7d 59 79 a6 d9 4a
fe 42 c5 b0 66 .
../.}Yy..J.B..f
0500 d8 2d f0 50 0
4 2e bf 1f ac a6 ff
1b ff ff fc ff .
-.P............
0510 c7 ff e6 8f 1
0 b1 b2 10 24 50 4a
d4 4a 55 12 85 .
.......$PJ.JU..
0520 4c 14
L
.
No. Time
Source
Destination
Protocol
Length Info
307 11.91947400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
875 http49
574 [PSH, ACK] Seq=
191034 Ack=1 Win=46
Len=821
Frame 307: 875 byte
s on wire (7000 bit
s), 875 bytes captu
red (7000 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0

4.969404000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.969404000 s
econds
[Time delta fro
m previous captured
frame: 0.080005000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08000500
0 seconds]
[Time since ref
erence or first fra
me: 11.919474000 se
conds]
Frame Number: 3
07
Frame Length: 8
75 bytes (7000 bits
)
Capture Length:
875 bytes (7000 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
61
Identification:
0xf220 (61984)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bc1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc

13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 191034, Ack:
1, Len: 821
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 821]
Sequence number
: 191034 (relati
ve sequence number)
[Next sequence
number: 191855 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u

nknown)]
Checksum: 0xe5d
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2081]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5d f2 20 4
0 00 31 06 3b c1 4a
7c 0c 8a c0 a8 .
]. @.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cb 4c 67 9e
87 4e aa 50 18 .
..P..+.Lg..N.P.
0030 00 2e e5 d9 0
0 00 36 5b ca a1 38
22 9b d0 97 31 .
.....6[..8"...1
0040 33 08 10 ca 8
8 55 65 c1 44 75 3f
29 60 b5 cd 68 3
....Ue.Du?)`..h
0050 1e 04 6a 39 0
1 92 a2 d2 49 b3 de
69 12 3f 77 b2 .
.j9....I..i.?w.
0060 ab 3f fa 9e 4
3 5f ab ed 1e 9d de
b1 e5 fe 66 cb .
?..C_........f.
0070 dc 45 b1 d5 5
4 d1 5f bb 6e fe ff
fb 92 04 e9 0f .
E..T._.n.......
0080 f2 f3 27 5a 8
1 ef 4a 50 60 86 eb
40 31 26 5c 0b .
.'Z..JP`..@1&\.
0090 b0 a3 66 07 b
1 69 41 8a 93 2c 80
f4 a5 29 d3 d4 .
.f..iA..,...)..
00a0 bd a5 52 a2 4
4 a4 95 da e4 7f 5b
4a 01 91 88 68 .
.R.D.....[J...h
00b0 25 00 71 28 c
8 b4 28 3a 05 de da
98 8f 8b 47 2b %
.q(..(:......G+
00c0 09 cc ed 9b 8
f be 1a 0a 80 f7 8f
ad c3 d0 f5 5a .
..............Z
00d0 7b 15 53 40 6
2 98 11 18 31 ba 14

b6 16 6a 65 d3 {
.S@b...1....je.
00e0 83 b7 1f c5 f
1 36 b7 eb ad c8 a2
d7 c8 e0 26 0a .
....6........&.
00f0 08 0f 2c 8b e
7 ce b5 82 f9 e6 32
b7 75 a3 fd 08 .
.,.......2.u...
0100 6a 1e 63 2c 8
8 46 80 e2 1d 04 c9
40 94 3b c0 5f j
.c,.F.....@.;._
0110 76 bf b5 62 3
7 0a 5c bc 8b 1d 88
3f 83 cd 17 9d v
..b7.\....?....
0120 c3 3e 10 d5 2
1 d5 68 5a 1f 67 86
fb 94 95 09 26 .
>..!.hZ.g.....&
0130 d4 73 cd 6b d
4 ed 11 14 83 f8 77
b0 f2 1a 29 56 .
s.k......w...)V
0140 6b 5f b9 76 b
f 96 79 5d ae 69 6e
f8 b1 c4 cf 14 k
_.v..y].in.....
0150 16 01 00 d4 d
5 02 4a 4a 11 51 66
9a 57 bc da 96 .
.....JJ.Qf.W...
0160 12 21 15 31 2
0 64 14 21 d1 1c e8
60 53 8b 9b d5 .
!.1 d.!...`S...
0170 f8 ca c6 18 4
c 2d aa f6 57 28 4d
8c b2 b0 39 39 .
...L-..W(M...99
0180 9e 85 f5 38 8
e 8d 0a 8a fa 63 4e
4e 4f 41 53 18 .
..8.....cNNOAS.
0190 67 58 6a 48 7
9 c4 0c 68 2c 81 07
06 19 41 19 a9 g
XjHy..h,....A..
01a0 15 dc 18 42 3
a ee 5e a1 9e ae 28
cd 1f 32 30 c4 .
..B:.^...(..20.
01b0 1f 3c 24 16 0
1 19 2c 49 4e 52 50
8a 8b 1d 61 ad .
<$...,INRP...a.
01c0 2f ff 47 f5 a
a 99 a8 8f 91 74 32
69 04 4f 2b 03 /
.G......t2i.O+.
01d0 63 8b a6 89 9
8 0c a4 dc c0 d8 ee
9d 84 d2 ea b7 c
...............
01e0 1d 3d 39 c1 d
0 d9 35 b2 ce d1 b5
7d 12 6e 83 e4 .

=9...5....}.n..
01f0 93 ea 68 52 d
c f9 8d a5 db 45 71
5f f5 ad e7 58 .
.hR.....Eq_...X
0200 cf bb cd 67 3
4 fe 1f dd 21 79 03
44 c4 ab 71 00 .
..g4...!y.D..q.
0210 eb 40 82 a6 a
d 0a 08 90 34 91 a0
eb ff fb 92 04 .
@......4.......
0220 e8 8f f2 fd 3
d 58 81 ef 32 e0 54
c6 9b 10 31 83 .
...=X..2.T...1.
0230 5c 0b fc d9 5
e 07 bd 0b 81 93 9b
2b 80 f7 8d 70 \
...^......+...p
0240 09 09 2c f2 3
3 f9 ee fd 5f eb 52
24 4a c4 b0 6d .
.,.3..._.R$J..m
0250 12 c0 b3 04 a
3 c6 71 75 1c a4 95
d1 b9 18 c2 4f .
.....qu.......O
0260 36 a2 9f 9f a
d d9 71 20 48 47 71
9f bc 54 94 6e 6
.....q HGq..T.n
0270 14 d1 0f 62 f
a 57 e3 b1 4d ea 42
81 54 b3 f9 5e .
..b.W..M.B.T..^
0280 b6 f6 7d ef 9
d 37 a6 fb f4 49 62
a4 53 9b 37 11 .
.}..7...Ib.S.7.
0290 37 b2 13 a9 d
c 90 15 52 b1 68 9a
ea 16 6c f7 ff 7
......R.h...l..
02a0 f1 fb fe f3 f
f f7 ff e4 5d 17 c1
32 de 74 be 2f .
.......]..2.t./
02b0 48 0c 88 3e c
e 16 4b a5 1f 31 0d
26 dc bc 53 d2 H
..>..K..1.&..S.
02c0 f5 67 ca 92 5
b 39 4d c1 56 ae 19
57 c9 ae 91 b4 .
g..[9M.V..W....
02d0 a7 79 84 4e c
a b0 b2 d4 97 7d a3
0b 11 52 2d 1e .
y.N.....}...R-.
02e0 26 31 78 78 c
e ab 79 3e e6 bd bc
2d d9 78 59 00 &
1xx..y>...-.xY.
02f0 63 21 b2 25 c
1 60 14 61 d6 15 3a
2a 6b 15 01 35 c
!.%.`.a..:*k..5

0300 28 42 19 79 a
7 51 66 de a9 64 89
37 5d 46 54 9a (
B.y.Qf..d.7]FT.
0310 a0 a6 21 be 9
5 44 41 c5 f8 35 53
a7 5c 50 fc 3c .
.!..DA..5S.\P.<
0320 21 29 1e 0a 6
1 f1 88 07 a1 34 c4
6a bd 20 6a 9d !
)..a....4.j. j.
0330 53 49 18 0a c
6 5a 0a a1 04 48 3a
22 8e 36 43 de S
I...Z...H:".6C.
0340 d6 4a cd 7c 5
c 43 dc e5 cf ae 94
ba 3f 73 ae e2 .
J.|\C......?s..
0350 f7 9d 70 08 f
3 9a 44 a9 d1 53 57
0a 80 9a 90 28 .
.p...D..SW....(
0360 ab 39 07 d1 3
9 b5 54 2b cf fe 8a
.
9..9.T+...
No. Time
Source
Destination
Protocol
Length Info
308 11.91965400
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=191855 Win=38430 L
en=0
Frame 308: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.969584000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.969584000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]

[Time delta fro

m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 11.919654000 se
conds]
Frame Number: 3
08
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11

), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f8b (20363)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 19185
5, Len: 0
Source Port: 49
574 (49574)

Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 191855 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 307]
[The RTT to
ACK the segment wa

s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 8b 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 4f 9c 50 10 .
....P..N.+.O.P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
309 11.94147200
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=19185
5 Ack=1 Win=46 Len=
1260
Frame 309: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
4.991402000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615224.991402000 s
econds
[Time delta fro
m previous captured
frame: 0.021818000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02181800
0 seconds]
[Time since ref
erence or first fra
me: 11.941472000 se
conds]
Frame Number: 3

09
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf221 (61985)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a09 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 191855, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number

: 191855 (relati
ve sequence number)
[Next sequence
number: 193115 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x28f
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 21 4
0 00 31 06 3a 09 4a

7c 0c 8a c0 a8 .
..!@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 4f 9c 9e
87 4e aa 50 10 .
..P..+.O...N.P.
0030 00 2e 28 f8 0
0 00 7d 65 84 42 82
04 05 71 4f 61 .
.(...}e.B...qOa
0040 16 d3 17 4c 8
6 e4 e2 03 9a 4d 76
59 71 7c 4b ea .
..L.....MvYq|K.
0050 3a f9 c4 e5 3
3 50 19 53 6e 8d b9
dd e5 0c b3 7a :
...3P.Sn......z
0060 b0 ef 30 36 1
1 80 cd 49 64 9a c2
a3 44 69 5c 9e .
.06...Id...Di\.
0070 92 29 26 8a 2
c 93 ba 48 8e 04 9d
95 62 6a 92 74 .
)&.,..H....bj.t
0080 94 b6 ad 91 f
7 d5 a6 cc e7 ff fb
92 04 ea 8f f3 .
...............
0090 08 27 57 03 0
f 7a 50 5e 44 9a d0
3d ec 4a 4c 08 .
'W..zP^D..=.JL.
00a0 91 5a 0c 61 e
9 41 88 16 2b 01 87
ad 30 f3 0f 26 .
Z.a.A..+...0..&
00b0 a3 0e 72 80 8
8 8a 3c ec 28 88 02
31 b6 60 54 c6 .
.r...<.(..1.`T.
00c0 ad 0d 2c 86 f
1 61 8a 10 f3 b4 c9
c5 1c 87 ed 3b .
.,..a.........;
00d0 f8 a4 3c 56 5
9 6d 99 27 8c f5 8c
ac 3c 2e fe e0 .
.<VYm.'....<...
00e0 5c 70 b6 e8 c
8 be d5 db 3c 0c da
81 eb 8b a2 95 \
p......<.......
00f0 7c a7 ab 50 4
8 75 cc b4 ce d7 62
83 12 56 97 ae |
..PHu....b..V..
0100 6f e3 db a9 b
b fe ac 7f 8b b5 c1
a6 30 b1 eb 4a o
...........0..J
0110 ff d6 ec ba a
8 49 16 21 0d dc 51
74 02 98 a0 2c .
....I.!..Qt...,
0120 e9 c5 2f 62 7
4 91 ad be 77 11 0b
3b 2f 46 29 b7 .

./bt...w..;/F).
0130 07 db 91 85 8
a 96 72 99 dc 29 17
9c 9f 23 e7 57 .
.....r..)...#.W
0140 35 09 f2 5e 3
b f8 2c d2 09 b3 8e
4d c7 2a e7 fd 5
..^;.,....M.*..
0150 66 d9 d6 6f 6
f 94 56 be 31 bd 24
23 c7 d4 4c 9a f
..oo.V.1.$#..L.
0160 41 3c 20 2b 5
0 f6 11 40 67 49 96
21 a9 6a 19 f1 A
< +P..@gI.!.j..
0170 a3 e4 ce f0 b
3 4b f2 22 5b 11 2b
00 38 8f aa 83 .
....K."[.+.8...
0180 08 20 38 05 e
2 bf d9 33 f0 91 ca
d7 2c 6e 14 aa .
8....3....,n..
0190 0b 2f bf 2e 4
d 34 60 86 21 cd 52
60 9b 4e 4d dd .
/..M4`.!.R`.NM.
01a0 a7 b6 87 33 c
7 67 cc 4a 1a 4e b2
72 3b 83 4d 7a .
..3.g.J.N.r;.Mz
01b0 fb 6e 97 af c
f 7d 3f ff e5 b2 3c
fe 6a 41 9b 86 .
n...}?...<.jA..
01c0 47 d4 10 6c 3
a 87 87 43 56 b8 e0
e8 f5 c2 8e af G
..l:..CV.......
01d0 d2 df 62 6a 8
7 5c c2 42 11 11 24
d5 50 fa 36 52 .
.bj.\.B..$.P.6R
01e0 60 14 45 b8 b
2 54 c8 0c d3 2e b0
ac 0f 73 a3 43 `
.E..T.......s.C
01f0 93 ea e7 63 5
8 50 4b aa 53 56 24
de a7 87 31 e2 .
..cXPK.SV$...1.
0200 d6 dc 79 1e c
1 56 71 e1 c6 0b 8b
90 8e cf 94 93 .
.y..Vq.........
0210 cb 2e b1 ab d
7 56 ce 2d ba e2 14
7f 7c 41 c1 df .
....V.-....|A..
0220 4d 7b f8 30 1
9 c1 e0 8c 42 a4 8b
ff fb 92 04 e8 M
{.0....B.......
0230 8f f2 d8 31 5
6 03 18 6a 60 5c e6
aa b0 63 08 5c .
..1V..j`\...c.\

0240 0b ec 9b 56 0
c 61 e9 41 88 14 2a
81 8c 3d 28 8c .
..V.a.A..*..=(.
0250 bd f7 1d 64 b
9 64 fa 9f d5 6e 2a
8a 18 67 ab 60 .
..d.d...n*..g.`
0260 1c 37 75 24 2
3 21 fc 1b a6 79 3e
34 9a 88 83 a8 .
7u$#!...y>4....
0270 ed 5f 80 4a c
d bb 64 57 46 64 5b
3e 38 55 c4 11 .
_.J..dWFd[>8U..
0280 0d 3c 57 07 1
2 40 5b d6 e8 f6 0a
a5 c8 ba cf d2 .
<W..@[.........
0290 10 2d 17 38 7
f 7d 5b 38 b7 83 b7
d1 b5 7c 67 4c .
-.8.}[8.....|gL
02a0 71 10 08 e8 7
c 6d 64 02 21 64 8f
19 17 c6 35 8e q
...|md.!d....5.
02b0 99 51 6e af a
5 f8 5c 28 0b 4f 57
80 bd a7 c1 0e .
Qn...\(.OW.....
02c0 b3 da df 35 5
5 e8 54 28 1e 72 66
ca 92 2e 00 88 .
..5U.T(.rf.....
02d0 ab aa c9 d9 0
b f8 f0 eb 42 c6 34
8a 48 d3 7c 70 .
.......B.4.H.|p
02e0 32 e0 d9 23 0
3 ae 42 98 02 1b 19
24 86 dc d1 10 2
..#..B....$....
02f0 42 08 13 92 1
1 22 91 05 73 e9 9b
e9 33 b9 91 18 B
...."..s...3...
0300 3d 69 a2 7c 5
0 11 29 10 a9 62 45
48 2d 0e 7a 95 =
i.|P.)..bEH-.z.
0310 1a 4a d1 68 d
5 6b 6f e5 9d d4 86
00 ae 36 c7 d1 .
J.h.ko......6..
0320 54 0d 48 61 4
2 65 21 7a ad d5 28
05 69 56 4a 91 T
.HaBe!z..(.iVJ.
0330 5d 82 3b 2b 5
b 00 b0 9e 7b b9 39
64 48 7f 22 11 ]
.;+[...{.9dH.".
0340 a7 3a 10 b6 2
3 10 f1 77 22 ec 9c
a3 92 3b 2e 71 .
:..#..w"....;.q
0350 09 96 a2 b7 2

3 32 67 5e 7d c7 be
e9 68 9f d1 f3 .
...#2g^}...h...
0360 ba e6 5d 75 4
6 75 f5 a7 f0 24 81
91 15 96 17 9c .
.]uFu...$......
0370 00 a1 e5 26 d
6 82 4c 5e 9a 72 1a
8a 68 94 16 c9 .
..&..L^.r..h...
0380 02 0a 01 de c
0 8b 04 d8 94 c2 09
1c 0a 9b 07 a7 .
...............
0390 59 4d 36 0d 4
f 18 a3 ec ea 48 6a
31 61 70 c0 90 Y
M6.O....Hj1ap..
03a0 44 76 9a 64 1
a 27 5e 95 17 6c 5f
21 5a cf e4 67 D
v.d.'^..l_!Z..g
03b0 b1 8d 21 36 5
b 3b 4e d0 3e 66 51
f8 5f fd 4b 71 .
.!6[;N.>fQ._.Kq
03c0 c7 fb da cf 3
7 fd 6c 78 d3 c3 25
44 22 ff fb 92 .
...7.lx..%D"...
03d0 04 ea 8f f2 f
a 27 55 83 18 7a 50
5d 84 8a a0 61 .
....'U..zP]...a
03e0 ef 4a 0c 70 9
3 52 0c e6 49 41 81
13 ea 01 8c 3d .
J.p.R..IA.....=
03f0 28 da 40 84 1
e 7f d7 5a c5 9f 4f
a9 ac bf c0 11 (
.@....Z..O.....
0400 b8 8c 20 20 4
0 65 b8 4e de c4 05
5b e4 88 2d 3a .
. @e.N...[..-:
0410 bb 8b a8 d2 4
c c7 c9 83 38 b5 ec
d9 d8 ac d7 ac .
...L...8.......
0420 56 21 37 10 7
1 00 54 a3 62 07 0b
96 04 dd c2 33 V
!7.q.T.b......3
0430 d5 d9 e5 14 5
7 60 b8 ce 56 56 59
a3 4d 5a e2 0e .
...W`..VVY.MZ..
0440 e0 fd d9 95 f
7 cd bc 14 7f 68 4c
8a 9b 06 01 32 .
........hL....2
0450 c5 d4 63 9a 7
8 ba ec d9 d2 d7 1e
43 08 87 69 57 .
.c.x......C..iW
0460 98 c0 87 e1 0
4 21 b4 55 98 36 a5

57 12 f1 99 52 .
....!.U.6.W...R
0470 25 cc 3f 61 f
5 c1 ff 73 6e c1 a1
5b 49 89 60 d7 %
.?a...sn..[I.`.
0480 25 90 2c 50 3
e 91 ee c8 da 53 47
00 7a d1 bd 0a %
.,P>....SG.z...
0490 34 41 36 db f
8 a7 8c d2 c7 f7 a7
b4 6a eb 7f 0c 4
A6.........j...
04a0 91 e9 fe 2e 7
a 5c 60 a8 54 ce 92
68 0b 0b 4e 45 .
...z\`.T..h..NE
04b0 c9 d6 4f a5 7
2 bc 62 19 09 90 5a
00 20 87 81 ca .
.O.r.b...Z. ...
04c0 28 55 18 e0 9
b 72 a7 98 02 a9 4b
12 c5 6b ca ae (
U...r....K..k..
04d0 db 65 0d a7 2
3 e1 4b ba 2b fb 09
43 ab 79 3a 57 .
e..#.K.+..C.y:W
04e0 fc da a8 ba 9
3 62 35 b7 f4 4f 15
3d eb 30 14 8a .
....b5..O.=.0..
04f0 9e 91 bd bd 3
7 3f bb 7c fe cb b1
a6 bf df 98 af .
...7?.|........
0500 87 31 cf 70 c
6 7f f7 25 80 f3 4c
cd e0 fd 92 87 .
1.p...%..L.....
0510 7c 7f d7 e1 a
7 76 60 08 80 84 03
4b 55 b8 a0 99 |
....v`....KU...
0520 cd 1a
.
.
No. Time
Source
Destination
Protocol
Length Info
310 12.06747800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1293 http49
574 [PSH, ACK] Seq=
193115 Ack=1 Win=46
Len=1239
Frame 310: 1293 byt
es on wire (10344 b
its), 1293 bytes ca

ptured (10344 bits)

on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.117408000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.117408000 s
econds
[Time delta fro
m previous captured
frame: 0.126006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12600600
0 seconds]
[Time since ref
erence or first fra
me: 12.067478000 se
conds]
Frame Number: 3
10
Frame Length: 1
293 bytes (10344 bi
ts)
Capture Length:
1293 bytes (10344
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
279
Identification:
0xf222 (61986)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a1d [validatio

n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 193115, Ack:
1, Len: 1239
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1239]
Sequence number
: 193115 (relati
ve sequence number)
[Next sequence
number: 194354 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t

.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x5ab
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2499]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 04 ff f2 22 4
0 00 31 06 3a 1d 4a
7c 0c 8a c0 a8 .
.."@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 54 88 9e
87 4e aa 50 18 .
..P..+.T...N.P.
0030 00 2e 5a bd 0
0 00 a9 45 87 58 4e
e7 90 82 42 e0 .
.Z....E.XN...B.
0040 24 4c a1 03 d
4 66 20 ae 34 81 1e
eb a2 9f ab 1b $
L...f .4.......
0050 eb 19 96 4b e
6 14 92 79 44 db 2b
9b 9b 7c ad 7e .
..K...yD.+..|.~
0060 f5 e1 1d d8 0
6 29 05 13 83 2d 02
58 d2 64 a4 50 .
....)...-.X.d.P
0070 34 41 15 5c 4
d 89 4d 03 87 02 da
7d e6 6c 8a 0b 4
A.\M.M....}.l..
0080 f7 b3 25 ff f
b 90 04 e9 0f f2 f6
24 54 83 38 c2 .
.%........$T.8.
0090 50 5d 24 9a 8
0 63 0f 4a 0b 5c 93
52 0c e5 e9 41 P
]$..c.J.\.R...A
00a0 88 13 29 c1 8
c 61 29 b5 2e b4 7d
05 5b 9e 9a fd .
.)..a)...}.[...

00b0 5d a1 60 8e a
8 ae 85 cf 28 78 3e
6d 54 a1 d0 2a ]
.`.....(x>mT..*
00c0 13 a5 83 bc 4
7 64 04 c9 12 0c bf
4c f9 92 4c 85 .
...Gd.....L..L.
00d0 5b 67 0a 16 6
b 03 31 58 05 fe 81
d7 4c e2 24 5f [
g..k.1X....L.$_
00e0 05 9d 00 ba 1
3 50 9b c9 86 89 32
e8 cb 16 2b 61 .
....P....2...+a
00f0 e7 01 38 ef c
2 bc b8 89 02 6a 7e
c4 d9 4d ca f2 .
.8......j~..M..
0100 8b 97 a4 26 9
6 e0 e4 3e 0d 30 55
b5 6a 72 45 0e .
..&...>.0U.jrE.
0110 bb e8 72 06 4
2 04 92 24 0a 50 03
90 3e 16 55 54 .
.r.B..$.P..>.UT
0120 f0 8f 35 a5 0
9 1d 50 1b ae 94 a6
1f 7d 23 cd 6e .
.5...P.....}#.n
0130 b3 38 79 b9 6
8 04 c2 27 bd 71 dc
ad e1 70 7d a2 .
8y.h..'.q...p}.
0140 24 35 64 09 2
8 1e ea c1 02 b2 84
fc 68 b2 9a dd $
5d.(.......h...
0150 7e 25 2b 8d c
0 cd b7 fc b0 1c 73
89 3d 8b d6 5e ~
%+.......s.=..^
0160 40 3c 22 93 5
a 14 a5 a8 5b 7d 2b
d4 c4 54 14 08 @
<".Z...[}+..T..
0170 34 07 8d b8 5
d 07 45 28 aa 06 bc
83 a3 80 ca a6 4
...].E(........
0180 24 3a 1e 44 6
3 ea 30 f1 2f fb 44
44 64 d8 c9 02 $
:.Dc.0./.DDd...
0190 de 4f 09 7c 1
3 27 81 f9 6f 19 c8
e3 94 a5 5d 17 .
O.|.'..o.....].
01a0 61 9d 94 e4 1
1 d0 ad 19 d6 71 63
22 ba aa 35 1c a
........qc"..5.
01b0 2f bf bb 4f 3
5 a5 74 ee 2d bb ca
28 bd f5 03 c3 /
..O5.t.-..(....
01c0 60 ae cc 49 a

6 65 d1 1f fd 5b d7
ad fb e5 6b 94 `
..I.e...[....k.
01d0 60 a2 86 83 6
b e4 c5 9f 2e b3 64
80 cd 32 d9 a2 `
...k.....d..2..
01e0 a7 28 d1 81 b
d 73 ea b6 56 a4 b2
5e 54 15 e2 02 .
(...s..V..^T...
01f0 b8 35 c9 76 5
d 96 50 a9 38 a5 0d
c9 0c 34 28 e4 .
5.v].P.8....4(.
0200 62 ce 47 52 6
a a2 b0 5e d3 a7 3d
f8 d9 c3 2f ed b
.GRj..^..=.../.
0210 ca da d6 ff 7
8 3d 98 fd cf e3 db
9d ff c7 1b bb .
...x=..........
0220 7b 6b 79 5d f
f fb 92 04 eb 0f f3
10 37 d4 03 59 {
ky]........7..Y
0230 6a e2 62 04 8
a 60 63 0f 4a 0b 3c
93 52 0c e1 e9 j
.b..`c.J.<.R...
0240 41 87 13 a9 8
1 8c 3d 29 67 2b 39
96 d4 d7 55 c0 A
.....=)g+9...U.
0250 93 02 4e 07 0
0 b8 cf b5 66 c6 c5
32 f2 c1 c7 8c .
.N.....f..2....
0260 c8 9e 54 13 b
7 18 53 7b 5d 16 e6
82 f2 7f 33 ae .
.T...S{].....3.
0270 09 50 d3 59 7
5 78 bb b8 a7 06 f1
d0 5b 18 11 8c .
P.Yux......[...
0280 47 e0 45 d9 0
b 99 aa 31 0c 70 c1
be fb bd 71 a4 G
.E....1.p....q.
0290 6d ee 06 2d 0
2 5f 98 48 08 be b3
51 1b 99 f7 ac m
..-._.H...Q....
02a0 b7 58 32 1e 3
e b5 c5 16 b3 06 e1
d7 55 8b 3b f4 .
X2.>.......U.;.
02b0 ba 0a c6 66 a
0 4c 3b 52 45 43 ea
45 a0 aa b1 f2 .
..f.L;REC.E....
02c0 a9 5c 11 9f 8
6 01 9c 4f 17 a1 d9
99 5e 96 60 2b .
\.....O....^.`+
02d0 94 34 83 c3 1
e 63 c5 73 2a 59 41

e0 95 6e 5c 79 .
4...c.s*YA..n\y
02e0 01 54 57 6d e
d df c2 0a fb e0 64
a5 f5 7f ef bd .
TWm......d.....
02f0 c2 ad 33 6f 0
1 99 53 fc 2b d0 e3
a6 a9 9d 38 5d .
.3o..S.+.....8]
0300 6c 26 45 02 4
5 af c9 50 49 95 34
12 da 01 0a 15 l
&E.E..PI.4.....
0310 00 28 78 00 0
3 80 c4 ee 4b 77 49
8c 8d ac 65 e5 .
(x.....KwI...e.
0320 92 65 8b dc 5
8 8c 6d ba a5 63 d6
eb c8 1d c7 30 .
e..X.m..c.....0
0330 47 56 b8 f5 4
c c3 4e cc a0 0c 9f
51 99 94 2c 43 G
V..L.N....Q..,C
0340 e8 1a d2 b0 c
0 5d ec 93 c7 a0 83
c7 d6 eb e3 ee .
....]..........
0350 d0 bd 9e db b
6 3e 54 4d f1 4a 25
fe a9 6d b0 de .
....>TM.J%..m..
0360 20 b4 71 d7 8
4 0f b5 e3 28 0c 31
96 5c 69 65 08
.q.....(.1.\ie.
0370 66 09 2d 2e d
7 69 6d cf 7d 54 11
24 9c 64 65 74 f
.-..im.}T.$.det
0380 88 6d 43 9a f
2 bc c3 d7 b4 6a 0d
9d 7d 9d f8 c5 .
mC......j..}...
0390 08 cf 76 5e 4
b 97 5e e9 23 5f ca
96 51 dc 08 06 .
.v^K.^.#_..Q...
03a0 2c ba d5 a4 b
2 8a 8a c1 47 93 61
7c f7 5f 5d fd ,
.......G.a|._].
03b0 eb ed 7e 5f c
a f4 34 9d ce e7 2f
c0 9c ef da e5 .
.~_..4.../.....
03c0 b3 cd 58 1c 0
4 04 ff fb 92 04 ea
0f f2 d7 27 d4 .
.X...........'.
03d0 83 39 c2 50 6
3 44 fa 60 63 0f 4a
0b 40 9f 52 0c .
9.PcD.`c.J.@.R.
03e0 e1 e9 41 8e 9
4 29 81 9c 3d 28 6d
b7 48 bb 3d 94 .

.A..)..=(m.H.=.
03f0 4c 44 f8 2f a
8 b4 26 e8 40 d3 4e
33 61 e0 b8 ed L
D./..&.@.N3a...
0400 70 75 82 42 1
d fa 95 b5 e8 00 12
14 c6 b9 8d a2 p
u.B............
0410 fe 2e b8 44 3
6 29 f6 c4 c9 61 db
4f da 48 f4 64 .
..D6)...a.O.H.d
0420 4c 27 ad 40 d
a 14 b9 d4 d0 8f 95
11 e0 cd 38 9c L
'.@..........8.
0430 9f 70 21 b2 6
f 37 c6 e7 bc 6d 6b
19 63 be e9 11 .
p!.o7...mk.c...
0440 c9 a2 6d ef 7
6 a4 38 a2 fe 78 ce
2c 71 f7 53 f6 .
.m.v.8..x.,q.S.
0450 af dc c7 7a d
7 90 4e 94 ab 11 7e
43 e6 21 43 50 .
..z..N...~C.!CP
0460 a8 a2 a1 9c 3
6 4c 74 9e 0e c8 ef
55 ec e7 64 aa .
...6Lt....U..d.
0470 f8 40 48 8d 7
4 9a bd e4 44 fb 72
71 c2 11 ce 97 .
@H.t...D.rq....
0480 13 c2 e5 59 1
c 1c 21 9e ca 8d 61
0b bc b1 e0 4e .
..Y..!...a....N
0490 f2 24 38 ff d
2 24 78 17 cc 3b ef
c2 a7 bc 0d 57 .
$8..$x..;.....W
04a0 7a bc 4c 85 9
2 40 48 92 e0 4a 9d
d7 90 42 b0 df z
.L..@H..J...B..
04b0 11 f4 60 05 0
d e1 58 8a 44 19 05
02 8c 53 4f 14 .
.`...X.D....SO.
04c0 5a b0 90 1d 2
c 27 3b b1 4e 49 a8
d7 04 16 74 ca Z
...,';.NI....t.
04d0 8d e4 54 3d 2
c 68 40 7c 4a c7 72
a1 4b 52 13 1c .
.T=,h@|J.r.KR..
04e0 5e 28 26 73 2
3 fc a7 56 70 8c c1
c5 f1 cd 18 73 ^
(&s#..Vp......s
04f0 d8 9b b7 7f f
8 dc db b1 cb ef ad
c4 dd e9 b7 ce .
...............

0500 bc 57 85 8e 5
6 7c ba 08 0b 1c 10
7e 95
.
W..V|.....~.
No. Time
Source
Destination
Protocol
Length Info
311 12.06765900
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=194354 Win=37805 L
en=0
Frame 311: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.117589000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.117589000 s
econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 12.067659000 se
conds]
Frame Number: 3
11
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4

0
Identification:
0x4f8c (20364)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 19435
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 194354 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t

.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37805
[Calculated win
dow size: 37805]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 310]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 8c 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 59 5f 50 10 .
....P..N.+.Y_P.
0030 93 ad 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol

Length Info
312 12.14548400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=19435
4 Ack=1 Win=46 Len=
1260
Frame 312: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.195414000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.195414000 s
econds
[Time delta fro
m previous captured
frame: 0.077825000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07782500
0 seconds]
[Time since ref
erence or first fra
me: 12.145484000 se
conds]
Frame Number: 3
12
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64

:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf223 (61987)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set

.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a07 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 194354, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 194354 (relati
ve sequence number)
[Next sequence
number: 195614 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set

.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x0d5
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 23 4
0 00 31 06 3a 07 4a
7c 0c 8a c0 a8 .
..#@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 59 5f 9e
87 4e aa 50 10 .
..P..+.Y_..N.P.
0030 00 2e 0d 58 0
0 00 87 12 c1 6f 09
35 98 27 b0 0a .
..X.....o.5.'..
0040 f9 44 e0 e2 7
c b6 61 84 d1 bc f5
65 c1 4c a5 6c .
D..|.a....e.L.l
0050 2d c8 d6 96 3
2 f0 1b ca 18 6f 15
50 52 94 a3 36 ...2....o.PR..6
0060 63 97 61 48 8
9 bd d2 33 1b 45 9d
b6 48 bc e7 33 c
.aH...3.E..H..3
0070 ec ee f0 77 7
a d6 b0 69 4f ba f6

ed fd 6a d0 b1 .
..wz..iO....j..
0080 08 f3 cb 52 9
e dc 63 af 74 d3 6e
4b 54 a4 87 9a .
..R..c.t.nKT...
0090 8c ff fb 92 0
4 eb 0f f2 f0 27 54
83 39 c2 50 64 .
........'T.9.Pd
00a0 65 0a 60 67 0
f 4a 4b 28 a7 5e 0c
3d e9 81 7b 97 e
.`g.JK(.^.=..{.
00b0 2b 40 f7 b1 3
0 7f 4f fa ab 70 60
53 72 ef 49 78 +
@..0.O..p`Sr.Ix
00c0 61 41 49 8c d
a c4 57 d2 17 d2 40
53 a4 e6 83 56 a
AI...W...@S...V
00d0 87 a6 7a 14 c
4 13 c1 d8 75 37 6c
79 1f 94 b6 70 .
.z.....u7ly...p
00e0 a9 11 8a c3 e
1 39 af 91 01 53 6f
5d 55 9c 5c 48 .
....9...So]U.\H
00f0 51 45 d8 6d c
4 a3 6f 6c 35 16 57
6d 94 b3 40 23 Q
E.m..ol5.Wm..@#
0100 84 48 95 20 e
7 8f d7 41 86 3f a5
6f 44 74 51 66 .
H. ...A.?.oDtQf
0110 c2 f7 3b 94 b
e 50 a1 cd 7c ad be
4d 2b e1 1c d8 .
.;..P..|..M+...
0120 d4 3a d8 a9 4
5 89 8b c1 55 ac 69
52 25 cf 17 4e .
:..E...U.iR%..N
0130 4c 70 2f 85 d
b 8e 5e 0c a4 13 ac
e7 d9 6f 1b 8d L
p/...^......o..
0140 f2 bb 31 6d 7
b 43 e0 ae 15 ba 12
a3 3a be 62 4c .
.1m{C......:.bL
0150 b3 26 76 7a 4
d e9 bf f7 fd 0c 57
4c fe 96 54 d0 .
&vzM.....WL..T.
0160 c4 b6 d6 e3 9
3 1c 77 3f bf e5 bb
9f e1 a8 8a b4 .
.....w?........
0170 67 35 fa bc b
9 e1 02 4b 4b bb 8f
90 76 03 3c 2e g
5.....KK...v.<.
0180 88 71 2e 68 1
1 0d 28 5a d5 b0 48
2a c5 a8 1e ad .

q.h..(Z..H*....
0190 c8 64 a6 b7 2
a d9 1d da ef b4 af
17 b5 d9 45 3f .
d..*.........E?
01a0 f6 8e 42 72 0
4 d9 c6 1a 4d 74 21
34 b2 67 ce 9b .
.Br....Mt!4.g..
01b0 e6 46 7f ff b
1 08 ae 99 fa 3b 2a
52 44 b6 d2 f2 .
F.......;*RD...
01c0 0f b0 f2 ab a
1 e3 c2 c1 c2 87 0d
38 a3 89 df 96 .
..........8....
01d0 22 b7 25 2e 0
f 8f 90 47 47 49 af
ad f9 74 0e 34 "
.%....GGI...t.4
01e0 69 ca b9 37 0
a 8b 81 9e a3 db c6
6c 43 73 83 9b i
..7.......lCs..
01f0 c2 26 59 9b 1
b bf 71 ad eb 7d 19
a5 3e f5 4c 50 .
&Y...q..}..>.LP
0200 42 33 34 9b 3
2 58 d9 ec ea 6c c1
e3 bb 20 f6 93 B
34.2X...l... ..
0210 75 ab 2d 35 7
7 a3 b2 b7 67 43 59
d5 1b 76 73 66 u
.-5w...gCY..vsf
0220 dd 9d 91 52 8
e b2 8d 42 ef 05 67
af b1 26 96 f5 .
..R...B..g..&..
0230 1a 8d 28 ff f
b 92 04 ec 8f f3 2c
28 57 83 0f 7a .
.(.......,(W..z
0240 50 5c e4 9a f
0 61 8b 4a 0b ed 07
62 0c 3c eb 89 P
\...a.J...b.<..
0250 6d 21 6c 00 f
6 15 70 a8 4d bf 7c
c7 7f fc f2 47 m
!l...p.M.|....G
0260 7e 20 b8 13 f
0 2d ad 1f 88 58 3f
a0 01 84 68 41 ~
...-...X?...hA
0270 a0 7c 46 3f 4
4 8c 6e 9a 4b df 8d
0c 23 76 ff fd .
|F?D.n.K...#v..
0280 5a db 2f 46 8
d e7 bb b9 0e 39 85
7d 5b 9f f6 0d Z
./F.....9.}[...
0290 ac 2d fa cf e
9 37 d0 ba 8f 16 f9
59 77 aa 45 58 .
-...7.....Yw.EX

02a0 8e e6 cd 17 8
a d2 91 ca 61 24 06
2d 8d c2 6f 35 .
.......a$.-..o5
02b0 28 b5 e6 6e 1
7 95 76 49 ac 33 71
2d 0a 5d 8f e7 (
..n..vI.3q-.]..
02c0 7d 95 06 35 5
0 0d 72 fd 44 5f 93
70 67 a1 8b 42 }
..5P.r.D_.pg..B
02d0 cc 5e 04 50 1
b cc 90 20 a1 ae ad
a4 c3 c6 07 84 .
^.P... ........
02e0 fe 0d e1 4b 3
b d2 77 2b 04 1f 44
a9 cd 7d 59 fc .
..K;.w+..D..}Y.
02f0 36 84 77 c1 6
b 89 27 d7 de 2d bb
fc 63 39 be bf 6
.w.k.'..-..c9..
0300 dd 9b 26 2c c
3 7e e4 ae 36 d7 8e
15 77 6b 18 a3 .
.&,.~..6...wk..
0310 d9 d3 09 d2 4
b 96 63 44 a1 ab 39
ec ed 6b 42 71 .
...K.cD..9..kBq
0320 42 05 a6 97 8
e 4b bc 5d 1c 13 ae
0a 3b 27 42 47 B
....K.]....;'BG
0330 a8 d5 80 f0 e
1 81 68 a9 24 31 7a
02 10 36 db ef .
.....h.$1z..6..
0340 0f 0d 04 7b 2
1 2d 8c 14 47 43 0e
73 25 a4 ac 92 .
..{!-..GC.s%...
0350 17 b2 c9 b9 b
6 76 bb a2 27 7f c7
ac c2 d0 4c ea .
....v..'.....L.
0360 43 a8 b5 71 b
6 8e 1c fd 51 72 c4
b5 eb 95 18 79 C
..q....Qr.....y
0370 14 4b 53 56 f
e de 2e 24 54 d2 58
1e 33 2c 40 6a .
KSV...$T.X.3,@j
0380 dc 38 5a 80 9
5 f3 4e 68 8a b0 a8
c7 85 e3 9d 95 .
8Z...Nh........
0390 3a 93 35 2c 3
a 53 b2 ea 32 c1 5e
67 7a 6e ed f9 :
.5,:S..2.^gzn..
03a0 2b 48 b7 0b 8
f ee 24 58 20 f1 2e
e5 5f 27 ec aa +
H....$X ..._'..
03b0 0c f9 4e a7 3

a 89 4a 6d 61 fb cf
2c b9 5f f0 a7 .
.N.:.Jma..,._..
03c0 85 e1 ae 76 8
1 e0 cf bf 7d 4c 14
43 c4 0a 51 6b .
..v....}L.C..Qk
03d0 05 26 81 58 e
6 ff fb 92 04 ed 0f
f3 33 41 d8 03 .
&.X........3A..
03e0 0f 3a e2 60 2
3 4a f0 3d 2c 38 4b
90 93 58 0c 3d .
:.`#J.=,8K..X.=
03f0 e9 41 63 92 6
a c1 87 ad 28 52 19
23 6a 52 ed 7d .
Ac.j...(R.#jR.}
0400 b5 a0 44 c1 2
3 0a 0b 3a d0 d2 04
bf d3 4a 63 81 .
.D.#..:.....Jc.
0410 01 9f a6 e8 b
3 da fc e3 c4 e9 db
9e e3 23 94 45 .
............#.E
0420 a3 c4 86 71 a
6 a5 72 ba 39 b7 22
c4 4e ae 57 e0 .
..q..r.9.".N.W.
0430 36 3b 77 2d 4
a 73 0e 87 64 b8 be
a2 f2 49 20 b5 6
;w-Js..d....I .
0440 a6 93 b2 e8 1
6 9b eb 44 a8 90 45
e7 d5 42 ad 9e .
......D..E..B..
0450 ab d1 d2 55 2
5 a9 5a 67 aa 70 40
ac c2 a3 d7 43 .
..U%.Zg.p@....C
0460 e8 4d 69 d2 0
0 d0 d1 87 a0 8d 6a
a8 72 fb 6a 21 .
Mi.......j.r.j!
0470 0b bb 5e 90 7
7 43 41 7e 25 bc 67
76 35 49 2c 96 .
.^.wCA~%.gv5I,.
0480 5c a6 76 56 f
3 41 ab 5f 67 83 95
24 88 c5 20 6a \
.vV.A._g..$.. j
0490 1f 30 3e 67 9
c a0 57 0b 7f 40 f9
1a 52 91 e5 c3 .
0>g..W..@..R...
04a0 ea 34 ac c9 4
6 f9 81 2a 4e 73 78
d3 39 45 07 31 .
4..F..*Nsx.9E.1
04b0 97 68 a8 a0 6
8 88 64 70 46 3d a4
5c 35 4f 59 47 .
h..h.dpF=.\5OYG
04c0 69 df ff 43 6
6 20 b1 ea 93 2e c9

22 02 5e c0 48 i
..Cf .....".^.H
04d0 0f 58 21 84 a
0 24 93 a8 43 8d c6
7b 83 e9 02 f1 .
X!..$..C..{....
04e0 48 dc d4 04 d
1 d0 62 59 ae 79 84
35 fa 5a b0 25 H
.....bY.y.5.Z.%
04f0 64 36 b3 56 2
3 ca 39 3f a4 26 d5
06 18 a6 ff fc d
6.V#.9?.&......
0500 da 93 eb 50 1
b de 6f 38 b6 1c b1
eb af 13 49 0e .
..P..o8......I.
0510 8a 82 cf 43 0
7 2e 3d a9 18 bb 62
86 34 d5 9c 0b .
..C..=...b.4...
0520 10 4d
.
M
No. Time
Source
Destination
Protocol
Length Info
313 12.21357800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
472 http49
574 [PSH, ACK] Seq=
195614 Ack=1 Win=46
Len=418
Frame 313: 472 byte
s on wire (3776 bit
s), 472 bytes captu
red (3776 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.263508000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.263508000 s
econds
[Time delta fro
m previous captured
frame: 0.068094000
seconds]
[Time delta fro
m previous displaye

d frame: 0.06809400
0 seconds]
[Time since ref
erence or first fra
me: 12.213578000 se
conds]
Frame Number: 3
13
Frame Length: 4
72 bytes (3776 bits
)
Capture Length:
472 bytes (3776 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co

m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
58
Identification:
0xf224 (61988)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d50 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 195614, Ack:
1, Len: 418
Source Port: ht
tp (80)

Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 418]
Sequence number
: 195614 (relati
ve sequence number)
[Next sequence
number: 196032 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xdd6
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1678]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 ca f2 24 4
0 00 31 06 3d 50 4a
7c 0c 8a c0 a8 .
..$@.1.=PJ|....
0020 01 0b 00 50 c
1 a6 2b cb 5e 4b 9e
87 4e aa 50 18 .
..P..+.^K..N.P.
0030 00 2e dd 69 0
0 00 09 76 52 71 41
cc f9 9a e9 77 .
..i...vRqA....w
0040 15 95 91 b8 8
3 ba 09 03 37 ce 26
e5 5b 82 1f 48 .
.......7.&.[..H
0050 b4 0b 17 b7 2
d 46 26 77 bd 51 35
44 ec a4 b5 63 .
...-F&w.Q5D...c
0060 03 a1 2a 0b d
3 24 0b 84 61 70 1b
a8 79 16 10 2a .
.*..$..ap..y..*
0070 c6 b9 ea 69 b
a cb aa 43 48 7c 93
2a 59 c3 68 b0 .
..i...CH|.*Y.h.
0080 17 d9 96 a4 5
9 54 d6 ea bb 67 5e
ff fb 92 04 ee .
...YT...g^.....
0090 0f f3 31 26 5
4 83 38 c2 50 61 46
9a 90 63 0d 5c .
.1&T.8.PaF..c.\
00a0 0c 28 9f 52 0
c 62 49 41 66 13 ea
41 97 bd 28 95 .
(.R.bIAf..A..(.
00b0 9c 9d 62 ce c
d c4 df f5 58 0b c8
33 01 49 87 36 .
.b.....X..3.I.6
00c0 8d 28 74 53 6
1 11 8b 6b ad ba fc
2a a9 a4 34 f9 .
(tSa..k...*..4.
00d0 88 0d bb 61 4
1 30 ad 4a 7a bc d8
5c ae 6c 0f 35 .
..aA0.Jz..\.l.5
00e0 11 b0 f5 28 b
5 a6 0b cb da 11 43
52 d4 8a e5 00 .
..(......CR....
00f0 7a 22 ed 80 6
a d4 df 75 ef 9b 43
7b e0 67 d8 f5 z
"..j..u..C{.g..
0100 9a 25 64 b7 5
9 de b5 9d 3f 9b 1f
7b de bc 27 03 .
%d.Y...?..{..'.

0110 b5 be 99 e6 e
d 91 7e bf f1 4b 69
96 b5 93 80 e0 .
.....~..Ki.....
0120 cf cd 21 12 2
c d0 cd 79 a1 93 64
74 de 91 91 0f .
.!.,..y..dt....
0130 95 ab 4a 6a a
b cc 9e 4e 24 bc 57
9d 0a 11 7b 41 .
.Jj...N$.W...{A
0140 f3 34 d5 18 8
0 43 59 4a 3e d3 90
60 98 b3 65 70 .
4...CYJ>..`..ep
0150 a1 80 0a ba b
9 24 0c 5e 8c a7 79
0f 39 93 17 df .
....$.^..y.9...
0160 cb 8b 26 fc 1
b 68 c6 7d 5c c2 ca
d9 c1 c3 44 a7 .
.&..h.}\.....D.
0170 d1 63 c4 60 0
5 96 7e c7 48 3a a5
05 00 d4 4d 28 .
c.`..~.H:....M(
0180 72 66 48 09 8
e 3a eb de 60 08 bb
44 2b 64 89 2c r
fH..:..`..D+d.,
0190 ce 5c 85 d7 6
0 78 36 68 a4 84 83
79 71 e8 82 2b .
\..`x6h...yq..+
01a0 dd b3 c7 e6 6
7 2c 0b 76 43 89 aa
8b c2 cc 4d 7c .
...g,.vC.....M|
01b0 5c a1 54 1c 7
9 8c 67 2a 7a 1a e1
d9 2b 5a c0 b6 \
.T.y.g*z...+Z..
01c0 e9 bb c5 59 a
f c3 ed 28 b1 5f 02
90 1c 38 e8 4c .
..Y...(._...8.L
01d0 a0 d4 32 44 0
1 e9 67 d0
.
.2D..g.
No. Time
Source
Destination
Protocol
Length Info
314 12.21375600
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=196032 Win=38430 L
en=0
Frame 314: 54 bytes

on wire (432 bits)

, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.263686000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.263686000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 12.213756000 se
conds]
Frame Number: 3
14
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f8d (20365)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum

: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 19603
2, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 196032 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .

..0 = Fin: Not set

Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 313]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 8d 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 5f ed 50 10 .
....P..N.+._.P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
315 12.22448700
0 Netgear_2e:1a:0
9
Broadcast
HomePlug
AV 60 MAC Manag
ement, Get Bridge I
nformations Confirm
ation
Frame 315: 60 bytes
on wire (480 bits)
, 60 bytes captured
(480 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)

Arrival Time: N
ov 10, 2014 11:27:0
5.274417000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.274417000 s
econds
[Time delta fro
m previous captured
frame: 0.010731000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01073100
0 seconds]
[Time since ref
erence or first fra
me: 12.224487000 se
conds]
Frame Number: 3
15
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:homeplug-av]
[Coloring Rule
Name: Broadcast]
[Coloring Rule
String: eth[0] & 1]
Ethernet II, Src: N
etgear_2e:1a:09 (20
:0c:c8:2e:1a:09), D
st: Broadcast (ff:f
f:ff:ff:ff:ff)
Destination: Br
oadcast (ff:ff:ff:f
f:ff:ff)
Address: Br
oadcast (ff:ff:ff:f
f:ff:ff)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f
actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Netgear
_2e:1a:09 (20:0c:c8
:2e:1a:09)
Address: Ne
tgear_2e:1a:09 (20:
0c:c8:2e:1a:09)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: Homeplug
AV (0x88e1)
HomePlug AV protoco
l
MAC Management
Header
.... ...1 =
Version: 1.1 (1)
Type: Get B
ridge Informations
Confirmation (0x602
1)
.... ..
01 = LSB: Confirm (
0x01)
.... .0
0. = MSB: STA - Cen
tral Coordinator (0
x00)
Fragmentati
on Info: 0x0000
.... 00
00 = Fragment count
:0
0000 ..
.. = Fragment index
:0
Fragmen
t Sequence number:
0
Get Bridge Info
rmations Confirmati
on
Bridging: T
rue
Bridge Term
inal Equipement Ide
ntifier: 5
Number of s
tations: 4
Bridged Des
tination Address: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1)
Bridged Des
tination Address: A
pple_86:da:3d (04:e
5:36:86:da:3d)
Bridged Des
tination Address: H
onHaiPr_be:71:b9 (8
4:4b:f5:be:71:b9)
Bridged Des
tination Address: H
onHaiPr_c9:0e:4a (0
0:1f:3a:c9:0e:4a)
0000 ff ff ff ff f
f ff 20 0c c8 2e 1a
09 88 e1 01 21 .
..... ........!

0010 60 00 00 01 0
5 04 90 01 3b d0 17
e1 04 e5 36 86 `
.......;.....6.
0020 da 3d 84 4b f
5 be 71 b9 00 1f 3a
c9 0e 4a 00 00 .
=.K..q...:..J..
0030 00 00 00 00 0
0 00 00 00 00 00 00
00
.
...........
No. Time
Source
Destination
Protocol
Length Info
316 12.28648900
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=19603
2 Ack=1 Win=46 Len=
1260
Frame 316: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.336419000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.336419000 s
econds
[Time delta fro
m previous captured
frame: 0.062002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06200200
0 seconds]
[Time since ref
erence or first fra
me: 12.286489000 se
conds]
Frame Number: 3
16
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)

[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser

vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf225 (61989)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a05 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 196032, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 196032 (relati
ve sequence number)
[Next sequence
number: 197292 (
relative sequence n
umber)]
Acknowledgment

number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd67
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 25 4
0 00 31 06 3a 05 4a
7c 0c 8a c0 a8 .
..%@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 5f ed 9e
87 4e aa 50 10 .
..P..+._...N.P.
0030 00 2e d6 72 0

0 00 71 00 90 94 70
71 80 8a 4d 24 .
..r..q...pq..M$
0040 cf c1 a1 0e 1
7 03 30 39 a5 33 1f
aa df c6 3c d7 .
.....09.3....<.
0050 69 9d 7c 93 4
5 ce bd 12 1d d2 9a
38 9a 9f d3 c7 i
.|.E......8....
0060 0f 6e 07 a9 6
6 38 31 13 14 ab a8
e4 bb 04 20 d6 .
n..f81....... .
0070 4a 75 45 c7 d
a 73 79 e5 dd ee a4
f7 75 9d 7a 5f J
uE..sy.....u.z_
0080 d5 cc fa d2 6
9 7f 77 6b d2 0d 15
ff fb 92 04 eb .
...i.wk........
0090 8f f3 11 2d d
4 03 38 8a 60 62 a5
7a 70 6b 0f 4c .
..-..8.`b.zpk.L
00a0 4b f8 9d 50 0
c e1 e9 41 75 94 29
c1 9c 3d 28 70 K
..P...Au.)..=(p
00b0 a9 d5 06 a7 5
7 a5 b9 5d 1f fe 86
22 92 68 00 2e .
...W..]...".h..
00c0 80 3c 8c 6c 5
2 4d 88 b6 cb dc 62
69 06 c2 90 b5 .
<.lRM....bi....
00d0 be 6d df a6 6
f 5a 37 3d 19 87 e1
da 44 6c 48 28 .
m..oZ7=....DlH(
00e0 76 33 3d 28 8
3 6d 48 e6 24 18 58
73 26 a0 c4 6b v
3=(.mH.$.Xs&..k
00f0 75 10 8e 89 4
1 ec d1 a3 99 63 3b
9b df 32 46 89 u
...A....c;..2F.
0100 8b ca a9 de 2
9 7b 22 6b fe e8 fa
0d f1 5f f5 fc .
...){"k....._..
0110 57 85 de d5 b
2 96 eb af d0 a6 05
99 34 06 cb 98 W
...........4...
0120 1c a9 52 00 2
1 b0 42 41 0c c6 22
c5 cb 0f 17 43 .
.R.!.BA.."....C
0130 04 88 35 c9 e
9 5c aa e1 00 a1 56
e7 11 cc a0 8b .
.5..\....V.....
0140 32 fd aa 7a a
2 40 b1 41 73 0a 80

54 22 4d bc 29 2
..z.@.As..T"M.)
0150 e8 e9 52 49 f
9 be fb 42 31 a1 cf
9d ef f2 e6 ac .
.RI...B1.......
0160 7f ef 19 ce 6
e f7 6e af ab 7d c6
e5 d9 79 56 20 .
...n.n..}...yV
0170 2c 74 0c 6d 3
5 b6 51 91 43 7a 11
e4 2f 98 19 50 ,
t.m5.Q.Cz../..P
0180 32 89 6b 0d 0
8 65 56 80 69 f3 af
a1 a4 12 47 a9 2
.k..eV.i.....G.
0190 d4 bd 30 fb 4
0 0b 1a 98 bc 8d c6
f6 25 89 47 9a .
.0.@.......%.G.
01a0 84 ae 7e 6d 7
6 0c 44 bb 52 11 88
06 f3 84 0a 41 .
.~mv.D.R......A
01b0 63 82 63 45 e
7 72 52 ab 95 bf 0a
6f a9 31 13 5a c
.cE.rR....o.1.Z
01c0 cb c7 fb 95 e
6 a5 4c 7f a8 5a 97
01 65 24 1b 24 .
.....L..Z..e$.$
01d0 59 86 d0 2f e
e 4e 54 95 50 07 50
10 0c 6b 29 7a Y
../.NT.P.P..k)z
01e0 5d 82 59 89 d
2 09 06 e0 2a 84 84
97 28 92 eb d1 ]
.Y.....*...(...
01f0 b8 ec 5f 29 3
4 85 be 8c 4b a1 b1
89 ae 99 da 7c .
._)4...K......|
0200 33 ac 2a 1c e
a 61 3d 5c 64 6a c7
4d c8 25 ce d0 3
.*..a=\dj.M.%..
0210 e3 67 fd 65 c
2 77 21 bf bb 1b c7
5d e5 7d 76 bc .
g.e.w!....].}v.
0220 35 4f cc ee 7
7 0d c9 ff 79 d5 bd
6b b5 ff fb 92 5
O..w...y..k....
0230 04 e9 8f f3 0
4 27 54 03 38 ca 50
5e 65 8a 70 63 .
....'T.8.P^e.pc
0240 0f 4c 0c 2c 9
d 4e 0d 63 09 41 75
93 e9 81 9c 3d .
L.,.N.c.Au....=
0250 28 85 c5 e3 6
4 c7 1d 97 75 49 ac
b2 eb 47 90 05 (

...d...uI...G..
0260 60 e7 10 42 2
d 93 e6 29 13 01 69
cb 31 3f 10 1e `
..B-..)..i.1?..
0270 a9 d5 aa 0f a
7 70 d5 13 d0 e2 ed
09 4c 75 fb a6 .
....p......Lu..
0280 41 a2 b2 51 7
7 79 e0 21 6a 25 97
17 72 1b 02 67 A
..Qwy.!j%..r..g
0290 e9 52 e1 04 2
5 f1 b4 39 d2 b9 52
e3 2f 25 ad 27 .
R..%..9..R./%.'
02a0 8b 0e 37 86 e
d cb df 19 88 dc e7
f3 8a 4f 09 92 .
.7..........O..
02b0 e6 5c 54 aa d
2 36 30 15 66 84 24
82 5a 08 a0 37 .
\T..60.f.$.Z..7
02c0 42 22 94 1c 2
9 8a 00 27 f4 c7 40
04 3a 9d ce b1 B
"..)..'..@.:...
02d0 62 6d 15 bc 9
b 86 a8 2f 45 fa d2
64 fa 9f 48 47 b
m...../E..d..HG
02e0 de 05 af 24 8
1 6e 96 15 25 96 e5
7e 61 62 91 2a .
..$.n..%..~ab.*
02f0 bc 7e ac 09 4
a 9c 8c 5f 71 5b 78
4a af ee f7 ff .
~..J.._q[xJ....
0300 d3 ea b6 1b b
b 5e 0f ee 5f 9e 2d
57 2c 3e 94 0c .
....^.._.-W,>..
0310 dc ea 66 f2 0
e a9 f4 bd f0 9b 4d
07 04 18 64 87 .
.f.......M...d.
0320 08 20 14 00 9
a 97 bd 89 3f 04 82
0c d2 77 b0 78 .
......?....w.x
0330 4c 1a c3 13 6
2 a6 e7 d5 56 04 bf
a5 1c 45 19 64 L
...b...V....E.d
0340 2a e4 0b 60 5
1 54 2c ba 51 4f 35
29 4b ac e0 9a *
..`QT,.QO5)K...
0350 47 e2 7d ac 3
1 7b af cd bc 39 3f
5e 96 8f bf 6b G
.}.1{...9?^...k
0360 b9 5e dd 0d 5
9 76 39 5c c6 76 27
6b 0c 71 5b 0e .
^..Yv9\.v'k.q[.

0370 56 c1 c9 bd 5
1 0e fd c8 4f 43 0a
38 39 b0 d1 f0 V
...Q...OC.89...
0380 c0 45 ad 33 5
1 1a 91 73 1d 78 29
d5 20 45 0b da .
E.3Q..s.x). E..
0390 9f 1c 16 d6 e
c ab e2 52 3e 68 52
27 56 c5 aa 3b .
......R>hR'V..;
03a0 6f c1 0f 19 0
f 62 a3 e0 3a 01 61
bd 50 fe 42 ee o
....b..:.a.P.B.
03b0 06 c4 73 60 e
6 58 dc db d4 ba cf
8b 06 1c 5d d9 .
.s`.X........].
03c0 49 17 fc b7 2
b e8 ed d7 8d 79 68
88 b8 00 f9 ff I
...+....yh.....
03d0 fb 92 04 e9 8
f f3 08 28 53 83 58
c2 50 5e a4 fa .
......(S.X.P^..
03e0 60 67 0f 4a 0
b c0 99 50 0c e3 09
41 79 12 a9 81 `
g.J...P...Ay...
03f0 8c 61 29 46 a
8 e9 ac 5b 47 4b 4d
30 28 2c 30 e3 .
a)F...[GKM0(,0.
0400 17 44 30 a7 2
b 29 78 39 8f f9 02
1c 72 55 ca 16 .
D0.+)x9....rU..
0410 7e 0e cb 27 e
3 5a d3 44 a6 b5 6d
29 a0 de cb a4 ~
..'.Z.D..m)....
0420 72 f9 78 5d 7
7 dd 48 63 2e bb 23
c8 a7 90 5a 95 r
.x]w.Hc..#...Z.
0430 43 e9 69 0f 4
a 15 4a 72 fd 0f ee
7f 2b bd b3 77 C
.i.J.Jr....+..w
0440 96 6d e5 04 5
5 ef ea b6 74 97 ec
7d ce dc cd 1a .
m..U...t..}....
0450 da 54 3c 50 8
0 ec 37 a1 76 18 11
28 e6 4d 58 bc .
T<P..7.v..(.MX.
0460 c2 47 cd 5d 9
6 18 48 26 35 a7 3c
90 32 6d 97 e6 .
G.]..H&5.<.2m..
0470 db b2 e3 c6 0
0 aa dd df 3b 74 02
19 87 a8 89 65 .
.......;t.....e
0480 4f 24 f2 f6 3

5 29 0d fe e2 ca c8
a0 f8 f5 0d 48 O
$..5).........H
0490 b8 59 b2 a9 e
1 ce 15 4e 50 36 b1
e6 74 12 74 e8 .
Y.....NP6..t.t.
04a0 0e 51 03 65 9
9 9b 1a 88 e4 a8 b5
97 58 b8 fa ab .
Q.e........X...
04b0 46 82 d1 ad 6
d 53 35 7f 3c d8 5d
f4 b6 81 62 8d F
...mS5.<.]...b.
04c0 24 54 50 a0 f
0 c3 ce 19 57 64 7e
1a 1d 11 83 15 $
TP.....Wd~.....
04d0 52 cd 97 a7 1
9 16 aa bd b6 59 5d
6b f2 a2 aa 97 R
........Y]k....
04e0 ab ff a9 5c 1
5 e5 94 7c de 6a ba
a8 d2 4a 29 f2 .
..\...|.j...J).
04f0 4a d3 14 60 b
3 44 cc 40 85 17 28
29 89 03 ec e6 J
..`.D.@..()....
0500 e6 45 e5 34 7
b 0b ee 89 f4 cd 45
8a 0b 9e 5a 67 .
E.4{.....E...Zg
0510 eb 53 29 92 4
9 f4 ed 52 74 7e e7
a8 bf 6d 5d 55 .
S).I..Rt~...m]U
0520 73 0c
s
.
No. Time
Source
Destination
Protocol
Length Info
317 12.35749000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=19729
2 Ack=1 Win=46 Len=
1260
Frame 317: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t

ype: Ethernet (1)

Arrival Time: N
ov 10, 2014 11:27:0
5.407420000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.407420000 s
econds
[Time delta fro
m previous captured
frame: 0.071001000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07100100
0 seconds]
[Time since ref
erence or first fra
me: 12.357490000 se
conds]
Frame Number: 3
17
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa

gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf226 (61990)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a04 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0

1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 197292, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 197292 (relati
ve sequence number)
[Next sequence
number: 198552 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win

dow size: 46]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xb91
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 26 4
0 00 31 06 3a 04 4a
7c 0c 8a c0 a8 .
..&@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 64 d9 9e
87 4e aa 50 10 .
..P..+.d...N.P.
0030 00 2e b9 1b 0
0 00 39 38 4a 5e 2e
50 e7 06 9a c4 .
.....98J^.P....
0040 91 f1 5d 36 d
a 9b b2 4d fc 5e 91
b8 c9 af 32 dd .
.]6...M.^....2.
0050 3f ac db 39 6
a 6b 93 9a a0 d7 31
8a c4 1d 1e cb ?
..9jk....1.....
0060 f0 bf 74 70 a
1 c9 b1 4b 84 13 3c
14 0b 17 b4 e8 .
.tp...K..<.....
0070 b1 cf 9a 9b b
f 8e ff e6 2e 5e ad
da 97 5d 7b 78 .
........^...]{x
0080 e7 9e 4f 54 e
6 ff fb 92 04 ea 8f
f2 ed 27 d4 03 .
.OT.........'..
0090 59 7a 50 5e 2
4 fa 60 63 18 4a 0c
8c d5 4e 0d 66 Y
zP^$.`c.J...N.f
00a0 0b 81 8d 1a a
9 41 9c 35 70 5f 6c
cb 96 a3 21 47 .
....A.5p_l...!G
00b0 8a 38 80 a6 8
2 7b 72 0a 58 d8 58
41 14 0b c8 69 .
8...{r.X.XA...i
00c0 93 9a 48 00 7
1 16 cc d8 a4 25 82
a5 dc 5f 07 86 .

.H.q....%..._..
00d0 fe 11 5c db a
c ab 6f e1 28 10 24
a5 d9 71 f9 74 .
.\...o.(.$..q.t
00e0 18 5c e3 0d a
4 b6 d4 76 86 0e d9
62 8d 77 10 66 .
\.....v...b.w.f
00f0 9a f7 6f 1a 9
d 89 77 3d b7 f4 c0
d8 f7 ed b1 e2 .
.o...w=........
0100 d7 ab e8 f6 6
e 75 6e fa 76 ad 7f
fc 95 f8 df f3 .
...nun.v.......
0110 69 e9 59 f9 5
f 7c 42 86 b2 15 75
a8 95 98 ba 87 i
.Y._|B...u.....
0120 8b 3c fb 7d c
b b5 38 dd 12 8d 9e
13 2d 21 aa db .
<.}..8.....-!..
0130 47 2e 48 b2 a
0 6a 5a 8f 88 e3 22
16 00 9d e4 f4 G
.H..jZ...".....
0140 ac b4 75 e8 a
6 3b 75 80 89 7e 5d
ca d4 d5 57 c3 .
.u..;u..~]...W.
0150 57 ee 0b 33 1
c eb 5f fc b1 d6 36
2a f7 f3 94 3b W
..3.._...6*...;
0160 99 7f 3b 5e 0
c 90 20 c0 6e 65 23
98 5c d6 47 1d .
.;^.. .ne#.\.G.
0170 dd 58 a3 38 0
2 1e 06 78 20 99 30
d0 e0 36 e3 e2 .
X.8...x .0..6..
0180 a5 41 6a 63 8
4 36 c1 e6 d0 c2 4d
a3 51 75 2a 44 .
Ajc.6....M.Qu*D
0190 9b d1 bc a7 0
2 21 c9 35 16 95 e0
08 ee 71 33 6f .
....!.5.....q3o
01a0 67 c8 ad 66 a
3 e6 c7 ad 0b 77 58
11 89 a8 d5 3d g
..f.....wX....=
01b0 e9 5c 45 d5 e
9 ed 65 8f b8 13 c3
78 a8 fa a4 69 .
\E...e....x...i
01c0 7f fa f8 fb c
6 ff 9e 3a 47 7e 85
58 15 53 22 12 .
......:G~.X.S".
01d0 3c 35 a0 83 0
5 1c 66 4a 9d b2 4b
94 51 9b 10 06 <
5....fJ..K.Q...

01e0 1a 35 6f 36 8
0 ea cf 45 30 4c 87
eb 28 0c 92 2a .
5o6...E0L..(..*
01f0 79 be b1 4a 5
9 53 65 5b 92 f9 f8
66 ac d3 00 05 y
..JYSe[...f....
0200 0b 79 e3 4f 8
9 09 a5 d2 b8 21 5e
f2 f5 1e 1f 97 .
y.O.....!^.....
0210 d4 b7 7b 2d 6
e ad 3c 0f 67 57 7b
55 e0 7b 7b 8d .
.{-n.<.gW{U.{{.
0220 db df 54 a2 5
6 04 a9 ff fb 92 04
e7 8f f2 fb 26 .
.T.V..........&
0230 53 83 59 c2 5
0 60 25 ca 50 67 0f
4c 0b 64 93 50 S
.Y.P`%.Pg.L.d.P
0240 0c e7 09 41 5
f 96 e9 81 97 bd 30
2b 6d d5 58 e3 .
..A_.....0+m.X.
0250 f4 a2 94 64 5
1 02 69 61 83 e0 53
0c 30 24 22 c1 .
..dQ.ia..S.0$".
0260 a2 bb fc aa 3
7 9b c1 ed 4b f3 60
b0 3d 47 67 81 .
...7...K.`.=Gg.
0270 64 38 d7 25 2
2 3b ab d7 96 cc b6
34 d5 42 09 07 d
8.%";.....4.B..
0280 b5 19 99 99 e
6 e8 bb a4 15 e7 6d
d9 4a 49 7d 3b .
.........m.JI};
0290 72 6b b6 1a f
e 7a 8c 65 d9 8b 78
d3 72 ed 5b f2 r
k...z.e..x.r.[.
02a0 ef d6 bb 56 5
9 07 67 bc 7b 70 90
44 b1 b6 a8 02 .
..VY.g.{p.D....
02b0 5c 39 77 af 8
e 6e 23 ac 19 80 39
6f 99 73 cf 56 \
9w..n#...9o.s.V
02c0 4b c7 15 75 d
9 53 e6 40 06 3d 2c
9b 6b ea d7 93 K
..u.S.@.=,.k...
02d0 bf 69 3f 1f 8
b 32 30 62 48 9e ff
d5 c6 a4 60 be .
i?..20bH.....`.
02e0 11 88 4d 06 a
d a5 b0 d1 25 92 09
b8 bc 59 85 36 .
.M.....%....Y.6
02f0 94 11 e6 6f 5

a 00 9e dc b3 9c e7
d8 c7 bf cb 30 .
..oZ..........0
0300 8c 73 b7 ac 6
3 d0 8c b5 ac 25 82
ad 1e 75 8e 16 .
s..c....%...u..
0310 22 d0 bb fd 2
a a8 28 c0 f1 c4 4d
34 b0 28 a5 2f "
...*.(...M4.(./
0320 ae b1 e1 16 3
8 5c a9 d6 d7 81 d3
5d 6f db 2b 7d .
...8\.....]o.+}
0330 a5 ec 9e 5e a
5 54 93 13 40 81 b2
47 5e 5f 37 36 .
..^.T..@..G^_76
0340 7a 02 00 e4 5
d 27 3b 39 0f 1a b2
2a 17 11 54 45 z
...]';9...*..TE
0350 d9 19 b7 c3 3
e 41 70 80 d8 f6 b5
f6 ab 8d 31 55 .
...>Ap.......1U
0360 97 1f 98 f8 c
5 16 02 8a 12 04 e7
00 40 c0 75 46 .
...........@.uF
0370 83 3a 8e 6c d
2 51 d1 97 12 b0 3a
b4 1a 24 08 e8 .
:.l.Q....:..$..
0380 54 38 76 6a a
1 ce 92 f5 43 b3 70
8b d1 d2 cd 5f T
8vj....C.p...._
0390 6f 9c 96 14 d
4 32 97 08 28 9e 51
59 2d d9 49 ec o
....2..(.QY-.I.
03a0 9f 3f 08 5c 1
9 1f 98 03 74 81 1b
b6 44 42 4f 95 .
?.\....t...DBO.
03b0 aa 73 e4 37 a
e 87 ba 95 bf 16 b7
79 3d 29 b6 c5 .
s.7.......y=)..
03c0 bc ae d0 55 8
8 c4 7d 67 14 ff fb
92 04 ed 0f f3 .
..U..}g........
03d0 1c 27 d3 83 5
a c2 50 62 84 ea 50
6b 18 4a 0b ec .
'..Z.Pb..Pk.J..
03e0 9d 52 0c e3 0
9 41 82 12 69 c1 9c
3d 28 81 0c 06 .
R...A..i..=(...
03f0 f0 e1 84 1f 0
3 b0 37 da 4d e8 46
b6 ec 41 01 10 .
.....7.M.F..A..
0400 8b 48 68 d4 3
a 1c 14 ae b5 48 d6

9d 06 07 1d 57 .
Hh.:....H.....W
0410 50 da ed aa b
3 5a 7b 85 65 80 3c
b1 18 c1 50 89 P
....Z{.e.<...P.
0420 5b 05 4a 6b 4
1 26 c3 79 90 2d eb
98 0b e3 74 ef [
.JkA&.y.-....t.
0430 33 8f 55 c2 4
3 6c e8 15 d9 66 2d
53 19 6e 0f 1c 3
.U.Cl...f-S.n..
0440 fe 75 aa cf 8
8 96 de 3b 1a ab 71
23 38 53 79 b4 .
u.....;..q#8Sy.
0450 e1 13 4b 9c 2
8 74 85 7b 56 f3 48
d6 ad 27 7a a4 .
.K.(t.{V.H..'z.
0460 08 40 97 22 b
d 10 89 d6 93 c3 f4
31 55 56 7e e3 .
@.".......1UV~.
0470 36 2f b4 ca 6
7 76 ca e7 7f 68 64
82 32 42 61 8a 6
/..gv...hd.2Ba.
0480 2b dd 5e 0c f
4 e2 0b ba 82 9f 41
9e 6e 50 a2 3f +
.^.......A.nP.?
0490 23 6e 99 13 2
9 b7 8a db e6 14 bb
cb d9 af 7b 5b #
n..).........{[
04a0 6e 18 52 ff d
b 82 69 3c 60 10 40
60 e6 20 be 20 n
.R...i<`.@`. .
04b0 20 00 53 45 7
7 f7 78 ed 2f c1 a4
a5 d0 2e c2 5f
.SEw.x./......_
04c0 cb da f3 43 8
2 60 05 25 97 05 cd
8d 4e b4 a5 3a .
..C.`.%....N..:
04d0 14 a8 79 96 b
b 55 c7 69 36 91 0e
a6 ba 8c 49 d0 .
.y..U.i6.....I.
04e0 f3 5e 24 59 a
4 d3 68 8a 09 05 11
42 92 19 a6 5e .
^$Y..h....B...^
04f0 6b e2 33 8c 8
a f2 13 6c 8c 1b 61
92 39 24 c9 39 k
.3....l..a.9$.9
0500 ea 72 eb 41 7
9 ef ab d8 5a 30 23
10 d2 0b 0f a1 .
r.Ay...Z0#.....
0510 a3 8a 0d f2 9
b 7a 6a 0b 42 90 6a
eb 81 df 74 9b .

....zj.B.j...t.
0520 c9 44
.
D
No. Time
Source
Destination
Protocol
Length Info
318 12.35766800
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=198552 Win=37800 L
en=0
Frame 318: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.407598000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.407598000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 12.357668000 se
conds]
Frame Number: 3
18
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 4
0
Identification:
0x4f8e (20366)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 19855
2, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 198552 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37800
[Calculated win
dow size: 37800]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 317]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 8e 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 69 c5 50 10 .
....P..N.+.i.P.
0030 93 a8 18 d4 0
0 00
.
.....
No. Time
Source
Destination

Protocol
Length Info
319 12.36348800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1295 http49
574 [PSH, ACK] Seq=
198552 Ack=1 Win=46
Len=1241
Frame 319: 1295 byt
es on wire (10360 b
its), 1295 bytes ca
ptured (10360 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.413418000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.413418000 s
econds
[Time delta fro
m previous captured
frame: 0.005820000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00582000
0 seconds]
[Time since ref
erence or first fra
me: 12.363488000 se
conds]
Frame Number: 3
19
Frame Length: 1
295 bytes (10360 bi
ts)
Capture Length:
1295 bytes (10360
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),

Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
281
Identification:
0xf227 (61991)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not

set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a16 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 198552, Ack:
1, Len: 1241
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1241]
Sequence number
: 198552 (relati
ve sequence number)
[Next sequence
number: 199793 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):

Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x0e3
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1241]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 01 f2 27 4
0 00 31 06 3a 16 4a
7c 0c 8a c0 a8 .
..'@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 69 c5 9e
87 4e aa 50 18 .
..P..+.i...N.P.
0030 00 2e 0e 36 0
0 00 86 fa 5a 85 cb
39 e8 33 8e 53 .
..6....Z..9.3.S
0040 0f 3e 84 f2 f
2 6d 2c 5a 5d b3 d8
c2 9e 04 69 08 .
>...m,Z].....i.
0050 0a 5d c3 3e 2
c 14 65 aa f5 ff de
ef 8b 6e 35 21 .
].>,.e......n5!
0060 57 3f 1e b9 8
d bf 66 e6 9a 2e 49
8a 1c d2 a5 f0 W
?....f...I.....
0070 42 82 4b bc a

2 96 f5 14 2f 73 25
ca 6a c9 fd ff B
.K...../s%.j...
0080 fb 92 04 e9 0
f f3 14 27 54 83 38
7a 50 60 64 ea .
......'T.8zP`d.
0090 80 67 0f 4a 0
b 90 91 58 0c 61 e9
41 77 96 2b c1 .
g.J...X.a.Aw.+.
00a0 87 a5 30 c1 f
f 7b b6 cf e5 de a7
14 11 0a a2 34 .
.0..{.........4
00b0 ae 76 1c e3 3
4 c6 bd 45 2b 30 e1
38 e8 f5 13 4d .
v..4..E+0.8...M
00c0 f3 c5 a0 e4 9
d 66 44 f2 78 94 bd
85 fc 60 05 bd .
....fD.x....`..
00d0 45 50 d0 a3 3
1 7a 14 ab 8f 32 ee
bd 68 3e 87 b2 E
P..1z...2..h>..
00e0 9b 2e d6 d8 f
b 93 33 78 f6 da c5
97 73 a2 71 10 .
.....3x....s.q.
00f0 3e 2b 0a 84 c
6 9d 6a a8 1d d8 a2
fb 17 39 ac 96 >
+....j......9..
0100 8c 9f eb 77 f
6 7e b1 c4 89 32 86
2a 8c fa 2b 93 .
..w.~...2.*..+.
0110 5b 84 91 c8 d
0 4d 63 8f 5e d6 ec
54 8d 1e 86 ac [
....Mc.^..T....
0120 cd 69 97 39 d
d db c0 55 27 55 87
66 e1 fe c0 e1 .
i.9...U'U.f....
0130 d6 df 11 f5 d
9 0e fd 38 ee 9d 61
25 f6 6a ab de .
......8..a%.j..
0140 e1 ff 5f ef f
4 fe c6 3e 1f a1 6a
59 96 9d b4 76 .
._....>..jY...v
0150 8e 47 73 fb f
5 4e 87 ce 1f ad c9
75 bf 74 ff ff .
Gs..N.....u.t..
0160 c1 89 a8 13 e
c c9 20 87 b6 5c 87
c0 cf 38 d5 27 .
..... ..\...8.'
0170 40 b5 29 19 5
9 8e 1c 13 09 ab 4e
8f 6d d7 68 b0 @
.).Y.....N.m.h.
0180 87 1d 1c 1d e
f fa 9b 82 bb ba 6c

0e 09 30 47 2c .
.........l..0G,
0190 2f d0 22 fd 7
d 39 97 92 f4 a7 da
6b 0c dd fd 63 /
.".}9.....k...c
01a0 dc 9c 69 26 4
5 43 91 4b 05 1c a1
47 ba 11 63 90 .
.i&EC.K...G..c.
01b0 2e c9 a7 ac 4
0 68 d8 aa 46 29 a7
47 b0 fb ab 00 .
...@h..F).G....
01c0 ba f7 27 b4 c
d 82 a8 a9 a8 07 69
d2 8a 6b 64 32 .
.'.......i..kd2
01d0 c1 ba cc c7 a
6 d6 78 4a 86 cc 79
f5 5d c3 9b e4 .
.....xJ..y.]...
01e0 ab 5b be f1 a
c 31 6f 59 b5 a5 6a
fe fb aa c5 74 .
[...1oY..j....t
01f0 ae d6 61 d7 7
e cc 2a 6a b5 16 6b
28 43 e1 cf fd .
.a.~.*j..k(C...
0200 f2 33 a7 fb 5
e 2d ee ab 53 87 fe
e4 73 c8 d3 8a .
3..^-..S...s...
0210 7e df 50 b3 9
f e5 e7 97 2c 07 42
8f 01 4c 16 6a ~
.P.....,.B..L.j
0220 0c ff fb 92 0
4 e9 0f f2 e8 24 57
83 0c 7a 50 5a .
........$W..zPZ
0230 84 cb 00 61 8
c 4a 0c 4c d3 62 07
b1 0b 89 80 93 .
..a.J.L.b......
0240 ac 40 f6 19 2
8 bd 19 a5 30 6a 6d
42 01 22 95 14 .
@..(...0jmB."..
0250 65 ed 9d 2e 1
2 97 03 bf 4f b6 54
2a 19 22 db e2 e
.......O.T*."..
0260 0d 90 a6 8b 4
4 6e 57 5a cf a0 28
2e 81 ae cc 03 .
...DnWZ..(.....
0270 63 cb 3a 84 5
2 68 15 53 cd 69 b7
3a 8d 57 ab 46 c
.:.Rh.S.i.:.W.F
0280 a4 93 2d 16 1
d b7 e8 a5 cc 85 70
9d cc 29 fc ed .
.-.......p..)..
0290 e6 54 8d 72 3
a 3f 6d 53 3c c5 eb
75 75 1c ca 92 .

T.r:?mS<..uu...
02a0 7a e9 4d e5 7
8 92 7d bf aa f9 de
c9 c7 1c 0a 8f z
.M.x.}.........
02b0 8f 72 b4 aa f
7 c9 74 19 55 55 fa
e4 15 5a 44 d5 .
r....t.UU...ZD.
02c0 5d 45 63 64 8
6 aa 8e 86 b3 da e4
c4 87 bf dd bb ]
Ecd............
02d0 83 c9 f6 a0 d
b 0a c4 ac 63 10 a0
42 63 c1 f3 fa .
.......c..Bc...
02e0 a7 af eb a9 e
b a3 05 6b 9a 78 f6
34 78 20 a8 69 .
......k.x.4x .i
02f0 c2 d0 9d 43 d
c d7 31 f8 b0 f1 81
53 a2 2c 26 1a .
..C..1....S.,&.
0300 bc f1 1d a8 c
4 2e 06 98 ad 60 1c
89 ed 88 0e 43 .
........`.....C
0310 a9 04 83 1e a
3 f0 07 25 29 dc c0
a7 74 55 26 94 .
......%)...tU&.
0320 d3 46 56 3f 4
7 5d 12 b1 1e a4 cd
62 3b 63 ed 38 .
FV?G].....b;c.8
0330 4a 3f a0 68 b
4 1b 19 32 9e 77 25
33 15 af 26 af J
?.h...2.w%3..&.
0340 86 f5 d5 4a e
a 69 18 9d 98 3e b5
82 03 16 88 16 .
..J.i...>......
0350 d5 8c 7b 9a 7
5 8f d4 f5 7c 27 c8
f6 a0 8f a5 4b .
.{.u...|'.....K
0360 ac 03 96 3d d
3 a2 00 8c 3c e9 12
02 47 25 90 a8 .
..=....<...G%..
0370 a6 a4 af bc 2
2 62 5c a7 c9 4e d6
61 f7 d6 99 eb .
..."b\..N.a....
0380 92 d5 98 68 d
5 ef 4a 1e 85 c5 0b
a5 92 ce e0 7a .
..h..J........z
0390 a1 42 5d 45 8
2 5b 5c 60 cc fd 8e
41 15 7b 95 2b .
B]E.[\`...A.{.+
03a0 4d 5b 61 56 f
9 d6 b3 ba 5f e9 4c
8f c7 de b0 78 M
[aV...._.L....x

03b0 45 ad 25 50 0
8 5c 1a 22 2e a2 c9
2e eb de 91 cc E
.%P.\."........
03c0 46 51 ca ff f
b 92 04 eb 0f f2 fa
4b d9 01 ef 1a F
Q.........K....
03d0 f0 62 a4 9b 0
0 3d e8 4a 4b e4 91
5c 0c 3d 69 41 .
b...=.JK..\.=iA
03e0 5f 11 2b 80 f
7 ad 28 44 49 ea 04
88 14 46 74 2c _
.+...(DI....Ft,
03f0 16 d1 0e a6 6
3 c0 ab 04 ef 36 56
4f 1b 5f b5 e3 .
...c....6VO._..
0400 10 d4 fc 4e 4
b 18 86 35 a9 b2 c2
e2 30 3c a6 96 .
..NK..5....0<..
0410 97 49 84 f7 7
5 dc aa aa a6 a6 a6
a9 22 a0 a3 27 .
I..u......."..'
0420 c3 e9 73 03 c
b 3e 5b 5a ae 89 7b
8b d9 1f 23 ed .
.s..>[Z..{...#.
0430 51 c7 f1 4e d
5 b5 d6 a4 02 c5 8b
89 d8 f9 61 c6 Q
..N..........a.
0440 d1 69 42 6c 4
4 5b d9 45 bf 50 89
d2 26 41 c6 b9 .
iBlD[.E.P..&A..
0450 91 91 43 0e 3
e 1e c2 c8 33 69 43
37 2a 65 d7 62 .
.C.>...3iC7*e.b
0460 34 8e ac 7b 3
c 2c b9 6e a5 79 43
4e a2 a7 d5 fc 4
..{<,.n.yCN....
0470 e3 0b 36 29 0
d cb af 7a 3a 24 05
eb 53 73 d6 80 .
.6)...z:$..Ss..
0480 46 27 14 26 c
1 47 35 4d 15 13 96
48 d1 d4 ee 9a F
'.&.G5M...H....
0490 c5 18 af 31 3
5 35 14 12 4e b3 0a
4b 46 a4 28 a2 .
..155..N..KF.(.
04a0 ee 86 bd 0b 9
c 4b 20 ca 34 9a 53
4b b5 e5 ee a0 .
....K .4.SK....
04b0 82 a6 40 8e 9
1 1f 12 c5 45 8d 6e
52 29 83 22 60 .
.@.....E.nR)."`
04c0 2a d6 be dc d

9 4c 69 d5 eb f7 26
b0 b4 a1 1d 96 *
....Li...&.....
04d0 12 04 89 70 5
c de a5 51 02 33 32
e1 d6 9e b2 46 .
..p\..Q.32....F
04e0 9b 7a 43 2e 3
d 11 3a 70 c7 9a db
b3 05 bd a6 c4 .
zC.=.:p........
04f0 6c ef 35 3a a
f e5 d6 98 a1 58 15
3a 28 17 0d 0e l
.5:.....X.:(...
0500 51 44 0e 33 f
2 02 d4 bd 49 ad fe
cf ff fe 9a
Q
D.3....I......
No. Time
Source
Destination
Protocol
Length Info
320 12.43649400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=19979
3 Ack=1 Win=46 Len=
1260
Frame 320: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.486424000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.486424000 s
econds
[Time delta fro
m previous captured
frame: 0.073006000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07300600
0 seconds]
[Time since ref
erence or first fra
me: 12.436494000 se
conds]
Frame Number: 3

20
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf228 (61992)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a02 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 199793, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number

: 199793 (relati
ve sequence number)
[Next sequence
number: 201053 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa19
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2501]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 28 4
0 00 31 06 3a 02 4a

7c 0c 8a c0 a8 .
..(@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 6e 9e 9e
87 4e aa 50 10 .
..P..+.n...N.P.
0030 00 2e a1 9b 0
0 00 30 18 4f a5 1b
1e 75 8a 8c 06 .
.....0.O...u...
0040 69 6f 44 9b a
e f4 7d 8f 92 15 9b
37 2a cf 3e 57 i
oD...}....7*.>W
0050 98 e7 ab 2c 7
6 dd 71 d4 a7 9c 52
57 56 89 74 16 .
..,v.q...RWV.t.
0060 b5 5e 23 57 2
1 2c 38 5e 61 b6 0c
e0 d3 40 c3 3f .
^#W!,8^a....@.?
0070 88 bc 44 f8 d
3 ec 59 8b 14 be 6b
44 22 ff 75 da .
.D...Y...kD".u.
0080 91 6e 84 c5 c
2 49 85 8a ca 39 e4
da ff fb 92 04 .
n...I...9......
0090 ed 8f f3 00 2
6 55 03 38 7a 50 5f
a5 4a a0 63 0b .
...&U.8zP_.J.c.
00a0 4c 0c c4 c7 5
0 0c e2 2b 81 7b 12
6a 41 8c 3d 28 L
...P..+.{.jA.=(
00b0 b2 84 e2 89 d
d a4 c4 47 29 b3 a2
98 73 d3 b4 d5 .
......G)...s...
00c0 d5 fe a8 5d e
6 10 3c 32 14 b6 8e
54 db cf 27 8c .
..]..<2...T..'.
00d0 c1 d1 d4 1b 6
9 33 35 27 49 c7 2d
80 e9 65 b4 8a .
...i35'I.-..e..
00e0 07 2f 8d de 9
c a0 9e 61 d7 91 45
b1 9e b2 fd 4c .
/.....a..E....L
00f0 43 ed bf e8 d
5 6b 3e 7d 12 f9 ab
72 6a 5f 7a d9 C
....k>}...rj_z.
0100 b2 fa ce f3 0
e 3e 3f c6 67 00 9d
20 e2 cb 11 a9 .
....>?.g.. ....
0110 a7 22 c1 d7 d
7 ad fa 10 58 85 80
e0 95 ed 09 86 .
"......X.......
0120 50 87 a9 a5 1
f 7f 4b ba d1 7d 15
62 63 b3 f1 62 P

.....K..}.bc..b
0130 01 27 b9 82 7
1 c9 70 c1 09 a3 95
73 58 89 f0 61 .
'..q.p....sX..a
0140 18 ed b0 a2 5
4 3e 85 ad 49 13 2e
06 80 b6 a1 0f .
...T>..I.......
0150 4e 70 ed 7e f
b 5d be d5 bb 55 3e
2f 06 ea 3a eb N
p.~.]...U>/..:.
0160 5d 81 5e a2 a
d e9 76 66 5f c5 1d
b0 5b 7c dd e5 ]
.^...vf_...[|..
0170 08 b9 c3 1d b
3 fa 5c b4 30 07 14
79 e5 fe 02 90 .
.....\.0..y....
0180 46 e5 4c 82 d
7 ca 8a 5a c4 2f 80
5d 98 6a 1c 93 F
.L....Z./.].j..
0190 4c 33 78 ba 1
c 57 5d bc 82 96 1e
13 fb 06 e3 4a L
3x..W]........J
01a0 87 91 a3 cd c
6 48 9a 0a 11 7b 79
a9 1d 2c 1e 2b .
....H...{y..,.+
01b0 35 3b c8 ab c
3 9b 2b 7e b7 a7 bc
9b 82 c7 7d 6a 5
;....+~......}j
01c0 0e e8 ab 85 9
b bc c9 11 38 7c 22
1b b5 aa 3a e8 .
.......8|"...:.
01d0 a0 fb 18 4b d
e aa 2d 29 65 80 20
09 2e ef 01 07 .
..K..-)e. .....
01e0 11 7f 46 15 1
2 46 d1 da 9a 64 2d
f7 4a 5b 0e cc .
.F..F...d-.J[..
01f0 d0 b5 ee be 8
f 7e a6 0a 86 7e a4
76 77 a3 d4 25 .
....~...~.vw..%
0200 cb 0c 10 22 3
1 21 c6 bc 69 ac ba
3f 87 0c b0 0a .
.."1!..i..?....
0210 92 51 19 86 f
4 6e c5 70 fe df fc
e1 8f 7e 0f 84 .
Q...n.p.....~..
0220 b5 03 59 be d
9 1c 70 e0 b2 a4 58
93 c1 b6 ff fb .
.Y...p...X.....
0230 92 04 ea 0f f
2 de 25 54 83 38 7a
50 61 85 5a 80 .
.....%T.8zPa.Z.

0240 63 0f 4c 0b d
4 9d 52 0c bd e9 49
7e 93 6a 01 8c c
.L...R...I~.j..
0250 3d 28 96 75 6
d 75 b4 98 0e 8b 10
28 13 ac 45 41 =
(.umu.....(..EA
0260 8c 39 56 3a 0
4 47 b0 32 62 ac 20
45 57 c1 52 b8 .
9V:.G.2b. EW.R.
0270 15 a0 d5 65 d
7 d7 83 7d 17 76 02
f1 22 24 4b 77 .
..e...}.v.."$Kw
0280 6a 41 69 bd 2
0 9f a0 a4 53 0f a9
2d 33 12 e1 0e j
Ai. ...S..-3...
0290 2f b0 f0 54 8
7 43 e6 b8 f4 6c cf
92 3e ef 9f 87 /
..T.C...l..>...
02a0 8d 73 e6 1d a
8 dd 1b e6 d7 6c fb
a7 98 7b 18 51 .
s.......l...{.Q
02b0 4b 03 0f 7c 3
9 9f ac b9 b1 42 42
21 64 48 c6 87 K
..|9....BB!dH..
02c0 30 60 c1 43 3
3 98 89 77 e8 1f 87
bc 90 ce 32 a9 0
`.C3..w......2.
02d0 e6 d9 d6 fd 2
a 8c 56 51 c9 ed e9
87 33 47 73 53 .
...*.VQ....3GsS
02e0 ba aa 0a 2c b
6 9e b6 fe cb 58 ee
5f 17 96 04 30 .
..,.....X._...0
02f0 41 12 28 05 c
5 3c 5f 41 47 8c 9d
14 d2 4a a9 1c A
.(..<_AG....J..
0300 3e 97 74 22 7
9 1b 0c e6 89 32 34
56 cb d6 d4 d0 >
.t"y....24V....
0310 65 56 f7 57 a
0 6b 7e 52 bf 8c 08
84 06 aa 91 01 e
V.W.k~R........
0320 01 06 c3 4c 3
1 e5 c2 9c 90 96 fd
56 a1 35 2c 9b .
..L1......V.5,.
0330 bc cb 3a 6f e
0 16 81 59 8c 3f 56
f0 47 f1 ea 30 .
.:o...Y.?V.G..0
0340 cc a5 b3 17 8
5 83 08 87 26 2f 68
fe 31 24 b3 52 .
.......&/h.1$.R
0350 d4 40 d8 92 7

3 f0 2c 62 3f 89 89
b1 ba cf 58 9f .
@..s.,b?.....X.
0360 16 57 24 33 a
b 62 c7 ac 4a ee 24
27 1c ee b9 f9 .
W$3.b..J.$'....
0370 fb 99 a7 c6 5
e 06 c2 3b 3f e8 67
60 10 e0 d0 30 .
...^..;?.g`...0
0380 52 34 89 2d 1
0 cd 7a ca 08 4e a3
a3 f4 54 45 a5 R
4.-..z..N...TE.
0390 c9 5d ae bb 1
c 6b f6 96 d4 09 62
95 59 5f 97 96 .
]...k....b.Y_..
03a0 a5 15 91 f8 3
9 11 de 4d 11 cb 36
0c 70 1f 87 a5 .
...9..M..6.p...
03b0 03 02 38 13 3
0 f0 a0 2b 81 79 4a
88 db 4e 6c 6f .
.8.0..+.yJ..Nlo
03c0 a9 01 95 65 a
4 c9 90 c1 81 97 d4
66 72 47 4a db .
..e.......frGJ.
03d0 ff fb 92 04 e
b 0f f2 e9 27 54 83
38 7a 50 61 65 .
.......'T.8zPae
03e0 3a 70 67 2f 4
c 0c 34 d5 50 0d 62
4b 89 7f 95 e9 :
pg/L.4.P.bK....
03f0 c1 8c 3d 30 3
c d6 aa 77 f7 2b 7f
6f ff 30 aa c2 .
.=0<..w.+.o.0..
0400 89 22 82 a5 1
2 f1 37 02 ff 66 ad
c6 e0 ea 71 98 .
"....7..f....q.
0410 11 38 9a e5 9
7 ca 25 19 99 b8 b6
a8 b0 8e 88 e5 .
8....%.........
0420 4e 97 e7 19 d
9 4b 44 10 03 03 3e
f4 1d 9c c8 07 N
....KD...>.....
0430 8d 34 d4 9d 7
6 4a cf a8 03 60 54
e9 ae 0f af dd .
4..vJ...`T.....
0440 f3 49 7e 6f b
5 de b3 7c 5d c2 6f
f7 86 2c 7d 67 .
I~o...|].o..,}g
0450 eb 36 de fd e
0 6d 02 40 bd 22 66
56 7e 94 68 30 .
6...m.@."fV~.h0
0460 65 43 84 09 1
4 81 43 11 18 09 0b

b9 3b 9e e4 f6 e
C....C.....;...
0470 66 85 84 31 c
5 cf 35 01 ac de b8
9a 64 70 9b 16 f
..1..5.....dp..
0480 ca a5 4a f7 e
e b4 e5 5a 00 b8 24
f0 ee 36 a6 c4 .
.J....Z..$..6..
0490 44 60 39 e1 3
5 0f 60 07 a9 d5 14
c1 11 24 0f bc D
`9.5.`......$..
04a0 d2 74 9c 5e 7
7 b8 ec 0e 75 6c 68
80 83 8b d6 63 .
t.^w...ulh....c
04b0 02 62 6b 45 5
a 91 66 a9 99 95 a9
5f 52 be 71 b1 .
bkEZ.f...._R.q.
04c0 71 a1 44 20 8
3 88 54 e8 98 2c 51
0c 4e 20 f1 31 q
.D ..T..,Q.N .1
04d0 b4 55 68 75 5
c f7 6d e8 b7 19 a7
66 b5 16 5c b2 .
Uhu\.m....f..\.
04e0 8a 78 2d 91 2
5 b5 fb df 8a 78 00
12 5d 4d 99 f2 .
x-.%....x..]M..
04f0 0b 83 df 53 4
7 4f 35 9d 33 c0 27
c4 75 89 e5 37 .
..SGO5.3.'.u..7
0500 89 bc b0 a1 4
f fd 59 10 af 9a cd
45 3b af 4a 5a .
...O.Y....E;.JZ
0510 5b c8 89 85 9
e 54 90 8d 2e d9 ab
2f 6f d0 78 ce [
....T...../o.x.
0520 28 68
(
h
No. Time
Source
Destination
Protocol
Length Info
321 12.43667200
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=201053 Win=38115 L
en=0
Frame 321: 54 bytes
on wire (432 bits)
, 54 bytes captured

(432 bits) on inte

rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.486602000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.486602000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 12.436672000 se
conds]
Frame Number: 3
21
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f8f (20367)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]

[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 20105
3, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 201053 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val

ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 320]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 8f 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 73 8a 50 10 .
....P..N.+.s.P.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
322 12.56450000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=20105
3 Ack=1 Win=46 Len=
1260
Frame 322: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:27:0

5.614430000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.614430000 s
econds
[Time delta fro
m previous captured
frame: 0.127828000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12782800
0 seconds]
[Time since ref
erence or first fra
me: 12.564500000 se
conds]
Frame Number: 3
22
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf229 (61993)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a01 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)

Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 201053, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 201053 (relati
ve sequence number)
[Next sequence
number: 202313 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc

aling factor: -1 (u
nknown)]
Checksum: 0x4ec
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 29 4
0 00 31 06 3a 01 4a
7c 0c 8a c0 a8 .
..)@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 73 8a 9e
87 4e aa 50 10 .
..P..+.s...N.P.
0030 00 2e 4e c3 0
0 00 56 9e 10 e0 37
d6 e8 38 2e 31 .
.N...V...7..8.1
0040 78 a2 3b 27 0
3 5a db b5 76 82 59
b6 7b 5b b8 b8 x
.;'.Z..v.Y.{[..
0050 a4 4f 64 f7 e
c da a1 5d 50 25 1d
8d 5d 55 22 61 .
Od....]P%..]U"a
0060 4f e3 c8 17 6
1 51 b5 3a e3 a3 6f
75 0d c8 35 7b O
...aQ.:..ou..5{
0070 fb 8d cb 56 7
f f7 f1 3e 73 2b d7
dd 57 b4 0e 0a .
..V...>s+..W...
0080 05 9e e2 e2 b
0 e9 ff fb 92 04 ea
0f f2 fd 28 54 .
.............(T
0090 03 58 92 52 5
f e5 ca 70 63 2f 4c
0c 60 e1 50 0d .
X.R_..pc/L.`.P.
00a0 61 ab 81 6d 9
3 e9 c1 9c 3d 28 05
4d d6 03 a8 46 a
..m....=(.M...F
00b0 fc 9f d4 eb 3
5 ba 85 01 a8 40 2a
01 da d9 00 84 .
...5....@*.....
00c0 06 a4 28 64 c
e 6e 29 9d 01 4b e7
d3 ce e4 1f 9b .
.(d.n)..K......
00d0 00 8c 67 28 4

2 61 3b d5 dd 7a b4
90 5b 9d 2d 7d .
.g(Ba;..z..[.-}
00e0 67 32 c8 c8 0
f 55 ac 41 52 f4 09
f3 ed bc 0a e4 g
2...U.AR.......
00f0 37 aa d2 98 8
b ab 41 92 34 5a 7b
ae df fa db 30 7
.....A.4Z{....0
0100 8e 57 5b dd 2
c c5 ad 66 bf 33 e6
49 46 66 df 0d .
W[.,..f.3.IFf..
0110 e9 7d 41 42 d
2 78 89 40 80 dd 23
35 13 12 66 e4 .
}AB.x.@..#5..f.
0120 4a 25 96 46 c
d 59 59 13 56 ec ee
50 3e 0e 5f 19 J
%.F.YY.V..P>._.
0130 84 a2 dd 30 5
b c8 5c d3 e9 e9 b7
88 11 7d 94 5d .
..0[.\......}.]
0140 d4 de 28 a1 8
e 33 11 da 40 40 94
67 d4 b6 47 c8 .
.(..3..@@.g..G.
0150 8d 7b 95 fb d
f 8c 52 5a ff dc 71
af 7e be 77 4a .
{....RZ..q.~.wJ
0160 ed f2 ee 1d b
d 73 d7 28 03 79 53
4a 71 d4 41 b5 .
....s.(.ySJq.A.
0170 7a d3 a6 90 e
1 72 52 a8 59 6b 19
f5 35 9d 45 29 z
....rR.Yk..5.E)
0180 00 af 91 8a 8
5 8b d2 c7 92 86 96
3a e2 58 a6 c9 .
..........:.X..
0190 79 cb 27 ed 0
8 a6 1e 09 c7 a7 ce
cc c0 22 d8 f8 y
.'.........."..
01a0 96 8b b4 91 7
0 a5 4f 82 fe d8 06
43 ef 20 a5 47 .
...p.O....C. .G
01b0 d4 a1 83 65 5
f de 5c 3b 36 7e 5e
28 b5 8c cb 92 .
..e_.\;6~^(....
01c0 c7 37 a4 7b c
3 71 35 9c 31 14 74
ad 62 c7 ed ee .
7.{.q5.1.t.b...
01d0 57 a9 76 47 1
8 38 12 6f 2f 52 d4
19 4a c5 4a 1e W
.vG.8.o/R..J.J.
01e0 fd 31 99 f2 5
3 55 0a ff fa 19 26

56 38 c0 e5 39 .
1..SU....&V8..9
01f0 c4 89 2e 5f 8
e 7c f4 bb 0b 88 dd
07 df 99 bd 36 .
.._.|.........6
0200 8c 84 40 d9 e
d b8 1a 26 22 44 d1
80 21 0b 8b 33 .
.@....&"D..!..3
0210 2e 1c 52 6c e
6 c9 d1 ac 6b 0c cd
74 09 92 58 96 .
.Rl....k..t..X.
0220 41 47 90 5d d
6 9e cc dd ff fb 92
04 ea 0f f2 f7 A
G.]............
0230 24 d4 03 38 c
2 50 5f 85 7a 60 67
0f 4c 0c 48 9f $
..8.P_.z`g.L.H.
0240 4e 0c e3 09 4
1 74 93 a9 81 8c bd
28 76 f5 af d4 N
...At.....(v...
0250 61 c3 59 20 b
2 04 30 47 b8 15 3c
8b 30 17 0c ca a
.Y ..0G..<.0...
0260 1d 1d 58 32 9
1 84 46 16 bd aa ae
cd 24 bf 05 f7 .
.X2..F.....$...
0270 1f 9f 8f 12 f
1 18 6a 52 e8 d6 15
90 cb 26 c7 33 .
.....jR.....&.3
0280 7a 0b 82 19 a
d 5f eb ac ef 97 8d
8b 01 3c 64 e6 z
...._.......<d.
0290 a3 80 e2 29 9
e 72 f1 ba 91 63 a3
58 9b a2 74 b8 .
..).r...c.X..t.
02a0 62 3c 20 c9 2
2 c6 28 3d d7 5d 25
77 6f 5d b9 ce b
< .".(=.]%wo]..
02b0 bd 62 02 a4 e
1 7e d4 a9 f5 11 24
1d 05 57 0b 0d .
b...~....$..W..
02c0 bc 4e d8 7c a
b f6 9e ca 33 ea f5
a7 66 d9 b8 b6 .
N.|....3...f...
02d0 f7 38 0d c1 3
1 18 74 3d cc f0 71
2d 49 65 96 6c .
8..1.t=..q-Ie.l
02e0 95 64 bd 75 d
a 16 f2 50 15 65 56
0f 4c 3c 0e 2e .
d.u...P.eV.L<..
02f0 c8 6a 45 a3 f
6 28 97 53 5b a2 43
88 92 0c 99 e3 .

jE..(.S[.C.....
0300 83 10 ba 9a 6
6 4c 66 8a 94 f7 3f
5a f4 12 3d 5b .
...fLf...?Z..=[
0310 2c fb 7b b7 a
c df a5 19 07 b4 68
40 b1 4b e0 14 ,
.{.......h@.K..
0320 2c 25 87 b9 4
e 38 c1 36 48 24 58
5d 96 e5 49 99 ,
%..N8.6H$X]..I.
0330 5a 15 03 8e 0
5 c7 bf 48 0d 92 96
32 68 7b 1c e5 Z
......H...2h{..
0340 8c b6 31 4b 9
e ec 8e 01 b3 73 b4
f4 3c 02 8c 6e .
.1K.....s..<..n
0350 60 1c 60 80 3
e 5f 0e 6a 04 63 65
4c 4c 4c d1 74 `
.`.>_.j.ceLLL.t
0360 4c 87 91 ab 1
d 40 e0 f5 45 35 9c
48 be 6b 75 5d L
....@..E5.H.ku]
0370 2a 4c d6 53 7
4 d2 6f 75 fa cf dd
2c 5d b2 12 95 *
L.St.ou...,]...
0380 0d 62 2c 05 6
0 f4 a5 c5 b0 a5 63
77 c9 36 4c f7 .
b,.`.....cw.6L.
0390 6e 6d da bf e
b 76 e2 4f 58 ca 6e
8c 78 11 0b 55 n
m...v.OX.n.x..U
03a0 6f 4d a1 5c f
c 7a 59 ec 09 b0 7b
96 38 35 cd 01 o
M.\.zY...{.85..
03b0 71 27 8c c2 4
6 2a 2e 35 54 7c bf
b9 a1 83 97 9d q
'..F*.5T|......
03c0 02 50 85 45 2
7 40 e8 93 14 10 ff
fb 92 04 ea 0f .
P.E'@..........
03d0 f2 ec 35 54 0
3 19 82 e0 5d e6 9a
60 63 31 5c 0c .
.5T....]..`c1\.
03e0 ac e1 4e 0c 6
2 2b 81 94 9c 29 81
8c 35 70 9e ae .
.N.b+...)..5p..
03f0 ee bc d2 eb 5
d 36 4f ce 3a a3 35
9c c9 fd 45 e4 .
...]6O.:.5...E.
0400 00 b5 4d 24 4
b 2c 42 a6 e2 fd a4
0c 28 b0 49 01 .
.M$K,B.....(.I.

0410 54 45 05 71 e
4 af b2 a7 b0 c5 32
5e 15 af d7 a1 T
E.q......2^....
0420 75 21 89 e9 6
d 8a e9 9d b8 2e 93
6c 01 24 2d 52 u
!..m......l.$-R
0430 67 24 c9 60 2
5 a4 24 00 57 06 54
c4 1c 9d 1e e9 g
$.`%.$.W.T.....
0440 68 a4 6c 7d e
7 04 ed 94 9a 06 22
64 71 99 1a 7b h
.l}......"dq..{
0450 af 6b 22 d5 2
9 fc c1 d2 89 6c e6
59 7a ae 12 2b .
k".)....l.Yz..+
0460 87 36 40 5b d
0 54 59 85 79 73 19
b0 38 f2 67 41 .
6@[.TY.ys..8.gA
0470 d6 9b 45 af 4
9 03 df 7f a9 6b d6
7c 9a 8b 99 f5 .
.E.I....k.|....
0480 ec dd 08 46 f
e bf d7 43 92 40 d1
e3 71 fc ae 51 .
..F...C.@..q..Q
0490 68 c6 05 40 a
c cc 23 11 2d 50 7f
ee 7e e5 ec f3 h
..@..#.-P..~...
04a0 b9 1c 95 61 f
d e5 c5 38 99 c7 fb
da 40 38 a2 8d .
..a...8....@8..
04b0 0a b1 cf 68 f
7 4a b6 b1 2e 4f 5e
90 fc 08 30 36 .
..h.J...O^...06
04c0 43 2c 85 00 a
a 1f c4 a1 4e ab 24
43 30 28 83 74 C
,......N.$C0(.t
04d0 bc ab 90 04 b
9 40 5e ee 5c 8c 47
f0 83 31 80 da .
....@^.\.G..1..
04e0 87 15 96 e9 4
3 6d dd c7 74 33 4d
02 fe 37 63 17 .
...Cm..t3M..7c.
04f0 90 8a 31 61 0
2 29 31 ef ac 17 da
9c de 79 54 bd .
.1a.)1......yT.
0500 73 75 3b 49 6
f e9 f0 a8 da e2 26
26 71 47 03 30 s
u;Io.....&&qG.0
0510 c9 59 30 3a 1
f 13 fe 6e 02 34 4e
e1 14 72 b6 bc .
Y0:...n.4N..r..
0520 ac 65

.
e
No. Time
Source
Destination
Protocol
Length Info
323 12.58449900
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
879 http49
574 [PSH, ACK] Seq=
202313 Ack=1 Win=46
Len=825
Frame 323: 879 byte
s on wire (7032 bit
s), 879 bytes captu
red (7032 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.634429000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.634429000 s
econds
[Time delta fro
m previous captured
frame: 0.019999000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01999900
0 seconds]
[Time since ref
erence or first fra
me: 12.584499000 se
conds]
Frame Number: 3
23
Frame Length: 8
79 bytes (7032 bits
)
Capture Length:
879 bytes (7032 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]

[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8

65
Identification:
0xf22a (61994)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bb3 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 202313, Ack:
1, Len: 825
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 825]
Sequence number
: 202313 (relati
ve sequence number)
[Next sequence
number: 203138 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x1d2
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2085]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 61 f2 2a 4
0 00 31 06 3b b3 4a
7c 0c 8a c0 a8 .
a.*@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cb 78 76 9e
87 4e aa 50 18 .
..P..+.xv..N.P.
0030 00 2e 1d 2b 0
0 00 f6 69 75 9f 73
9d 16 3e 41 14 .
..+...iu.s..>A.
0040 94 34 8b ea 2
1 b9 5a aa 27 aa b6
85 51 40 d0 b8 .
4..!.Z.'...Q@..
0050 70 60 63 5c 0
c 73 80 dc 8a a7 a1

18 31 19 df e1 p
`c\.s......1...
0060 9d 74 15 ae 7
4 49 88 c3 a4 f2 ce
a0 c7 a4 58 9f .
t..tI........X.
0070 da 90 67 5f 7
d 36 2e d8 85 5b 58
dd 5c f3 0a a7 .
.g_}6...[X.\...
0080 ff fb 92 04 e
6 0f f2 f3 31 54 03
18 92 60 5d 66 .
.......1T...`]f
0090 2a 70 63 0d 4
c 0b f8 9d 50 0c 63
09 41 71 12 69 *
pc.L...P.c.Aq.i
00a0 c0 f7 e1 28 d
c 74 59 60 24 bb 34
1d 15 76 a4 7f .
..(.tY`$.4..v..
00b0 d6 08 70 e6 3
0 c9 15 75 bd cb 79
56 e0 f0 ba 66 .
.p.0..u..yV...f
00c0 5a 4c ba ad 1
d 06 91 71 46 30 1d
2e c3 be ee 94 Z
L.....qF0......
00d0 42 9c 3a 1a a
e a0 3f d3 01 2a 64
56 3d 3f de 0b B
.:...?..*dV=?..
00e0 21 10 c6 cf a
5 34 41 c3 79 91 62
21 10 ee 79 1a !
....4A.y.b!..y.
00f0 b5 81 16 93 7
b c4 83 1e 58 52 d2
75 22 aa 78 98 .
...{...XR.u".x.
0100 bd 63 c1 81 9
b 9e 78 76 6c 4e 4a
f9 b6 56 56 7c .
c....xvlNJ..VV|
0110 f9 0b 19 02 0
a 64 83 c5 47 5d 92
f2 bb 54 cf eb .
....d..G]...T..
0120 d5 79 f8 6d c
7 76 b5 05 14 62 27
c8 1a 8d 79 09 .
y.m.v...b'...y.
0130 20 ed 0d ef 9
8 61 35 8b 73 8c 2a
46 96 02 36 cc
....a5.s.*F..6.
0140 99 6b a8 43 9
8 25 3d 0f 17 16 3b
eb 36 ac 3b ff .
k.C.%=...;.6.;.
0150 6d 67 50 b1 9
c d6 c8 98 87 44 e8
59 c4 19 97 98 m
gP......D.Y....
0160 49 65 53 80 5
e b9 0e a8 d0 f9 2d
c2 ae 29 aa 17 I

eS.^.....-..)..
0170 2f 89 94 52 b
6 a9 20 02 de 2a 85
dd 9d a5 aa 54 /
..R.. ..*.....T
0180 20 ee 35 51 c
4 05 a5 5c 74 89 b9
89 0e 13 6a 99
.5Q...\t.....j.
0190 76 3d 51 71 8
9 f2 8a 31 76 c9 74
8c 21 f4 c1 2a v
=Qq...1v.t.!..*
01a0 41 97 4b 5a f
e 36 a1 cb af 6d 66
24 5b 5e 58 b8 A
.KZ.6...mf$[^X.
01b0 6d 89 9f 7b c
2 9a 71 0a 17 4b 80
21 b2 ca 4f 1a m
..{..q..K.!..O.
01c0 b1 f2 15 fb 6
d bb ff fe 27 28 66
44 f4 0d 28 a2 .
...m...'(fD..(.
01d0 f6 66 eb a9 4
c a4 12 3e a1 d8 1e
46 89 79 62 3a .
f..L..>...F.yb:
01e0 0e c0 e8 7a 1
5 19 70 82 6e ce 5b
97 e5 bc 0c 5a .
..z..p.n.[....Z
01f0 89 23 1e d2 5
f 18 20 33 59 89 57
75 88 da a6 bd .
#.._. 3Y.Wu....
0200 73 ef 8f 4b e
2 f8 d7 cc 91 5b 0c
61 8c d9 37 b5 s
..K.....[.a..7.
0210 2a 17 a1 77 0
d ba c7 8c d2 f1 05
cc f5 bb a5 cd *
..w............
0220 f1 35 ff fb 9
2 04 e9 0f f3 07 28
d5 83 2f 7a 50 .
5........(../zP
0230 60 65 1a a0 6
5 ef 4a 4b 0c 93 58
0c bd e9 41 84 `
e..e.JK..X...A.
0240 93 ea c1 97 b
d 28 a2 9e 90 17 c4
64 50 f7 c5 b8 .
....(.....dP...
0250 9c a6 90 48 f
6 57 63 dd 1e e1 0d
62 d1 15 c7 aa .
..H.Wc....b....
0260 12 69 22 b6 5
b 63 b6 e3 15 29 2c
7c a8 ea 3e 20 .
i".[c...),|..>
0270 d2 75 c3 85 6
7 12 36 1a de 46 75
32 a5 b3 be 36 .
u..g.6..Fu2...6

0280 5a 57 15 ca 8
7 66 be 56 e5 1d 48
1c da d2 f1 51 Z
W...f.V..H....Q
0290 77 38 5d 08 6
a 10 2c 12 34 10 95
49 ac a6 2e 72 w
8].j.,.4..I...r
02a0 87 eb 47 6c c
0 8a ae a5 e4 d5 28
75 55 0b db 28 .
.Gl......(uU..(
02b0 75 18 0e ef d
5 61 90 f4 92 5d 37
b9 76 2c 41 72 u
....a...]7.v,Ar
02c0 c6 8a 84 be 7
d 7c 83 39 f9 87 17
89 b6 b4 f6 6a .
...}|.9.......j
02d0 bf 8e 7b f6 f
b 5f 1b e7 38 b6 f6
79 55 5d 79 96 .
.{.._..8..yU]y.
02e0 3a df ef 9f d
a b1 02 04 2e ff bc
9a 47 13 5b 47 :
...........G.[G
02f0 60 72 36 0e f
9 ea 30 b6 d5 e9 b8
7e ce bb 67 e1 `
r6...0....~..g.
0300 fe e2 db 36 3
d a0 de 70 64 02 0b
ca 1c d8 e3 7b .
..6=..pd......{
0310 2d 75 19 74 d
b 65 bb 10 91 02 a0
d2 a7 53 21 b2 u.t.e.......S!.
0320 55 94 9f 51 8
2 c2 1f 64 b5 a3 a6
62 7b 68 82 77 U
..Q...d...b{h.w
0330 c4 0a dc 0d 0
d f6 ff eb 3e eb a0
ea d3 da a7 da .
.......>.......
0340 6a d1 b8 af f
b e6 e2 ae 23 48 48
30 ae f2 23 c7 j
.......#HH0..#.
0350 38 3c 85 63 0
f 6f 0c 17 39 5e 00
46 46 95 39 fc 8
<.c.o..9^.FF.9.
0360 40 e1 e8 fc f
b eb fb 9b 1f 4d d2
6f 3c c8 31
@
........M.o<.1
No. Time
Source
Destination
Protocol
Length Info
324 12.58468100
0 pc13.home
cust-74-124-

12-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=203138 Win=38430 L
en=0
Frame 324: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.634611000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.634611000 s
econds
[Time delta fro
m previous captured
frame: 0.000182000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018200
0 seconds]
[Time since ref
erence or first fra
me: 12.584681000 se
conds]
Frame Number: 3
24
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f90 (20368)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 20313
8, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 203138 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set

.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38430
[Calculated win
dow size: 38430]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 323]
[The RTT to
ACK the segment wa
s: 0.000182000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 90 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 7b af 50 10 .
....P..N.+.{.P.
0030 96 1e 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
325 12.71250600
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=20313
8 Ack=1 Win=46 Len=
1260
Frame 325: 1314 byt
es on wire (10512 b

its), 1314 bytes ca

ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.762436000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.762436000 s
econds
[Time delta fro
m previous captured
frame: 0.127825000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12782500
0 seconds]
[Time since ref
erence or first fra
me: 12.712506000 se
conds]
Frame Number: 3
25
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf22b (61995)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum

: 0x39ff [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 203138, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 203138 (relati
ve sequence number)
[Next sequence
number: 204398 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se

t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd7b
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 2b 4
0 00 31 06 39 ff 4a
7c 0c 8a c0 a8 .
..+@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb 7b af 9e
87 4e aa 50 10 .
..P..+.{...N.P.
0030 00 2e d7 bd 0
0 00 14 62 41 4b 5e
d8 4c 0e d5 37 .
......bAK^.L..7
0040 31 94 1d 9f 0
d 16 d6 f5 b7 b0 14
98 ad 0a 8a 47 1
..............G
0050 de 34 50 83 1
4 88 c3 e8 91 ba e6
34 50 bb 60 7e .
4P........4P.`~
0060 a6 5f f5 c3 9
d 7f 17 c3 ab 3c a1
a6 ff 54 05 dd .
_.......<...T..
0070 3f de 7f 64 5
4 4d bd 1e be 2a a4
69 3e 7b cc c1 ?
..dTM...*.i>{..
0080 e6 41 b3 3e b
e c4 e7 bc 59 cb ea
ff fb 92 04 ea .
A.>....Y.......
0090 8f f2 cc 24 d
7 83 0c 7a 50 60 c5
0a e0 3d eb 4a .
..$...zP`...=.J
00a0 0c 20 93 60 0
c 3d 69 49 92 9a 2b
c1 85 a1 71 f9 .

.`.=iI..+...q.
00b0 54 f7 f3 43 6
b 97 18 5c e0 13 01
2b 2d c7 5a 9d T
..Ck..\...+-.Z.
00c0 1e 47 45 33 2
1 07 92 b0 ed 64 98
d4 2a 02 94 ac .
GE3!....d..*...
00d0 06 a8 ff f1 4
1 44 96 8c d0 82 65
cb a4 ba 51 1a .
...AD....e...Q.
00e0 92 ff af 66 b
f 87 f6 a9 39 43 45
ff 54 8b b2 3f .
..f....9CE.T..?
00f0 9b 9f e0 2a a
b bf 46 22 c5 e3 01
d2 fa b5 33 9a .
..*..F"......3.
0100 56 1b 95 f7 c
6 17 bc ac ab 17 1d
dc af d9 35 43 V
.............5C
0110 ab ff 11 36 b
6 d8 b2 cc 44 4c 66
3e e5 ba 89 93 .
..6....DLf>....
0120 3d 37 71 77 1
9 14 35 62 d1 52 cb
d9 e4 4b 4d 7c =
7qw..5b.R...KM|
0130 25 85 a2 15 3
3 48 c2 c7 59 ab e5
30 0b cd 2f 8b %
...3H..Y..0../.
0140 64 b9 2d 60 d
c 77 a6 e9 bf d7 f4
b6 f5 f3 9a 7d d
.-`.w.........}
0150 db 19 7c 01 1
1 2d d0 93 c3 c9 ac
04 95 b8 3a 1d .
.|..-........:.
0160 62 c0 2c a0 2
b 22 82 bd 41 da 9f
2b 22 4e 2e ec b
.,.+"..A..+"N..
0170 8a 80 d5 9d 2
4 57 55 d8 e0 83 9a
04 f4 24 1d 33 .
...$WU......$.3
0180 1c 59 f1 66 5
7 e5 ea 0d 03 35 27
05 92 cb 66 70 .
Y.fW....5'...fp
0190 02 4a 75 a2 5
0 78 bb af 06 47 9d
3d ef 52 81 03 .
Ju.Px...G.=.R..
01a0 4c de f0 4e a
6 9a 1f 8e 7a 62 d7
a6 b7 98 96 de L
..N....zb......
01b0 be 61 d3 ee d
f 32 45 09 1e 3b 41
1b 5e 9d e2 5a .
a...2E..;A.^..Z

01c0 8f 38 34 2c 7
d 65 9b 02 b8 90 95
c9 06 81 a2 22 .
84,}e........."
01d0 27 ad ca 95 d
b 06 9e c6 44 a7 7e
a5 02 7a 1c a8 '
.......D.~..z..
01e0 b0 e5 66 af 6
6 52 15 22 54 e6 d5
a5 7f a6 d1 82 .
.f.fR."T.......
01f0 45 52 b4 b7 6
e e5 1b a3 85 aa e4
33 44 8a d8 f3 E
R..n......3D...
0200 b2 80 90 e1 7
7 97 6d 0d a0 2d db
50 10 9e 78 2d .
...w.m..-.P..x0210 50 b9 32 6f 1
1 33 17 58 cc b5 de
a9 86 c6 5d 7d P
.2o.3.X......]}
0220 66 c6 eb 8f f
b bd 27 f9 b2 11 69
ba ab ff fb 90 f
.....'...i.....
0230 04 e9 8f f2 f
5 24 58 83 0f 5a 52
5d 04 8b 00 3d .
....$X..ZR]...=
0240 28 4a 4c 5c 9
1 5a 0c 3d e9 41 8c
12 6b 01 86 3d (
JL\.Z.=.A..k..=
0250 28 56 2a de b
0 44 13 30 1c 14 15
69 29 62 db 45 (
V*..D.0...i)b.E
0260 06 b0 8d 30 2
9 77 2d 81 2e 8c b4
dc a2 7b a4 21 .
..0)w-......{.!
0270 98 80 b8 e2 a
7 f8 2b 20 43 fd b4
14 91 5c 98 27 .
.....+ C....\.'
0280 6b 35 c7 5b b
d 2e 69 cf c6 6d 10
65 47 6e 89 7a k
5.[..i..m.eGn.z
0290 e2 d9 96 be 9
4 c6 1f eb eb 56 52
f2 a5 cc ef 10 .
........VR.....
02a0 2d 29 9f 71 c
5 b9 18 bf ea 57 2a
ef a3 41 a1 40 ).q.....W*..A.@
02b0 96 64 e3 2b e
5 2c 0a 80 4b 3b 68
eb 4a 1b a4 6d .
d.+.,..K;h.J..m
02c0 64 ab d6 bb 2
c ac d4 e7 60 9b 50
53 f7 33 64 45 d
...,...`.PS.3dE
02d0 1a 5c 39 d1 9

a 4a 7f 06 97 0e 41
76 aa cb 59 39 .
\9..J....Av..Y9
02e0 18 56 f0 80 a
f e6 27 62 da 82 0b
27 56 4d 9f 31 .
V....'b...'VM.1
02f0 5a 98 fb 19 2
9 07 38 3a 85 1d 24
52 59 80 e9 24 Z
...).8:..$RY..$
0300 16 a5 5d 2f 5
3 24 8b 5a 6c aa da
66 a3 8d 03 08 .
.]/S$.Zl..f....
0310 66 4d dc 4e b
6 7d 26 aa 06 29 0e
c3 58 77 c4 22 f
M.N.}&..)..Xw."
0320 31 95 86 23 d
3 94 9d ae 9a 05 44
9a ec c4 c4 5e 1
..#......D....^
0330 cf 25 50 e4 7
e 53 19 15 b8 95 21
aa 2c 29 f8 23 .
%P.~S....!.,).#
0340 3d 23 e5 7e a
c b4 94 24 da cb ee
cb 6a 3c d7 ac =
#.~...$....j<..
0350 92 8e 5b ba 7
c 2a ef 58 77 f2 cf
0e d6 92 3d dd .
.[.|*.Xw.....=.
0360 c6 b7 39 29 b
1 cd 5c ef 2d 5c 01
11 b0 02 0d 2d .
.9)..\.-\.....0370 47 ce 34 d8 a
c b1 3a ad b9 6e de
95 22 3c cf 14 G
.4...:..n.."<..
0380 78 71 25 13 5
5 52 18 11 5f 81 a4
48 a4 a2 64 b1 x
q%.UR.._..H..d.
0390 a1 5d 0b 38 3
6 4b 25 14 d4 bb 76
44 75 08 6c 65 .
].86K%...vDu.le
03a0 89 ad 17 d2 4
1 6e 37 94 91 3b d7
35 fc 33 81 af .
...An7..;.5.3..
03b0 85 84 fc 56 5
6 c7 ce a6 2f 67 db
cf 7d 9b c7 3f .
..VV.../g..}..?
03c0 c3 3c 5f cb 1
a df e6 d2 e4 d8 f6
ef 2a 5f ff fb .
<_.........*_..
03d0 92 04 e7 0f f
2 a4 28 55 03 38 7a
50 59 24 9a 90 .
.....(U.8zPY$..
03e0 69 ef 4a 0d 1
8 c7 4e 0c e6 4b 81

94 93 e9 c1 8c i
.J...N..K......
03f0 61 28 2e e3 2
a 20 87 50 c9 20 19
ca 19 51 e8 b8 a
(..* .P. ...Q..
0400 90 96 f5 70 8
2 a1 b3 50 36 2a 46
2a 59 33 b2 bd .
..p...P6*F*Y3..
0410 91 72 75 c6 c
6 15 dc 60 ec 17 9f
29 a1 b1 88 52 .
ru....`...)...R
0420 81 fc b1 45 d
b 82 01 2c 34 3a 7e
ae 95 83 1a 92 .
..E...,4:~.....
0430 4a ee 08 29 1
4 16 38 0d b7 95 68
bc 7d 66 d2 d6 J
..)..8...h.}f..
0440 de 9e 58 9a c
7 8b 2b fd d7 78 dd
e7 f7 ce 33 3f .
.X...+..x....3?
0450 2d bf dd 36 f
9 9c 8b 9a 31 d1 15
32 5c 55 e1 d4 ..6....1..2\U..
0460 12 88 d1 d1 4
c e3 77 5d 73 33 7a
8c d2 18 2b 0b .
...L.w]s3z...+.
0470 b3 42 dc 25 9
3 4e 3d 97 f1 7f 6a
a0 c8 e0 87 92 .
B.%.N=...j.....
0480 73 1b 39 0c b
f 19 2d 4c 2e 44 59
2c b7 75 6a 64 s
.9...-L.DY,.ujd
0490 a7 2a 31 4c 5
5 25 cd e7 95 8c b2
c7 3e df a9 96 .
*1LU%......>...
04a0 aa dc 72 ef e
b 0e 5c 69 33 99 86
c1 00 42 b3 97 .
.r...\i3....B..
04b0 1b 7b 4a 32 8
d 45 72 c9 05 34 08
76 48 a6 60 60 .
{J2.Er..4.vH.``
04c0 46 c1 6b a4 1
c 02 81 aa 83 53 49
45 78 f6 54 60 F
.k......SIEx.T`
04d0 10 25 1c 0f 4
6 c3 5c ac 23 42 29
ca a4 30 8c e4 .
%..F.\.#B)..0..
04e0 39 05 db 6d f
9 cf 94 8b 05 19 af
8d c6 29 4e a7 9
..m.........)N.
04f0 2d 9a 5c 48 0
6 fb 73 55 75 5a 9f
1e ef b5 30 ca -

.\H..sUuZ....0.
0500 ee a2 f9 61 d
d 61 00 e1 9e 39 6a
a5 e1 b1 ac 79 .
..a.a...9j....y
0510 17 a0 d3 16 e
a 7b 54 18 21 4c 00
e2 21 3c c1 01 .
....{T.!L..!<..
0520 cc 3d
.
=
No. Time
Source
Destination
Protocol
Length Info
326 12.73299300
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1300 http49
574 [PSH, ACK] Seq=
204398 Ack=1 Win=46
Len=1246
Frame 326: 1300 byt
es on wire (10400 b
its), 1300 bytes ca
ptured (10400 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.782923000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.782923000 s
econds
[Time delta fro
m previous captured
frame: 0.020487000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02048700
0 seconds]
[Time since ref
erence or first fra
me: 12.732993000 se
conds]
Frame Number: 3
26
Frame Length: 1
300 bytes (10400 bi
ts)
Capture Length:
1300 bytes (10400

bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =

Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
286
Identification:
0xf22c (61996)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a0c [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 204398, Ack:
1, Len: 1246
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1246]
Sequence number
: 204398 (relati
ve sequence number)
[Next sequence
number: 205644 (
relative sequence n
umber)]

Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18f
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2506]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 06 f2 2c 4
0 00 31 06 3a 0c 4a
7c 0c 8a c0 a8 .
..,@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 80 9b 9e
87 4e aa 50 18 .
..P..+.....N.P.

0030 00 2e 18 f5 0
0 00 00 67 68 32 f2
a8 a9 40 56 09 .
......gh2...@V.
0040 16 a1 71 48 1
6 03 e6 59 a6 f4 6a
ac 44 72 6a ed .
.qH...Y..j.Drj.
0050 a6 e3 dc e9 c
a 94 7b e2 13 ba a9
2a 12 3d 1e ed .
.....{....*.=..
0060 c3 f4 43 03 6
d 78 4a 4a 2e 37 78
7e cd ee 7e f9 .
.C.mxJJ.7x~..~.
0070 3d 8d 9c 71 8
9 bd 1a c3 2f c1 c7
de 5f 67 39 a0 =
..q..../..._g9.
0080 c0 84 28 24 f
f fb 92 04 e8 0f f2
fd 27 d4 03 2f .
.($........'../
0090 c2 50 5b 65 5
a 70 63 2f 4c 4b a0
95 50 0c 63 09 .
P[eZpc/LK..P.c.
00a0 41 7b 93 a9 c
1 8c 61 28 0a d6 e7
6f 22 72 e1 3c A
{....a(...o"r.<
00b0 54 9b b6 69 1
4 b0 88 46 56 26 51
79 47 90 28 b2 T
..i...FV&QyG.(.
00c0 38 80 28 6c 9
2 10 e3 18 2b 63 bd
33 2d 57 73 b3 8
.(l....+c.3-Ws.
00d0 fa 66 1d c3 8
9 4a d3 d9 6d 99 4c
a2 56 41 0a 67 .
f...J..m.L.VA.g
00e0 de 8f 5a 5d 6
8 d7 3f 76 55 03 5e
55 18 ce 8a a4 .
.Z]h.?vU.^U....
00f0 83 f9 76 7f b
6 79 cd e3 3d 8d 9d
e3 13 7e 35 ae .
.v..y..=....~5.
0100 d0 ea 7e df 7
2 c6 fd 6c 72 d5 9e
c5 2d 2a 56 8b .
.~.r..lr...-*V.
0110 81 87 cb d2 3
d f7 d0 32 48 c8 8b
74 68 f2 22 13 .
...=..2H..th.".
0120 6c 7e f5 58 a
5 93 a5 49 1d 67 c7
2d 10 45 eb 08 l
~.X...I.g.-.E..
0130 c9 9c d2 be c
1 d0 07 b4 3e 0d 67
6c 0c 02 b1 8e .
.......>.gl....
0140 0d 32 30 c0 8

c ff 7b 4e c0 0d 5b
95 48 11 c7 65 .
20...{N..[.H..e
0150 97 99 8d 7d 4
9 12 35 af fd 4f dd
6e de 08 d1 81 .
..}I.5..O.n....
0160 9c fd c3 95 5
2 00 a5 6a a8 ab e0
86 2a f9 67 e8 .
...R..j....*.g.
0170 81 84 4c 2d 7
8 42 81 67 51 71 b9
2f 42 06 b3 c2 .
.L-xB.gQq./B...
0180 15 23 44 30 5
1 c9 4c 9d d7 70 ae
3c b6 18 94 62 .
#D0Q.L..p.<...b
0190 c7 51 b2 03 7
9 ee fe 31 85 58 b7
30 97 fd 71 d2 .
Q..y..1.X.0..q.
01a0 ab ab b6 f5 0
6 cd 3f 75 b1 66 4b
ff 3a 18 13 95 .
.....?u.fK.:...
01b0 bb f7 2f 5a a
d 7f 5f 7a 67 0e f7
eb b6 1c b3 c7 .
./Z.._zg.......
01c0 bd ab 5b ce 4
6 ad eb 75 84 e8 55
0c 14 14 90 34 .
.[.F..u..U....4
01d0 32 db 2b 38 8
1 00 9b 64 ca 55 0b
49 77 15 7d c9 2
.+8...d.U.Iw.}.
01e0 5a f6 51 97 3
6 d2 bb ed e7 e3 19
82 4e 3f 90 d6 Z
.Q.6.......N?..
01f0 16 ec b6 21 d
1 be 55 6b 7e 64 13
4d 4c 72 a5 88 .
..!..Uk~d.MLr..
0200 56 0b 59 20 e
6 a4 5c 2a 8f 90 22
aa 07 e9 1c 21 V
.Y ..\*.."....!
0210 c8 17 9d e5 7
2 1c 84 e1 89 4c 79
22 ae 89 d7 51 .
...r....Ly"...Q
0220 b3 d2 bd b6 a
1 56 ff fb 92 04 eb
8f f3 28 27 53 .
....V.......('S
0230 83 38 c2 50 6
2 e5 3a 60 67 18 4c
0b 24 9f 50 0c .
8.Pb.:`g.L.$.P.
0240 bd e9 41 6a 9
4 29 c1 8c 61 28 e9
ad 7d 56 ec b4 .
.Aj.)..a(..}V..
0250 1f e7 bf ea 0
1 20 de d2 15 91 b0

88 83 06 09 8c .
.... ..........
0260 68 20 8c e5 5
4 9a cc 44 8d 2f b4
7e 12 b1 68 14 h
..T..D./.~..h.
0270 e7 18 a4 39 8
f 09 21 29 76 af eb
27 89 0c de 59 .
..9..!)v..'...Y
0280 7b f5 bc c4 0
3 59 96 ad 59 8d c5
91 f6 1f bc fb {
....Y..Y.......
0290 8f 1a de df b
c 2c d1 e3 72 a6 5d
cb fe 9b 57 bf .
....,..r.]...W.
02a0 57 6e c5 71 d
6 37 6d c6 ad 70 b8
1d 85 21 76 35 W
n.q.7m..p...!v5
02b0 d7 11 45 2d d
0 99 69 0c 69 86 24
00 f1 4a ae 03 .
.E-..i.i.$..J..
02c0 29 8b 10 8f 2
d 2a 86 d1 09 5e 67
27 29 54 0b 4e )
...-*...^g')T.N
02d0 ca 39 0f 37 b
b 96 16 f8 99 8d 72
a5 7a 4a 72 6b .
9.7......r.zJrk
02e0 53 db a4 c5 4
0 de a0 ca 35 37 35
49 10 fb 0b 14 S
...@...575I....
02f0 52 23 a9 32 2
2 55 41 9e a2 35 03
74 14 a2 34 66 R
#.2"UA..5.t..4f
0300 da 61 40 3d 2
2 b6 8a cb d4 b7 64
18 bd ac de 20 .
a@=".....d....
0310 75 7b a8 3d b
7 43 06 53 34 25 14
80 8c 28 03 07 u
{.=.C.S4%...(..
0320 3c 8f c5 9a a
1 51 0c c2 66 0d 14
4e 93 85 c2 43 <
....Q..f..N...C
0330 f2 2a 38 66 d
5 40 16 60 50 2c 0c
90 e0 40 61 d2 .
*8f.@.`P,...@a.
0340 bd 19 a6 b3 3
0 d2 10 b3 7d c6 1a
cd da 7e b4 dd .
...0...}....~..
0350 59 66 9f 49 3
6 b2 b5 db 93 7a 9f
c7 0d 44 64 fc Y
f.I6....z...Dd.
0360 fa 98 f1 e2 c
b bf ce d5 b7 c8 14
80 6d cc 39 24 .

...........m.9$
0370 b8 a1 ca 08 f
d 6a 06 2d bd 1e 50
96 56 a2 55 01 .
....j.-..P.V.U.
0380 c3 16 2a 0a 3
7 00 b3 71 c0 51 8d
f6 ce 34 db e1 .
.*.7..q.Q...4..
0390 00 dd 19 06 c
e a6 45 63 60 b2 3b
9b 9c 17 61 dd .
.....Ec`.;...a.
03a0 2b 93 87 d8 d
0 30 98 71 a8 58 b2
88 04 43 b1 01 +
....0.q.X...C..
03b0 7e 22 d2 4e a
3 74 2a 52 eb 9c 23
c7 39 d4 aa 42 ~
".N.t*R..#.9..B
03c0 ba 5f 55 d1 3
5 0b d4 04 ff fb 92
04 ec 8f f3 28 .
_U.5..........(
03d0 3b d3 83 38 8
a e0 60 e5 0a 60 63
18 4a 0c 18 b9 ;
..8..`..`c.J...
03e0 4e 0c e2 49 8
1 7f 14 29 81 97 e1
28 62 ca f7 c4 N
..I...)...(b...
03f0 ae bf 9a d4 0
c 88 60 cc 08 55 70
72 88 40 5a 18 .
.....`..Upr.@Z.
0400 b2 87 e1 1d 7
6 c9 41 53 ee 15 78
b2 bb a0 69 37 .
...v.AS..x...i7
0410 46 49 79 70 a
a 2b 78 d0 2f 9d 25
de 15 21 01 b2 F
Iyp.+x./.%..!..
0420 3d 6b 4e 82 4
6 05 18 9a 86 7c e4
09 05 44 44 58 =
kN.F....|...DDX
0430 88 ec e2 5b 9
2 3d bc 0d de 06 bc
28 6a 2d 63 19 .
..[.=.....(j-c.
0440 6c 53 b1 db 5
3 d6 24 5c a1 e7 84
90 77 1e f8 aa l
S..S.$\....w...
0450 6b 6e 61 b5 1
e c9 55 cc 05 8a 83
12 01 03 51 2f k
na...U.......Q/
0460 1c a9 32 1f a
7 64 89 ee 4e 10 2a
f6 e3 cd 6d 3a .
.2..d..N.*...m:
0470 5b fc 2b 81 2
2 ab d9 bd 2e 1f 25
00 2a 82 37 ad [
.+.".....%.*.7.

0480 53 a6 dc 8b 2
c 66 22 10 d1 13 de
5a 55 53 62 bd S
...,f"....ZUSb.
0490 8a 5a d6 b2 e
5 48 fe f9 ac ae 67
3b cd 5c c7 15 .
Z...H....g;.\..
04a0 1e 97 65 bb 1
7 ad ff ff fe 56 7a
55 6d 72 0b 65 .
.e......VzUmr.e
04b0 bb e8 0f 6b d
6 b1 68 00 58 23 fd
c0 42 58 c3 56 .
..k..h.X#..BX.V
04c0 a0 cf 8f d1 2
1 c7 96 d6 6c 3b ab
0d 83 4e a7 40 .
...!...l;...N.@
04d0 4b 37 c2 6c 2
9 f7 5d b7 8c f2 f7
00 06 a8 d7 30 K
7.l).]........0
04e0 ac 43 c1 2b 2
4 8e 22 4c 90 01 ce
0d a8 88 97 44 .
C.+$."L.......D
04f0 8c 3b 2e 2d 2
4 91 c2 20 ee 91 36
8a 6a 52 09 98 .
;.-$.. ..6.jR..
0500 b2 45 83 54 8
7 e3 64 96 79 8a cf
ab 5d 3e 71 15 .
E.T..d.y...]>q.
0510 88 b3 d5 a6
.
...
No. Time
Source
Destination
Protocol
Length Info
327 12.73317400
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=205644 Win=37803 L
en=0
Frame 327: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0

5.783104000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.783104000 s
econds
[Time delta fro
m previous captured
frame: 0.000181000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018100
0 seconds]
[Time since ref
erence or first fra
me: 12.733174000 se
conds]
Frame Number: 3
27
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f91 (20369)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)

[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 20564
4, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 205644 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 37803
[Calculated win
dow size: 37803]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 326]
[The RTT to
ACK the segment wa
s: 0.000181000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 91 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 85 79 50 10 .
....P..N.+..yP.
0030 93 ab 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
328 12.88251600
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1311 http49
574 [PSH, ACK] Seq=
205644 Ack=1 Win=46
Len=1257
Frame 328: 1311 byt
es on wire (10488 b
its), 1311 bytes ca
ptured (10488 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.932446000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.932446000 s
econds
[Time delta fro

m previous captured
frame: 0.149342000
seconds]
[Time delta fro
m previous displaye
d frame: 0.14934200
0 seconds]
[Time since ref
erence or first fra
me: 12.882516000 se
conds]
Frame Number: 3
28
Frame Length: 1
311 bytes (10488 bi
ts)
Capture Length:
1311 bytes (10488
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080

0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
297
Identification:
0xf22d (61997)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a00 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P

ort: 49574 (49574),

Seq: 205644, Ack:
1, Len: 1257
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1257]
Sequence number
: 205644 (relati
ve sequence number)
[Next sequence
number: 206901 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x206
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:

0
[SEQ/ACK analys
is]
[Bytes in f
light: 1257]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 11 f2 2d 4
0 00 31 06 3a 00 4a
7c 0c 8a c0 a8 .
..-@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 85 79 9e
87 4e aa 50 18 .
..P..+..y..N.P.
0030 00 2e 20 69 0
0 00 54 a7 03 97 f0
7c 6a e8 30 c0 .
. i..T....|j.0.
0040 08 c3 25 0c 9
3 21 d9 f8 4d c2 27
33 aa cd 56 31 .
.%..!..M.'3..V1
0050 8b b9 48 42 6
a 9b c9 43 07 8d 6e
96 de 74 82 35 .
.HBj..C..n..t.5
0060 c9 a5 59 7e d
3 be d5 aa b4 d0 fc
d0 1e 28 c9 a6 .
.Y~.........(..
0070 17 e4 79 94 8
d 98 ba 8b 19 10 e3
24 b7 29 96 99 .
.y........$.)..
0080 4c a4 03 09 9
a 35 36 3a 86 cc a4
94 ff fb 92 04 L
....56:........
0090 e8 0f f2 cf 2
7 54 03 19 82 50 5e
e5 0a 60 63 2f .
...'T...P^..`c/
00a0 4a 0c 44 ad 4
e 0c 63 09 81 7b 96
e9 81 8c 49 30 J
.D.N.c..{....I0
00b0 9b 6c ae d4 f
e 71 e5 27 e2 e7 ff
d6 22 18 84 c0 .
l...q.'...."...
00c0 b4 80 bc 8f 2
0 a3 16 ce 23 26 b4
a3 91 a4 3d 27 .
... ...#&....='
00d0 13 b5 4c f5 9
5 83 24 f0 98 18 34
5b 1b 6d 98 7a .
.L...$...4[.m.z
00e0 54 35 6d 51 5
6 04 ae 2a d4 b5 ca
ab e5 a9 65 77 T
5mQV..*......ew
00f0 b5 eb 16 56 1
f c9 59 5e da 90 e5
1e 73 f7 fb 84 .

..V..Y^....s...
0100 d5 cd ff 7b 4
5 ce 6a e5 ec 58 78
01 e0 17 21 67 .
..{E.j..Xx...!g
0110 88 b0 2c 46 4
d 12 8f cf d6 5d 22
0c 95 2d 08 b9 .
.,FM....]"..-..
0120 95 68 77 0c f
6 6e c8 22 85 46 94
20 91 49 c4 fe .
hw..n.".F. .I..
0130 dd 6d 9b 35 3
3 31 e2 c3 c9 b5 d5
0e 47 e7 e6 be .
m.531......G...
0140 fb 9b 5a 79 e
a d5 cd 42 d2 04 a8
63 59 6c a2 04 .
.Zy...B...cYl..
0150 78 39 c9 0e 6
1 e9 f4 d3 ad d6 45
8b a8 22 cb 51 x
9..a.....E..".Q
0160 ac fa 49 19 9
1 51 50 4a 65 53 68
b2 8c d0 53 58 .
.I..QPJeSh...SX
0170 c4 9a c6 06 f
7 66 5f 59 ea 7a d1
c4 1c 35 15 22 .
....f_Y.z...5."
0180 23 6e 46 04 6
c 69 d3 98 34 49 5c
30 51 a8 cd 3b #
nF.li..4I\0Q..;
0190 02 70 6b 2c 3
d 22 d6 81 39 40 38
c1 23 3b b9 e5 .
pk,="..9@8.#;..
01a0 7e 6d 84 45 d
a 85 5a e7 06 30 2f
61 d5 13 06 05 ~
m.E..Z..0/a....
01b0 90 6b 89 23 1
1 c0 79 01 49 1a 98
13 c8 bc a0 cb .
k.#..y.I.......
01c0 5b 2c a0 d3 7
2 69 02 f9 1a 3c 6a
9c ec e8 a7 34 [
,..ri...<j....4
01d0 72 82 37 ca d
1 cf 3f 55 4b c2 20
84 a5 14 15 18 r
.7...?UK. .....
01e0 91 84 53 98 1
d 5d 22 db 55 82 ac
a6 95 52 b9 0e .
.S..]".U....R..
01f0 1e 96 0a e2 e
d 8d ea a8 13 8d 49
e5 9f a4 d7 1a .
.........I.....
0200 8b e7 10 d5 a
3 80 d0 00 98 93 89
91 a4 08 9a 21 .
..............!

0210 43 cd 19 64 6
6 25 b9 49 07 59 74
d4 cd eb 32 45 C
..df%.I.Yt...2E
0220 d6 a4 d3 17 8
3 05 29 ea 47 ab 5e
b4 6a 6c ff fb .
.....).G.^.jl..
0230 92 04 ea 0f f
3 0f 34 d3 03 18 92
e0 5d e4 8a 50 .
.....4.....]..P
0240 63 18 4a 0c 1
0 b7 4c 0c 62 69 81
75 96 29 41 8c c
.J...L.bi.u.)A.
0250 45 30 e4 6c 5
f 29 ce 31 6d d2 d3
57 90 f4 87 82 E
0.l_).1m..W....
0260 5d c1 21 29 2
7 02 31 56 03 75 14
78 98 39 e9 96 ]
.!)'.1V.u.x.9..
0270 70 94 7c 5e 5
3 8b b6 66 e5 20 82
65 bc da 5b a4 p
.|^S..f. .e..[.
0280 ad c5 cb 2e 7
b b2 ac 46 02 10 09
aa 59 28 54 32 .
...{..F....Y(T2
0290 15 b0 de 48 6
3 93 59 1a 68 64 6a
68 f3 53 42 bb .
..Hc.Y.hdjh.SB.
02a0 b2 25 b2 fb a
2 9b 26 60 36 5d 46
2c 60 8d 6b e8 .
%....&`6]F,`.k.
02b0 de a4 55 65 6
6 6e b1 da b3 ff 49
6e 02 86 29 01 .
.Uefn....In..).
02c0 1d 53 d1 48 1
7 51 9b 41 8f ca 89
af 55 94 d0 2c .
S.H.Q.A....U..,
02d0 e3 0e be d8 3
7 19 87 0b 93 d1 00
ac 01 0d 2d d9 .
...7.........-.
02e0 16 a9 23 08 0
a 9e 9f b7 71 00 c5
c0 36 c9 a7 31 .
.#.....q...6..1
02f0 35 33 0f c4 5
c a4 f8 b4 92 ee 91
10 b1 ab a0 6e 5
3..\..........n
0300 62 60 7a 82 8
6 1a 6a 51 9c 87 0d
03 4a 53 89 ef b
`z...jQ....JS..
0310 ac d0 16 61 4
c 0c 46 55 f9 5d 49
60 5e c3 3b b1 .
..aL.FU.]I`^.;.
0320 79 50 30 08 d

6 84 8e 73 34 56 61
e4 f2 bd b6 62 y
P0....s4Va....b
0330 ba a3 0b b6 0
8 60 5b 95 43 06 1c
c1 70 13 c6 6a .
....`[.C...p..j
0340 92 93 61 70 a
d 58 ce 51 41 8e 04
b9 d5 77 83 5d .
.ap.X.QA....w.]
0350 3e bb 46 c7 3
3 50 57 6b 8b 8f 5c
6a 77 af 33 7d >
.F.3PWk..\jw.3}
0360 2b 4d b9 77 0
3 d2 c7 84 db f4 a5
bf df de a0 b1 +
M.w............
0370 4f 80 14 f8 1
7 30 b7 a9 5f 42 06
10 6d 60 74 0c O
....0.._B..m`t.
0380 92 b2 9c 50 c
8 04 83 28 8d c4 3a
47 19 ec 81 51 .
..P...(..:G...Q
0390 ab 12 29 a2 f
e 5e d8 0c 42 de d3
84 c4 0d c0 7f .
.)..^..B.......
03a0 18 a4 50 1a 0
b 93 80 cd 58 55 36
60 f1 0c 2d 65 .
.P.....XU6`..-e
03b0 b1 ed 51 c7 1
f de 95 b3 85 75 f5
5f 47 ec ed aa .
.Q......u._G...
03c0 fd 1c a9 ac c
c 3e de 39 7d bd 26
77 28 da 31 fb .
....>.9}.&w(.1.
03d0 ff fb 92 04 e
a 0f f2 ef 2e d3 03
18 92 60 60 c6 .
............``.
03e0 2a 50 63 30 4
c 0b f8 ad 4c 0c 66
29 81 7d 15 a9 *
Pc0L...L.f).}..
03f0 01 8c bd 30 5
7 3c c2 0b 4f a2 df
ff e7 bb f3 90 .
..0W<..O.......
0400 b8 07 4e 1e 0
4 c4 d3 19 d5 04 80
14 c7 05 1e c9 .
.N.............
0410 51 75 2c 66 f
1 d2 38 d0 c3 d5 2a
ab 57 9e c5 82 Q
u,f..8...*.W...
0420 55 39 82 c2 a
1 51 1a 0a dd b4 32
1c 8a 12 68 2b U
9...Q....2...h+
0430 70 3d 09 1c 2
4 14 02 a6 10 82 e6

88 15 06 ca 55 p
=..$..........U
0440 94 32 17 d7 1
7 6e 75 9e df 0b 9b
bf 9c 13 a6 17 .
2...nu.........
0450 8d 43 37 c2 3
3 8b 7d 21 81 c7 c1
e0 1d 40 36 67 .
C7.3.}!.....@6g
0460 0b a3 0b 38 4
6 a7 cf 5d 69 cf b1
22 5f d8 12 3a .
..8F..]i.."_..:
0470 70 85 53 70 e
b 9b 39 5f d5 6d 4d
a2 4a bd af 97 p
.Sp..9_.mM.J...
0480 d4 2a 94 d7 5
f 8c 83 02 02 2a 8a
31 0f 59 bd 7c .
*.._....*.1.Y.|
0490 27 71 ba 87 8
d cd b4 cb a3 f6 69
a0 e9 e1 41 38 '
q........i...A8
04a0 50 d0 40 30 b
2 8c 4a 8c 4b f0 41
84 10 0a 0a 14 P
.@0..J.K.A.....
04b0 70 65 04 d3 9
7 28 18 93 fc a6 9c
41 ee d9 a5 e2 p
e...(.....A....
04c0 37 75 cd 7f 6
6 63 c8 7b 39 49 76
44 4c 97 0f 21 7
u..fc.{9IvDL..!
04d0 4c 8d 1c 22 5
d d4 f0 14 9d 66 e6
4f d7 53 5e 9f L
.."]....f.O.S^.
04e0 99 81 01 37 e
7 ce dc ab 1f 19 ce
2e 40 c4 90 a9 .
..7........@...
04f0 04 d5 5d b9 2
e 8d 1e f9 ed 39 db
49 31 b3 bd a6 .
.]......9.I1...
0500 31 60 34 2b 0
c 0d 13 87 89 8a 1c
13 bd 4c 21 07 1
`4+.........L!.
0510 c1 fb e5 2b 0
f cb ce 29 db f7 7e
9b 72 12 6b
.
..+...)..~.r.k
No. Time
Source
Destination
Protocol
Length Info
329 12.88450500
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP

1314 http49
574 [ACK] Seq=20690
1 Ack=1 Win=46 Len=
1260
Frame 329: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.934435000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.934435000 s
econds
[Time delta fro
m previous captured
frame: 0.001989000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00198900
0 seconds]
[Time since ref
erence or first fra
me: 12.884505000 se
conds]
Frame Number: 3
29
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As

ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf22e (61998)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set

Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39fc [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 206901, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 206901 (relati
ve sequence number)
[Next sequence
number: 208161 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et

.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x659
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2517]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 2e 4
0 00 31 06 39 fc 4a
7c 0c 8a c0 a8 .
...@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb 8a 62 9e
87 4e aa 50 10 .
..P..+..b..N.P.
0030 00 2e 65 9c 0
0 00 19 1a 12 59 7c
5e 04 c2 49 2e .
.e......Y|^..I.
0040 94 47 2f 43 0
a 92 4d 47 89 d0 9b
24 3a 82 69 6b .
G/C..MG...$:.ik
0050 79 92 8e f1 0
2 de e1 8e 5b 13 57
42 0e ad 84 a2 y
.......[.WB....
0060 d0 1d c1 f0 8
8 c5 99 05 04 de fc
5c 8f a7 e6 55 .
..........\...U
0070 6a af e4 79 f
d b7 3e a6 cd 7e 17
f9 92 57 e8 a8 j
..y..>..~...W..
0080 95 a4 78 bb 5
0 1d 38 91 cc ff fb
92 04 ea 0f f3 .
.x.P.8.........

0090 0e 2d 55 83 2
f 62 62 63 65 da b0
61 e9 4c 0b 74 .
-U./bbce..a.L.t
00a0 8b 5e 0c 31 2
9 41 81 16 2b c1 84
a5 30 67 46 9b .
^.1)A..+...0gF.
00b0 db 7c e3 80 5
2 67 e9 0c 70 94 96
18 ee 32 2e 1c .
|..Rg..p....2..
00c0 99 1a a5 b6 a
3 23 13 1d 29 8c 17
17 a9 2e 25 2f .
....#..).....%/
00d0 ac 41 2f 3a 5
4 33 1b 2c 86 98 a3
16 ca f6 51 ec .
A/:T3.,......Q.
00e0 71 50 38 98 a
8 44 ca 1c 7b 91 4d
76 b9 4e a3 5e q
P8..D..{.Mv.N.^
00f0 a8 38 45 eb b
7 ba bd 46 4a 45 c3
ea 2c a1 39 63 .
8E....FJE..,.9c
0100 49 41 17 9b 3
a de 79 0c e9 c5 0b
8e 3e 5d e5 54 I
A..:.y.....>].T
0110 3d d3 46 aa 0
9 2a bc 68 6a 1c 44
d5 de b1 8a 02 =
.F..*.hj.D.....
0120 45 c8 ca 35 1
d 49 b5 2a 28 30 40
d2 f5 95 cb 4a E
..5.I.*(0@....J
0130 4f 41 12 8b 9
7 d6 71 cc 91 5b 4d
ed f1 ff 65 e3 O
A....q..[M...e.
0140 57 77 de 9f 2
a 52 a1 97 46 f8 17
bf 97 57 3f 92 W
w..*R..F....W?.
0150 07 bb cc b5 e
6 aa 76 69 7e 67 c2
a1 d4 5e 44 3f .
.....vi~g...^D?
0160 f7 58 ff da 7
7 6b 8e 0b fa 70 68
bf a8 ee be 04 .
X..wk...ph.....
0170 83 95 2a 3e 0
f 14 53 0a 12 cc ad
63 4d 33 5e b0 .
.*>..S....cM3^.
0180 93 e7 7f 5a 4
9 b0 3b cd 35 74 d3
63 da 59 53 ee .
..ZI.;.5t.c.YS.
0190 24 74 24 9b 5
6 1a 9d 45 ba a2 ac
a4 48 5c 81 50 $
t$.V..E....H\.P
01a0 ce c4 84 c4 8

a 2b 51 5f 12 41 72
53 c8 b7 f7 91 .
....+Q_.ArS....
01b0 3f ec 2f 2b d
2 74 cf 2c b2 36 54
a6 92 69 34 cb ?
./+.t.,.6T..i4.
01c0 5e ff 99 5e 1
7 66 5f f9 e1 1f 84
ca f5 fa 52 2d ^
..^.f_.......R01d0 f9 74 75 52 8
0 e9 b6 f0 e4 2a 75
81 61 2d b5 5e .
tuR.....*u.a-.^
01e0 70 1f 6c e1 4
b 62 f0 7d 56 4e f1
c3 f5 b4 81 9a p
.l.Kb.}VN......
01f0 93 0f 6a 8b 2
9 4f d9 c0 49 65 c9
4d 74 9e 5b 2a .
.j.)O..Ie.Mt.[*
0200 88 e1 ee 65 d
2 90 af 6f db 33 87
91 95 ef 99 be .
..e...o.3......
0210 52 7e 51 29 b
9 1a 77 66 84 65 41
84 fb 8f 93 65 R
~Q)..wf.eA....e
0220 9a 68 e5 b8 7
c d8 af df c9 56 3f
ff fb 92 04 e8 .
h..|....V?.....
0230 8f f2 e8 40 5
9 83 09 1a e0 5d 06
cb 30 3c c5 5c .
..@Y....]..0<.\
0240 0b 8c 8f 66 0
7 a4 c9 49 88 2b 2c
c0 f3 0d b9 fb .
..f...I.+,.....
0250 77 bc e2 9b 7
7 e9 4a 07 bc d7 e1
c8 d5 2b 76 a4 w
...w.J......+v.
0260 ab 52 55 41 a
0 1a 63 91 c5 52 a2
b0 66 f4 be 4f .
RUA..c..R..f..O
0270 98 d6 93 b3 3
7 5e 11 cf 5a d5 d7
91 0f 47 43 54 .
...7^..Z....GCT
0280 f8 63 f4 6c d
c e6 c6 f9 7f f2 fb
de 45 33 53 7c .
c.l........E3S|
0290 f6 fd be df 8
e df b3 34 ce de 34
b4 fa fe 75 b7 .
......4..4...u.
02a0 25 d8 da 53 4
6 96 20 a9 3a f0 51
13 c2 a1 fc 51 %
..SF. .:.Q....Q
02b0 8f 28 a2 cc 1
f 32 22 c3 cc 57 4c

57 8b b0 80 c3 .
(...2"..WLW....
02c0 87 0d b6 a4 a
4 cb 92 40 f0 e9 28
ce b8 69 bc 22 .
......@..(..i."
02d0 e4 8d 34 cd b
1 aa 74 69 2f 1b 9d
2e 06 28 98 74 .
.4...ti/....(.t
02e0 7a 19 44 48 b
5 2b 2c 3e 75 21 5e
3a 66 24 c5 54 z
.DH.+,>u!^:f$.T
02f0 2b 31 19 26 7
b 55 7d ab 3e a4 3e
b2 32 3a 3a 29 +
1.&{U}.>.>.2::)
0300 5a 67 65 4b 3
2 b8 c3 0a 3c 92 2f
74 3a 21 73 01 Z
geK2...<./t:!s.
0310 66 b9 66 00 c
f b6 1a f9 6a 88 10
be 1d ec 2e 6b f
.f.....j......k
0320 92 eb 57 8a f
8 19 20 04 24 c3 91
21 64 ee c6 1c .
.W... .$..!d...
0330 3d 1c 5a a7 1
6 58 b4 ae e4 da 71
da b3 39 4c f5 =
.Z..X....q..9L.
0340 13 59 76 63 0
a 8d 51 51 13 b0 80
15 51 e7 09 0b .
Yvc..QQ....Q...
0350 90 d6 66 38 e
f 54 47 61 14 35 14
ab e7 47 5d 4b .
.f8.TGa.5...G]K
0360 47 7a 3b 18 e
8 b4 55 92 c8 a8 3c
a3 43 c7 4e ba G
z;...U...<.C.N.
0370 a3 aa 2a bc 3
4 95 9b 5e ba 15 5b
61 c9 5e 96 dd .
.*.4..^..[a.^..
0380 da 61 18 25 3
1 bc 0e d2 43 c3 71
50 56 d2 23 a4 .
a.%1...C.qPV.#.
0390 ed b0 f9 a3 c
2 65 d0 59 88 8d c1
98 9c 46 3e c8 .
....e.Y.....F>.
03a0 2b 96 f5 09 6
e df 77 4b ba a7 a0
44 c7 6c 91 7a +
...n.wK...D.l.z
03b0 94 ea 81 90 8
0 2c 2c 1c 2a c7 9c
b1 05 04 27 2f .
....,,.*.....'/
03c0 03 29 91 18 5
9 a0 92 5f 06 4e 50
3b 6d ff fb 92 .

)..Y.._.NP;m...
03d0 04 eb 0f f2 f
6 41 d9 83 09 1a e2
60 28 8b 30 60 .
....A.....`(.0`
03e0 c6 5c 0c 6d 0
d 62 07 a4 ab 81 80
22 ec 80 f4 95 .
\.m.b....."....
03f0 70 bc 8d b9 b
4 f1 9c 3c 8b 03 88
a2 41 3f 84 39 p
......<....A?.9
0400 a2 ad d9 ab 0
2 40 0b 4e 6c b0 b1
62 19 71 23 c7 .
....@.Nl..b.q#.
0410 ec b5 6d 04 5
8 e8 18 cb e5 5a a9
6d 08 d7 2f df .
.m.X....Z.m../.
0420 49 2d a6 5d 1
a cb 38 96 da d2 7c
b4 1d 0d 22 1a I
-.]..8...|...".
0430 32 ae 5e be d
7 3e 9b 33 ff f3 b3
46 fa a9 7c df 2
.^..>.3...F..|.
0440 1b fb fd d6 7
9 f5 86 56 36 ee 3b
bf fb 45 ff ed .
...y..V6.;..E..
0450 9f 7f dd a1 5
b 53 3a 61 7b 37 f5
46 0b 56 2d 4d .
...[S:a{7.F.V-M
0460 b9 70 89 60 a
e d3 d4 d1 0a 71 57
5c b9 23 52 49 .
p.`.....qW\.#RI
0470 1c cd 6a d0 a
a 6e 15 50 b1 44 13
83 e5 1c 9f ff .
.j..n.P.D......
0480 66 5e dc 29 5
4 21 ca 1f d0 e9 77
69 56 dc e4 b3 f
^.)T!....wiV...
0490 6f 29 9e 32 c
a af 6d e3 3b fd bf
bd 99 a3 4f cd o
).2..m.;.....O.
04a0 d7 be d7 9d f
1 88 ee fc 39 5e b7
37 f4 bb 1f 25 .
.......9^.7...%
04b0 75 16 ec 7e c
b 7a d0 82 2c 40 94
59 86 34 da cf u
..~.z..,@.Y.4..
04c0 7c 24 26 46 1
0 18 d2 ad 17 8e cf
52 ce f8 d3 67 |
$&F.......R...g
04d0 3f 6c bd d8 f
f 29 cf 3f 4b 4a 7b
87 8a 19 f6 e4 ?
l...).?KJ{.....

04e0 7c 9f d8 e7 2
0 9b 05 c2 46 18 78
90 37 35 4d c1 |
... ...F.x.75M.
04f0 c8 cc 2f 63 4
d ae 5e 07 5b 35 91
23 79 ee 6e 7b .
./cM.^.[5.#y.n{
0500 e2 e2 ec aa 3
6 b9 75 b6 e5 7e 91
76 2c 34 4c 04 .
...6.u..~.v,4L.
0510 a5 9c 07 f6 d
d 8c f1 5f 11 2a 69
10 32 6f bf d6 .
......_.*i.2o..
0520 25 44
%
D
No. Time
Source
Destination
Protocol
Length Info
330 12.88462500
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=208161 Win=38115 L
en=0
Frame 330: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.934555000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.934555000 s
econds
[Time delta fro
m previous captured
frame: 0.000120000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00012000
0 seconds]
[Time since ref
erence or first fra
me: 12.884625000 se
conds]

Frame Number: 3
30
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated

Services Field: 0x0

0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f92 (20370)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 20816
1, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se

quence number)
Acknowledgment
number: 208161 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38115
[Calculated win
dow size: 38115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 329]
[The RTT to
ACK the segment wa
s: 0.000120000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 92 4

0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 8f 4e 50 10 .
....P..N.+..NP.
0030 94 e3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
331 12.88850200
0 livebox.home
all-systems.
mcast.net IGMPv2
60 Membership Q
uery, general
Frame 331: 60 bytes
on wire (480 bits)
, 60 bytes captured
(480 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
5.938432000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615225.938432000 s
econds
[Time delta fro
m previous captured
frame: 0.003877000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00387700
0 seconds]
[Time since ref
erence or first fra
me: 12.888502000 se
conds]
Frame Number: 3
31
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f

rame: eth:ethertype
:ip:igmp]
[Coloring Rule
Name: Routing]
[Coloring Rule
String: hsrp || eig
rp || ospf || bgp |
| cdp || vrrp || ca
rp || gvrp || igmp
|| ismp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: IPv4mcast_01 (
01:00:5e:00:00:01)
Destination: IP
v4mcast_01 (01:00:5
e:00:00:01)
Address: IP
v4mcast_01 (01:00:5
e:00:00:01)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Padding: 000000
0000000000000000000
000
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: all-syste
ms.mcast.net (224.0
.0.1)
Version: 4
Header Length:
24 bytes
Differentiated
Services Field: 0x8
0 (DSCP 0x20: Class
Selector 4; ECN: 0
x00: Not-ECT (Not E
CN-Capable Transpor
t))
1000 00.. =
Differentiated Ser

vices Codepoint: Cl
ass Selector 4 (0x2
0)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 3
2
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
Protocol: IGMP
(2)
Header checksum
: 0x42ad [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: al
l-systems.mcast.net
(224.0.0.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Options: (4 byt
es), Router Alert
Router Aler
t (4 bytes): Router
shall examine pack
et (0)
Type: 1
48
1..
. .... = Copy on fr
agmentation: Yes
.00
. .... = Class: Con
trol (0)
...
1 0100 = Number: Ro
uter Alert (20)
Length:
4
Router
Alert: Router shall
examine packet (0)
Internet Group Mana
gement Protocol

[IGMP Version:
2]
Type: Membershi
p Query (0x11)
Max Resp Time:
10,0 sec (0x64)
Header checksum
: 0xee9b [correct]
Multicast Addre
ss: 0.0.0.0 (0.0.0.
0)
0000 01 00 5e 00 0
0 01 90 01 3b d0 17
e1 08 00 46 80 .
.^.....;.....F.
0010 00 20 00 00 4
0 00 01 02 42 ad c0
a8 01 01 e0 00 .
..@...B.......
0020 00 01 94 04 0
0 00 11 64 ee 9b 00
00 00 00 00 00 .
......d........
0030 00 00 00 00 0
0 00 00 00 00 00 00
00
.
...........
No. Time
Source
Destination
Protocol
Length Info
332 13.00851600
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=20816
1 Ack=1 Win=46 Len=
1260
Frame 332: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.058446000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.058446000 s
econds
[Time delta fro
m previous captured
frame: 0.120014000
seconds]

[Time delta fro

m previous displaye
d frame: 0.12001400
0 seconds]
[Time since ref
erence or first fra
me: 13.008516000 se
conds]
Frame Number: 3
32
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf22f (61999)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39fb [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 208161, Ack:
1, Len: 1260

Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 208161 (relati
ve sequence number)
[Next sequence
number: 209421 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x4c1
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 2f 4
0 00 31 06 39 fb 4a
7c 0c 8a c0 a8 .
../@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb 8f 4e 9e
87 4e aa 50 10 .
..P..+..N..N.P.
0030 00 2e 4c 17 0
0 00 22 8f ca 3e bd
56 8a 11 7d 59 .
.L..."..>.V..}Y
0040 67 b2 93 4c 6
9 44 38 d3 15 2b 59
8a 55 0a e3 d7 g
..LiD8..+Y.U...
0050 e5 53 03 70 6
1 11 b9 d4 cd e2 b1
c5 8c 74 18 06 .
S.pa........t..
0060 06 61 22 29 e
1 e2 b2 15 1d 9e 84
46 cf 73 a3 6a .
a").......F.s.j
0070 ce f4 ee ec b
b aa ba 96 35 8c a4
d6 31 b9 51 52 .
.......5...1.QR
0080 66 a1 72 ff f
b 92 04 e8 8f f2 cf
25 58 03 09 32 f
.r........%X..2
0090 50 5b e9 2b 1
0 3d 06 5e 0c 51 23
5c 0c 24 cb c1 P
[.+.=.^.Q#\.$..
00a0 8b a1 6b c0 f
6 21 70 24 55 00 32
25 dd 52 d8 3a .
.k..!p$U.2%.R.:
00b0 f7 53 d9 58 9
0 09 f9 be 7e 65 78
80 47 39 1e c6 .
S.X....~ex.G9..
00c0 71 3a 4a 51 5
d 32 35 14 2b 22 f3
43 72 c7 65 93 q
:JQ]25.+".Cr.e.
00d0 c1 69 2b 11 b
6 af cd 48 97 c1 49
dd da 24 ca f9 .
i+....H..I..$..
00e0 d7 8e d1 80 c
1 8a a9 27 ce c4 3f
5d 7f cc cc aa .
......'..?]....
00f0 dc f6 cd 0e f
8 6d c7 f9 7f 67 3a
f8 e1 60 91 f2 .
....m...g:..`..
0100 20 73 0f 0c 4
5 ce 9b 26 c1 e6 a6

af 9c e2 97 75
s..E..&.......u
0110 3f 52 87 a7 6
2 35 b5 05 9b 80 e1
66 da b6 13 12 ?
R..b5.....f....
0120 21 39 6e db 8
b 29 54 69 e4 56 7e
d4 f7 ba b8 79 !
9n..)Ti.V~....y
0130 8c ce d4 6b 3
a fa fb fe 00 a3 c6
50 fd a9 96 38 .
..k:......P...8
0140 22 ec d2 47 3
1 c2 05 5a 40 b0 f5
84 a4 f9 8a e5 "
..G1..Z@.......
0150 f9 6f 18 b2 5
6 53 ce c9 cf f3 17
5a 4d 95 29 37 .
o..VS.....ZM.)7
0160 5f a7 d4 cc d
f 43 29 2d 18 c5 b9
41 32 e7 30 c1 _
....C)-...A2.0.
0170 3b 45 17 2a 8
f 1d 89 a1 8a ac 65
26 79 44 3e 7e ;
E.*......e&yD>~
0180 e8 ea 19 42 1
3 55 00 84 ce c6 53
3f b5 99 a4 91 .
..B.U....S?....
0190 5e 57 60 aa 2
d 8f 2f 30 ce c0 ee
79 5d 6d 8a 20 ^
W`.-./0...y]m.
01a0 c7 68 58 68 d
0 90 d1 11 23 98 ad
11 53 f5 64 33 .
hXh....#...S.d3
01b0 1b 30 b0 92 a
b b1 0e f6 14 75 ee
eb 26 c6 a3 3b .
0.......u..&..;
01c0 ee 97 65 52 a
9 54 77 3f 8f 8b 1f
62 cb be 97 bd .
.eR.Tw?...b....
01d0 77 37 f9 5a 1
4 19 6c 52 b9 4e 1a
fc f1 00 26 a4 w
7.Z..lR.N....&.
01e0 33 c4 2a 89 8
f 10 3b 4f 9b 73 58
71 d7 4e 55 d2 3
.*...;O.sXq.NU.
01f0 6b 37 23 45 4
e f8 8c 8e ca 6e ab
09 06 93 73 a3 k
7#EN....n....s.
0200 72 63 67 18 a
b 16 35 c6 d8 25 53
26 a4 5c 8b 64 r
cg...5..%S&.\.d
0210 9e 4b 3f d8 f
f 5f d5 fc 8d e5 a7
2a 66 bd af b4 .

K?.._.....*f...
0220 85 de 88 07 7
c d5 ff fb 92 04 e9
8f f3 05 49 d7 .
...|.........I.
0230 03 09 2a f0 5
e 06 ea f0 3d 26 5c
0c 49 11 5a 0c .
.*.^...=&\.I.Z.
0240 31 0b 81 7e a
4 6b 80 f4 95 78 ee
b6 93 6b b6 c9 1
..~.k...x...k..
0250 bb 7f 1c be b
f 56 ff f6 04 54 47
43 91 2a c2 e4 .
....V...TGC.*..
0260 37 1b 05 76 7
4 5d ec 54 73 26 3c
75 46 c6 24 e8 7
..vt].Ts&<uF.$.
0270 a1 1f cf 9e 6
8 b5 69 6d b2 e9 4d
46 34 47 1e e3 .
...h.im..MF4G..
0280 87 54 a0 e9 9
f e3 3c c0 78 3d 11
06 1b 99 79 d6 .
T....<.x=....y.
0290 c3 6c 63 bf e
c 91 5a ab 69 8e ca
a6 ed 67 8e 6f .
lc...Z.i....g.o
02a0 e2 6e 38 ea 6
3 e5 a6 7e 6e 27 b8
d8 e1 87 04 8f .
n8.c..~n'......
02b0 04 b7 d1 b7 8
d d0 4e 00 59 13 a4
fa 99 4a 10 b6 .
.....N.Y....J..
02c0 02 df 00 de 7
4 0b 09 c4 76 d4 d0
ac c4 8c fa 50 .
...t...v......P
02d0 4f 3f 19 2e 8
6 0c b3 ba a9 9c f1
7b 00 38 70 82 O
?.........{.8p.
02e0 38 4d 8d 71 1
4 63 2d 47 68 c6 40
9e 04 da 0e 8c 8
M.q.c-Gh.@.....
02f0 ee 16 e5 20 a
e 2d 3f f8 5e 29 6d
eb e7 b6 bb a7 .
.. .-?.^)m.....
0300 7e b5 1a 81 8
4 84 08 14 87 47 8c
86 13 70 9d c9 ~
........G...p..
0310 61 d7 d2 af d
7 41 d0 1c a6 81 0e
32 de 86 ad 38 a
....A.....2...8
0320 46 b2 93 5a 8
a 34 7a da 01 96 24
2a 33 e8 60 1b F
..Z.4z...$*3.`.

0330 9f cd 5c 3f 0
5 6e bc 99 fe 1b 00
e9 04 33 47 6c .
.\?.n.......3Gl
0340 50 8a 45 9b 3
3 b4 1c c1 c8 27 02
25 0c 4d 23 8d P
.E.3....'.%.M#.
0350 dd 58 3a 4c e
4 89 af 8f 9d 52 ea
55 f7 6b 95 c8 .
X:L.....R.U.k..
0360 32 ad 36 d9 8
4 15 02 85 52 50 b6
1b 30 ea 44 ae 2
.6.....RP..0.D.
0370 72 7e ea 2a 2
3 42 92 49 07 99 8a
f8 19 1a 6f 70 r
~.*#B.I......op
0380 5d 2c ac f6 3
0 4a 40 a1 98 97 ca
80 1c 3d 3f 39 ]
,..0J@......=?9
0390 4d 48 31 9b 3
9 03 75 fd d8 0b 95
92 73 2e b5 9c M
H1.9.u.....s...
03a0 e8 42 9f d2 a
5 2a 9c 62 d0 ab 4a
4e db 2a 99 cb .
B...*.b..JN.*..
03b0 1f c3 db c5 7
f b1 94 ea e6 6e 6f
db 68 5c ad d4 .
........no.h\..
03c0 9f ce 50 f7 8
e 0a ba fb ff fb 92
04 e8 0f f3 02 .
.P.............
03d0 31 56 83 0c 4
a 62 5d a8 aa e0 3d
28 5c 0b f8 eb 1
V..Jb]...=(\...
03e0 5a 07 a5 0b 8
1 76 9c 6b 40 f4 a1
70 7b b7 9d fb Z
....v.k@..p{...
03f0 cf bc 9e 7e c
f 62 14 89 41 c0 8c
2e 13 12 f6 05 .
..~.b..A.......
0400 44 e6 a6 68 a
2 42 8e 10 54 f9 16
a1 82 e3 38 df D
..h.B..T.....8.
0410 a8 a5 25 13 2
5 0f 76 a1 fc 05 cb
15 36 a4 1d 6b .
.%.%.v.....6..k
0420 3c ed 29 b9 5
2 41 52 51 bb d1 24
dd 75 72 35 ec <
.).RARQ..$.ur5.
0430 75 a7 f0 fc f
0 9d 3f 2f 7f 1c dd
45 f7 db ff df u
.....?/...E....
0440 fc c7 17 7c 6

9 7c af 5e 3d ce 4d
f4 8a d1 d5 a2 .
..|i|.^=.M.....
0450 01 06 94 bd 2
a ea 16 dc 08 43 01
b7 28 2e 6a f4 .
...*....C..(.j.
0460 35 8d e5 49 c
e 9a 5e 3d a3 8f 93
59 9a 4c f5 9d 5
..I..^=...Y.L..
0470 b7 56 c3 d8 4
5 f5 af 78 05 3c c3
8d 57 0f 9b 8b .
V..E..x.<..W...
0480 bd 52 d4 3b 1
8 48 aa ee c8 a9 1c
e9 4c b5 12 b3 .
R.;.H......L...
0490 2c fc 7c d3 d
4 57 77 7f c1 30 b4
f3 2d 52 3b e7 ,
.|..Ww..0..-R;.
04a0 9a e7 ce a5 e
8 db 88 9e bc e1 8c
8c d8 e6 2c aa .
.............,.
04b0 13 8a d5 b5 d
0 b5 24 4a f7 ad bd
89 b4 4f 58 6e .
.....$J.....OXn
04c0 c1 f1 92 74 c
6 d0 96 de 8f 84 c5
8e c5 0e d6 73 .
..t...........s
04d0 7b 6e 21 9f 4
d 6a c1 91 8b 72 74
ff 79 92 a6 46 {
n!.Mj...rt.y..F
04e0 0f b2 4d ab 6
0 07 41 b5 a8 9d 9b
6c 6c 93 e7 12 .
.M.`.A....ll...
04f0 6b 3a ca 58 f
5 43 9d d6 19 a7 b6
7b a5 5b 97 ab k
:.X.C.....{.[..
0500 9b 6b 6e 3d 9
e bb fa 88 88 7e 62
ff d2 46 f3 17 .
kn=.....~b..F..
0510 0c 80 6e 4d 2
7 a6 00 2b 49 24 47
e2 41 0c df 85 .
.nM'..+I$G.A...
0520 87 14
.
.
No. Time
Source
Destination
Protocol
Length Info
333 13.03251800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home

TCP
873 http49
574 [PSH, ACK] Seq=
209421 Ack=1 Win=46
Len=819
Frame 333: 873 byte
s on wire (6984 bit
s), 873 bytes captu
red (6984 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.082448000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.082448000 s
econds
[Time delta fro
m previous captured
frame: 0.024002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02400200
0 seconds]
[Time since ref
erence or first fra
me: 13.032518000 se
conds]
Frame Number: 3
33
Frame Length: 8
73 bytes (6984 bits
)
Capture Length:
873 bytes (6984 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
59
Identification:
0xf230 (62000)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3bb3 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 209421, Ack:
1, Len: 819
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 819]
Sequence number
: 209421 (relati
ve sequence number)
[Next sequence
number: 210240 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa8b
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2079]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 5b f2 30 4
0 00 31 06 3b b3 4a
7c 0c 8a c0 a8 .
[.0@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cb 94 3a 9e
87 4e aa 50 18 .
..P..+..:..N.P.
0030 00 2e a8 bf 0
0 00 5c 44 a6 b0 fa
47 76 44 39 6f .
.....\D...GvD9o
0040 16 64 f8 fa b
a 1f 59 bc 0b 14 68
44 5f 8d 47 1c .
d....Y...hD_.G.
0050 17 84 73 91 2
7 e3 f9 8b 5e 1c 90
08 89 35 5a 4c .
.s.'...^....5ZL
0060 2d 48 f5 53 f
7 a6 d7 a8 7f b1 2f
f0 9e 67 fb 51 H.S....../..g.Q
0070 9d fe e3 41 a
f 0f b7 fa 4f d9 fe
e4 76 47 ff fb .
..A....O...vG..
0080 92 04 e9 0f f
2 e2 38 56 81 e9 5a
e2 5b 89 0a e0 .

.....8V..Z.[...
0090 3d 68 5c 0b e
1 21 58 0c 31 0b 81
93 a4 eb 41 86 =
h\..!X.1.....A.
00a0 21 78 85 cb 9
9 0f 85 ee 23 43 14
61 ea bf a0 70 !
x......#C.a...p
00b0 ea 54 d6 9b 3
5 2d 56 b9 9b ed 1a
11 0e ac 26 24 .
T..5-V.......&$
00c0 ca 3e a3 f8 9
5 f7 52 16 56 57 99
57 d3 1f 1b 28 .
>....R.VW.W...(
00d0 69 17 f5 de 6
d 3b 6b ff e2 43 c3
cf f5 4b c0 cd i
...m;k..C...K..
00e0 55 10 e1 43 8
3 2c bb 87 81 a2 20
48 3f 26 75 a1 U
..C.,.... H?&u.
00f0 14 97 35 5b d
7 0d 00 41 41 38 a1
86 80 52 85 82 .
.5[...AA8...R..
0100 eb 8a a1 53 b
a 25 bd dd 07 00 30
00 68 07 84 ce .
..S.%....0.h...
0110 08 b5 41 4a d
7 2d 45 6b 12 f6 b1
87 97 33 ef 79 .
.AJ.-Ek.....3.y
0120 08 e9 e9 e1 c
3 33 ba 98 3e 1a b3
8a 2d 00 47 aa .
....3..>...-.G.
0130 87 49 15 bd b
3 c9 f6 b6 91 1a 09
4a 3d ca b9 87 .
I.........J=...
0140 4e 54 3f 77 7
d 47 07 bd 95 db b9
64 54 d6 ff f6 N
T?w}G.....dT...
0150 db e9 fc aa c
0 ca d8 d5 29 62 92
81 31 21 5b 48 .
.......)b..1![H
0160 7d fb f3 a8 0
8 09 2c 0c 43 f1 1c
c8 4a e8 2c b1 }
.....,.C...J.,.
0170 e5 59 c3 f5 f
a 95 36 9b d4 46 fb
5c 6b 18 9d 5f .
Y....6..F.\k.._
0180 26 e6 ab 9d 9
8 24 aa 7b 49 94 26
40 51 c4 a5 4e &
....$.{I.&@Q..N
0190 70 4e 63 af 7
5 42 41 ce 1e 87 0e
36 84 a2 44 11 p
Nc.uBA....6..D.

01a0 6e 95 e9 ee c
c 36 b8 2b 55 1c 36
f5 26 29 dd 7f n
....6.+U.6.&)..
01b0 fe 0d b4 a6 9
d b8 86 ae e7 ae 28
bb 5b 9c 27 a9 .
.........(.[.'.
01c0 25 1e a7 3f a
3 fa d5 13 c0 18 0a
c3 a6 29 19 2f %
..?.........)./
01d0 f0 8f 68 e7 b
e d3 2e 94 56 80 b3
25 3c 59 6b ba .
.h.....V..%<Yk.
01e0 e2 68 f8 c4 a
6 96 e9 89 3a 64 79
d3 15 85 c2 c8 .
h......:dy.....
01f0 b0 f2 b4 49 a
9 ba ea 2e 56 a3 54
98 ea 2e 62 75 .
..I....V.T...bu
0200 89 ea d6 c6 a
f 31 41 94 a4 54 93
26 a7 ce bb 98 .
....1A..T.&....
0210 33 20 cf dd 3
2 e2 e6 ea 3a ca 75
2d eb d9 d1 ac 3
..2...:.u-....
0220 ff fb 92 04 e
a 0f f3 16 41 d6 01
ef 32 e0 59 a4 .
.......A...2.Y.
0230 9a d0 61 2f 4
a 0b 74 e7 58 07 ad
6b 81 89 20 ab .
.a/J.t.X..k.. .
0240 00 f6 21 70 c
c 61 f3 40 26 88 93
75 ee 93 a3 ad .
.!p.a.@&..u....
0250 ec 08 8b 91 0
f c8 5b 2d 15 c5 89
56 6e 0e 5e e9 .
.....[-...Vn.^.
0260 b7 c0 45 6e 0
3 65 b7 8a e5 d8 d6
de 72 14 2b 19 .
.En.e......r.+.
0270 66 4e 86 7f 9
0 dd 0c 03 0e 24 3a
af 09 6a 57 22 f
N.......$:..jW"
0280 ad 87 12 09 3
0 e7 2c 43 24 d7 f9
58 a8 28 45 c7 .
...0.,C$..X.(E.
0290 c5 45 23 5c b
4 eb 6c b7 29 ff d4
fb 8e 62 c4 24 .
E#\..l.)....b.$
02a0 d6 b2 67 49 b
8 e1 f1 48 b9 45 75
d5 42 07 60 9f .
.gI...H.Eu.B.`.
02b0 0c e1 13 73 4

c 0b 23 38 b3 ba 4e
ad c1 59 68 d4 .
..sL.#8..N..Yh.
02c0 68 2d 8c 34 6
c ae 30 76 62 db fb
db 44 cf f3 ea h
-.4l.0vb...D...
02d0 3d ca ed 7c 5
d a8 32 1e 94 07 d7
68 3e 6e 86 97 =
..|].2....h>n..
02e0 55 5b 18 62 b
0 86 62 d9 97 cd 2c
da 57 d8 ea e5 U
[.b..b...,.W...
02f0 bb fb b5 89 b
e 23 9e 65 b1 ad 23
69 bb d7 f5 a8 .
....#.e..#i....
0300 8b ee fe 4c 9
5 bd c5 74 0e 5f ac
dc 44 28 4a 66 .
..L...t._..D(Jf
0310 d5 d3 94 61 e
a 5a ab 41 7c d1 d9
7c b6 e3 6f 1d .
..a.Z.A|..|..o.
0320 7e 60 28 33 b
e f7 dd 4f c5 14 d4
1f 5d b3 a6 85 ~
`(3...O....]...
0330 61 04 56 44 e
3 b7 09 66 ae 9e 2a
56 81 40 72 20 a
.VD...f..*V.@r
0340 a2 38 e5 74 7
e 6b 34 aa 8b b4 9e
ad 96 ef bb 9a .
8.t~k4.........
0350 af 8b e7 18 f
1 bc ce eb c3 cf 1d
c6 96 83 cd 9b .
...............
0360 70 ac ca d4 d
5 66 51 ff 4a
p
....fQ.J
No. Time
Source
Destination
Protocol
Length Info
334 13.03270100
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=210240 Win=43155 L
en=0
Frame 334: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0

(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.082631000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.082631000 s
econds
[Time delta fro
m previous captured
frame: 0.000183000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018300
0 seconds]
[Time since ref
erence or first fra
me: 13.032701000 se
conds]
Frame Number: 3
34
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek

C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f93 (20371)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False

]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 21024
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 210240 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 43155
[Calculated win
dow size: 43155]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 333]
[The RTT to
ACK the segment wa
s: 0.000183000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 93 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb 97 6d 50 10 .
....P..N.+..mP.
0030 a8 93 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
335 13.15052900
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=21024
0 Ack=1 Win=46 Len=
1260
Frame 335: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.200459000 Romance
Standard Time

[Time shift for

this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.200459000 s
econds
[Time delta fro
m previous captured
frame: 0.117828000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11782800
0 seconds]
[Time since ref
erence or first fra
me: 13.150529000 se
conds]
Frame Number: 3
35
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally

unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf231 (62001)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)

[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 210240, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 210240 (relati
ve sequence number)
[Next sequence
number: 211500 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x806

e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 31 4
0 00 31 06 39 f9 4a
7c 0c 8a c0 a8 .
..1@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb 97 6d 9e
87 4e aa 50 10 .
..P..+..m..N.P.
0030 00 2e 80 6e 0
0 00 64 09 ac 4c 65
11 a9 19 4a bb .
..n..d..Le...J.
0040 6b 6a 9e 00 a
3 6b 70 69 cb 72 5e
12 5e 2c b1 2f k
j...kpi.r^.^,./
0050 87 27 51 31 f
c 05 7d de 6a bc a9
3e f5 ec e5 60 .
'Q1..}.j..>...`
0060 02 9e 13 84 f
e 40 62 95 ea 5c 94
b2 e4 08 03 58 .
....@b..\.....X
0070 11 94 44 20 3
c a1 f1 4b 1c 3d 72
cd 14 f1 49 08 .
.D <..K.=r...I.
0080 65 a3 a3 4d c
7 c7 f4 bc 0d a9 a9
58 bd 4b 79 ff e
..M.......X.Ky.
0090 fb 92 04 eb 8
f f3 26 41 55 81 ef
6a e0 5d 87 0a .
.....&AU..j.]..
00a0 c0 61 88 5c 0
b b1 0f 56 07 bd 0b
81 77 a0 ab 00 .
a.\...V....w...
00b0 f6 21 70 f2 2
9 41 b1 46 53 72 f3
88 a4 94 00 a8 .
!p.)A.FSr......
00c0 5c 16 56 13 b
0 38 e7 cb 0b a3 d5
00 b5 f0 e5 01 \
.V..8..........
00d0 46 a0 96 7d 6
0 77 3c 89 f7 bd 1d
6e e3 45 ae 45 F
..}`w<....n.E.E

00e0 35 9e de af e
8 0b 47 86 4b ae 8c
11 cb 9a f9 17 5
.....G.K.......
00f0 b7 10 43 02 8
8 3e 41 a1 82 2b 9d
a5 26 50 8f 3d .
.C..>A..+..&P.=
0100 12 c5 4c d4 4
4 41 97 4d 09 df 5f
0e cb 23 92 07 .
.L.DA.M.._..#..
0110 c4 e9 7f c4 c
d e3 34 47 05 9d 4f
bc df 67 e8 4e .
.....4G..O..g.N
0120 00 d6 0f f2 5
8 ca 4a 81 30 ad 57
c2 36 20 2f b8 .
...X.J.0.W.6 /.
0130 b2 ed eb eb b
c 81 0f 3f a4 eb 5a
7d 75 d4 f0 f3 .
......?..Z}u...
0140 9c 0f 74 bd 7
e 65 94 03 93 25 a2
73 37 20 9b 71 .
.t.~e...%.s7 .q
0150 5b ae ed e6 e
e 2a 28 bb 3a f1 fe
17 88 86 3a dd [
....*(.:.....:.
0160 2c 6e c9 eb 8
8 be 6d cf aa 7f f1
1f 14 fe 65 93 ,
n....m.......e.
0170 0b 6b 61 d8 e
3 a3 de b6 75 75 22
0e 83 c4 86 e4 .
ka.....uu".....
0180 fe c4 a9 cd 4
0 e2 78 60 7b eb 58
f3 04 07 91 ff .
...@.x`{.X.....
0190 08 61 8c d3 6
6 a6 b3 dd b8 49 19
4c e1 ca 90 4a .
a..f....I.L...J
01a0 31 17 bc e7 6
5 44 74 63 7b b4 4f
d1 0c 39 86 9f 1
...eDtc{.O..9..
01b0 30 3b af c6 e
a 53 b2 f4 e2 50 a9
9f e2 e9 f7 17 0
;...S...P......
01c0 55 6d e6 e2 e
1 db 6d f2 79 01 81
e2 10 02 cb 35 U
m....m.y......5
01d0 75 8a 7d 35 f
1 d5 56 8b 1b 18 3c
6a 72 82 cd bc u
.}5..V...<jr...
01e0 30 55 25 ee a
a 92 f6 36 50 c5 11
27 57 92 34 fa 0
U%....6P..'W.4.
01f0 bf 99 60 d5 c

7 7e bc f7 5a d7 bc
0b 8b 8f 96 03 .
.`..~..Z.......
0200 ae f5 aa 3d 7
7 bb c7 d6 22 63 2c
cb eb a7 d8 9b .
..=w..."c,.....
0210 69 4f 0a 96 c
c ba dc 7f ac ea b8
f7 fa f7 f1 80 i
O..............
0220 f5 d2 b5 24 d
1 26 a4 eb 03 38 ca
9e 85 3a d6 31 .
..$.&...8...:.1
0230 a5 ff fb 92 0
4 eb 8f f3 16 3e 55
83 0f 42 e0 62 .
........>U..B.b
0240 48 2a b0 3d e
8 5c 0b 64 ef 56 07
bd 6b 81 6d 1c H
*.=.\.d.V..k.m.
0250 eb 00 f6 2d 7
0 95 04 18 e5 9f df
a3 ec a1 58 30 .
..-p.........X0
0260 32 ca cc 7e b
d d2 cd 0c e7 36 d4
0a ea 06 91 b6 2
..~.....6......
0270 6c 71 37 dc a
9 91 39 57 cf 4f a8
0e 11 29 9a e3 l
q7...9W.O...)..
0280 f9 d7 a2 14 8
1 db 14 d8 53 2c 59
06 b9 9c d2 1b .
.......S,Y.....
0290 74 84 7c b2 d
6 12 54 4b 5c b5 4f
7e d2 b2 ca ad t
.|...TK\.O~....
02a0 a3 02 71 59 1
2 e1 d2 6e 51 75 0c
1e 48 06 68 68 .
.qY...nQu..H.hh
02b0 aa a7 68 a0 8
a da cd d6 5d 5b 11
97 a1 60 b0 00 .
.h.....][...`..
02c0 c0 5d 54 61 d
6 03 c1 40 23 8f c6
00 80 b8 4d 41 .
]Ta...@#.....MA
02d0 23 4d 90 26 2
7 40 8a e6 a6 2f 38
2f 83 99 ed 2f #
M.&'@.../8/.../
02e0 5d af bb a6 b
3 26 89 15 63 d2 f7
bc 79 e6 d5 e5 ]
....&..c...y...
02f0 d7 cd 25 83 0
9 f3 57 f4 eb 54 ab
ee 0f 46 9b 27 .
.%...W..T...F.'
0300 41 b8 70 93 3
a d7 f7 16 8b 90 33

fe 02 3f 37 c9 A
.p.:.....3..?7.
0310 be c1 bf 6d 2
b bb 6a d6 ef bb dd
b8 1f ee 2a 37 .
..m+.j.......*7
0320 00 20 17 81 2
b 2c 0a b2 f9 32 21
5e 1d 03 40 bd .
..+,...2!^..@.
0330 51 21 42 b3 e
6 36 33 15 57 8d 40
dd 9b ac bb 08 Q
!B..63.W.@.....
0340 fd cb b9 31 9
9 d6 53 e8 0e 3b 26
2e 6b 93 6e ef .
..1..S..;&.k.n.
0350 da 92 5b 35 6
d 11 c5 b1 05 6a b7
7b 3a ab b4 a7 .
.[5m....j.{:...
0360 2d 96 f9 3b a
6 f3 85 5c d7 57 10
ac 78 a9 fa ad ..;...\.W..x...
0370 13 d8 95 17 3
b de 2d 0f 2a d1 59
53 13 fd fe 95 .
...;.-.*.YS....
0380 26 02 92 10 4
0 69 b8 b1 8b 3c 56
c3 f6 61 35 13 &
...@i...<V..a5.
0390 25 87 9f ce 7
0 fd 75 0d df 97 a2
b7 b6 1d 29 9a %
...p.u.......).
03a0 57 55 00 ab 6
7 5f 74 2f 6d 75 2a
c8 99 b8 7f 0f W
U..g_t/mu*.....
03b0 ad 13 90 e9 a
3 01 90 a8 a8 55 00
9a ca b8 73 10 .
........U....s.
03c0 38 a2 24 5c a
d 65 df bd cb df 28
b4 1e ba 14 26 8
.$\.e....(....&
03d0 19 5b 02 ff f
b 92 04 ec 8f f3 1e
2f d5 81 ec 7a .
[........./...z
03e0 60 5f 05 4a c
0 3d ec 4c 0c 44 93
58 07 a5 e9 49 `
_.J.=.L.D.X...I
03f0 82 97 2b 80 f
6 25 30 12 34 10 ca
a4 71 03 55 a2 .
.+..%0.4...q.U.
0400 6b f1 f9 4c e
c be 6a 40 d4 b3 06
2c 4b 3d 89 ef k
..L..j@...,K=..
0410 b6 c9 eb 08 b
2 4b 5a d6 ae da e0
e3 e2 49 22 b9 .

....KZ......I".
0420 72 81 d5 cc 1
f 8e 7a ab ea 6a 2c
6b f8 ba d9 bc r
.....z..j,k....
0430 c5 f5 2c 3a 3
4 68 2c 5c 22 51 33
8e 14 9a 1c 2e .
.,:4h,\"Q3.....
0440 b1 3a 0c a0 3
7 4a d2 e4 17 05 bc
b8 60 fa 27 c7 .
:..7J......`.'.
0450 9f 12 4e 29 6
1 a5 9b 91 3e 8a 0b
e9 49 0e 31 e9 .
.N)a...>...I.1.
0460 0b a3 91 0a 1
f 1a 42 5b 36 e4 50
7c cd cf 3d 77 .
.....B[6.P|..=w
0470 45 17 c3 dd 7
3 b3 87 d4 3e 1e 10
e2 28 e8 10 18 E
...s...>...(...
0480 b1 f8 80 b4 f
4 11 72 a3 3b ab ba
9a 41 d3 ce ce .
.....r.;...A...
0490 c5 47 73 4e b
a 50 e9 7d 55 28 8d
42 58 79 97 eb .
GsN.P.}U(.BXy..
04a0 78 8e c2 86 7
2 24 c7 bf e8 e1 88
cf 73 4f bf a9 x
...r$......sO..
04b0 cb dd ff ce 1
8 bf 3f 42 27 79 81
24 26 6b 6c ed .
.....?B'y.$&kl.
04c0 d4 8b cb e2 5
8 41 b7 a5 72 16 1d
5e d2 26 c3 58 .
...XA..r..^.&.X
04d0 61 5c 02 d4 e
a b8 7e aa cf 7e 80
e3 89 63 50 a5 a
\....~..~...cP.
04e0 3e f0 23 55 b
b ad 2f 8d 56 a8 46
ee bb e7 dd 82 >
.#U../.V.F.....
04f0 a5 b1 f5 bb e
6 67 7a 2f 3f dd f3
f7 0e 0a d8 12 .
....gz/?.......
0500 18 7b 73 52 c
4 22 69 a7 e8 5c 02
c7 1f 17 07 4e .
{sR."i..\.....N
0510 63 df cf 49 2
e 81 70 24 e0 79 26
20 76 2a 48 21 c
..I..p$.y& v*H!
0520 94 62
.
b

No. Time
Source
Destination
Protocol
Length Info
336 13.18052300
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1298 http49
574 [PSH, ACK] Seq=
211500 Ack=1 Win=46
Len=1244
Frame 336: 1298 byt
es on wire (10384 b
its), 1298 bytes ca
ptured (10384 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.230453000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.230453000 s
econds
[Time delta fro
m previous captured
frame: 0.029994000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02999400
0 seconds]
[Time since ref
erence or first fra
me: 13.180523000 se
conds]
Frame Number: 3
36
Frame Length: 1
298 bytes (10384 bi
ts)
Capture Length:
1298 bytes (10384
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http

2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
284
Identification:
0xf232 (62002)

Flags: 0x02 (Do

n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a08 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 211500, Ack:
1, Len: 1244
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1244]
Sequence number
: 211500 (relati
ve sequence number)
[Next sequence
number: 212744 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x2ee
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2504]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 04 f2 32 4
0 00 31 06 3a 08 4a
7c 0c 8a c0 a8 .
..2@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb 9c 59 9e
87 4e aa 50 18 .
..P..+..Y..N.P.
0030 00 2e 2e e7 0
0 00 1f fe 1c 25 c3
90 92 0c b2 43 .
........%.....C
0040 db 97 09 ea f
1 a1 a8 69 5a a4 5a
d4 60 2d fc f3 .
......iZ.Z.`-..
0050 40 74 29 07 d
b a2 4d dc 5d dd a1
56 26 56 55 84 @
t)...M.]..V&VU.
0060 ef 6a b9 f1 9

a a7 13 e8 b7 f5 11
1b 5d 2b f5 5e .
j..........]+.^
0070 dd 71 d3 8e 9
e 3b f9 1c e9 93 2d
f1 4d 4f a9 74 .
q...;....-.MO.t
0080 47 f9 8a e3 1
c 85 f9 91 f5 ff fb
92 04 e8 8f f2 G
...............
0090 be 24 d7 01 e
9 5a 50 60 45 5a f0
61 e8 4c 0b ec .
$...ZP`EZ.a.L..
00a0 f9 5c 07 ac a
b 89 79 9a 2b c1 85
99 70 2c 32 9d .
\....y.+...p,2.
00b0 fc 6d ad 5e 2
3 65 c3 ca 70 9a 84
52 72 72 96 3d .
m.^#e..p..Rrr.=
00c0 42 1a 96 7f 9
c bd 36 69 51 ef bf
49 65 0a 66 ef B
.....6iQ..Ie.f.
00d0 79 6c f8 51 1
e fa a9 15 1e 12 eb
84 77 77 bb e6 y
l.Q........ww..
00e0 c6 47 b8 35 f
4 c2 6d f0 30 a1 e2
6e 3f 1f c7 fe .
G.5..m.0..n?...
00f0 a4 ee ca b2 d
a 8a 7b 78 f3 5d 51
52 ed a1 cd ec .
.....{x.]QR....
0100 34 a5 ff 82 d
f e3 17 c7 4f b3 65
23 59 bf 76 d9 4
.......O.e#Y.v.
0110 d2 c9 92 e0 3
2 f2 64 c0 ed 3d 96
48 e7 6a bd 13 .
...2.d..=.H.j..
0120 d4 c4 3d 6a f
8 64 82 cb 3e fc a9
a9 b1 6f 95 cf .
.=j.d..>....o..
0130 cd f7 56 71 1
3 b7 fb 80 12 05 38
c1 67 10 72 9b .
.Vq......8.g.r.
0140 fc a2 ca 65 5
5 25 9d 5d 15 11 ee
ac b7 64 cc 88 .
..eU%.].....d..
0150 44 99 ee 67 6
4 5e 85 52 f9 84 8c
6a ea 23 34 2e D
..gd^.R...j.#4.
0160 91 62 b6 b0 8
1 10 59 58 48 ad 67
2f 52 64 9c 29 .
b....YXH.g/Rd.)
0170 61 02 b1 8d 2
6 9d a3 c9 7f 1b 57

79 83 bf 33 f0 a
...&.....Wy..3.
0180 7e d9 ec fb 5
d 21 c0 ab 4f 64 82
8c de ee 36 55 ~
...]!..Od....6U
0190 35 b7 b4 38 f
7 87 7d f7 32 d7 7a
cd b0 12 02 98 5
..8..}.2.z.....
01a0 60 f2 ab a1 9
f c9 42 d4 84 51 db
65 33 09 26 e8 `
.....B..Q.e3.&.
01b0 ea 9b 13 a2 1
8 7c b7 54 b5 5b 3a
2e d8 c3 b1 7e .
....|.T.[:....~
01c0 ac 2b 76 9e 2
f eb f8 71 92 f4 17
79 43 ef 41 76 .
+v./..q...yC.Av
01d0 ff 79 5d 3a 6
5 bf 96 95 20 a0 59
04 f0 6a 42 42 .
y]:e... .Y..jBB
01e0 62 0f 5b e4 9
4 83 51 81 c7 24 a4
2a b2 fe 2a e9 b
.[...Q..$.*..*.
01f0 d1 5b b9 3d 8
9 0c 32 15 a9 41 d4
2f c9 ab 3e 36 .
[.=..2..A./..>6
0200 9a 24 5f 69 b
9 83 5b 4a d6 53 28
c6 b3 cc 6c db .
$_i..[J.S(...l.
0210 cd 8a 5d 49 2
3 93 a0 6b f7 ca 83
42 18 3b 01 3f .
.]I#..k...B.;.?
0220 91 7d 2e 4b 8
f 5c e2 f8 fe d1 33
ff fb 92 04 ec .
}.K.\....3.....
0230 8f f3 1a 40 5
6 81 e8 42 e2 5c 24
5a e0 61 86 4a .
..@V..B.\$Z.a.J
0240 4c 71 03 58 0
c 3c ab 81 8b 9e 2b
01 87 95 71 44 L
q.X.<....+...qD
0250 2f 77 77 32 d
7 4e a9 7c 9c 36 6c
ea 3c d4 fd dc /
ww2.N.|.6l.<...
0260 ed 1b d7 38 1
4 6f 5a c6 70 6f 4d
f0 86 b3 ee b4 .
..8.oZ.poM.....
0270 de e2 69 e6 7
e 8a 15 77 d4 b5 d8
64 b2 0d da 2d .
.i.~..w...d...0280 1e 79 ae a7 1
4 7c eb 11 38 f3 24
9b 73 8f 66 d8 .

y...|..8.$.s.f.
0290 eb 91 da b9 b
5 e8 bf f2 b4 e2 41
62 dc 62 16 55 .
.........Ab.b.U
02a0 31 00 6a 58 5
8 b7 b0 e6 49 84 da
4f 5d aa 5a 1a 1
.jXX...I..O].Z.
02b0 ea b1 97 08 a
2 cd 8d 7b a4 a3 78
d2 69 90 e2 b4 .
......{..x.i...
02c0 d8 d2 e7 b6 b
c 85 8a 93 39 b3 53
95 2f 07 1e b2 .
.......9.S./...
02d0 87 cc 5c 5f 5
6 49 85 c6 bc b8 86
5b 9a 34 a9 be .
.\_VI.....[.4..
02e0 59 62 66 b9 d
6 2f e3 7d f7 eb 34
ac b3 64 f9 75 Y
bf../.}..4..d.u
02f0 cd 81 75 13 2
0 c0 98 b3 d5 8f a0
c8 b8 c1 96 be .
.u. ...........
0300 c3 ed 79 16 a
1 0a 8d 73 9e b6 21
91 a8 53 a3 cb .
.y....s..!..S..
0310 96 6a 65 d7 9
e 5a cc d0 2f 05 69
62 4a 9c e8 14 .
je..Z../.ibJ...
0320 35 58 a4 0d 6
9 d7 07 db 0e d7 27
04 28 96 28 eb 5
X..i.....'.(.(.
0330 9a 1f 0b 55 c
7 cd cd 98 aa 7b ea
ca 82 92 9e 0e .
..U.....{......
0340 6e 7f 4d a6 5
b f4 f4 4c 67 1f 3b
fa c7 f6 8b 7a n
.M.[..Lg.;....z
0350 cb 36 57 6f 5
f ae f6 2f 8f b5 5b
f8 ad 9b ff 02 .
6Wo_../..[.....
0360 39 1e bf 1c b
d 6b f1 31 55 78 7e
2f 9d cc b8 b6 9
....k.1Ux~/....
0370 3c 3a 9a 7e a
f a4 90 56 ff bf c5
dd fc da 38 40 <
:.~...V......8@
0380 75 3b 83 78 0
7 20 c6 0d ba c4 c8
8b 9a 87 b4 45 u
;.x. .........E
0390 d6 1f 11 d1 d
0 bd 25 5f eb 9e c4
5b 8d b3 b4 c6 .
.....%_...[....

03a0 38 b6 45 51 4
d 62 cc 05 c9 a5 13
cb 1b c3 61 87 8
.EQMb........a.
03b0 d3 39 a5 2b 5
5 2f b7 33 2f d6 9d
22 74 f7 73 26 .
9.+U/.3/.."t.s&
03c0 60 8f 8c b3 2
a dd 16 b6 8e b5 92
1e e3 ff fb 92 `
...*...........
03d0 04 e8 8f f2 b
f 27 55 81 ec 6a 50
5b 67 1a b0 61 .
....'U..jP[g..a
03e0 e7 5c 0c e0 9
5 50 0c 3d e9 41 9d
92 2a 40 f7 bd .
\...P.=.A..*@..
03f0 29 e0 2c a2 2
9 36 3c 9d 0c a6 bd
ce 9e d9 8e 1e )
.,.)6<.........
0400 91 8d 09 d1 9
2 3d 84 49 9e 1b e0
43 0f 03 d0 b5 .
....=.I...C....
0410 6a b2 98 78 c
e 97 e9 45 5e ba 29
37 4b 6e 39 d2 j
..x...E^.)7Kn9.
0420 71 4c 4f 0c 5
3 60 c4 02 75 b3 8b
35 20 47 e3 eb q
LO.S`..u..5 G..
0430 2b 63 6b d1 3
d 4b 99 a4 92 d3 c9
14 34 30 47 4b +
ck.=K......40GK
0440 00 a1 a1 6a e
f 5d 4a 7b 60 37 eb
b0 05 38 36 60 .
..j.]J{`7...86`
0450 3e 29 6a 86 9
3 55 d5 ee c1 52 ba
cb 00 4e 1e e7 >
)j..U...R...N..
0460 88 b8 12 b5 4
0 f2 bc 51 05 73 4f
c5 48 ca a4 50 .
...@..Q.sO.H..P
0470 b7 ba e4 cb 1
f a2 c8 f8 30 35 03
46 2d 96 eb 7a .
.......05.F-..z
0480 88 31 7f b7 9
1 c2 a3 8d a3 69 27
58 57 42 fe 9b .
1.......i'XWB..
0490 d4 1b df 19 8
0 fa 06 6f 2f e6 fe
d2 4c db d8 97 .
......o/...L...
04a0 44 6d 8e 6e 0
4 d4 f6 12 77 cd ed
46 39 e9 f5 2d D
m.n....w..F9..04b0 76 7e b3 be a

5 6d 1e 9a 29 a4 c2
eb 69 62 41 6b v
~...m..)...ibAk
04c0 d0 c6 68 a0 7
4 99 c3 3d b6 0c 01
e7 57 1e 40 a3 .
.h.t..=....W.@.
04d0 7a 0b a3 9c 3
d e7 2a 03 06 63 bc
ec 34 2a 20 7d z
...=.*..c..4* }
04e0 11 bd 82 72 d
7 11 2a 1b 19 ce 9d
32 bb 73 96 b3 .
..r..*....2.s..
04f0 e6 67 25 9e 3
2 27 33 22 81 72 40
04 14 48 ed 96 .
g%.2'3".r@..H..
0500 01 1e 0a 6a a
1 ea ae 59 45 1f a6
ae 92 df e8 a9 .
..j...YE.......
0510 ec 4d
.
M
No. Time
Source
Destination
Protocol
Length Info
337 13.18069600
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=212744 Win=42529 L
en=0
Frame 337: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.230626000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.230626000 s
econds
[Time delta fro
m previous captured
frame: 0.000173000
seconds]
[Time delta fro

m previous displaye
d frame: 0.00017300
0 seconds]
[Time since ref
erence or first fra
me: 13.180696000 se
conds]
Frame Number: 3
37
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124

-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f94 (20372)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 21274
4, Len: 0
Source Port: 49
574 (49574)
Destination Por

t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 212744 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 42529
[Calculated win
dow size: 42529]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 336]
[The RTT to
ACK the segment wa
s: 0.000173000 seco

nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 94 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb a1 35 50 10 .
....P..N.+..5P.
0030 a6 21 18 d4 0
0 00
.
!....
No. Time
Source
Destination
Protocol
Length Info
338 13.26352700
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=21274
4 Ack=1 Win=46 Len=
1260
Frame 338: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.313457000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.313457000 s
econds
[Time delta fro
m previous captured
frame: 0.082831000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08283100
0 seconds]
[Time since ref
erence or first fra
me: 13.263527000 se
conds]
Frame Number: 3
38

Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0

0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf233 (62003)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f7 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 212744, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 212744 (relati

ve sequence number)
[Next sequence
number: 214004 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x11e
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 33 4
0 00 31 06 39 f7 4a
7c 0c 8a c0 a8 .

..3@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb a1 35 9e
87 4e aa 50 10 .
..P..+..5..N.P.
0030 00 2e 11 e3 0
0 00 0e 03 44 09 10
8f 8d d1 2e 5e .
.......D......^
0040 09 f3 18 91 9
e e0 c7 0a 7b 36 46
55 89 75 86 86 .
.......{6FU.u..
0050 f7 d3 6a 12 a
4 a6 8d 7a eb 15 02
b1 08 bf 3f b6 .
.j....z......?.
0060 c4 d6 b7 b9 4
6 55 06 07 17 ca 3d
45 f5 e9 75 7b .
...FU....=E..u{
0070 bb d5 4b f8 7
f f6 4a e3 f7 2b bd
f9 4d df e7 2b .
.K...J..+..M..+
0080 56 d8 e2 cf 4
8 d1 c5 ca 8f 0e 2e
29 8a 88 5a 92 V
...H......)..Z.
0090 bb 7d 3e ff f
b 92 04 e6 8f f2 e8
27 d4 01 ef 8a .
}>........'....
00a0 50 5c 44 9a 8
0 3d ed 4a 0b 28 93
50 07 bd e9 41 P
\D..=.J.(.P...A
00b0 74 92 6a 01 8
7 ad 28 ce ee 9b df
bb fa 13 44 04 t
.j...(.......D.
00c0 04 56 45 56 b
d 16 04 b1 a8 b5 e5
ac be 49 99 60 .
VEV.........I.`
00d0 b3 72 6e 3d 4
a 87 c5 e2 63 31 c2
36 82 91 a5 9e .
rn=J...c1.6....
00e0 ad 94 90 35 5
6 54 28 37 05 30 85
6f 35 5c 3e 02 .
..5VT(7.0.o5\>.
00f0 52 99 88 ee c
9 02 56 6d 56 e8 1a
5c cc 97 37 9d R
.....VmV..\..7.
0100 73 71 f5 3b 5
c d9 06 d2 e8 a2 8d
6c 9a dd 9d d9 s
q.;\......l....
0110 d7 b9 c5 22 6
4 6d c4 35 6c 47 a9
1a 1d 76 ce 9d .
.."dm.5lG...v..
0120 2b b0 40 34 c
9 16 50 04 cc ec 2e
79 6a 7c 30 a4 +
.@4..P....yj|0.

0130 90 45 05 1a c
2 9f b1 98 1b 3a a3
0b 3c b6 90 aa .
E.......:..<...
0140 3a 19 a4 85 0
8 a2 1f 99 2c 33 54
a3 3c 0b 81 e3 :
.......,3T.<...
0150 63 02 e1 68 5
a 86 2a 28 11 35 22
4f 2c cd d0 a6 c
..hZ.*(.5"O,...
0160 e8 68 1e 26 1
e 66 8a 64 f9 2e f3
a8 9a a5 87 44 .
h.&.f.d.......D
0170 c8 59 c5 57 8
7 76 99 cc 7f f4 ab
90 14 4b c0 44 .
Y.W.v.......K.D
0180 31 f6 b4 90 2
7 df d2 57 a7 c8 21
c1 12 9f 09 e4 1
...'..W..!.....
0190 9c 5c 97 58 4
4 54 46 7c ef 47 31
0e d6 bd 58 c7 .
\.XDTF|.G1...X.
01a0 ba bd 16 b1 6
d 2e 85 a3 11 a0 df
0c 8b 5b c2 de .
...m........[..
01b0 b6 b5 e4 8f 8
d 6f 79 97 d2 ab a6
6f 0e 69 e7 5b .
....oy....o.i.[
01c0 df ce eb 3e b
f f6 c5 2f 6d 79 05
45 83 11 48 41 .
..>.../my.E..HA
01d0 d1 02 59 bc 5
c 49 b5 ef ae df ff
ff fa 15 53 01 .
.Y.\I........S.
01e0 48 3b 62 c8 0
6 31 98 0c 52 5a f1
b8 41 08 35 8e H
;b..1..RZ..A.5.
01f0 56 54 e5 9e 9
3 99 59 26 16 57 2f
ce e0 f3 4d e5 V
T....Y&.W/...M.
0200 8e 10 95 7c d
1 13 b7 8d 81 25 d6
e0 69 94 c4 55 .
..|.....%..i..U
0210 6e 0a ab c2 8
9 ed bf e4 d4 68 de
06 5e eb 32 d6 n
........h..^.2.
0220 72 a6 da f9 d
4 92 e6 99 86 b1 c7
06 0c 95 05 2d r
..............0230 0c 10 85 dc e
7 ff fb 92 04 ed 8f
f3 1a 27 d3 81 .
............'..
0240 ef c2 50 63 2

6 aa 70 61 ed 5c 0b
38 9f 4e 0c 3e .
.Pc&.pa.\.8.N.>
0250 49 41 8c 96 e
9 81 87 bd 30 f6 2f
fe 52 99 f6 7f I
A......0./.R...
0260 6b 7d 61 f6 b
8 95 2e a8 70 88 86
ce 80 ba ae 59 k
}a.....p......Y
0270 48 a8 42 46 d
0 d9 5c 36 51 80 50
2e cb 8d 54 a6 H
.BF..\6Q.P...T.
0280 df e6 79 a1 1
3 18 a4 21 e0 6d bc
4a 52 a2 28 5c .
.y....!.m.JR.(\
0290 62 ee 57 4e 1
1 31 16 0c 6d 44 a6
1d 4f fc 9a dc b
.WN.1..mD..O...
02a0 6f 02 14 19 b
3 2d 5c d4 f9 ff 3a
92 56 de 7c 5e o
....-\...:.V.|^
02b0 2a bc c5 58 c
6 4b be 53 eb 33 fe
73 49 0b 3f fc *
..X.K.S.3.sI.?.
02c0 83 f8 a0 72 b
4 b0 65 6b d0 aa 38
b2 62 bf 23 50 .
..r..ek..8.b.#P
02d0 ce 01 dd 3f d
1 cb 9f e5 5a 9d 2b
9f fc ee 1c 0e .
..?....Z.+.....
02e0 33 42 f1 bd 6
1 58 10 c9 4c 93 40
39 49 ed 33 48 3
B..aX..L.@9I.3H
02f0 d1 9b 36 66 6
5 cb ab 5d 6b 51 a2
d6 81 77 cc 9a .
.6fe..]kQ...w..
0300 72 de a8 12 5
0 18 6a 94 72 26 78
62 03 2e f2 80 r
...P.j.r&xb....
0310 80 6c 20 b7 8
7 2b 34 1f 59 cc 2d
fb 0f 90 34 b6 .
l ..+4.Y.-...4.
0320 35 af 88 0c c
3 89 c8 c8 69 53 99
d4 14 2c bd 1b 5
.......iS...,..
0330 9e 66 06 52 3
2 47 37 f8 84 de 8b
51 8c 03 ef f8 .
f.R2G7....Q....
0340 87 8c fa c6 e
0 1c 7b ba c6 34 51
11 76 f5 7a e9 .
.....{..4Q.v.z.
0350 3d 7f 6d 7a 6
f df 1f db 55 89 5a

41 d5 75 9c ea =
.mzo...U.ZA.u..
0360 0b da 34 9c a
0 75 d5 38 9a 59 18
19 10 48 56 c1 .
.4..u.8.Y...HV.
0370 44 ae fa 0b 9
5 65 52 e0 f8 9e da
1c 97 da dd 43 D
....eR........C
0380 4f a7 18 72 5
1 68 71 c9 f0 a7 34
cf 31 06 6c 1f O
..rQhq...4.1.l.
0390 1a 3c 79 21 9
2 9a e3 5b cf ba 16
f2 94 af fc 6d .
<y!...[.......m
03a0 b9 3d c0 3c 1
3 bf 4b 0f 05 8f d6
e9 f5 3f fd af .
=.<..K......?..
03b0 5b 26 e6 eb 3
6 b0 00 4e 9b 9b 56
d5 15 0f 92 d8 [
&..6..N..V.....
03c0 74 32 66 4e 5
c b3 18 f7 17 80 25
94 cc 9b 80 6d t
2fN\.....%....m
03d0 38 c1 50 f5 e
5 98 f5 ff fb 90 04
ea 8f f3 0c 28 8
.P............(
03e0 53 83 0f 7a 5
0 5d 24 fa 70 61 ef
4a 0c 70 93 56 S
..zP]$.pa.J.p.V
03f0 0c 31 a9 41 8
7 92 2a 81 87 bd 28
84 42 28 5a d6 .
1.A..*...(.B(Z.
0400 45 65 76 a1 2
b 07 8a d8 f6 86 1b
36 14 18 15 84 E
ev.+......6....
0410 10 cd ca 1e 5
d 04 a3 de 54 d8 f9
41 49 34 23 8a .
...]...T..AI4#.
0420 81 2d 05 0c 1
2 10 47 2d 1f 69 ed
5c eb 4c 7a bb .
-....G-.i.\.Lz.
0430 44 6b 06 25 6
9 b0 fb 55 73 54 07
a3 60 4a 97 89 D
k.%i..UsT..`J..
0440 c9 89 d4 44 5
6 4c 99 c4 4a 20 ba
62 d6 85 97 32 .
..DVL..J .b...2
0450 6f 51 77 a4 6
8 0c 4b 4b 00 51 54
ea 51 c2 61 a6 o
Qw.h.KK.QT.Q.a.
0460 6c a4 60 ee e
3 6d 2e 3d dd c0 1a
cd fa 8a 8c 82 l

.`..m.=........
0470 90 c4 ee be 1
b 1c 35 8a 75 03 79
23 67 98 0b 21 .
.....5.u.y#g..!
0480 dd 63 32 f9 b
8 71 8b cc 75 a7 0d
29 2a b5 ae 86 .
c2..q..u..)*...
0490 a2 13 d6 84 7
6 bc 50 39 41 65 24
ae 2e b2 aa 7a .
...v.P9Ae$....z
04a0 d2 6c 44 6e 5
8 1a 65 41 50 c9 59
61 c0 52 35 9d .
lDnX.eAP.Ya.R5.
04b0 cf 20 ad 28 8
6 9f ad ca 2c da a7
9c b8 10 78 a9 .
.(....,.....x.
04c0 6c c5 57 3c 8
1 59 e2 8a 59 19 55
26 cc 14 32 d1 l
.W<.Y..Y.U&..2.
04d0 fe dc 14 3b 5
4 78 1b fe d6 9b eb
e0 81 4e 77 ff .
..;Tx.......Nw.
04e0 45 6b 74 da b
2 9e 18 34 39 0a b2
85 5a 31 a9 15 E
kt....49...Z1..
04f0 b6 e3 3a 90 7
1 d4 d1 c7 d1 f6 43
ae 76 87 76 d6 .
.:.q.....C.v.v.
0500 db ad 4d 79 c
8 8e f3 9a 87 1d 6f
56 24 3c 15 50 .
.My......oV$<.P
0510 32 e5 6a 06 9
f 5b 12 74 28 f8 15
e5 56 a7 ea 7a 2
.j..[.t(...V..z
0520 e0 12
.
.
No. Time
Source
Destination
Protocol
Length Info
339 13.32953000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1307 http49
574 [PSH, ACK] Seq=
214004 Ack=1 Win=46
Len=1253
Frame 339: 1307 byt
es on wire (10456 b
its), 1307 bytes ca
ptured (10456 bits)

on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.379460000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.379460000 s
econds
[Time delta fro
m previous captured
frame: 0.066003000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06600300
0 seconds]
[Time since ref
erence or first fra
me: 13.329530000 se
conds]
Frame Number: 3
39
Frame Length: 1
307 bytes (10456 bi
ts)
Capture Length:
1307 bytes (10456
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
293
Identification:
0xf234 (62004)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39fd [validatio
n disabled]

[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 214004, Ack:
1, Len: 1253
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1253]
Sequence number
: 214004 (relati
ve sequence number)
[Next sequence
number: 215257 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .

.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x006
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2513]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 0d f2 34 4
0 00 31 06 39 fd 4a
7c 0c 8a c0 a8 .
..4@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb a6 21 9e
87 4e aa 50 18 .
..P..+..!..N.P.
0030 00 2e 00 64 0
0 00 2a 5f a1 48 8e
8c 1d 65 32 2d .
..d..*_.H...e20040 78 87 d2 b2 c
3 dc 50 fb 73 66 14
6a 4d b8 a8 61 x
.....P.sf.jM..a
0050 95 3c ab 54 e
b 83 d1 02 e3 9c e3
20 4d e9 39 26 .
<.T....... M.9&
0060 5c 4f 44 e9 e
5 26 45 0a 60 01 a6
6e 62 c7 46 3c \
OD..&E.`..nb.F<
0070 84 40 d5 55 9
1 15 91 54 69 99 93
cc 83 1e 32 0f .
@.U...Ti.....2.
0080 c8 de 83 22 6
a fe b7 a0 6c f3 74
54 ff fb 92 04 .
.."j...l.tT....
0090 e7 0f f2 b6 2
4 56 81 eb 5a 50 58
a4 8a c0 3d 67 .
...$V..ZPX...=g
00a0 4a 0c 64 93 5
4 0c 3d a9 41 97 a0
ea 41 87 9d 70 J
.d.T.=.A...A..p
00b0 da d2 5c f5 4

7 36 68 d4 ff 50 30
0e aa 7d 03 86 .
.\.G6h..P0..}..
00c0 84 e2 ff 80 1
9 2a 33 89 a7 30 e4
60 24 db 2d 78 .
....*3..0.`$.-x
00d0 30 b3 17 aa b
5 ed 67 be 75 64 4f
ca 7b cc 3c 94 0
.....g.udO.{.<.
00e0 39 2e 4a d7 6
b 72 1f b3 94 75 83
4c 85 8b fc a5 9
.J.kr...u.L....
00f0 b1 c9 c9 fc e
2 fd c7 08 cf cb 7f
f3 b3 03 73 0a .
.............s.
0100 b8 56 6a 96 7
5 84 de a1 d7 2a 87
3d e2 d1 5d ac .
Vj.u....*.=..].
0110 6d d8 20 bd e
d bf ef fe 9f 2a a1
02 26 84 07 87 m
. ......*..&...
0120 20 64 90 59 4
2 09 58 f1 01 d1 f8
15 46 45 70 40
d.YB.X.....FEp@
0130 8c 37 68 22 b
d b4 8d 59 2b 6a f0
43 0a c6 09 35 .
7h"...Y+j.C...5
0140 ad 0b 62 db 3
4 fe 18 49 02 ee 24
65 6b 29 fa 03 .
.b.4..I..$ek)..
0150 f4 6a 5e 25 0
d 50 10 95 90 45 49
c9 44 4b 7b 39 .
j^%.P...EI.DK{9
0160 d4 52 40 f4 3
f e5 cc 9a 52 9b b2
cc 94 cf 52 28 .
R@.?...R.....R(
0170 3d 7b df 9e e
a 7d bd 03 df fe 95
48 21 7a fb 05 =
{...}.....H!z..
0180 88 5b ab 40 0
5 b7 7c ab 56 cc 32
75 9a 55 db 42 .
[.@..|.V.2u.U.B
0190 bb c7 be 47 1
1 50 4c 66 f2 dd c2
02 4e 54 bf 95 .
..G.PLf....NT..
01a0 16 99 05 a6 5
7 7f 87 02 44 17 bd
33 62 c9 32 43 .
...W...D..3b.2C
01b0 40 ad 20 5f 2
5 0d 54 2b 08 2c 83
3c e1 34 a4 1a @
. _%.T+.,.<.4..
01c0 a2 fa 6c 91 9
a 28 0e 5a 0e b5 31

24 df 41 46 95 .
.l..(.Z..1$.AF.
01d0 cc 0e 52 72 b
2 52 c7 34 38 56 49
02 ff 87 00 c0 .
.Rr.R.48VI.....
01e0 70 e4 97 e1 4
5 06 8e 0e db a2 93
ce 19 0a 17 a4 p
...E...........
01f0 01 6a 2a e7 5
2 ab 0c 21 9d 51 58
a1 55 25 61 84 .
j*.R..!.QX.U%a.
0200 6b 74 5a bf 7
a 57 df e3 8c 3f 7c
f0 97 de 9e 00 k
tZ.zW...?|.....
0210 4b 0c a8 a6 5
3 4c 27 d5 29 55 97
c9 53 06 93 07 K
...SL'.)U..S...
0220 d1 91 9f 45 6
1 c9 11 2d 3c 81 9b
6a a9 25 ff fb .
..Ea..-<..j.%..
0230 92 04 e9 8f f
2 f5 2e 52 83 0f 92
60 60 44 ea 40 .
......R...``D.@
0240 63 18 4a 0c 1
4 ef 48 0c be 6b 81
7d 16 e9 01 8c c
.J...H..k.}....
0250 49 30 a4 f3 8
e 96 9b dd b9 d4 e5
06 91 93 4e a4 I
0............N.
0260 50 7c d4 d8 b
a 40 a7 bc e0 e0 46
c0 1a 91 92 3e P
|...@....F....>
0270 0b 18 38 f4 e
5 94 f7 9a 64 41 62
d2 40 13 9d ba .
.8.....dAb.@...
0280 88 4e ec 82 b
5 6f f9 7d d7 db bb
40 41 20 ab 1b .
N...o.}...@A ..
0290 a0 2f 46 29 5
c 42 31 80 45 9c ae
98 75 cf 17 10 .
/F)\B1.E...u...
02a0 5b a8 dc 98 3
5 d8 dc 90 a9 03 ca
1c 92 45 a6 08 [
...5........E..
02b0 a3 da a5 29 2
d 23 55 4f 28 ec 49
cb d6 9f a9 66 .
..)-#UO(.I....f
02c0 0c ad 10 92 3
8 29 34 fc 4d c6 b2
1e 17 55 39 99 .
...8)4.M....U9.
02d0 50 85 04 60 a
7 96 28 eb 38 63 10
9b e8 eb f8 4c P

..`..(.8c.....L
02e0 cf bc f8 53 5
7 bd 51 ac cd bd 18
fd 04 94 0b d1 .
..SW.Q.........
02f0 e3 30 9d 7a 0
3 ab dc c3 72 d1 a1
7c 2c 6b 14 6b .
0.z....r..|,k.k
0300 99 ff db 72 1
8 cb 8c 4c ea 36 50
39 f6 f6 cf f5 .
..r...L.6P9....
0310 d5 6d 49 3a 4
c 2c 98 65 f0 41 b2
24 de 3e 84 4c .
mI:L,.e.A.$.>.L
0320 22 f3 12 4a 1
0 e3 28 72 ce 6f 4c
23 70 98 8a 71 "
..J..(r.oL#p..q
0330 25 e1 11 a7 7
e 18 28 04 14 c7 a9
92 3f 3d 55 64 %
...~.(.....?=Ud
0340 0d 9e cd af e
c 71 56 d5 9d c7 5c
5c ad da dd a9 .
....qV...\\....
0350 2c 62 84 1c 2
5 d3 53 32 92 63 10
6f 4c 97 4d 8e ,
b..%.S2.c.oL.M.
0360 98 8f 85 af 3
3 11 83 3b 9b 9e 9d
2c 5d d1 49 6f .
...3..;...,].Io
0370 7a 4a 3a a6 7
5 29 b4 2b 7f 3a ba
bf ff d1 52 d5 z
J:.u).+.:....R.
0380 c8 4a 1a 41 a
b a6 48 01 aa 50 15
24 5f 90 97 5c .
J.A..H..P.$_..\
0390 a3 99 d9 7f 1
1 86 1a 91 da 51 49
7e 3b 78 5e 6b .
........QI~;x^k
03a0 1a c7 56 23 7
9 b5 dc 38 50 3c 15
d3 12 26 4c 12 .
.V#y..8P<...&L.
03b0 69 0b 58 9c c
9 82 1a 57 3c 22 28
1c 31 67 73 16 i
.X....W<"(.1gs.
03c0 27 93 52 45 6
2 17 59 50 e9 17 1e
4f b2 92 3c 87 '
.REb.YP...O..<.
03d0 ff fb 92 04 e
9 0f f3 0c 34 52 03
18 6a e0 5f 45 .
.......4R..j._E
03e0 ca 40 63 12 4
c 0b f8 b1 46 0c 61
e9 81 7d 9a 29 .
@c.L...F.a..}.)

03f0 01 8c 35 70 a
d dc b8 ee b3 fb 12
6a 2a eb 51 5b .
.5p.......j*.Q[
0400 b5 26 02 7e b
c a3 c5 1e ea 64 96
e5 9c 03 ca c1 .
&.~.....d......
0410 14 31 67 92 6
9 6f 4c 58 53 a6 47
66 2d 3c d3 1e .
1g.ioLXS.Gf-<..
0420 ea 2d 3b 4f d
5 3c f5 49 64 a1 57
e6 fc d4 ed cc .
-;O.<.Id.W.....
0430 49 8b 8c be 6
2 6f 10 cc 75 92 08
ab d0 f8 71 84 I
...bo..u.....q.
0440 ea e4 b5 04 a
f 94 09 dc b5 69 37
3a be c7 b2 bf .
........i7:....
0450 db 72 ea e0 e
f fd 75 ff 27 bb 24
a8 58 43 20 88 .
r....u.'.$.XC .
0460 8a ac 69 88 b
2 01 9e 5d 09 5b 0b
34 d5 ca 90 74 .
.i....].[.4...t
0470 13 c2 f1 19 7
3 32 98 e8 53 38 29
d5 70 50 f5 1c .
...s2..S8).pP..
0480 c8 b8 cc f1 5
8 40 51 7f b0 9a d9
6e 02 fa f3 b5 .
...X@Q....n....
0490 6f c4 ae 9b 1
d 3e 67 6b 0b 93 4f
87 ae 85 0e 73 o
....>gk..O....s
04a0 7d 95 8d cb 0
d c8 3c 54 20 4c 98
20 7c 06 70 22 }
.....<T L. |.p"
04b0 04 15 34 68 f
e a1 63 35 f3 ff a9
17 9a ad 60 00 .
.4h..c5......`.
04c0 08 26 22 6b c
8 5a d1 6e 1d f4 8c
a0 39 d3 82 9c .
&"k.Z.n....9...
04d0 9a 3b 8f 15 5
a 3d 0d 72 88 8a 78
d6 e6 ca b6 cf .
;..Z=.r..x.....
04e0 01 5f 20 d2 c
a 02 42 80 91 01 d9
32 8d 26 99 e9 .
_ ...B....2.&..
04f0 ca 4a 1d 8d 3
e 1a 6e 1f be e5 98
ed 96 e5 4a cc .
J..>.n.......J.
0500 80 dc f2 0b 1

5 28 d2 64 12 64 22
11 0e 00 c4 26 .
....(.d.d"....&
0510 a6 e5 0f b6 5
e a2 46 bd 55 58 b5
.
...^.F.UX.
No. Time
Source
Destination
Protocol
Length Info
340 13.32971200
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=215257 Win=41900 L
en=0
Frame 340: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.379642000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.379642000 s
econds
[Time delta fro
m previous captured
frame: 0.000182000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018200
0 seconds]
[Time since ref
erence or first fra
me: 13.329712000 se
conds]
Frame Number: 3
40
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype

:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab

le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f95 (20373)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 21525
7, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 215257 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set

...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41900
[Calculated win
dow size: 41900]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 339]
[The RTT to
ACK the segment wa
s: 0.000182000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 95 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb ab 06 50 10 .
....P..N.+...P.
0030 a3 ac 18 d4 0
0 00
.
.....
No.

Time

Source
Destination
Protocol
Length Info
341 13.46922000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=21525
7 Ack=1 Win=46 Len=
1260
Frame 341: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.519150000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.519150000 s
econds
[Time delta fro
m previous captured
frame: 0.139508000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13950800
0 seconds]
[Time since ref
erence or first fra
me: 13.469220000 se
conds]
Frame Number: 3
41
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S

agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf235 (62005)
Flags: 0x02 (Do
n't Fragment)

0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f5 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 215257, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 215257 (relati
ve sequence number)
[Next sequence
number: 216517 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .

... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x5b2
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 35 4
0 00 31 06 39 f5 4a
7c 0c 8a c0 a8 .
..5@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb ab 06 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 5b 2e 0
0 00 52 01 9d 38 7d
1d a5 a0 93 a0 .
.[...R..8}.....
0040 49 e2 54 9c 4
a 07 84 5f ad 0a 90
b7 35 d4 5a 50 I
.T.J.._....5.ZP
0050 65 ac 5a 57 0
1 84 f1 f8 58 7f b7
8c 66 c1 8e ec e
.ZW....X...f...
0060 95 ef d9 ff e
e 45 37 6d 74 de a3
1b 0b 8c f9 f5 .

....E7mt.......
0070 ae 3b 4c 0b 5
e 01 69 54 63 d9 5c
23 a9 23 3a 99 .
;L.^.iTc.\#.#:.
0080 07 80 16 13 d
7 da d6 cd 26 ef fb
be af ff fb 92 .
.......&.......
0090 04 e8 0f f2 f
9 2e 52 03 18 92 60
5a e6 9a 40 63 .
.....R...`Z..@c
00a0 0b 5c 0c 38 9
d 52 0c 3d 89 41 73
13 2b 41 87 99 .
\.8.R.=.As.+A..
00b0 28 ff 7f 9f 9
f fd d9 92 7f 64 ff
db 3b 6c 46 51 (
........d..;lFQ
00c0 b4 c5 ef 48 e
e 2c 78 45 2c 0a 0d
66 06 24 4c 89 .
..H.,xE,..f.$L.
00d0 c6 a5 bd 47 1
c 24 02 e8 94 73 90
02 6c a9 4c 23 .
..G.$...s..l.L#
00e0 1a 91 66 10 1
e a6 66 66 48 7a 12
8f 32 17 41 50 .
.f...ffHz..2.AP
00f0 80 ec 81 eb e
5 58 25 1a 0c 84 4d
38 54 b0 2e 91 .
....X%...M8T...
0100 e6 ef 04 09 9
a 78 7c 22 15 73 40
99 c0 c1 01 ee .
....x|".s@.....
0110 39 36 4d 07 3
c 9e c2 96 7e 9a 9c
06 63 51 e8 4f 9
6M.<...~...cQ.O
0120 a1 e2 d4 c6 4
9 db 12 88 84 4d 18
f4 3d 63 88 14 .
...I....M..=c..
0130 fe 1f 03 3f 8
1 ae 3d 2e 24 06 63
24 aa 20 77 4d .
..?..=.$.c$. wM
0140 ae c8 ea 5a 4
6 38 8d 12 63 39 8c
8e b5 92 84 19 .
..ZF8..c9......
0150 29 2a 56 a6 5
a b4 ea 47 53 2a 4c
86 7c ae a3 59 )
*V.Z..GS*L.|..Y
0160 15 ec ad 46 1
a 3a 36 9d 7e d4 d7
7b ed de 87 f5 .
..F.:6.~..{....
0170 1b 6e 50 3d 5
a e9 a6 cf f5 60 12
23 d4 80 a9 2e .
nP=Z....`.#....

0180 4b 25 b4 5a a
d 15 5b 6c c4 26 45
6e cf 4c 67 f6 K
%.Z..[l.&En.Lg.
0190 c9 38 8b ef a
7 e2 e2 a8 b1 25 ba
29 8c 64 ad 68 .
8.......%.).d.h
01a0 58 f7 66 3c 2
c 55 95 11 48 a1 b8
ab d8 55 0a 54 X
.f<,U..H....U.T
01b0 44 56 2c 6f 4
1 27 dc 56 ca a9 94
1c 6d a9 42 b9 D
V,oA'.V....m.B.
01c0 51 d3 30 89 0
e d1 ee 7f 0c f7 77
7f 7c 9d b8 6b Q
.0.......w.|..k
01d0 19 f9 3a ae 1
6 b3 fc f9 15 74 12
67 33 ad 64 f3 .
.:......t.g3.d.
01e0 23 6e 6a 78 6
b 98 e6 ba 48 9a 63
b7 32 31 ca 21 #
njxk...H.c.21.!
01f0 5f 67 98 4d 1
8 f6 07 a3 67 99 80
2a b8 89 30 a3 _
g.M....g..*..0.
0200 51 8c 9b 20 e
5 24 a4 1c c2 c9 23
98 4e 66 47 5a Q
.. .$....#.NfGZ
0210 26 ca 7e c9 9
1 55 5b 47 57 77 59
68 ac 7a 23 a3 &
.~..U[GWwYh.z#.
0220 5a 71 c7 0f 1
a 92 38 64 bd e4 8f
b1 ab ba 6d ff Z
q....8d......m.
0230 fb 92 04 ea 8
f f3 18 2f 57 81 e9
32 62 5d 45 6b .
....../W..2b]Ek
0240 00 60 c3 4c 0
b e1 1b 5e 06 20 ab
89 7c 19 ec 01 .
`.L...^. ..|...
0250 83 15 71 21 4
1 e5 43 ad 12 b7 b0
0f 5b a2 17 43 .
.q!A.C.....[..C
0260 8e b3 5c eb 4
d 87 26 bd 5e 69 e5
55 e8 a3 6b 59 .
.\.M.&.^i.U..kY
0270 ce 52 aa 8e 1
2 56 4e 78 94 e3 e9
b1 9e 67 36 2d .
R...VNx.....g60280 8b 36 66 3e e
2 53 9f d7 df 03 12
c8 ec 87 31 a6 .
6f>.S........1.
0290 2e 34 96 ee 3

6 76 ae b8 9c af b7
3f c7 49 2b ed .
4..6v.....?.I+.
02a0 11 b1 a7 4e 8
d 51 6a 32 b1 34 4b
fc db 62 66 ff .
..N.Qj2.4K..bf.
02b0 cf fb f6 05 b
d 55 57 e6 ed 56 37
4d 7f f7 f5 98 .
....UW..V7M....
02c0 75 37 d8 0b 3
6 78 38 40 4a 5b d7
a2 35 4a 8f a6 u
7..6x8@J[..5J..
02d0 e4 53 64 c7 9
b 15 ac 2b 5e 2f db
f5 5f 40 fb 66 .
Sd....+^/.._@.f
02e0 a1 98 03 18 c
c e4 43 12 9a a3 a2
ab 8a 96 8a c3 .
.....C.........
02f0 6c 47 95 ea f
e 88 ef 6d d9 6f 34
e9 bc e6 b4 c7 l
G.....m.o4.....
0300 21 a4 1d 94 3
2 13 f2 6d c7 f2 d4
6b 7f 78 bd d7 !
...2..m...k.x..
0310 de e7 76 bc d
8 be ff 42 3b cf ba
b8 f7 a4 f4 3f .
.v....B;......?
0320 cd d3 a6 03 2
8 ee 83 0f 0c 28 10
3d b9 c1 63 66 .
...(....(.=..cf
0330 4c d9 66 3e d
a bb e2 fd 7d af 2f
c6 5a f5 7b a0 L
.f>....}./.Z.{.
0340 32 bb 39 16 2
d 47 aa 24 68 98 c1
02 18 61 a7 13 2
.9.-G.$h....a..
0350 64 c6 bb 4c f
6 ad 48 8f 98 b6 7b
66 7e 94 7a 14 d
..L..H...{f~.z.
0360 93 9c ac 95 3
3 55 ae 22 f9 f2 94
3a 12 34 70 22 .
...3U."...:.4p"
0370 b8 ac 9a 22 0
3 a0 57 2b 7a ee 42
90 3d 90 0a e8 .
.."..W+z.B.=...
0380 61 d1 d1 0a f
7 19 a9 5e d3 42 66
2b 2c 4e 50 a5 a
......^.Bf+,NP.
0390 ed 33 ae 58 c
e 3d 36 c2 91 64 51
d3 ba 0f b0 5e .
3.X.=6..dQ....^
03a0 75 ec be e2 a
2 dd c3 6b 4d 74 5d

c3 2e 50 bf 98 u
......kMt]..P..
03b0 73 b9 9f 77 5
1 17 6c f9 ae af e9
bd 4f d4 ca c4 s
..wQ.l.....O...
03c0 00 c3 44 66 a
f 43 9e 7e f0 a0 0c
38 9a 20 d1 33 .
.Df.C.~...8. .3
03d0 b7 ff fb 92 0
4 ea 0f f2 fd 42 57
01 e6 2a e0 62 .
........BW..*.b
03e0 e6 6a e0 61 2
6 5c 4b bc f1 5a 0c
24 ab 89 75 21 .
j.a&\K..Z.$..u!
03f0 6b 80 f4 95 7
0 21 d4 2c 36 99 63
35 d6 e5 47 a7 k
...p!.,6.c5..G.
0400 41 32 87 99 0
9 16 f1 ef 0e b1 d2
68 00 54 f9 4a A
2.........h.T.J
0410 cd 20 90 25 a
6 d5 e2 e8 f5 ee 5b
93 ed ad d6 3e .
.%......[....>
0420 ee 96 d8 f6 7
5 f5 3d 20 eb 66 ba
ae 14 53 83 43 .
...u.= .f...S.C
0430 09 0d 0c bb 0
0 80 ca 83 f6 8d 0b
62 f3 90 bc e4 .
..........b....
0440 22 be 7a f1 f
6 2a 7e 5d 38 50 b4
33 2e 7a e7 23 "
.z..*~]8P.3.z.#
0450 0c 8d 4b 56 5
1 0f 26 87 24 28 c4
92 bf 2d 2d a9 .
.KVQ.&.$(...--.
0460 72 15 74 f1 1
4 06 09 6d 02 8a 94
34 cc 6f 68 05 r
.t....m...4.oh.
0470 aa 46 ef 66 9
1 5d 66 a7 2b 65 be
6d 62 98 e5 a6 .
F.f.]f.+e.mb...
0480 97 8c 23 4d f
b e8 02 dd b7 5d d1
5f ac 7e ed 99 .
.#M.....]._.~..
0490 18 d0 cd c1 d
b 1b 79 af 5b 26 1a
70 0a fa 83 90 .
.....y.[&.p....
04a0 ca 45 10 95 1
9 52 84 cf 06 30 bc
3e b9 72 03 00 .
E...R...0.>.r..
04b0 4d 76 c6 58 e
6 6b 96 23 53 5c 67
42 84 07 a3 09 M

v.X.k.#S\gB....
04c0 90 c6 80 3d a
a 48 5a 17 6b 01 4e
40 cb 4e a0 4a .
..=.HZ.k.N@.N.J
04d0 72 06 77 bd 4
e 19 19 b2 e6 f3 12
d3 b0 cd ed 2c r
.w.N..........,
04e0 97 f7 6e 52 a
3 6e ec 86 10 1a a6
8b 1d 39 09 4d .
.nR.n.......9.M
04f0 7b 70 6a 9b e
6 7d 95 0f 9d fb 72
29 0b 3e 67 0b {
pj..}....r).>g.
0500 9d ec 27 ce 6
7 ae bb fe 44 30 e7
1e 4c 2e db 12 .
.'.g...D0..L...
0510 e6 a1 28 26 8
2 2a 30 de a4 55 90
ab 0d 67 45 64 .
.(&.*0..U...gEd
0520 ca c0
.
.
No. Time
Source
Destination
Protocol
Length Info
342 13.47753400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1294 http49
574 [PSH, ACK] Seq=
216517 Ack=1 Win=46
Len=1240
Frame 342: 1294 byt
es on wire (10352 b
its), 1294 bytes ca
ptured (10352 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.527464000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.527464000 s
econds
[Time delta fro
m previous captured
frame: 0.008314000

seconds]
[Time delta fro
m previous displaye
d frame: 0.00831400
0 seconds]
[Time since ref
erence or first fra
me: 13.477534000 se
conds]
Frame Number: 3
42
Frame Length: 1
294 bytes (10352 bi
ts)
Capture Length:
1294 bytes (10352
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V

ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
280
Identification:
0xf236 (62006)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3a08 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 216517, Ack:

1, Len: 1240
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1240]
Sequence number
: 216517 (relati
ve sequence number)
[Next sequence
number: 217757 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x641
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys

is]
[Bytes in f
light: 2500]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 00 f2 36 4
0 00 31 06 3a 08 4a
7c 0c 8a c0 a8 .
..6@.1.:.J|....
0020 01 0b 00 50 c
1 a6 2b cb af f2 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 64 1a 0
0 00 ad a0 97 ee 5e
0b 05 c7 16 5c .
.d.......^....\
0040 de 6f 7d 36 e
7 3e fd 3b 2c 5c 8d
dd b4 0b 04 07 .
o}6.>.;,\......
0050 dc c0 fe d7 e
b dc 22 ca 8f e9 db
64 f1 db 96 3b .
....."....d...;
0060 2c 5a a1 9c 2
f 3a 81 e7 89 d2 0d
0d 49 99 54 a4 ,
Z../:......I.T.
0070 dd 8a 48 d5 4
0 42 81 e7 1b 72 05
96 7e b7 ae 75 .
.H.@B...r..~..u
0080 c9 6c f9 16 3
1 a8 43 ff fb 92 04
ea 0f f3 01 38 .
l..1.C........8
0090 56 03 0b 5a e
0 61 49 2a d0 3d 63
5e 0b 68 9d 56 V
..Z.aI*.=c^.h.V
00a0 0c 3c c9 41 7
6 24 ab 00 f5 8d 78
22 ca b2 5a 01 .
<.Av$....x"..Z.
00b0 4a 94 25 28 1
2 f6 7e 24 4a 38 04
b1 eb 6c 42 8d J
.%(..~$J8...lB.
00c0 c1 e5 a3 45 d
b fc ae 35 5d b7 c4
b6 ab bd c4 9d .
..E...5].......
00d0 96 fb e4 10 f
4 70 07 2f 2f af 4c
39 59 bf 3c f6 .
....p.//.L9Y.<.
00e0 72 e1 5c b2 b
7 43 21 de f9 9f e6
5f ae db 3f d6 r
.\..C!...._..?.
00f0 35 e6 ae 2a 7
1 47 6c 2c 08 2c 4d
09 de c2 30 79 5
..*qGl,.,M...0y
0100 84 61 92 35 8

a b2 d6 58 86 5b a1
09 5d 94 cc 0c .
a.5...X.[..]...
0110 7e 50 4c e8 1
1 2d db 61 c6 07 3b
50 4e 49 07 01 ~
PL..-.a..;PNI..
0120 04 47 2d cb 1
1 57 d5 7b 61 89 4c
22 23 e6 d3 e6 .
G-..W.{a.L"#...
0130 02 83 7e 1e 1
c 29 0c 59 ab 4b 80
e4 9f 72 c8 3a .
.~..).Y.K...r.:
0140 a9 c5 54 9d 9
5 4e 65 ac 7d f5 0e
6a 55 f3 15 71 .
.T..Ne.}..jU..q
0150 10 7a 3e f7 3
6 9b eb 59 64 ac 48
b5 ac 07 d6 b0 .
z>.6..Yd.H.....
0160 86 bf 3a d9 b
8 56 da b5 5c 28 45
3a ed e5 6d 59 .
.:..V..\(E:..mY
0170 d2 02 c2 68 b
7 0e 13 e0 6e 2b 8f
27 27 09 47 ba .
..h....n+.''.G.
0180 db 4c af 1f f
7 2c be 70 b6 da ef
ba 5f 72 27 2f .
L...,.p...._r'/
0190 0a 5c 60 f8 8
b fd 19 a7 3f 6f bf
8c 49 78 9b b6 .
\`.....?o..Ix..
01a0 62 bc 50 85 5
1 a1 a6 d5 dd 82 a1
88 29 1d 4f 61 b
.P.Q.......).Oa
01b0 8c d9 09 4d 9
4 cd 7a d6 e7 42 3b
7a 5d 15 ef 9f .
..M..z..B;z]...
01c0 65 64 77 ac c
e fb 9e 81 f3 83 48
3e 49 04 6d e6 e
dw.......H>I.m.
01d0 b9 39 35 6b 2
a ab 40 b3 95 41 e9
02 b6 61 83 4e .
95k*.@..A...a.N
01e0 42 70 1d d5 5
4 51 16 cd 55 16 5c
f1 f0 7f 6f 12 B
p..TQ..U.\...o.
01f0 66 c8 09 de 6
f d6 2e 04 7b b6 be
00 58 6b 5e ea f
...o...{...Xk^.
0200 2c fc 5c fc 3
2 fa 7d b3 8a 3b 90
50 cc e5 28 14 ,
.\.2.}..;.P..(.
0210 04 8f 97 59 5
3 c5 8a 95 dc 92 09

16 1b 71 65 96 .
..YS........qe.
0220 0c 1c 48 0e 9
8 ca 75 5d fa ff fb
92 04 eb 8f f2 .
.H...u]........
0230 f5 29 55 03 0
c 5a 60 5f 66 2a b0
3d e6 4c 0b f4 .
)U..Z`_f*.=.L..
0240 c1 52 0c 3d 6
9 81 8b a6 aa 80 f7
89 78 62 f2 db .
R.=i.......xb..
0250 4c 2a c4 a9 1
a 35 10 c0 7e 07 59
ca 2d f9 13 94 L
*...5..~.Y.-...
0260 d5 61 90 12 9
d 51 46 37 d9 66 94
81 bc df 4e 47 .
a...QF7.f....NG
0270 de 2b 19 81 d
f cc 77 b0 4c 1d e3
f8 36 c3 91 fc .
+....w.L...6...
0280 7f de ad 9a 5
a bd 36 e6 a7 ad 47
ba ff 79 80 18 .
...Z.6...G..y..
0290 24 14 06 86 0
1 85 c3 81 c1 49 22
aa 7b 52 c4 35 $
........I".{R.5
02a0 8f 72 54 51 8
0 36 91 59 92 a2 94
13 a0 12 15 b1 .
rTQ.6.Y........
02b0 29 db 4d 1d 6
d 34 50 84 21 42 86
b1 58 cc c8 8c )
.M.m4P.!B..X...
02c0 f5 23 0b 84 b
e 42 11 f7 8e c9 56
5c b8 d7 e3 4e .
#...B....V\...N
02d0 a7 85 8a 3e 5
9 9d 83 79 ab c2 1d
0b 10 ac c4 00 .
..>Y..y........
02e0 01 66 18 3b 0
9 06 b2 4d ef b3 6a
43 cf 74 b5 ac .
f.;...M..jC.t..
02f0 0f a9 af ef f
4 ee 2e 2b 4e f7 9e
bf ff e4 dd a1 .
......+N.......
0300 b7 9d 62 0a a
1 92 a3 4f ad 63 7b
18 bb b8 e1 74 .
.b....O.c{....t
0310 ce f9 ee 83 a
1 d8 f3 02 ca 2a 10
31 14 a0 f4 70 .
........*.1...p
0320 5e ea d1 44 e
6 fd f5 aa d7 82 09
0b 52 1e cd 16 ^

..D........R...
0330 85 9a 59 c8 c
7 ef 87 8e 05 cb b3
06 65 62 42 e7 .
.Y.........ebB.
0340 9a 8a 6a 9e 3
e 87 e6 f6 87 2d 56
3e 96 a5 eb 4a .
.j.>....-V>...J
0350 ee e5 22 72 9
c 5e f5 38 e9 a2 08
7d b3 0a 1e 9a .
."r.^.8...}....
0360 dc a6 b4 5a 0
c 8b 20 58 73 6b 01
a0 8b 49 13 ae .
..Z.. Xsk...I..
0370 2e 8a 7d e4 8
8 aa 60 a8 7e ad a4
c5 53 75 61 35 .
.}...`.~...Sua5
0380 ad e1 87 32 1
9 2d 2b e6 22 13 b5
92 3a ec 97 49 .
..2.-+."...:..I
0390 6b 79 53 b8 5
3 71 a8 80 73 92 1d
fa 84 d0 79 27 k
yS.Sq..s.....y'
03a0 65 28 15 b4 5
3 4c a3 2f 12 87 cd
3b 3f 93 8a 6b e
(..SL./...;?..k
03b0 d1 9b 3a 2b 3
5 01 99 43 de 6c a8
d0 11 86 b5 ab .
.:+5..C.l......
03c0 70 70 4a 1a 1
e 66 51 35 32 cb 58
ff fb 92 04 ea p
pJ..fQ52.X.....
03d0 0f f2 e6 27 5
4 83 0f 5a 50 60 a4
8a 90 3d ec 4a .
..'T..ZP`...=.J
03e0 0b e4 e3 50 0
c 3d 0b 81 86 93 aa
00 f7 b1 28 d8 .
..P.=........(.
03f0 35 65 cb 36 c
1 13 f7 f6 6d e3 8a
d1 30 25 c2 fc 5
e.6....m...0%..
0400 26 0d 10 2d a
f 97 7b 98 4e 84 e0
46 95 b6 56 b9 &
..-..{.N..F..V.
0410 c7 64 e4 b9 c
3 d0 83 9a 91 20 5f
50 02 4e 0c 57 .
d....... _P.N.W
0420 87 c5 3d 65 5
0 03 d5 31 b0 a2 0e
23 77 d3 9d f0 .
.=eP..1...#w...
0430 1d 71 74 bb 5
c c9 b3 8e b4 40 8e
2e 21 05 82 7d .
qt.\....@..!..}

0440 6e 04 1a 54 5
3 52 e0 90 a9 b0 e0
6d ac 6c 1a b2 n
..TSR.....m.l..
0450 2a e3 2c 68 d
f a1 9b 56 e4 18 53
24 1e 82 1d 9d *
.,h...V..S$....
0460 99 13 12 36 0
a 44 c7 28 c9 ea 5c
cf 14 26 96 1c .
..6.D.(..\..&..
0470 8e 39 22 c5 9
e 2d 6e 34 f5 16 b8
de 8b ec 39 23 .
9"..-n4......9#
0480 e7 67 b0 6e 7
d ee 6c 0f d4 1e 57
6e ab 0f 37 9f .
g.n}.l...Wn..7.
0490 ff 8d c9 af e
e c9 7d e3 19 3e 6c
70 4c a0 88 a5 .
.....}..>lpL...
04a0 50 3c 8b d7 5
8 d6 ba 74 bd b2 76
3e 26 10 c6 48 P
<..X..t..v>&..H
04b0 7a 94 aa 35 a
9 4c 10 55 90 07 39
c7 6b 43 40 cd z
..5.L.U..9.kC@.
04c0 3e 29 a9 dc c
2 a8 a4 4e d5 68 9b
f5 85 15 97 d6 >
).....N.h......
04d0 ce ae 95 07 6
7 7a e6 78 3f 65 ff
23 68 5a af 3b .
...gz.x?e.#hZ.;
04e0 63 69 1e ca c
e c0 ba 4f 3a 6b cf
c4 f6 e2 ca 9a c
i.....O:k......
04f0 87 90 71 5c 5
1 a8 b5 a9 0f 4e 8a
1f 9d 24 4d b3 .
.q\Q....N...$M.
0500 48 05 87 2d 2
b 58 59 97 31 bf ff
76 9a aa
H
..-+XY.1..v..
No. Time
Source
Destination
Protocol
Length Info
343 13.47770000
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=217757 Win=41895 L
en=0
Frame 343: 54 bytes

on wire (432 bits)

, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.527630000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.527630000 s
econds
[Time delta fro
m previous captured
frame: 0.000166000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00016600
0 seconds]
[Time since ref
erence or first fra
me: 13.477700000 se
conds]
Frame Number: 3
43
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f96 (20374)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum

: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 21775
7, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 217757 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .

..0 = Fin: Not set

Window size val
ue: 41895
[Calculated win
dow size: 41895]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 342]
[The RTT to
ACK the segment wa
s: 0.000166000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 96 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb b4 ca 50 10 .
....P..N.+...P.
0030 a3 a7 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
344 13.60088600
0 pc13.home
livebox.home
DNS
82 Standard que
ry 0x9b30 PTR 1.0.
0.224.in-addr.arpa
Frame 344: 82 bytes
on wire (656 bits)
, 82 bytes captured
(656 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:27:0

6.650816000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.650816000 s
econds
[Time delta fro
m previous captured
frame: 0.123186000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12318600
0 seconds]
[Time since ref
erence or first fra
me: 13.600886000 se
conds]
Frame Number: 3
44
Frame Length: 8
2 bytes (656 bits)
Capture Length:
82 bytes (656 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally

unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: livebox.hom
e (192.168.1.1)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 6
8
Identification:
0x4f97 (20375)
Flags: 0x00
0... .... =
Reserved bit: Not
set
.0.. .... =
Don't fragment: No
t set
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: UDP (
17)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: li
vebox.home (192.168
.1.1)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto

col, Src Port: 4981

6 (49816), Dst Port
: domain (53)
Source Port: 49
816 (49816)
Destination Por
t: domain (53)
Length: 48
Checksum: 0x839
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
8]
Domain Name System
(query)
[Response In: 3
48]
Transaction ID:
0x9b30
Flags: 0x0100 S
tandard query
0... .... .
... .... = Response
: Message is a quer
y
.000 0... .
... .... = Opcode:
Standard query (0)
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
Questions: 1
Answer RRs: 0
Authority RRs:
0
Additional RRs:
0
Queries
1.0.0.224.i
n-addr.arpa: type P
TR, class IN
Name: 1
.0.0.224.in-addr.ar
pa
[Name L
ength: 22]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)

0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 44 4f 97 0
0 00 80 11 00 00 c0
a8 01 0b c0 a8 .
DO.............
0020 01 01 c2 98 0
0 35 00 30 83 9e 9b
30 01 00 00 01 .
....5.0...0....
0030 00 00 00 00 0
0 00 01 31 01 30 01
30 03 32 32 34 .
......1.0.0.224
0040 07 69 6e 2d 6
1 64 64 72 04 61 72
70 61 00 00 0c .
in-addr.arpa...
0050 00 01
.
.
No. Time
Source
Destination
Protocol
Length Info
345 13.61448800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=21775
7 Ack=1 Win=46 Len=
1260
Frame 345: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.664418000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.664418000 s
econds
[Time delta fro
m previous captured
frame: 0.013602000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01360200

0 seconds]
[Time since ref
erence or first fra
me: 13.614488000 se
conds]
Frame Number: 3
45
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),

Dst: pc13.home (192

.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf237 (62007)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f3 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 217757, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por

t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 217757 (relati
ve sequence number)
[Next sequence
number: 219017 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x049
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]

0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 37 4
0 00 31 06 39 f3 4a
7c 0c 8a c0 a8 .
..7@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb b4 ca 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 04 93 0
0 00 5a 81 02 43 e5
9e dc 51 c0 16 .
.....Z..C...Q..
0040 36 b0 8e af 6
4 38 fd 35 52 24 35
dc 72 8d 4d 43 6
...d8.5R$5.r.MC
0050 37 70 97 e1 c
4 ef 94 63 8f f7 05
1a ae 0c fe 18 7
p.....c........
0060 c8 1c 2f 33 8
9 e1 85 a9 5d 99 b7
68 29 ed 35 7f .
./3....]..h).5.
0070 e0 6e 6b f8 1
9 54 c9 fd 34 e0 e7
5f 4c 3c 8e 70 .
nk..T..4.._L<.p
0080 b1 b4 06 ca 8
0 61 a6 0f 88 45 56
85 0b 08 ef 60 .
....a...EV....`
0090 05 1a f2 6c 4
7 ff fb 92 04 e9 8f
f3 02 26 53 83 .
..lG........&S.
00a0 0f 6a 50 60 6
5 0a 70 3d e8 4a 0b
44 93 4c 0c 3d .
jP`e.p=.J.D.L.=
00b0 e9 41 62 13 a
9 c1 8c 2d 28 a5 1f
e8 0b 00 bb 5e .
Ab....-(......^
00c0 a9 91 29 52 0
7 2d 80 2c 35 b4 a7
84 15 5c 9c 0f .
.)R.-.,5....\..
00d0 ad d9 96 d2 2
4 f5 ef b6 ec 5c 58
15 bf 8f ef 5a .
...$....\X....Z
00e0 9c 93 e1 87 e
4 48 13 34 dd 51 b0
49 13 ec c5 be .
....H.4.Q.I....
00f0 4d f5 99 dd 6
f e2 07 d6 bd 20 aa
73 b9 33 68 91 M
...o.... .s.3h.
0100 eb e4 ae 2b 8
f f1 b8 59 af a5 6f
9c 78 a1 c3 ab .
..+...Y..o.x...
0110 59 c4 ac 15 8

a 26 f9 92 a5 aa 2b
15 26 1d ab ff Y
....&....+.&...
0120 ca b4 15 b6 a
2 e4 c2 ea 0b 94 96
e2 f8 a2 3b 8d .
.............;.
0130 a4 88 3a 4b d
5 9b 5d b7 1c 55 26
09 7c e4 9e b6 .
.:K..]..U&.|...
0140 c1 ce 7a 83 9
0 3c a3 e9 1e 14 20
2a 66 c8 28 8b .
.z..<.... *f.(.
0150 12 62 38 22 1
2 95 44 60 f9 a0 7d
b4 0f a1 48 94 .
b8"..D`..}...H.
0160 26 0f 54 92 6
2 93 36 a9 13 c7 d2
35 49 18 05 a3 &
.T.b.6....5I...
0170 8f 1f 7b d8 8
3 88 b1 09 4d 2a ec
26 42 b4 2b 61 .
.{.....M*.&B.+a
0180 c4 ec 2d 56 4
6 15 8c 88 b7 51 9e
18 60 36 48 48 .
.-VF....Q..`6HH
0190 4c 08 1b ec 4
3 34 ce f7 15 52 93
ea 47 93 66 97 L
...C4...R..G.f.
01a0 7b fc 99 85 1
4 6f 1c 90 03 f0 0b
ee c9 24 e2 30 {
....o.......$.0
01b0 60 91 53 c4 1
4 d9 c7 bf b1 b3 3a
44 82 4f 53 c7 `
.S.......:D.OS.
01c0 19 6d 48 a8 c
c f2 37 67 5b 32 17
31 51 55 92 cb .
mH...7g[2.1QU..
01d0 0c b4 82 3d 2
f e1 c7 d2 bf 88 bf
f4 55 57 ac a9 .
..=/.......UW..
01e0 43 58 95 0a 7
0 01 95 5c c2 26 cf
70 a1 11 f6 72 C
X..p..\.&.p...r
01f0 c5 33 a4 60 b
4 ae fd 98 1e 9b 2e
cc 25 94 66 a6 .
3.`........%.f.
0200 f9 91 9e b2 9
9 65 9a 00 ec 11 67
bf 0f 22 02 98 .
....e....g.."..
0210 f0 c3 7c d9 7
e e1 3d a9 fb cd 52
ff 38 52 db e2 .
.|.~.=...R.8R..
0220 5c 21 2e 7f 1
8 ab 84 93 71 89 36

02 16 bd c4 dc \
!......q.6.....
0230 c2 02 be f6 4
e bf b5 ff fb 92 04
ee 8f f3 10 27 .
...N..........'
0240 d2 83 18 7a 5
0 65 25 fa 50 63 0f
4c 0b a0 a1 4a .
..zPe%.Pc.L...J
0250 0c 3e 49 41 7
8 17 29 41 8c 35 30
f2 d6 f2 df e9 .
>IAx.)A.50.....
0260 16 84 51 70 0
7 b1 79 1a 80 2d 2e
c0 d8 9f 8a 39 .
.Qp..y..-.....9
0270 85 51 11 35 e
4 ce 21 1c b6 ef d8
6d 98 a6 59 41 .
Q.5..!....m..YA
0280 8b 3a 4d 53 7
c e8 7a 01 0d 7f 17
07 b1 a5 9f 42 .
:MS|.z........B
0290 40 e0 24 c9 4
b 3f d6 1e 26 26 83
bf e0 7a cd f0 @
.$.K?..&&...z..
02a0 dc df fe 25 8
a ca 9b f8 c4 ce 12
bc 24 90 ab 44 .
..%........$..D
02b0 c7 07 3c cd e
3 28 73 9a f7 fe 3c
02 f5 48 f2 a8 .
.<..(s...<..H..
02c0 90 50 84 96 2
8 6c 68 1a 32 c1 d9
d8 54 2e 50 e8 .
P..(lh.2...T.P.
02d0 48 8b 42 d0 9
e 1a d1 b8 b4 33 41
ea 1b 23 d5 4b H
.B......3A..#.K
02e0 6b da 5b af c
7 35 43 4b 39 4b dc
07 10 34 99 0f k
.[..5CK9K...4..
02f0 6a be 76 80 7
6 34 58 5d ba c8 68
f4 a3 03 db b1 j
.v.v4X]..h.....
0300 65 29 d2 60 e
6 71 65 21 5f 24 ba
04 d3 a3 aa d7 e
).`.qe!_$......
0310 a3 b3 ab 52 f
5 b3 2c ee 2c 49 2b
39 90 ab ff 52 .
..R..,.,I+9...R
0320 b4 a0 2c 19 2
6 c7 0a 2f 3a 1f ba
60 e1 27 94 a9 .
.,.&../:..`.'..
0330 48 28 b1 41 1
f 7e c6 d6 1e 5b 1c
da f9 5c 3f c7 H

(.A.~...[...\?.
0340 8d 96 52 5c f
c 36 d9 9c c8 7a 1f
d3 07 c0 7c 28 .
.R\.6...z....|(
0350 b9 81 4c 80 0
6 08 db 16 27 a3 88
76 94 4c cf e6 .
.L.....'..v.L..
0360 4a 3e 7a a3 a
7 95 52 69 0f 72 de
b2 71 39 75 e8 J
>z...Ri.r..q9u.
0370 d3 4d a8 ab 3
2 51 33 2a 4b 5a 2a
c1 7d ff 23 d8 .
M..2Q3*KZ*.}.#.
0380 95 47 c9 95 7
e 4c 59 40 51 82 03
5d 28 6c a4 76 .
G..~LY@Q..](l.v
0390 69 73 b5 bc c
0 ab bf 57 a9 59 a5
c7 d5 f3 e6 96 i
s.....W.Y......
03a0 0e 43 47 67 5
8 18 0e 7a 07 53 51
b0 4e 43 84 db .
CGgX..z.SQ.NC..
03b0 1c 24 54 3a 3
1 b4 b1 7b 51 81 f5
17 4d 73 74 54 .
$T:1..{Q...MstT
03c0 aa ce 0f 2a a
9 13 31 71 a0 d3 8a
33 0c 8a 95 3a .
..*..1q...3...:
03d0 51 5b 68 25 8
8 19 43 6b 20 ff fb
92 04 ec 0f f2 Q
[h%..Ck .......
03e0 f8 28 d2 03 1
8 7a 50 5f 64 fa 40
3f 0f 4a 0c 08 .
(...zP_d.@?.J..
03f0 d3 46 0c 62 0
b 81 83 98 28 c1 8c
35 30 da 5b e8 .
F.b....(..50.[.
0400 ff a1 7e 83 4
6 ed a6 75 38 50 08
e8 fa 82 26 f5 .
.~.F..u8P....&.
0410 43 04 d0 9e b
a e1 59 85 b5 4b af
65 d8 eb 9b 7b C
.....Y..K.e...{
0420 4c f5 0b 64 f
8 eb e9 19 5c 26 33
2e fb 44 02 7f L
..d....\&3..D..
0430 70 fc 9c a9 4
b 03 93 ed e9 a2 dc
ae 51 66 4f 63 p
...K.......QfOc
0440 bb cf 1e 73 f
3 a4 8a 4e 7e 19 dd
a7 cb 1f ad cb .
..s...N~.......

0450 21 74 5f 8f 6
1 90 e8 ca 9b 51 c6
57 b5 7a 7f ff !
t_.a....Q.W.z..
0460 58 41 0f 08 e
8 68 8e eb 21 3c c7
1d 1f 17 45 a2 X
A...h..!<....E.
0470 0a 55 8c 60 4
9 f6 9c b9 af c8 66
61 f5 8f 2d 87 .
U.`I.....fa..-.
0480 bb 79 26 4c 8
2 5d 29 c7 1a ae b4
8a 6b b7 b6 4b .
y&L.]).....k..K
0490 c6 d2 ff da 8
7 a5 01 2e 9d 21 a3
41 62 86 27 64 .
........!.Ab.'d
04a0 99 bd 44 b5 9
a 89 98 c0 7a d9 10
e6 20 82 8d 5c .
.D.....z... ..\
04b0 ac b4 74 94 7
2 67 5d 1a b6 51 a2
fa ad ea 33 fa .
.t.rg]..Q....3.
04c0 8f af 6e 4f 4
7 ab a4 b6 a6 5b 03
85 a9 b4 3c aa .
.nOG....[....<.
04d0 65 db 5a 81 c
4 40 ac 0c 8c 01 96
8d 0d 7c e2 c7 e
.Z..@.......|..
04e0 19 4c 6a 3b 6
c 44 48 af 3b 07 39
76 ff 78 d5 55 .
Lj;lDH.;.9v.x.U
04f0 0a b2 e9 fe 6
0 41 48 55 fd 63 15
8d 03 41 8e 93 .
...`AHU.c...A..
0500 23 b1 88 68 e
5 91 02 28 3c 66 ab
6d 12 f1 08 6b #
..h...(<f.m...k
0510 bb 09 f5 48 2
d 52 b1 9a eb da 8b
9f a2 9a 1b a8 .
..H-R..........
0520 d5 6d
.
m
No. Time
Source
Destination
Protocol
Length Info
346 13.62854400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
887 http49
574 [PSH, ACK] Seq=

219017 Ack=1 Win=46

Len=833
Frame 346: 887 byte
s on wire (7096 bit
s), 887 bytes captu
red (7096 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.678474000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.678474000 s
econds
[Time delta fro
m previous captured
frame: 0.014056000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01405600
0 seconds]
[Time since ref
erence or first fra
me: 13.628544000 se
conds]
Frame Number: 3
46
Frame Length: 8
87 bytes (7096 bits
)
Capture Length:
887 bytes (7096 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
73
Identification:
0xf238 (62008)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0

Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3b9d [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 219017, Ack:
1, Len: 833
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 833]
Sequence number
: 219017 (relati
ve sequence number)
[Next sequence
number: 219850 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen

t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x170
d [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2093]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 69 f2 38 4
0 00 31 06 3b 9d 4a
7c 0c 8a c0 a8 .
i.8@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cb b9 b6 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 17 0d 0
0 00 a9 7f 97 dd 53
eb 5f f8 a2 49 .
.........S._..I
0040 05 24 a1 8d 0
e 03 48 e3 51 1a 52
ab ca 14 a4 a2 .
$....H.Q.R.....
0050 e3 88 8d 28 f
4 e4 5e 8e f4 6b ae
3c 9f 3a d5 e1 .
..(..^..k.<.:..
0060 16 2c 6b 0b a
c e2 5d 4b 4d 63 85
46 29 c6 1c ba .
,k...]KMc.F)...
0070 de cb 81 a5 9
1 63 c5 01 b2 b2 02
b3 22 5d de 5b .
....c......"].[
0080 43 ca c4 22 b
6 87 2e 89 a2 04 d2
68 a5 f4 66 ff C
..".......h..f.
0090 fb 92 04 eb 0
f f2 e6 26 d1 83 18

9a 50 5e e4 ea .
......&....P^..
00a0 30 63 18 4a 0
c c4 ef 42 0c e2 4b
81 8f 9b e8 41 0
c.J...B..K....A
00b0 9c 41 70 ae 8
b 17 2f d4 9a bd 16
ae b9 ca fa cf .
Ap.../.........
00c0 fd 60 43 94 9
d 70 17 e2 58 94 c0
e2 36 25 62 ac .
`C..p..X...6%b.
00d0 4a d2 36 8e e
5 42 98 55 98 bc 6b
28 d6 91 da 8b J
.6..B.U..k(....
00e0 3a 8f fb 5e 9
c a9 fc ba d2 28 ee
e5 61 81 38 1c :
..^.....(..a.8.
00f0 61 e6 33 1e 8
5 b8 21 64 d1 e2 80
d9 40 9a 2c 1b a
.3...!d....@.,.
0100 95 0b 48 52 7
5 76 2a 1b 76 16 fa
33 89 ad 07 f5 .
.HRuv*.v..3....
0110 bd 34 58 e1 9
e 3c de 76 2a c6 c3
bf ea 81 44 21 .
4X..<.v*.....D!
0120 3b e4 ee b2 e
9 b4 b8 d3 0c 70 1a
fa 88 f2 3d 10 ;
........p....=.
0130 c3 90 9c 28 1
3 e4 21 61 fd e3 b1
9c e3 7d 9f 57 .
..(..!a.....}.W
0140 bc 35 ed 2c 8
4 cc f2 82 aa dd b2
59 2d 78 38 bc .
5.,.......Y-x8.
0150 cc cc fd 7b f
f f4 59 4e 85 f9 9d
eb b6 bd 7b f6 .
..{..YN......{.
0160 a1 e4 cd ef 7
7 ee 1f 2e 04 38 f2
21 f9 70 fa cf .
...w....8.!.p..
0170 94 04 0a 06 3
3 80 83 ab c4 ef f5
06 7f d4 e0 97 .
...3...........
0180 3c da 70 30 d
a 1c ed 3d bc 9c b1
87 05 22 b8 43 <
.p0...=.....".C
0190 0c 86 45 39 d
0 f5 3e ab 92 66 f2
ff 87 ef d9 ef .
.E9..>..f......
01a0 44 0c 17 15 b
1 68 99 f6 ba ed 88
17 15 93 b7 73 D

....h.........s
01b0 b9 c2 0c 26 8
e 48 18 f0 e8 d1 cf
d4 1c 08 13 14 .
..&.H..........
01c0 07 c0 ef 04 3
1 38 e7 07 f3 e0 83
81 09 f0 40 48 .
...18........@H
01d0 72 5c ff ac f
e 08 28 10 fc 4e e0
7e 96 95 84 0b r
\....(..N.~....
01e0 60 be 51 68 f
4 0a be e2 34 a7 ed
c8 84 31 16 79 `
.Qh....4....1.y
01f0 b0 9e b7 72 7
6 8e b3 0b 0a 85 96
3b 54 15 2a cd .
..rv......;T.*.
0200 1c b4 73 33 8
e 8c 20 26 27 d6 91
00 75 e9 94 c8 .
.s3.. &'...u...
0210 58 55 75 ed 0
3 39 04 2e 56 6b 35
96 c4 a2 5b e4 X
Uu..9..Vk5...[.
0220 26 ad d6 27 2
9 f8 aa e0 39 c3 61
01 ab 24 80 9b &
..')...9.a..$..
0230 1b ff fb 92 0
4 e7 0f f2 f3 3b 51
03 18 92 e0 5b .
........;Q....[
0240 a5 ca 20 63 1
1 4c 0c 1c 9f 56 0c
3d 89 41 77 92 .
. c.L...V.=.Aw.
0250 2b 41 87 a5 2
8 93 76 14 62 bd 5b
66 14 cf 37 1d +
A..(.v.b.[f..7.
0260 18 1e ea 10 2
f 76 5d 02 3b aa 1f
31 0f a3 2c e1 .
.../v].;..1..,.
0270 35 49 3b 38 a
e c3 56 25 7a b9 ba
2b d4 eb 1d a0 5
I;8..V%z..+....
0280 69 bd 86 12 b
b 2a e7 38 2c 0c 8f
9c d9 e7 b0 0e i
....*.8,.......
0290 d9 13 51 53 d
9 74 42 6f 25 17 4a
97 b0 8a 0c 4b .
.QS.tBo%.J....K
02a0 32 13 7c 21 8
7 ea 7d b3 3f b5 3a
76 61 98 fd ff 2
.|!..}.?.:va...
02b0 f2 5b 40 ea c
e 60 60 c0 c9 36 a3
d1 ab 4d 30 e2 .
[@..``..6...M0.

02c0 24 81 f7 76 1
b 93 5c 66 f0 65 78
7c a0 45 a1 30 $
..v..\f.ex|.E.0
02d0 c1 4a e1 e8 3
4 3a 3e 2e a8 d5 c3
85 a9 1c 76 8d .
J..4:>.......v.
02e0 34 4b 0a d0 2
0 f3 6e e8 84 27 27
7c cc 1a cc 6b 4
K.. .n..''|...k
02f0 3d 4a 95 ea e
b 7b 71 3c 25 30 06
0e c1 e5 a9 e8 =
J...{q<%0......
0300 bd e2 64 a1 3
4 80 56 e2 8b 7a d9
63 87 7e d8 7e .
.d.4.V..z.c.~.~
0310 97 2e 3e 9a b
7 fd 2b 74 0d 83 1f
db 78 e3 39 0d .
.>...+t....x.9.
0320 0a 66 76 0d 0
1 a3 89 89 38 e0 c5
49 c0 f4 4a 78 .
fv.....8..I..Jx
0330 e6 24 a9 8f 1
8 ac aa 7b 2b 4a e3
4e 80 75 db 04 .
$.....{+J.N.u..
0340 84 a1 72 77 b
1 98 45 9a 6b d7 45
1d 6b 6f fc 4e .
.rw..E.k.E.ko.N
0350 eb 7e af 4c 5
7 fd 61 d1 28 34 74
36 6d 2b 0e bc .
~.LW.a.(4t6m+..
0360 26 f1 39 a1 8
4 b6 80 89 19 53 92
47 c8 35 29 de &
.9......S.G.5).
0370 e6 f7 c5 7f 2
8 e5 d5
.
...(..
No. Time
Source
Destination
Protocol
Length Info
347 13.62871900
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=219850 Win=41895 L
en=0
Frame 347: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.678649000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.678649000 s
econds
[Time delta fro
m previous captured
frame: 0.000175000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 13.628719000 se
conds]
Frame Number: 3
47
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f98 (20376)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]

[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 21985
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 219850 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41895
[Calculated win

dow size: 41895]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 346]
[The RTT to
ACK the segment wa
s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 98 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb bc f7 50 10 .
....P..N.+...P.
0030 a3 a7 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
348 13.65954200
0 livebox.home
pc13.home
DNS
117 Standard que
ry response 0x9b30
PTR all-systems.mc
ast.net
Frame 348: 117 byte
s on wire (936 bits
), 117 bytes captur
ed (936 bits) on in
terface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.709472000 Romance
Standard Time

[Time shift for

this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.709472000 s
econds
[Time delta fro
m previous captured
frame: 0.030823000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03082300
0 seconds]
[Time since ref
erence or first fra
me: 13.659542000 se
conds]
Frame Number: 3
48
Frame Length: 1
17 bytes (936 bits)
Capture Length:
117 bytes (936 bit
s)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:udp:dns]
[Coloring Rule
Name: UDP]
[Coloring Rule
String: udp]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: live
box.home (192.168.1
.1), Dst: pc13.home
(192.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
03
Identification:
0x0000 (0)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 6
4
Protocol: UDP (
17)
Header checksum
: 0xb729 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: livebox
.home (192.168.1.1)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
User Datagram Proto
col, Src Port: doma
in (53), Dst Port:

49816 (49816)
Source Port: do
main (53)
Destination Por
t: 49816 (49816)
Length: 83
Checksum: 0x0df
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
[Stream index:
8]
Domain Name System
(response)
[Request In: 34
4]
[Time: 0.058656
000 seconds]
Transaction ID:
0x9b30
Flags: 0x8180 S
tandard query respo
nse, No error
1... .... .
... .... = Response
: Message is a resp
onse
.000 0... .
... .... = Opcode:
Standard query (0)
.... .0.. .
... .... = Authorit
ative: Server is no
t an authority for
domain
.... ..0. .
... .... = Truncate
d: Message is not t
runcated
.... ...1 .
... .... = Recursio
n desired: Do query
recursively
.... .... 1
... .... = Recursio
n available: Server
can do recursive q
ueries
.... .... .
0.. .... = Z: reser
ved (0)
.... .... .
.0. .... = Answer a
uthenticated: Answe
r/authority portion
was not authentica
ted by the server
.... .... .
..0 .... = Non-auth
enticated data: Una
cceptable
.... .... .
... 0000 = Reply co
de: No error (0)
Questions: 1
Answer RRs: 1

Authority RRs:
0
Additional RRs:
0
Queries
1.0.0.224.i
n-addr.arpa: type P
TR, class IN
Name: 1
.0.0.224.in-addr.ar
pa
[Name L
ength: 22]
[Label
Count: 6]
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Answers
1.0.0.224.i
n-addr.arpa: type P
TR, class IN, all-s
ystems.mcast.net
Name: 1
.0.0.224.in-addr.ar
pa
Type: P
TR (domain name Poi
nTeR) (12)
Class:
IN (0x0001)
Time to
live: 15438
Data le
ngth: 23
Domain
Name: all-systems.m
cast.net
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 00 67 00 00 4
0 00 40 11 b7 29 c0
a8 01 01 c0 a8 .
g..@.@..)......
0020 01 0b 00 35 c
2 98 00 53 0d f6 9b
30 81 80 00 01 .
..5...S...0....
0030 00 01 00 00 0
0 00 01 31 01 30 01
30 03 32 32 34 .
......1.0.0.224
0040 07 69 6e 2d 6
1 64 64 72 04 61 72
70 61 00 00 0c .
in-addr.arpa...
0050 00 01 c0 0c 0
0 0c 00 01 00 00 3c
4e 00 17 0b 61 .
.........<N...a
0060 6c 6c 2d 73 7
9 73 74 65 6d 73 05
6d 63 61 73 74 l
l-systems.mcast

0070 03 6e 65 74 0
0
.
net.
No. Time
Source
Destination
Protocol
Length Info
349 13.67154400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=21985
0 Ack=1 Win=46 Len=
1260
Frame 349: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.721474000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.721474000 s
econds
[Time delta fro
m previous captured
frame: 0.012002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01200200
0 seconds]
[Time since ref
erence or first fra
me: 13.671544000 se
conds]
Frame Number: 3
49
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule

Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)

Total Length: 1
300
Identification:
0xf239 (62009)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 219850, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 219850 (relati
ve sequence number)
[Next sequence
number: 221110 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .

... = Reserved: Not

set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x13a
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 39 4
0 00 31 06 39 f1 4a
7c 0c 8a c0 a8 .
..9@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb bc f7 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 13 a0 0
0 00 b4 ae 4e a1 a3
49 ef 48 fc 47 .
.......N..I.H.G
0040 9f 47 64 48 1
4 a0 8a ae 5d 08 cc
db 25 9c d4 01 .
GdH....]...%...
0050 a6 a2 e8 88 b

c e4 bc c6 91 06 89
f0 9c c1 53 38 .
.............S8
0060 f3 78 62 cc 4
a 26 0a 49 a0 ac 12
c9 91 e5 06 77 .
xb.J&.I.......w
0070 c3 bb 13 65 2
7 b1 83 ab 05 de 8c
3f d4 ff a3 56 .
..e'......?...V
0080 ab 7f cf d6 c
5 73 5b 7e 2f 47 f1
ff 0c e4 fe 15 .
....s[~/G......
0090 f1 ec ff fb 9
2 04 e9 8f f2 ff 2b
57 03 2f 4a 60 .
.........+W./J`
00a0 5e 86 9a f0 6
1 e6 5c 0b 14 93 5c
0c b0 c9 41 7c ^
...a.\...\...A|
00b0 95 ab c1 86 1
9 30 b4 97 f9 bd 40
e1 d5 0c 43 9c .
....0....@...C.
00c0 9d f2 e8 f4 7
3 e3 3e 33 2a 16 d4
1d 73 c4 16 d1 .
...s.>3*...s...
00d0 a0 55 5a c0 5
b a4 fc b4 7d f6 72
d7 86 30 48 3f .
UZ.[...}.r..0H?
00e0 8b 3b 10 ab f
c 4e 54 5e 74 c7 03
5d 3e 16 6d aa .
;...NT^t..]>.m.
00f0 e5 3d e2 f6 1
d ac 04 d4 92 0b 00
5e 10 2b 17 3a .
=.........^.+.:
0100 e4 06 53 31 8
a 0a 9c 11 25 aa a1
26 10 43 2f 4c .
.S1....%..&.C/L
0110 7e 9b eb 7e a
3 6b c6 30 14 27 1b
f5 b4 04 7a b7 ~
..~.k.0.'....z.
0120 4e ef 3e ed 1
0 09 9a 8d 05 01 e9
e2 e4 07 e4 70 N
.>............p
0130 95 da af 88 5
4 c1 8c 73 30 41 15
d9 61 c5 c0 04 .
...T..s0A..a...
0140 0e a2 6e cf 9
2 ee e7 85 c3 32 7b
79 29 67 b8 de .
.n......2{y)g..
0150 79 5a c4 2b 2
9 a5 8f 1b 06 cb 9e
b0 bb 57 df 46 y
Z.+)........W.F
0160 df 0a 8a 72 2
a c1 70 db ce fe 99

6f ff b7 41 5c .
..r*.p....o..A\
0170 dd 82 b2 74 b
f a9 fc ef ff ff 9a
fb 4d d5 5e 02 .
..t........M.^.
0180 9a 8c 3a f1 a
8 72 cd a8 e1 22 72
2a 99 e0 31 32 .
.:..r..."r*..12
0190 a9 18 dd 9f a
d fd fb 8a 79 58 c3
59 dd 58 e3 45 .
.......yX.Y.X.E
01a0 cd a5 17 00 8
3 89 38 5a dd 6e eb
35 69 ae da e2 .
.....8Z.n.5i...
01b0 ca a8 59 ea 0
e 68 74 4a 3a c7 83
42 11 40 31 f6 .
.Y..htJ:..B.@1.
01c0 00 98 9c 06 5
5 47 89 06 c0 4b 00
a9 2f 3d 5b 19 .
...UG...K../=[.
01d0 c5 19 bd 85 b
d 5e be 86 d2 5c a9
ee 69 e1 23 e9 .
....^...\..i.#.
01e0 69 5d e5 e8 d
7 22 8d 68 8d a1 a8
82 5a 94 43 dc i
]...".h....Z.C.
01f0 15 11 d1 c9 2
4 95 e0 da 23 44 4d
c0 81 5f e3 df .
...$...#DM.._..
0200 b9 9b 82 f5 c
6 ce 5b 63 5c b4 6d
8e 99 9a 0b dd .
.....[c\.m.....
0210 5f e6 25 ef e
b e5 9f c4 ce 2d 16
bf ee 40 e8 94 _
.%......-...@..
0220 d0 2a 59 e2 1
3 c1 a5 19 01 3c 68
4c 54 e8 1a b4 .
*Y......<hLT...
0230 a9 0e 1c f7 f
f fb 92 04 ed 0f f3
01 1c 57 03 29 .
............W.)
0240 5a 52 5d 05 4
a e0 61 88 4c 0c 9c
91 58 0c b1 29 Z
R].J.a.L...X..)
0250 49 73 91 ab 4
1 87 a1 28 8b 68 f4
0a ec ed d6 28 I
s..A..(.h.....(
0260 34 ed 39 e9 3
e 53 b5 a9 ae 87 12
38 fb 29 b4 1b 4
.9.>S.....8.)..
0270 08 b4 6a 95 b
5 0c 57 32 22 94 8c
fa a2 75 e3 cc .

.j...W2"....u..
0280 c2 85 9b fb 5
f 2b a0 11 96 1e 3e
4b b3 96 6f 52 .
..._+....>K..oR
0290 d5 51 59 7d e
b 1f 98 be 63 a4 61
cd 96 7b 0f 5b .
QY}....c.a..{.[
02a0 db 74 d6 f1 7
d 23 1d 1d a4 bc f2
04 a2 c4 92 7a .
t..}#.........z
02b0 d7 dc 94 a5 6
c 39 77 da 95 2d c5
40 01 d2 0e c8 .
...l9w..-.@....
02c0 25 85 04 24 e
b ba 35 60 9d a9 c2
58 6b 17 12 c2 %
..$..5`...Xk...
02d0 aa ba 49 46 e
a 48 0a e5 b2 c4 a7
83 22 8e 35 0e .
.IF.H......".5.
02e0 14 fc ce ea a
f 20 48 5f bd 60 41
51 23 7b 56 9f .
.... H_.`AQ#{V.
02f0 63 1b 9f 1b c
c d9 b6 28 f6 b6 ac
0b 5b 11 e7 de c
......(....[...
0300 7d be 31 fe 2
9 9f f5 aa da f7 ae
bc 80 68 28 44 }
.1.)........h(D
0310 a3 89 8b a1 2
5 21 46 2c 62 46 ad
14 51 30 af fe .
...%!F,bF..Q0..
0320 a4 d1 30 0e 1
7 01 b8 25 b2 bd 65
cd f4 09 2c 1e .
.0....%..e...,.
0330 4e 21 4c 83 3
4 4b 89 cf 32 29 12
a8 6c 56 28 ac N
!L.4K..2)..lV(.
0340 8e 5a 6d 80 d
2 e7 21 28 d9 e6 f7
80 c0 df d6 49 .
Zm...!(.......I
0350 26 2a 33 a5 1
9 92 cb 6c ff b5 27
55 04 37 5d 29 &
*3....l..'U.7])
0360 2c 93 4f 92 7
8 15 2a 2a 20 12 20
02 0d 9a 08 a4 ,
.O.x.** . .....
0370 f4 20 3e 5c 7
8 b0 b5 85 98 c8 40
7c fb a7 57 59 .
>\x.....@|..WY
0380 df f2 55 5c 0
5 b2 3d e8 43 11 2d
f7 36 84 46 0e .
.U\..=.C.-.6.F.

0390 65 65 11 0b 8
5 01 d0 71 2c 17 a6
75 12 10 9a 33 e
e.....q,..u...3
03a0 db 55 0f 19 d
e 37 d1 3f 03 39 28
97 70 71 24 08 .
U...7.?.9(.pq$.
03b0 c1 3e e7 a7 3
a b2 80 d0 f4 79 99
96 94 34 c8 1c .
>..:....y...4..
03c0 5b 94 d2 53 1
9 48 9d 86 43 ee d7
a9 4f eb a9 77 [
..S.H..C...O..w
03d0 ae 62 c9 36 3
b bb ff fb 92 04 ec
8f f3 0f 26 d5 .
b.6;.........&.
03e0 03 4f 7a 50 5
a e6 0a b0 61 eb 4c
0c d8 c3 52 0d .
OzPZ...a.L...R.
03f0 3d e9 81 87 9
3 2a 41 97 a5 28 ef
c5 85 c7 11 b9 =
....*A..(......
0400 4d 25 a5 ec 4
a 36 53 a1 b5 2d 90
69 61 c5 35 85 M
%..J6S..-.ia.5.
0410 9b 2a 4d 3e c
b 92 2e 2a 1b 0a 64
aa 14 f5 1e 86 .
*M>...*..d.....
0420 26 93 2f d5 0
a d6 d4 21 ce 0a be
26 e3 a2 97 30 &
./....!...&...0
0430 71 a7 d5 29 e
3 c6 73 cb 29 a1 2b
be 85 c6 3a 99 q
..)..s.).+...:.
0440 56 f5 4e 77 1
9 99 bf 4b 4b ee 7e
f1 fc 4e c3 bf V
.Nw...KK.~..N..
0450 ca 9c a7 ed f
7 7e 7f ce d0 f9 c3
43 e1 9b 45 e9 .
....~.....C..E.
0460 c7 f8 07 57 f
d be 96 00 15 64 c2
d9 4c d0 3a ac .
..W.....d..L.:.
0470 0c a6 10 23 7
5 32 ce 51 02 2c 41
27 84 91 5a 5e .
..#u2.Q.,A'..Z^
0480 4e 2a ce d6 d
b 52 1e 99 95 aa e4
83 43 e1 57 62 N
*...R......C.Wb
0490 86 81 78 1a 3
a b5 9c 81 3a 97 90
a2 db 56 76 6f .
.x.:...:....Vvo
04a0 77 d8 87 2f f

1 16 e6 ff 34 5a 8c
46 3c 38 81 71 w
../....4Z.F<8.q
04b0 1b 83 0d 0d 8
b 08 89 b1 46 90 96
8b 1a 17 30 29 .
.......F.....0)
04c0 d4 43 47 43 f
e 94 6c 1a 18 21 cb
1d 5f 33 99 c5 .
CGC..l..!.._3..
04d0 89 08 99 16 3
2 0a 2f d7 40 b3 70
3f 55 68 62 e1 .
...2./.@.p?Uhb.
04e0 56 7e ac c8 c
0 a6 7d 19 5b 19 90
98 30 21 ec ca V
~....}.[...0!..
04f0 80 f0 48 55 4
f 61 4b 12 ac 22 8a
f2 6f 23 97 33 .
.HUOaK.."..o#.3
0500 e7 97 4a 7b 3
1 3e 4f 65 03 cd a4
b8 f0 e1 21 29 .
.J{1>Oe......!)
0510 12 26 1a 0b 8
e 2c 4c 55 c0 40 e2
6d 3c 2e 81 49 .
&...,LU.@.m<..I
0520 6a 88
j
.
No. Time
Source
Destination
Protocol
Length Info
350 13.77755500
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1312 http49
574 [PSH, ACK] Seq=
221110 Ack=1 Win=46
Len=1258
Frame 350: 1312 byt
es on wire (10496 b
its), 1312 bytes ca
ptured (10496 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.827485000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]

Epoch Time: 141

5615226.827485000 s
econds
[Time delta fro
m previous captured
frame: 0.106011000
seconds]
[Time delta fro
m previous displaye
d frame: 0.10601100
0 seconds]
[Time since ref
erence or first fra
me: 13.777555000 se
conds]
Frame Number: 3
50
Frame Length: 1
312 bytes (10496 bi
ts)
Capture Length:
1312 bytes (10496
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .

... .... .... ....

= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
298
Identification:
0xf23a (62010)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 221110, Ack:
1, Len: 1258
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1258]
Sequence number
: 221110 (relati
ve sequence number)
[Next sequence
number: 222368 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x0be
e [validation disab
led]
[Good Check

sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2518]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 12 f2 3a 4
0 00 31 06 39 f2 4a
7c 0c 8a c0 a8 .
..:@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb c1 e3 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 0b ee 0
0 00 68 91 af ee 52
15 8a 2c 83 f4 .
.....h...R..,..
0040 44 48 29 69 1
1 b4 40 2d a8 bf 29
4c 96 33 57 98 D
H)i..@-..)L.3W.
0050 c7 82 bd 91 0
9 8e 67 3c 80 ab 7f
09 3a a8 8d 59 .
.....g<....:..Y
0060 68 dc ff 4e 5
5 8d 00 cd 31 27 87
6d be 0c 54 14 h
..NU...1'.m..T.
0070 1b 4b e9 f1 f
1 59 eb 7d 4f 5b 78
1b d5 ab 75 7c .
K...Y.}O[x...u|
0080 6c 9b 32 b0 f
9 11 13 40 00 91 33
a1 ff fb 92 04 l
.2....@..3.....
0090 e8 8f f3 06 3
5 54 03 4f 42 e0 5e
c6 ba 90 65 e6 .
...5T.OB.^...e.
00a0 5c 0b e0 93 5
0 0c bd 89 41 87 12
e9 c1 87 a5 28 \
...P...A......(
00b0 03 e9 20 54 1
2 34 b4 29 34 62 ba
94 a6 74 ff ad .
. T.4.)4b...t..
00c0 5b 0b ac 1b 4
a b0 05 80 64 a4 21
cb 66 53 f1 d1 [
...J...d.!.fS..
00d0 ac 1a 93 c0 c
8 86 60 55 74 b8 a9
a2 79 3d a2 61 .
.....`Ut...y=.a
00e0 82 3a 28 58 b
a 8f ab 6a 14 04 99
89 3b 5c 29 e1 .

:(X...j....;\).
00f0 10 15 14 1b 4
7 d5 33 6f 8a ce f7
7e 3d 6d e9 f5 .
...G.3o...~=m..
0100 6a da 1b 36 7
6 af 47 cb 0a e8 00
a7 34 83 f6 21 j
..6v.G.....4..!
0110 90 25 bf 5c c
b ad ff d5 ff ce 72
df ef e7 1d 51 .
%.\......r....Q
0120 94 0f 92 dd 6
0 80 1e 41 03 09 c2
cc 93 8d 28 41 .
...`..A......(A
0130 c5 a5 16 28 8
8 1a 3e 22 6a 76 88
9a 63 91 fb 81 .
..(..>"jv..c...
0140 c9 15 21 b8 4
7 ea 16 ac 43 e0 d1
12 5b e0 2b ed .
.!.G...C...[.+.
0150 13 04 00 fb f
6 73 8f 0e 26 31 ab
df 1b ae 6f 0e .
....s..&1....o.
0160 ec fb 93 fd b
d 73 7a de f1 51 5a
5e 79 22 46 42 .
....sz..QZ^y"FB
0170 23 43 29 29 3
4 e2 d7 ad 54 39 0a
90 b8 63 d2 31 #
C))4...T9...c.1
0180 11 20 42 88 4
2 97 29 03 d0 26 18
b8 ae c7 91 2b .
B.B.)..&.....+
0190 47 44 35 63 9
c 37 88 e6 8a 5a 74
7e 65 4d 7c 13 G
D5c.7...Zt~eM|.
01a0 4f d4 89 70 b
8 41 10 e2 5e c4 56
1c 0d fa d7 bc O
..p.A..^.V.....
01b0 74 b6 75 ef 9
f 5d bb 7e fc e4 cd
a2 56 f1 af 78 t
.u..].~....V..x
01c0 a8 ad 21 d6 2
4 49 9c 86 52 83 af
74 f5 8a a1 73 .
.!.$I..R..t...s
01d0 0b 02 9c 69 4
8 01 22 b0 71 50 55
a1 34 92 40 9e .
..iH.".qPU.4.@.
01e0 03 75 ac e0 2
5 ca b7 24 a0 f2 6c
1e d1 f7 67 f4 .
u..%..$..l...g.
01f0 8e ce 86 ae 1
2 ce 40 4d 3c 23 06
35 1e 97 71 e5 .
.....@M<#.5..q.

0200 05 7d 67 12 a
2 ad 9f 0b 54 a7 de
ab a8 9e 91 7d .
}g.....T......}
0210 e0 c0 de 73 b
c 46 5a d3 c4 22 e5
4c 24 20 2a 44 .
..s.FZ..".L$ *D
0220 40 c5 91 36 5
c 3e 55 50 30 58 b9
ef ff fd ff fb @
..6\>UP0X......
0230 92 04 e7 0f f
2 fe 25 53 83 4f 7a
50 5e 84 aa 70 .
.....%S.OzP^..p
0240 65 8f 4a 4b 5
c 93 50 0c bd e9 41
56 92 6a 01 87 e
.JK\.P...AV.j..
0250 b1 28 0b 58 8
e a0 3e 46 d0 1a f2
93 29 46 bf 57 .
(.X..>F....)F.W
0260 32 58 bc 1d a
7 fc 85 89 22 e4 70
97 a5 e1 4e 8f 2
X......".p...N.
0270 6e db 1f c7 4
e ae 13 73 82 49 c0
c0 35 b5 53 0c n
...N..s.I..5.S.
0280 b1 43 5c a3 6
4 95 75 0b 38 93 e2
9e d5 8b a9 bd .
C\.d.u.8.......
0290 22 fb c1 a7 c
f fe ce 59 5a 0d 70
50 f0 83 24 a8 "
......YZ.pP..$.
02a0 df 40 93 e6 3
f 1e 7a 62 d0 ce b3
4e b7 ff 3d ef .
@..?.zb...N..=.
02b0 ff ff ff db 4
c 73 4f e0 98 89 a8
22 74 15 0a 9c .
...LsO...."t...
02c0 5c 8e ca f2 3
0 df 18 c6 b8 94 4f
16 3d 9b ea d9 \
...0.....O.=...
02d0 a3 e9 e2 41 6
a 24 28 07 3a d0 7c
ac 94 48 f7 ab .
..Aj$(.:.|..H..
02e0 43 4c e4 56 b
d 8b 96 03 39 d6 e5
ae 6d 16 9e 2d C
L.V....9...m..02f0 f3 24 db fa f
1 a0 e3 eb d5 27 3e
77 ac de 3e 9a .
$.......'>w..>.
0300 a7 10 51 25 1
6 0b b1 c4 e1 e1 c2
ce 34 e4 3c 42 .
.Q%........4.<B
0310 df d2 f2 18 e

4 93 e0 44 2b 39 8b
20 82 56 c2 25 .
......D+9. .V.%
0320 86 12 49 68 0
f c6 b8 a1 3b 8f 3a
9f e8 4b d7 3d .
.Ih....;.:..K.=
0330 36 41 5a 64 8
5 22 1e e4 29 ae 8c
24 1b 6b 91 9a 6
AZd."..)..$.k..
0340 72 2b 60 cd 5
6 44 85 6d 99 af 27
a7 7b 7f 24 5d r
+`.VD.m..'.{.$]
0350 da 6f 68 32 7
a 5b 2d fb de f5 9c
c7 d3 94 7c 31 .
oh2z[-.......|1
0360 0f 0c 2c 3d 8
e ac a0 50 71 80 2b
af 4e a7 74 aa .
.,=...Pq.+.N.t.
0370 66 84 84 1c 2
6 98 61 00 05 62 20
c5 68 99 b3 86 f
...&.a..b .h...
0380 b9 ec 8c 94 2
0 2a 05 c5 e9 ec c8
80 47 21 d2 6a .
... *......G!.j
0390 d0 9f 2a 10 d
7 ec 0a a2 18 e4 a4
35 f4 a8 1a 60 .
.*........5...`
03a0 bd 8b 49 a9 3
0 0a 85 18 1f 1d 43
47 d5 f3 63 4d .
.I.0.....CG..cM
03b0 59 dc a4 48 a
5 80 aa 3e 91 51 15
13 16 be 3e f5 Y
..H...>.Q....>.
03c0 ae e9 d6 14 d
e 4b 1e 87 06 4b 15
02 91 8e b5 ce .
....K...K......
03d0 ff fb 92 04 e
e 8f f3 00 25 53 83
2f 7a 50 60 a4 .
.......%S./zP`.
03e0 aa 60 61 ef 4
a 4b c8 a1 4e 0c bd
e9 41 75 14 29 .
`a.JK..N...Au.)
03f0 81 97 bd 28 5
5 6a e5 23 8a a3 13
61 c1 aa 16 40 .
..(Uj.#...a...@
0400 77 a5 bf 66 e
e fc 08 7f ba 06 01
6d 68 37 14 08 w
..f.......mh7..
0410 42 38 bf 49 9
8 5d 69 58 c3 1d 91
a4 d5 9d 48 6d B
8.I.]iX......Hm
0420 d1 60 cf 0c 9
a c4 70 a6 84 8c 81

68 e1 75 ad df .
`....p....h.u..
0430 bc a3 7e d8 e
8 2b f8 09 41 f6 23
19 b1 9d aa 73 .
.~..+..A.#....s
0440 a7 be 73 ee 5
c 95 df b9 ec f0 09
07 9e 18 83 c9 .
.s.\...........
0450 60 f4 6c 9f 4
d 7d 69 98 09 2a 2f
7c ca 80 12 ae `
.l.M}i..*/|....
0460 44 58 28 4a 5
2 ee dd 26 aa b0 95
ac 02 0d 24 66 D
X(JR..&......$f
0470 af b9 aa 9c 2
3 37 c1 81 19 d4 cb
4c 85 d9 74 02 .
...#7.....L..t.
0480 d3 9d 8f 28 2
d e4 04 50 e2 f1 74
f4 5a d5 39 7b .
..(-..P..t.Z.9{
0490 7f ad df 3b d
f f5 ad f1 46 ab e6
3f f2 17 eb ef .
..;....F..?....
04a0 79 79 9f fd 6
0 62 19 ec 2e 09 9d
0c 85 07 87 0d y
y..`b..........
04b0 0f b2 d3 a8 f
e 85 5a ad 0a 40 0a
83 1e 61 41 86 .
.....Z..@...aA.
04c0 18 04 c3 01 0
8 74 e1 0d c5 9a 3e
e2 94 6a 86 f9 .
....t....>..j..
04d0 e8 61 c5 8f 1
a 13 b5 dc 16 c3 62
2c ca a7 03 b9 .
a........b,....
04e0 b8 07 65 5e d
0 77 7e 3d c8 9b 5d
d5 22 8a e3 c5 .
.e^.w~=..]."...
04f0 64 d7 76 48 b
f 77 d1 45 34 94 64
5f 59 be 70 4f d
.vH.w.E4.d_Y.pO
0500 9e a6 2e 2f a
2 60 a3 34 ba e9 ad
04 d1 a0 9a 4a .
../.`.4.......J
0510 3e 63 05 80 6
f 03 56 db 9b f6 b9
8b b9 b6 ff a2 >
c..o.V.........
No. Time
Source
Destination
Protocol
Length Info
351 13.77773900

0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=222368 Win=41265 L
en=0
Frame 351: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.827669000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.827669000 s
econds
[Time delta fro
m previous captured
frame: 0.000184000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018400
0 seconds]
[Time since ref
erence or first fra
me: 13.777739000 se
conds]
Frame Number: 3
51
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa

gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f9a (20378)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t

..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 22236
8, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 222368 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .

... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41265
[Calculated win
dow size: 41265]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 350]
[The RTT to
ACK the segment wa
s: 0.000184000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 9a 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb c6 cd 50 10 .
....P..N.+...P.
0030 a1 31 18 d4 0
0 00
.
1....
No. Time
Source
Destination
Protocol
Length Info
352 13.87955000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=22236
8 Ack=1 Win=46 Len=
1260

Frame 352: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.929480000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.929480000 s
econds
[Time delta fro
m previous captured
frame: 0.101811000
seconds]
[Time delta fro
m previous displaye
d frame: 0.10181100
0 seconds]
[Time since ref
erence or first fra
me: 13.879550000 se
conds]
Frame Number: 3
52
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally

unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf23b (62011)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (

6)
Header checksum
: 0x39ef [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 222368, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 222368 (relati
ve sequence number)
[Next sequence
number: 223628 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xd09
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 3b 4
0 00 31 06 39 ef 4a
7c 0c 8a c0 a8 .
..;@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb c6 cd 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e d0 98 0
0 00 58 41 8c 4e 03
9e c0 53 49 70 .
.....XA.N...SIp
0040 8c f7 d7 43 7
e 52 17 f4 38 b0 93
87 86 f5 12 ec .
..C~R..8.......
0050 8a b7 f2 67 0
8 b6 c6 76 b8 2b cb
26 89 f7 05 37 .
..g...v.+.&...7
0060 98 e4 65 3f 4
c dd be 10 1b 56 a5
a7 f5 f9 d5 bf .
.e?L....V......
0070 87 bc 5b 7d 8
9 a7 e3 59 c2 74 32
0a 38 f3 c7 0a .
.[}...Y.t2.8...
0080 8c 61 41 48 b
5 74 5c d6 ff fb 92
04 ef 0f f3 0b .
aAH.t\.........
0090 34 53 03 2f 4
2 e0 61 06 9a 50 61
e6 5c 0c 54 ab 4
S./B.a..Pa.\.T.
00a0 4a 0d 3d e9 8

1 9b 1a 29 01 97 b5
70 6a 50 15 2a J
.=....)...pjP.*
00b0 a7 7b b4 69 5
7 22 9b 8e 08 4d 31
ce c2 d4 2e bb .
{.iW"...M1.....
00c0 47 86 60 61 d
2 5b cd 82 b4 7e 27
09 12 e1 1f 15 G
.`a.[...~'.....
00d0 6a 56 08 78 5
7 32 5d 77 53 d9 65
3a 6d b0 a6 e1 j
V.xW2]wS.e:m...
00e0 ce 3b 53 f2 7
a 2f b5 02 16 78 70
33 eb f3 9b 67 .
;S.z/...xp3...g
00f0 c3 fe d1 ae d
c e5 f5 fe 14 b1 36
1a 75 a0 c3 01 .
.........6.u...
0100 46 20 44 d0 b
2 ca cc 21 c1 36 75
0f 2c aa 5d 3c F
D....!.6u.,.]<
0110 e7 51 57 ac b
8 00 40 30 39 c9 31
62 50 a7 29 6d .
QW...@09.1bP.)m
0120 17 7b fa d2 e
3 b7 9a c7 ea 5c f2
45 28 76 b6 c2 .
{.......\.E(v..
0130 5f 5a f7 18 6
c a5 9c 3a ca b1 46
2e c7 95 66 95 _
Z..l..:..F...f.
0140 c4 28 29 4b 3
4 5d 4d 40 4b 0a c6
c5 e4 11 5b d1 .
()K4]M@K.....[.
0150 75 28 b8 aa 9
6 81 89 5d f5 a0 23
27 4e 9d ab 49 u
(.....]..#'N..I
0160 6d 5a 2a 53 a
2 ab 6e ba 96 a3 90
0a 4e 19 76 f2 m
Z*S..n.....N.v.
0170 c8 66 ca 05 d
2 80 40 b1 1d 24 cb
2d f4 e0 2d 83 .
f....@..$.-..-.
0180 5b 87 59 fc 0
3 19 5d 8e 14 da 58
ee 46 d5 5e ca [
.Y...]...X.F.^.
0190 76 c7 9d c8 3
e e9 4e a9 64 4b 90
24 2a 57 b7 65 v
...>.N.dK.$*W.e
01a0 20 28 08 4b 3
0 da a4 04 11 b3 97
94 6a b3 f5 32
(.K0.......j..2
01b0 92 2e 29 4a 4
c e1 89 f7 52 aa 17

d4 d4 9f 4d 2b .
.)JL...R.....M+
01c0 56 8a 94 7d 1
5 5b 75 a9 48 a8 e2
0e 81 0a 81 1b V
..}.[u.H.......
01d0 4a e3 35 14 8
d 6f fe 8a 52 c1 1f
47 1c 23 46 a4 J
.5..o..R..G.#F.
01e0 f8 24 20 52 e
d 72 04 7c d2 2c 6d
a3 71 91 ea e9 .
$ R.r.|.,m.q...
01f0 6e 2a a2 eb 9
7 f0 2a 3b 51 d2 ea
1b 11 78 4a cd n
*....*;Q....xJ.
0200 4c 8b 86 68 0
b b0 2f 1d 6a 38 52
01 76 30 5e 57 L
..h../.j8R.v0^W
0210 40 cc fa 1a e
5 63 56 52 91 2e ba
56 74 45 0e 0c @
....cVR...VtE..
0220 8c 50 4c c9 1
0 19 d4 31 f5 bc ff
fb 92 04 e8 0f .
PL....1........
0230 f2 d0 24 53 0
3 2f 7a 50 5f c4 aa
40 65 ef 4a 0c .
.$S./zP_..@e.J.
0240 10 cf 48 0d b
e 4b 81 8d 19 a8 c1
97 c1 70 04 79 .
.H..K.......p.y
0250 44 1c db 0b 3
9 c5 39 fe b4 ad 0e
28 d5 94 1c c0 D
...9.9....(....
0260 89 16 18 10 3
b 15 6f 5d 23 68 83
94 62 90 8c 52 .
...;.o]#h..b..R
0270 a6 1c d9 5c 1
f a6 64 56 41 09 6c
9b 64 95 99 98 .
..\..dVA.l.d...
0280 8c cb 09 91 f
a 04 a8 23 09 2d 46
0a 0b 7f 1b ce .
......#.-F.....
0290 99 5d 03 33 6
4 14 79 39 78 c5 8e
32 67 59 4f b0 .
].3d.y9x..2gYO.
02a0 eb 49 16 55 4
c b4 4f 91 15 3a b6
1b c3 e0 22 2a .
I.UL.O..:...."*
02b0 bb 89 85 e8 d
b 76 b3 0a 08 6e e7
0e 40 02 2f 22 .
....v...n..@./"
02c0 1b 61 42 42 0
a 56 cb 9a 9a fa a9
94 6a a6 dc 12 .

aBB.V......j...
02d0 47 44 65 14 7
4 55 65 de 9a 55 fb
85 68 7a 62 7a G
De.tUe..U..hzbz
02e0 ed 7d dd 6e 0
2 e5 96 57 c6 65 fc
2f 2b df 8e 12 .
}.n...W.e./+...
02f0 ee e7 2c e6 3
b c7 38 2e 8a de f9
9d 7a 9c ff cb .
.,.;.8.....z...
0300 8c 26 8b f2 c
7 fe c2 ca 0b 03 17
c0 a7 00 4b 1a .
&............K.
0310 98 19 ae 72 7
a 35 b9 21 c5 4c 70
30 f7 c2 31 6e .
..rz5.!.Lp0..1n
0320 21 89 0c 61 0
4 a4 cb 2d 51 b4 d0
60 09 b8 80 9d !
..a...-Q..`....
0330 47 32 1e 4d d
e a7 89 31 40 e9 46
a7 39 4e 64 da G
2.M...1@.F.9Nd.
0340 e5 95 7a 1e 9
c 83 e9 e9 f7 b7 88
5b 36 73 ca 42 .
.z........[6s.B
0350 fa 21 8c 9f 9
c a6 cf 1b 1c de ee
f6 57 20 cb bf .
!..........W ..
0360 da f5 3f 9c c
a cb 61 16 1e a4 17
08 99 47 68 05 .
.?...a......Gh.
0370 84 9e 6c 88 5
6 56 7d 39 8d 15 1c
00 70 c3 81 80 .
.l.VV}9....p...
0380 87 d5 9d 21 0
c 65 95 d8 a8 ed b1
90 38 c6 11 8a .
..!.e......8...
0390 a3 48 26 92 e
8 b6 e5 09 37 42 15
ad 8c ad 08 7a .
H&.....7B.....z
03a0 21 5e c1 a7 e
7 f2 9d 54 e7 41 22
08 da 6e d0 16 !
^.....T.A"..n..
03b0 d8 4b 81 c5 5
c 46 8c d8 df bb de
db 96 b8 ce 33 .
K..\F.........3
03c0 85 6e b1 bd 6
1 b5 d5 77 38 8c 2c
64 ff fb 92 04 .
n..a..w8.,d....
03d0 e8 0f f2 e4 2
4 51 83 2f 8a 50 5e
05 2a 20 65 f1 .
...$Q./.P^.* e.

03e0 4c 0c 1c 9f 4
4 0d bf 09 41 88 12
28 41 a7 e1 28 L
...D...A..(A..(
03f0 69 64 29 0a 1
4 b4 9b 83 29 4a 62
b5 8e fe 2c c7 i
d).....)Jb...,.
0400 0d 83 0f 24 9
8 02 0b ab 11 98 03
df 2b 82 15 04 .
..$........+...
0410 3d 88 7e 9f e
6 e2 94 d2 55 4c 84
9a 6a 06 16 c4 =
.~.....UL..j...
0420 25 0c 57 ae 1
c e2 51 fa e8 e1 5a
9e 29 bc 1d 6b %
.W...Q...Z.)..k
0430 7a 7a e6 c2 a
0 41 6a 5b 4f 2c b4
f7 85 99 7c 99 z
z...Aj[O,....|.
0440 f9 ac bf 16 8
b db 69 5c ef 11 e7
c3 86 a8 f2 91 .
.....i\........
0450 61 06 89 86 9
1 4a 93 15 af f6 54
20 44 08 91 a9 a
....J....T D...
0460 ab ca 80 67 a
0 c3 95 c1 40 42 e3
25 8d c2 74 23 .
..g....@B.%..t#
0470 10 0b a1 56 7
5 2b e4 58 10 c8 72
44 4f 9c 25 c1 .
..Vu+.X..rDO.%.
0480 58 af bd 57 0
a 03 93 31 e2 22 c1
6d 0f c8 fd c0 X
..W...1.".m....
0490 ec 57 b2 b6 5
b 51 ad ac 7c f9 77
8d 49 8d b3 78 .
W..[Q..|.w.I..x
04a0 0c 99 da fb f
c fd 66 70 8b 46 a4
3c d5 81 1c e8 .
.....fp.F.<....
04b0 a2 6b 12 5a b
5 de ed dc 98 59 a5
98 16 6a 24 a3 .
k.Z.....Y...j$.
04c0 d3 14 02 bc 2
0 ec 96 56 70 97 e1
74 08 88 04 80 .
... ..Vp..t....
04d0 a9 21 9b 4f d
0 3a 1f 27 19 09 82
84 bc 27 1f de .
!.O.:.'.....'..
04e0 54 42 18 a4 6
4 a3 8b f1 62 53 b1
b7 c2 68 4c 28 T
B..d...bS...hL(
04f0 ea b8 c5 60 6

3 5a f9 df 89 7d 7d
6d f6 71 36 ec .
..`cZ...}}m.q6.
0500 d6 ff 28 0b 1
c 50 d5 1a 6a a4 dc
b6 29 f2 5a 17 .
.(..P..j...).Z.
0510 8d 1d d3 76 4
1 69 aa 28 33 23 e1
14 8b 0b 04 38 .
..vAi.(3#.....8
0520 bf 90
.
.
No. Time
Source
Destination
Protocol
Length Info
353 13.92355200
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
457 http49
574 [PSH, ACK] Seq=
223628 Ack=1 Win=46
Len=403
Frame 353: 457 byte
s on wire (3656 bit
s), 457 bytes captu
red (3656 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.973482000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.973482000 s
econds
[Time delta fro
m previous captured
frame: 0.044002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04400200
0 seconds]
[Time since ref
erence or first fra
me: 13.923552000 se
conds]
Frame Number: 3
53
Frame Length: 4
57 bytes (3656 bits
)

Capture Length:
457 bytes (3656 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
43
Identification:
0xf23c (62012)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d47 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 223628, Ack:
1, Len: 403
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 403]
Sequence number
: 223628 (relati
ve sequence number)
[Next sequence
number: 224031 (

relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x669
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1663]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 bb f2 3c 4
0 00 31 06 3d 47 4a
7c 0c 8a c0 a8 .
..<@.1.=GJ|....
0020 01 0b 00 50 c
1 a6 2b cb cb b9 9e

87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 66 9a 0
0 00 ca aa 06 60 fc
43 10 94 3d b9 .
.f......`.C..=.
0040 b2 1a 18 74 3
8 24 0e 47 90 e1 a7
09 da 17 48 66 .
..t8$.G......Hf
0050 6a c2 41 63 8
d af 3b 58 5f 7d 70
90 78 52 61 63 j
.Ac..;X_}p.xRac
0060 14 a6 75 2f 7
b ce e3 8c 52 f7 70
4c 00 13 83 e1 .
.u/{...R.pL....
0070 60 c0 7c e0 d
7 97 3e e0 81 72 d5
ac fa ef 4e bf `
.|...>..r....N.
0080 ac 1f ff fb 9
2 04 e8 0f f3 07 26
51 03 2f 7a 50 .
.........&Q./zP
0090 5c 05 0a 20 6
5 ef 4a 0b b8 9d 48
0c bd e9 41 70 \
.. e.J...H...Ap
00a0 92 a8 c1 87 b
d 28 07 21 8a b5 18
ff f3 e0 fe 5d .
....(.!.......]
00b0 71 3b ba c0 0
7 10 76 60 70 4b 6e
04 13 20 b8 e0 q
;....v`pKn.. ..
00c0 12 06 62 80 8
6 9d 6d 68 a3 c0 7a
10 31 da a1 2b .
.b...mh..z.1..+
00d0 12 2a 63 6a 1
a 8e 8a 71 5c 86 00
88 8a c9 e6 48 .
*cj...q\......H
00e0 85 1a 20 30 8
0 e2 04 12 9d 66 42
73 9c 36 0a 29 .
. 0.....fBs.6.)
00f0 0d 9b 02 c0 8
0 3e 5c 7a de a1 a0
41 a1 f4 14 38 .
....>\z...A...8
0100 20 d6 7f 07 d
e 99 ff 2f dc 42 cd
7f 59 ce 51 d1
....../.B..Y.Q.
0110 38 7f a8 98 0
e 00 17 82 82 4e 0f
d5 4b e4 e1 ec 8
........N..K...
0120 35 94 ac a9 7
5 61 94 a5 4f 47 c3
f6 25 0a cc 48 5
...ua..OG..%..H
0130 8f 19 e3 bf 8
4 06 a5 a7 b1 19 2e
a6 26 d6 ff 4a .

...........&..J
0140 bc 2f 7e 6e 4
e 7d 98 ee cd 79 ef
16 2a c2 6c 3e .
/~nN}...y..*.l>
0150 2a e7 8d 89 0
e 02 64 03 e1 92 0a
32 d5 a1 f4 13 *
.....d....2....
0160 7e 90 f1 34 0
0 2d fe ff a5 63 95
e5 2e 28 5d 07 ~
..4.-...c...(].
0170 e0 71 28 d1 8
c 69 35 12 5d c0 a6
48 3d 79 01 1d .
q(..i5.]..H=y..
0180 05 4e af 75 6
4 43 26 58 64 50 2b
5c 9c b0 7d 97 .
N.udC&XdP+\..}.
0190 b7 25 2a 17 6
c 24 d4 36 ea 6a 4f
15 34 64 c3 8d .
%*.l$.6.jO.4d..
01a0 38 1c 03 8d 0
7 4f 05 8b bc 13 a1
e2 41 82 a1 01 8
....O......A...
01b0 00 10 06 81 c
0 32 06 dd 0d e1 1b
49 c3 f6 22 5e .
....2.....I.."^
01c0 bb 77 5d d6 1
1 7b 76 4a 2a
.
w]..{vJ*
No. Time
Source
Destination
Protocol
Length Info
354 13.92372700
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=224031 Win=41265 L
en=0
Frame 354: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.973657000 Romance
Standard Time
[Time shift for

this packet: 0.000

000000 seconds]
Epoch Time: 141
5615226.973657000 s
econds
[Time delta fro
m previous captured
frame: 0.000175000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017500
0 seconds]
[Time since ref
erence or first fra
me: 13.923727000 se
conds]
Frame Number: 3
54
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f9b (20379)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 22403
1, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 224031 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 41265
[Calculated win
dow size: 41265]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]

Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 353]
[The RTT to
ACK the segment wa
s: 0.000175000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 9b 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb cd 4c 50 10 .
....P..N.+..LP.
0030 a1 31 18 d4 0
0 00
.
1....
No. Time
Source
Destination
Protocol
Length Info
355 13.94255400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=22403
1 Ack=1 Win=46 Len=
1260
Frame 355: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
6.992484000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615226.992484000 s
econds
[Time delta fro
m previous captured
frame: 0.018827000
seconds]

[Time delta fro

m previous displaye
d frame: 0.01882700
0 seconds]
[Time since ref
erence or first fra
me: 13.942554000 se
conds]
Frame Number: 3
55
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf23d (62013)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39ed [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 224031, Ack:
1, Len: 1260

Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 224031 (relati
ve sequence number)
[Next sequence
number: 225291 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x286
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 3d 4
0 00 31 06 39 ed 4a
7c 0c 8a c0 a8 .
..=@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb cd 4c 9e
87 4e aa 50 10 .
..P..+..L..N.P.
0030 00 2e 28 6b 0
0 00 6a 8e 5b ea 51
74 91 71 64 72 .
.(k..j.[.Qt.qdr
0040 c6 55 c9 89 7
1 39 14 5c ae ae 89
28 26 ad 28 44 .
U..q9.\...(&.(D
0050 8c b1 20 6c 1
7 58 50 28 c8 35 5d
04 71 b9 83 86 .
. l.XP(.5].q...
0060 8e 3a 14 d5 d
1 2a 8a 0a 83 6e c4
e7 ca 13 2d ca .
:...*...n....-.
0070 24 86 de 6b 6
a e4 48 4a 58 36 18
52 39 20 bb ea $
..kj.HJX6.R9 ..
0080 79 57 02 c2 2
8 09 26 19 4d cc 19
6a d1 7b 54 71 y
W..(.&.M..j.{Tq
0090 0c ff fb 90 0
4 eb 8f f3 25 21 56
03 0f 62 50 61 .
.......%!V..bPa
00a0 24 2a c0 61 e
9 4a 0b 64 95 66 07
bc c9 41 69 0d $
*.a.J.d.f...Ai.
00b0 6c 80 f7 a4 e
0 a5 ce 7c bf 53 64
81 e1 b1 ad 6d l
......|.Sd....m
00c0 e5 a6 90 cf 6
3 10 9e 15 90 25 56
d1 d9 28 93 ce .
...c....%V..(..
00d0 a8 c1 11 19 6
2 40 d8 2e d0 a0 93
f6 a5 d0 45 cd .
...b@........E.
00e0 cc 1b 30 87 1
d 09 b5 16 11 2a 8a
0a 83 47 65 73 .
.0......*...Ges
00f0 59 84 fa e5 1
2 23 b7 eb 5d 72 e4
a4 61 e0 d2 43 Y
....#..]r..a..C
0100 34 a6 ae de b
6 1f d2 ab 36 cc bd

88 81 7c de 91 4
.......6....|..
0110 d9 df 7b 6a 4
7 df e4 50 c3 2d 1d
d4 3b f9 81 74 .
.{jG..P.-..;..t
0120 70 06 e9 7e 1
f e8 26 06 d4 ed fb
e4 46 8a 90 b0 p
..~..&.....F...
0130 86 6a b2 14 4
7 0d d2 64 5d 14 4f
24 99 6b 2f 09 .
j..G..d].O$.k/.
0140 96 66 08 69 e
3 cb 0c 0e 8b 20 cd
da ec 71 61 a7 .
f.i..... ...qa.
0150 0b e5 78 c3 3
a 8c 66 9d c8 7c 84
67 2e 42 22 51 .
.x.:.f..|.g.B"Q
0160 c7 ea 2e 67 c
e 74 3c e4 75 24 e8
59 d9 dd 8e d4 .
..g.t<.u$.Y....
0170 de 36 b5 13 5
a 68 37 25 24 a2 54
21 d6 b1 c5 7d .
6..Zh7%$.T!...}
0180 46 e2 74 49 5
7 10 11 da db 8d d5
7b 4d 05 45 2c F
.tIW......{M.E,
0190 21 b4 2c 86 0
8 d4 5f 49 8d 52 25
4c c9 b3 96 5e !
.,..._I.R%L...^
01a0 2c e2 30 45 9
6 94 f4 48 a5 45 67
5e 75 e5 a4 f6 ,
.0E...H.Eg^u...
01b0 2f 33 ce b9 4
9 6f 33 33 de c1 ff
c4 62 e6 e0 19 /
3..Io33....b...
01c0 72 13 a7 1b 8
0 f5 76 a8 28 5c 1c
d5 58 77 34 d6 r
.....v.(\..Xw4.
01d0 bb 54 fb 77 c
9 47 5f fa e6 3f 04
de 7d e9 ff 27 .
T.w.G_..?..}..'
01e0 ff fc 5e 37 8
7 00 9a 8b d4 38 f0
54 d9 7a 9d f8 .
.^7.....8.T.z..
01f0 30 5e 8e 38 2
8 e3 1a fc 94 68 d3
6c d8 03 40 f7 0
^.8(....h.l..@.
0200 99 93 69 44 9
2 bc 74 92 63 03 c4
3c 66 2f 63 79 .
.iD..t.c..<f/cy
0210 9a eb fa 5c d
3 33 24 a8 8b 37 1d
f2 5d ff 66 be .

..\.3$..7..].f.
0220 da 6e 97 86 d
6 de 6b 1f 2d 2a ad
f9 93 de dd 4c .
n....k.-*.....L
0230 69 87 ff fb 9
2 04 ec 0f f2 fd 34
5a 03 09 1a e0 i
.........4Z....
0240 65 08 cb 30 6
1 23 5c 4c 39 15 6a
07 a4 ab 81 89 e
..0a#\L9.j.....
0250 96 ad 00 f4 9
9 31 8e 86 89 92 2a
28 79 c0 53 a8 .
....1....*(y.S.
0260 16 65 05 5a a
7 7f 49 dc 64 12 91
aa a9 40 2b 35 .
e.Z..I.d....@+5
0270 19 e3 eb eb 7
2 1e 59 aa 62 91 72
a7 2c 95 59 c4 .
...r.Y.b.r.,.Y.
0280 a2 ec 1d 8c 6
3 6a ad 02 23 53 cf
49 1d 03 a3 bb .
...cj..#S.I....
0290 cb af 72 b3 2
c dd f4 e8 9d 5d a9
b3 e9 b8 ef 92 .
.r.,....]......
02a0 ef fb 35 f6 d
7 d7 c3 43 a0 ea 83
c0 11 83 88 06 .
.5....C........
02b0 83 c5 48 8c 2
c 54 a8 d1 e8 09 0a
1a 50 97 44 c4 .
.H.,T......P.D.
02c0 6d 9a bf a1 4
a 3d 10 cb 08 25 15
e6 b3 2a dc 2b m
...J=...%...*.+
02d0 64 a4 81 71 9
1 ec 16 c4 99 9c 4d
e1 8f a6 2d a3 d
..q......M...-.
02e0 aa 96 89 11 d
9 b6 96 01 94 9a 09
61 d5 b6 cd 13 .
..........a....
02f0 19 8f 32 5c e
3 43 66 f6 77 f0 f8
d5 5e 73 b7 68 .
.2\.Cf.w...^s.h
0300 ec c5 d1 71 7
b 3f 6f b6 49 55 5f
e4 bb 74 b8 a0 .
..q{?o.IU_..t..
0310 0c 12 5b a4 c
3 6e 73 46 91 71 5a
f2 37 7f 43 0a .
.[..nsF.qZ.7.C.
0320 a1 64 89 52 a
3 d0 b8 52 30 6d b6
24 0d 54 f0 b0 .
d.R...R0m.$.T..

0330 b9 3a 50 71 3
7 86 17 cc 5d 43 e5
24 46 42 b2 ee .
:Pq7...]C.$FB..
0340 a0 0d 87 e6 d
5 1d 64 cc f1 2d 98
f2 e5 ca 1c a6 .
.....d..-......
0350 ca 6a ef e1 e
1 aa bc e7 66 69 d6
62 d2 74 2e a7 .
j......fi.b.t..
0360 e9 fb 1e 4a 0
6 a0 12 80 d2 88 03
81 d2 55 81 4d .
..J.........U.M
0370 1e 1b 0f 1e d
e be bd 3f 75 15 39
07 71 5e 5b 83 .
......?u.9.q^[.
0380 3c f6 17 8c 0
6 ed 5e ae 03 c8 85
28 54 12 aa f7 <
.....^....(T...
0390 f4 9c 92 ad 3
d 3c 66 28 ab a7 b1
42 55 89 a1 d8 .
...=<f(...BU...
03a0 9e 45 19 c7 3
8 f2 5a 29 64 9e 9f
ab a7 aa a7 fc .
E..8.Z)d.......
03b0 b9 ef cb dd e
f f6 72 b5 f9 d9 3b
d6 cc ff e4 be .
.....r...;.....
03c0 f9 bf 9f b7 d
f 9f 2f a2 e5 c8 0a
30 78 44 f8 34 .
...../....0xD.4
03d0 01 10 30 9c f
f fb 92 04 e6 8f f2
fd 3d da 01 e6 .
.0.........=...
03e0 32 e0 5d 26 4
b 40 3d 26 5c 0b 5c
f9 64 07 98 cb 2
.]&K@=&\.\.d...
03f0 81 6b 1c 6c 4
0 f3 19 70 c2 7b 0c
ec ef 1e 5f 13 .
k.l@..p.{...._.
0400 83 28 85 b1 b
1 1a 10 1b 75 15 81
48 00 50 47 86 .
(......u..H.PG.
0410 f0 9d b1 94 a
2 89 0c 9a 57 a1 8a
29 4d 3d d2 52 .
.......W..)M=.R
0420 aa 4d 0e c5 3
2 2a 98 de 7d 58 a1
fe 59 dd 0b 4f .
M..2*..}X..Y..O
0430 51 e3 51 46 e
f bb ee de 17 f4 dc
ad 7e 76 4e f4 Q
.QF........~vN.
0440 a9 9f f3 51 7

d f3 79 95 ad f7 e7
2f 4c 7e f4 ce .
..Q}.y..../L~..
0450 73 0a 85 46 a
0 1a 05 45 0f 0b dc
44 6b a3 0b ad s
..F...E...Dk...
0460 5e b6 c0 9f 4
3 ef 57 e0 b7 3b e8
5e fb 2a 83 e3 ^
...C.W..;.^.*..
0470 1f 96 2c 8d 7
3 a5 80 8a 2b 54 56
ff 3a ba 18 96 .
.,.s...+TV.:...
0480 a4 5e b1 c5 3
e fd 6e 86 bb 1a 53
02 61 2d 3b 5b .
^..>.n...S.a-;[
0490 3a b8 a9 b0 2
b 25 20 6a 5b 56 bc
97 0d b9 be ee :
...+% j[V......
04a0 8d 76 8c c7 7
8 76 68 ad 68 66 68
97 9a ff 25 df .
v..xvh.hfh...%.
04b0 1a 59 bd 61 b
6 30 8a 50 40 18 0f
39 04 05 02 57 .
Y.a.0.P@..9...W
04c0 13 c6 b7 ee 5
3 60 41 62 83 94 19
72 43 ee 5b bd .
...S`Ab...rC.[.
04d0 72 0d dc a2 1
8 c5 4b 8b 2d 2c 9e
46 bd 86 d8 29 r
.....K.-,.F...)
04e0 a2 9a 36 e5 f
6 b1 d1 f4 35 d8 d2
98 13 09 69 da .
.6.....5.....i.
04f0 d8 41 71 7b 6
0 54 94 fe b8 aa dd
74 6b 72 d1 bb .
Aq{`T.....tkr..
0500 a3 5d a2 5e f
b db 33 d6 b4 33 34
4b cd 7f 92 ef .
].^..3..34K....
0510 91 2c dd 98 d
f fc e2 7d 2e 2e 2d
4b 2b 40 a9 1f .
,.....}..-K+@..
0520 4b eb
K
.
No. Time
Source
Destination
Protocol
Length Info
356 14.07155800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home

TCP
1301 http49
574 [PSH, ACK] Seq=
225291 Ack=1 Win=46
Len=1247
Frame 356: 1301 byt
es on wire (10408 b
its), 1301 bytes ca
ptured (10408 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.121488000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.121488000 s
econds
[Time delta fro
m previous captured
frame: 0.129004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12900400
0 seconds]
[Time since ref
erence or first fra
me: 14.071558000 se
conds]
Frame Number: 3
56
Frame Length: 1
301 bytes (10408 bi
ts)
Capture Length:
1301 bytes (10408
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
287
Identification:
0xf23e (62014)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 225291, Ack:
1, Len: 1247
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1247]
Sequence number
: 225291 (relati
ve sequence number)
[Next sequence
number: 226538 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x590
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2507]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 07 f2 3e 4
0 00 31 06 39 f9 4a
7c 0c 8a c0 a8 .
..>@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb d2 38 9e
87 4e aa 50 18 .
..P..+..8..N.P.
0030 00 2e 59 0c 0
0 00 3b d4 7f 0b 26
27 66 32 1d 87 .
.Y...;...&'f2..
0040 f8 21 0c 35 2
b e9 03 e1 74 4a a6
50 dc 2c ac 0f .
!.5+...tJ.P.,..
0050 32 65 f6 60 9
1 cf 46 c1 2b d4 a4
f1 0d cf 94 dc 2
e.`..F.+.......
0060 07 59 06 2a c
b a5 8c 2b 6e a5 6d
47 c1 7f eb ce .
Y.*...+n.mG....
0070 87 af 37 2f 0
5 bd 20 92 ac 06 01
15 09 c8 98 00 .
.7/.. .........
0080 38 2c 1e 17 7
9 24 ad 07 1c 22 ff
fb 92 04 ec 0f 8

,..y$..."......
0090 f2 ff 3d 57 8
1 e9 32 e0 63 a8 0a
e0 3d 26 5c 0c .
.=W..2.c...=&\.
00a0 64 f1 58 0c 3
0 cb 81 7d 20 6b 01
86 19 70 7b 0b d
.X.0..} k...p{.
00b0 2f 13 3e 10 f
e df 5c 38 5c b0 c7
c3 cf 1b d4 ae /
.>...\8\.......
00c0 1a cb bf 19 6
c 03 97 25 65 43 44
2e 21 28 aa 6a .
...l..%eCD.!(.j
00d0 ad 46 0e 3a 4
5 f1 3a 29 53 51 0e
ce 9a 6b 07 99 .
F.:E.:)SQ...k..
00e0 0c 55 85 1c 7
c c6 c5 33 92 54 dd
97 fe bc c4 1e .
U..|..3.T......
00f0 bc dc bc 9e f
e b9 9c fb 0c 01 e4
79 54 40 e2 c3 .
..........yT@..
0100 ba 16 b5 83 d
4 53 f4 f3 38 fb 59
33 f9 cd ff ff .
....S..8.Y3....
0110 ff 1b 81 84 e
b 41 9e 02 9a 90 a2
c7 82 d5 2c 40 .
....A........,@
0120 fc 91 3c c6 b
d 76 62 69 1f 2d 0a
6a 28 ae bb 50 .
.<..vbi.-.j(..P
0130 78 57 d4 28 1
1 ef 13 03 02 50 a5
14 84 8d 50 a8 x
W.(.....P....P.
0140 a9 08 f4 49 2
6 ad 3b 4a dc b1 d6
ab 6c 79 46 17 .
..I&.;J....lyF.
0150 03 69 a1 0f e
c 73 9a 9d 43 98 34
04 16 24 25 80 .
i...s..C.4..$%.
0160 50 f8 40 c9 8
9 66 93 15 26 8b 24
95 20 9b cf b1 P
.@..f..&.$. ...
0170 5a 09 e0 0d 4
7 22 16 37 82 02 47
9d e5 02 7a 62 Z
...G".7..G...zb
0180 11 38 9c 45 6
b 88 98 90 e9 02 c0
92 35 42 1a b0 .
8.Ek.......5B..
0190 7d cb 76 c5 c
c 2a 91 53 ce 2c 60
8f b4 3b 14 ab }
.v..*.S.,`..;..

01a0 c1 54 f1 5a 7
b 53 8b d7 55 14 67
9a d3 6b 30 bd .
T.Z{S..U.g..k0.
01b0 5c a5 50 6f 3
5 ce b6 a6 e2 ef 3c
34 04 16 0b 03 \
.Po5.....<4....
01c0 a8 00 9a 36 8
0 92 58 4c 63 cb d3
44 8b c9 34 aa .
..6..XLc..D..4.
01d0 7b 3a ea a5 2
d 39 1e ae 20 f8 ea
88 1c c3 d0 55 {
:..-9.. ......U
01e0 3a 1f 70 9d 8
5 12 56 32 bc bc 13
75 73 83 8b 1b :
.p...V2...us...
01f0 85 a6 6d 56 4
4 a4 1c c6 5a 7c af
7b 86 db b2 c1 .
.mVD...Z|.{....
0200 85 06 d7 00 f
8 d1 f5 53 6e 30 c4
34 69 dc 4b 40 .
......Sn0.4i.K@
0210 d9 5b bf 8a 3
f a7 dc 7a c5 3d 3a
0e b4 ea e0 e9 .
[..?..z.=:.....
0220 3a ee a1 87 1
1 65 20 36 2b 69 f8
5e ff fb 92 04 :
....e 6+i.^....
0230 e8 0f f2 d5 2
b d5 83 09 42 60 5a
a5 7a b0 61 28 .
...+...B`Z.z.a(
0240 4c 4c 00 a9 5
4 0c 3d 09 81 84 15
aa 40 f4 a5 30 L
L..T.=.....@..0
0250 05 39 71 7b 9
a 58 3b 0a b5 8e ae
32 19 70 e2 13 .
9q{.X;....2.p..
0260 51 01 ac 39 7
0 66 bc e9 eb 36 22
7c 4b f0 7d 09 Q
..9pf...6"|K.}.
0270 24 b0 4c 54 a
2 a9 16 18 39 02 98
5f ff 3b ab 27 $
.LT....9.._.;.'
0280 35 5a 96 93 4
b 84 72 58 d1 c1 d5
21 71 43 8d 2c 5
Z..K.rX...!qC.,
0290 91 9c 65 3b 9
7 dd 71 47 f5 72 e3
d6 25 eb a5 8e .
.e;..qG.r..%...
02a0 d6 fe 47 8f c
6 25 aa 5c 34 5c 4f
ce ff df 53 6b .
.G..%.\4\O...Sk
02b0 50 bd 4a b4 6

3 64 e9 63 7f ff d0
8f 20 12 88 f8 P
.J.cd.c.... ...
02c0 07 0a 48 52 3
e 81 93 95 82 57 c1
bb ce 61 60 0b .
.HR>....W...a`.
02d0 2c 1e ec d9 c
d c5 07 aa 1d 48 bf
5d d9 40 2c 2e ,
........H.].@,.
02e0 5e 86 cf 95 d
b dd 7c a7 71 2e 68
3e 9a a4 71 6a ^
.....|.q.h>..qj
02f0 6f 06 10 7d 6
9 79 c7 bf 5c de 5a
b9 f8 99 76 e7 o
..}iy..\.Z...v.
0300 fb 77 52 d5 a
4 f6 aa fa 73 6d cf
6b 6d e7 76 b1 .
wR.....sm.km.v.
0310 20 75 45 45 8
5 07 3a 02 96 4d e9
a5 39 57 d2 1a
uEE..:..M..9W..
0320 8b 75 97 a5 e
a f6 b6 97 1b 43 a2
bd 57 1f ce 18 .
u.......C..W...
0330 16 16 77 b1 d
6 1a 2b 54 54 1a 41
53 c4 91 a1 ce .
.w...+TT.AS....
0340 90 6e d6 a7 4
8 51 95 4c 53 42 80
c9 d3 6d 31 d6 .
n..HQ.LSB...m1.
0350 b9 2d 3c 5b 1
2 53 a7 56 cd de bf
a3 ba 84 37 de .
-<[.S.V......7.
0360 35 28 63 5b 0
5 bb 79 1e cc 46 1d
07 9a f9 61 1a 5
(c[..y..F....a.
0370 85 05 5f 18 2
e c6 a2 c4 3c ef 14
d0 a5 2e 42 68 .
._.....<.....Bh
0380 56 8c 4d 8a 0
2 d2 b5 91 f2 60 48
8d 64 cd 3f 5e V
.M......`H.d.?^
0390 9e 09 f6 73 4
8 74 48 bc f9 47 5d
45 64 9f 51 a2 .
..sHtH..G]Ed.Q.
03a0 43 84 fa 33 6
3 14 38 67 79 4f 1a
b0 9e ec c2 6f C
..3c.8gyO.....o
03b0 d2 99 6d f6 2
9 2d 2d 02 f8 cc 96
cc 59 62 57 5a .
.m.)--.....YbWZ
03c0 d5 db ee 6d c
0 a8 90 d0 51 ce 14

0d 8c 5b ff fb .
..m....Q....[..
03d0 92 04 eb 8f f
3 1e 36 54 03 2f 42
e0 60 28 aa 80 .
.....6T./B.`(..
03e0 61 88 5c 0c 1
c d5 4c 0c b1 6b 81
88 18 a9 81 87 a
.\...L..k......
03f0 a5 30 4b 39 f
6 10 30 e3 a1 a9 72
85 85 6e fb d4 .
0K9..0...r..n..
0400 aa a6 30 5d 8
e a5 d2 41 26 ac e3
26 7e 8b c4 92 .
.0]...A&..&~...
0410 6a 41 ed 50 5
4 11 ac b3 ec e5 39
6a f4 56 a9 9a j
A.PT.....9j.V..
0420 e3 ef 38 69 b
1 a0 3c 09 bf 27 d8
09 1f 42 00 8e .
.8i..<..'...B..
0430 78 70 83 47 5
d 1e c7 b3 3e e9 48
86 cb bb c9 95 x
p.G]...>.H.....
0440 0e e9 63 a8 7
8 60 24 49 2d 2c 03
7d a5 58 e7 22 .
.c.x`$I-,.}.X."
0450 a6 22 9c 93 e
5 a8 0b 14 46 e1 b9
ae 60 97 aa 18 .
"......F...`...
0460 bb 0c 00 c1 8
f 2a 88 1d 16 12 3c
0e 0a 5a 25 d4 .
....*....<..Z%.
0470 9b 1d e2 25 1
b 2c 98 b6 81 d5 10
b6 96 1e e7 43 .
..%.,.........C
0480 ff 97 d1 da d
c 31 9c 5b 34 81 1b
cf 9c 5a 35 71 .
....1.[4....Z5q
0490 1e 15 73 ac f
a c0 5b b5 7c 1f 8b
fa ee f7 d5 be .
.s...[.|.......
04a0 f5 8f 5b 4f 1
e f3 2a 9a 78 72 a9
af 05 86 df a5 .
.[O..*.xr......
04b0 b7 1d ba 3f f
f 81 64 b5 93 0b 9a
4b 08 40 92 1b .
..?..d....K.@..
04c0 4b 05 03 0c 8
a c0 80 a9 01 c6 89
46 16 04 d5 2a K
..........F...*
04d0 f2 b3 58 57 9
3 82 74 0b 49 1c f1
e0 b4 44 7a 61 .

.XW..t.I....Dza
04e0 42 6f 50 28 c
b ad 12 ad f6 71 75
37 b1 9d 97 ab B
oP(.....qu7....
04f0 bf cf 56 07 e
d 5c 7a 72 f9 cc 5f
f6 72 3a 53 af .
.V..\zr.._.r:S.
0500 37 66 1b 6e 5
4 4b 65 9a dd 15 9a
fb 87 7f 2d 6d 7
f.nTKe.......-m
0510 af ff ad bf 7
5
.
...u
No. Time
Source
Destination
Protocol
Length Info
357 14.07174200
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=226538 Win=40638 L
en=0
Frame 357: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.121672000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.121672000 s
econds
[Time delta fro
m previous captured
frame: 0.000184000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018400
0 seconds]
[Time since ref
erence or first fra
me: 14.071742000 se
conds]
Frame Number: 3
57
Frame Length: 5

4 bytes (432 bits)

Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: Not-

ECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f9c (20380)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 22653
8, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 226538 (

relative ack number

)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40638
[Calculated win
dow size: 40638]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 356]
[The RTT to
ACK the segment wa
s: 0.000184000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 9c 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|

0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb d7 17 50 10 .
....P..N.+...P.
0030 9e be 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
358 14.14656100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=22653
8 Ack=1 Win=46 Len=
1260
Frame 358: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.196491000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.196491000 s
econds
[Time delta fro
m previous captured
frame: 0.074819000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07481900
0 seconds]
[Time since ref
erence or first fra
me: 14.146561000 se
conds]
Frame Number: 3
58
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]

[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio

n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf23f (62015)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39eb [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 226538, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 226538 (relati
ve sequence number)
[Next sequence
number: 227798 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes

.... 0000 0001

0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x13e
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 3f 4
0 00 31 06 39 eb 4a
7c 0c 8a c0 a8 .
..?@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb d7 17 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 13 e9 0
0 00 0b 12 90 81 a3
23 f8 5c 41 a3 .
..........#.\A.
0040 dc 37 1c 56 3

7 72 02 40 7b 92 45
2b 8a 58 1a ef .
7.V7r.@{.E+.X..
0050 1b 1f 18 55 8
9 15 4b 27 c7 67 d9
87 b7 b5 d6 4f .
..U..K'.g.....O
0060 50 f3 a8 cc 7
f 16 71 7e c2 f2 db
89 8c cb ef ac P
.....q~........
0070 66 f1 33 4d 5
5 f5 ed 56 37 79 f5
b5 f5 f5 aa ef f
.3MU..V7y......
0080 16 be 37 6b 7
b 6b 1a d4 42 af 05
0d ad 26 08 d4 .
.7k{k..B....&..
0090 28 ff fb 92 0
4 e7 0f f2 ef 24 d3
83 0f 7a 50 56 (
........$...zPV
00a0 25 3a 70 61 8
8 4c 0b ec bf 4c 0c
31 e9 89 7c 18 %
:pa.L...L.1..|.
00b0 29 41 84 b1 3
1 84 35 f3 9c 95 f2
42 06 a5 40 d2 )
A..1.5....B..@.
00c0 ea a8 29 11 d
4 05 d6 1c 04 4d b8
ca 17 69 c4 cc .
.)......M...i..
00d0 cf 50 99 dc 9
c 8f c6 f6 64 62 40
f2 77 1b 2f df .
P......db@.w./.
00e0 98 77 56 df f
5 29 0d f0 b6 d1 a8
08 47 87 a2 94 .
wV..)......G...
00f0 24 18 27 2c 5
e af 82 1e 86 89 8c
12 9d c2 8b 9c $
.',^...........
0100 5a f6 c7 69 2
b 70 c8 d6 cd 51 5a
a9 ac 35 e0 34 Z
..i+p...QZ..5.4
0110 e8 22 45 41 8
2 a5 5a 0d 1e 49 da
d1 1f ef e5 41 .
"EA..Z..I.....A
0120 01 81 8d 1b 9
d f4 03 3a 50 e2 18
47 8c c6 9b 89 .
......:P..G....
0130 1b 3f 05 34 e
8 2f 4e ce 51 76 84
f6 a8 bd 52 32 .
?.4./N.Qv....R2
0140 e5 28 ef 30 e
4 95 08 8c f2 2b e9
cf 93 ae 77 b9 .
(.0.....+....w.
0150 73 c0 77 fc b
0 e3 32 c4 87 6d cb

36 22 5b 30 ed s
.w...2..m.6"[0.
0160 f3 bf ab d5 9
1 6b 37 c6 bd 77 7d
e2 7e 59 0c 02 .
....k7..w}.~Y..
0170 ff c1 a3 4d 1
1 3f 69 af 44 86 6b
e3 71 fe fd 7f .
..M.?i.D.k.q...
0180 ff ec 18 32 6
6 85 da 2c 45 ee 4c
c6 05 2a 47 26 .
..2f..,E.L..*G&
0190 f9 0d 44 31 b
1 2d 46 a0 f3 bc 6d
59 fa b9 c8 f6 .
.D1.-F...mY....
01a0 64 6c cc 37 3
d 21 13 b0 46 8d 85
db 9c 6a c5 4d d
l.7=!..F....j.M
01b0 e0 ab d6 62 e
6 ad 50 f3 8f 5f 4a
4e f7 38 f7 b6 .
..b..P.._JN.8..
01c0 6b 98 2f 23 7
2 8d 15 9d 37 c7 24
cd fe 51 89 50 k
./#r...7.$..Q.P
01d0 11 f2 da ba a
c 1b 3b fd dc ff 63
ff f8 2f 09 b9 .
.....;...c../..
01e0 58 ba d2 91 f
6 c3 a7 02 8b 18 27
09 2b 90 ea cd X
.........'.+...
01f0 d2 9e db 4c a
4 90 87 76 37 17 bf
2d 91 e3 7e 61 .
..L...v7..-..~a
0200 9a 6f 0a f4 7
7 2b 65 4f 72 fc a1
2f 3c af 6a c1 .
o..w+eOr../<.j.
0210 ab 32 ae 04 a
c be 57 90 a3 da b0
b7 ed 12 f6 bd .
2....W.........
0220 33 8c cb 85 2
b 96 71 ed f5 f7 ac
df f8 5c 24 68 3
...+.q......\$h
0230 06 79 c1 ff f
b 92 04 ec 8f f3 0b
31 52 83 2f 7a .
y.........1R./z
0240 60 63 e6 4a 4
0 61 e8 5c 0c 50 ab
48 0c bd e9 89 `
c.J@a.\.P.H....
0250 6c 92 a9 01 8
7 bd 29 79 47 30 d0
bb 01 f1 82 3a l
.....)yG0.....:
0260 6b 66 be 94 1
d 1b 6b 06 44 d6 e0
11 36 27 00 8c k

f....k.D...6'..
0270 35 f8 49 f6 3
5 a4 62 a1 2a 3d 0f
e5 a3 66 de b7 5
.I.5.b.*=...f..
0280 94 03 c1 ec 6
6 38 0d 8a 68 2c 6e
f1 0c 4e d9 a3 .
...f8..h,n..N..
0290 da ef 62 46 6
7 89 b7 54 84 c5 0a
d5 bf de ef 17 .
.bFg..T........
02a0 c6 be 3c 68 7
0 29 06 7a ea 4c 6c
57 51 76 0c 9a .
.<hp).z.LlWQv..
02b0 0f d1 21 be c
8 ee 39 d3 ad 63 ff
4f 99 7c 10 a0 .
.!...9..c.O.|..
02c0 ec ec ea 30 b
9 26 92 c6 80 80 80
99 e9 ad ba 30 .
..0.&.........0
02d0 8c 40 eb 0a 5
3 fd 13 41 6e 02 da
e5 3d 31 e8 f2 .
@..S..An...=1..
02e0 ac 2a 63 15 8
2 35 df 96 48 99 a0
fe b9 f0 95 7d .
*c..5..H......}
02f0 cc 11 0c 50 7
d ce 90 8c 62 6a a9
c5 a6 67 3b a0 .
..P}...bj...g;.
0300 b2 aa dd 15 a
6 38 ce ae a4 14 69
3a f5 c7 92 b1 .
....8....i:....
0310 df 7c 9d c5 8
f 26 0d 03 0e 9a ed
bb 9f a0 c0 0e .
|...&..........
0320 c2 46 30 79 1
0 e6 64 1c f2 57 01
20 c5 4d f2 7b .
F0y..d..W. .M.{
0330 1c e3 44 d0 7
f 01 95 4f 86 56 08
b0 f0 8a 29 58 .
.D....O.V....)X
0340 98 a1 ac 35 a
0 9c 0f c4 f7 d8 32
dc 6b 4b 21 91 .
..5......2.kK!.
0350 48 43 9f 82 e
3 16 03 8c 0a e2 d6
df 71 d7 c6 6b H
C..........q..k
0360 97 d6 b6 59 f
7 5d fc da 05 b1 eb
48 25 44 22 e2 .
..Y.].....H%D".
0370 75 9f 49 c5 1
6 6c 0e c1 a7 00 30
d3 d5 f5 a2 04 u
.I..l....0.....

0380 03 19 70 b8 6
8 a1 08 01 97 0d 85
41 4b 9e c0 85 .
.p.h......AK...
0390 19 91 4c 84 c
f f2 db 5e cc c2 65
7b 87 6a 5b 66 .
.L....^..e{.j[f
03a0 76 17 08 bb 4
9 5a 9e 9f 5d 94 2c
96 40 b4 54 63 v
...IZ..].,.@.Tc
03b0 60 95 24 94 e
a 2b 26 16 7c d0 b6
75 66 c7 4b 55 `
.$..+&.|..uf.KU
03c0 4f 2c b8 f3 e
a 44 eb 59 66 69 0b
81 33 54 43 a4 O
,...D.Yfi..3TC.
03d0 d8 d0 c2 ec e
2 ff fb 92 04 ea 0f
f3 14 2c 51 83 .
............,Q.
03e0 38 7a 60 5a c
4 da 30 61 ef 4a 4b
e8 a1 44 0c be 8
z`Z..0a.JK..D..
03f0 29 49 85 15 6
8 41 97 bd 30 3d 6a
79 2b e9 85 6c )
I..hA..0=jy+..l
0400 bb 27 9b b3 b
5 d9 81 84 02 cd 05
52 c2 d4 91 82 .
'.........R....
0410 7a ba 5f 42 1
5 94 65 b9 d9 78 1c
37 62 3f 0b 22 z
._B..e..x.7b?."
0420 b5 9a 3b d2 4
e 6e a4 01 03 c7 71
ad 09 95 62 42 .
.;.Nn....q...bB
0430 04 f7 dc 31 5
d c1 70 d9 7b d8 9b
b7 47 6f 8b b7 .
..1].p.{...Go..
0440 8b 7a c5 b5 e
2 75 d7 dd a9 13 e3
6e 78 4d 7c 66 .
z...u.....nxM|f
0450 fa a4 fd 32 e
6 00 3e 38 cf ee 6b
e0 19 87 99 6f .
..2..>8..k....o
0460 bb ad ff a7 9
0 cc 24 2b ac 95 e7
ec 79 65 95 24 .
.....$+....ye.$
0470 5c d6 a7 40 7
1 7e 58 34 45 6a 9d
e8 cd 02 51 54 \
..@q~X4Ej....QT
0480 8c b8 7c bd c
c ea 86 28 95 b4 75
f5 b8 af a2 63 .
.|....(..u....c
0490 41 4a cc f2 3

5 62 4c 09 87 76 6c
8f ba 67 19 ad A
J..5bL..vl..g..
04a0 6b 2c 27 93 e
2 1c 17 5a cf 71 c9
a7 8f 7f 4c 4d k
,'....Z.q....LM
04b0 80 e1 d7 82 5
3 6c 41 60 f9 a4 3d
76 e8 d2 9c 80 .
...SlA`..=v....
04c0 ee 01 3a d0 d
c 41 09 92 b6 d9 a7
ed 80 f9 55 8d .
.:..A........U.
04d0 c3 f9 3e da 5
6 01 62 f1 2e 77 b8
43 8c 0b 83 6d .
.>.V.b..w.C...m
04e0 eb 3b e9 9b 6
3 43 27 e9 5b 3c 09
6b 63 0c cd 67 .
;..cC'.[<.kc..g
04f0 05 42 38 db e
9 3f 5d 2d da 0c 1a
d6 1d db e9 4c .
B8..?]-.......L
0500 6e 69 ab 99 a
a ab c5 2f 8c c9 3d
0d 1c 03 23 95 n
i...../..=...#.
0510 30 d2 17 91 5
2 04 54 15 28 9a 58
42 a1 94 05 59 0
...R.T.(.XB...Y
0520 41 86
A
.
No. Time
Source
Destination
Protocol
Length Info
359 14.21856400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
887 http49
574 [PSH, ACK] Seq=
227798 Ack=1 Win=46
Len=833
Frame 359: 887 byte
s on wire (7096 bit
s), 887 bytes captu
red (7096 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.268494000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.268494000 s
econds
[Time delta fro
m previous captured
frame: 0.072003000
seconds]
[Time delta fro
m previous displaye
d frame: 0.07200300
0 seconds]
[Time since ref
erence or first fra
me: 14.218564000 se
conds]
Frame Number: 3
59
Frame Length: 8
87 bytes (7096 bits
)
Capture Length:
887 bytes (7096 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
73
Identification:
0xf240 (62016)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3b95 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.

11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 227798, Ack:
1, Len: 833
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 833]
Sequence number
: 227798 (relati
ve sequence number)
[Next sequence
number: 228631 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0xaa2
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2093]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 69 f2 40 4
0 00 31 06 3b 95 4a
7c 0c 8a c0 a8 .
i.@@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cb dc 03 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e aa 20 0
0 00 58 19 74 06 5d
97 95 fb db aa .
.. ..X.t.].....
0040 db 61 34 29 6
3 d9 10 2d 86 43 c5
62 e1 58 fd fb .
a4)c..-.C.b.X..
0050 fb e2 28 a1 9
0 1f d8 4a 7a 22 10
28 00 31 78 b1 .
.(....Jz".(.1x.
0060 f2 7b fa 56 6
6 f7 5c 10 9a 79 81
84 1c 0c 1b 97 .
{.Vf.\..y......
0070 2e 0f 9c 20 2
7 2e f9 0c f9 77 87
d1 6f c3 e8 f5 .
.. '....w..o...
0080 bf f9 74 4e 2
5 70 7c 1f 04 1d 94
ff fb 92 04 ea .
.tN%p|.........
0090 0f f3 1a 25 d
0 83 78 8a 52 5d 45
0a 10 67 0f 4a .
..%..x.R]E..g.J
00a0 4b 4c a1 44 0
d 3d e9 41 6e 94 28
41 87 bd 28 12 K
L.D.=.An.(A..(.
00b0 46 d3 39 0c 2
6 a3 b4 f3 51 97 8a
c6 78 88 ba fb F
.9.&...Q...x...
00c0 b6 56 d8 ef d
b 0d 03 a1 58 9c 28
1e 33 bf 57 dc .
V......X.(.3.W.
00d0 81 10 38 08 1
c f4 02 cf 98 43 0c
01 7b 22 ad 43 .

.8......C..{".C
00e0 f1 1f be a0 c
7 9b 5a d1 12 b9 35
1c a1 c0 03 e4 .
.....Z...5.....
00f0 03 e0 f8 91 4
7 04 e1 fa bd 22 70
f8 44 f8 3e d2 .
...G...."p.D.>.
0100 ef 3e b9 cf 0
7 c0 ef e2 07 62 05
3b 63 c1 ce 27 .
>.......b.;c..'
0110 0c 2c 3f 40 b
6 9d d5 3e 0a 2b 16
86 d9 c2 fa 87 .
,?@...>.+......
0120 cf ea f9 b9 2
c b4 9c ca 0b 15 8e
c3 9e 43 26 5c .
...,........C&\
0130 f9 4b f1 62 8
8 25 41 30 5c 21 b5
d5 a9 49 28 21 .
K.b.%A0\!...I(!
0140 20 39 11 0f d
2 d5 9e 26 2d aa e7
7a be a2 5a 92
9.....&-..z..Z.
0150 cd 03 0c 16 0
f 0f 6c e9 f6 40 f2
89 ad 6d 61 77 .
.....l..@...maw
0160 ce 20 d4 5c 9
b 4a 64 2f 22 34 80
ab eb ad 80 41 .
.\.Jd/"4.....A
0170 08 64 20 31 5
6 09 06 58 95 e5 e3
80 5f 94 25 73 .
d 1V..X...._.%s
0180 80 dc 6e dc 6
f 69 53 e4 c8 d6 61
61 89 02 bc ab .
.n.oiS...aa....
0190 1d a3 2d c2 4
8 20 77 0c 89 c9 76
32 8c b2 29 ac .
.-.H w...v2..).
01a0 3a 50 a9 86 f
c 25 72 5e ae b7 73
6e 76 3b 32 2a :
P...%r^..snv;2*
01b0 59 0a e1 99 1
5 15 aa b3 d6 94 ee
bd 3e ad 59 12 Y
...........>.Y.
01c0 b3 a5 aa ae c
c aa bd b6 92 9d ff
93 25 bd 3f 41 .
...........%.?A
01d0 90 5d 4d c6 4
c d5 70 2c 42 7e 71
0d b2 90 a1 86 .
]M.L.p,B~q.....
01e0 c6 73 b5 74 c
5 c9 51 bd 05 cc ab
d0 3b 11 92 53 .
s.t..Q.....;..S

01f0 39 15 9b 9a 9
7 45 6d 8f 5d cd 86
54 95 51 67 35 9
....Em.]..T.Qg5
0200 22 08 5c a7 9
6 5b ae af 6e d9 15
fc bf 99 fd e1 "
.\..[..n.......
0210 fa 2c e1 4e 1
9 67 9f e5 9c 7d c8
d1 45 a2 1f f5 .
,.N.g...}..E...
0220 fb 18 24 25 9
8 57 90 65 47 ec fb
be c5 ff fb 92 .
.$%.W.eG.......
0230 04 ed 8f f2 e
8 24 54 83 0f 42 50
63 e4 9a 80 3d .
....$T..BPc...=
0240 e8 4a 0c b4 a
1 5e 0c 31 09 41 72
ac ab c0 f4 89 .
J...^.1.Ar.....
0250 b8 f8 ff a2 d
e 8d cc 79 05 60 fa
13 51 9c 96 3e .
......y.`..Q..>
0260 94 e8 c6 16 3
c c2 24 4c 52 8d 45
e2 d1 d6 e0 c3 .
...<.$LR.E.....
0270 86 58 84 58 6
5 64 6b fb d2 bd 8b
ae e7 80 c5 21 .
X.Xedk........!
0280 14 a4 54 a2 1
5 a2 0d 45 33 32 32
1c b2 9d 56 ee .
.T....E322...V.
0290 cc af ae bb b
3 ad 1f 22 bd 0b a3
b3 a1 3b b2 d1 .
......".....;..
02a0 d9 ca e4 51 f
7 0e fe f1 de 31 6b
51 c4 0c 88 7e .
..Q.....1kQ...~
02b0 25 9c ff 5f 4
5 17 63 8c 03 71 88
12 e0 a6 63 47 %
.._E.c..q....cG
02c0 68 2a c0 d7 d
9 15 fa d7 21 dc 44
a4 70 e4 4b 29 h
*......!.D.p.K)
02d0 6b 2d 0d 0a 8
2 a8 3d 34 5b bb 37
60 9d c6 4b 5d k
-....=4[.7`..K]
02e0 1c d5 77 9c f
9 a2 d6 33 db e9 7e
b1 98 11 f1 e5 .
.w....3..~.....
02f0 35 bc ff 8a 4
4 70 e9 aa b3 ee 8a
70 d0 ca 92 ac 5
...Dp.....p....
0300 59 65 ec 62 8

6 90 57 7a 93 26 9f
c1 d7 cc f5 1e Y
e.b..Wz.&......
0310 0d 8f e2 82 d
c 74 51 7e 0a 0a 09
e6 fe 2f 05 8c .
....tQ~...../..
0320 7e bc 23 94 6
b 3b 2c d9 0a b8 b2
cb 02 22 ea 3e ~
.#.k;,......".>
0330 69 88 30 28 2
9 87 54 11 4d cb 26
01 32 82 b0 d5 i
.0().T.M.&.2...
0340 4d 3e db 23 c
1 b9 5f 1f ae 13 4b
67 4c 1b d3 f9 M
>.#.._...KgL...
0350 4c 6e 57 26 3
7 7a 59 65 94 05 ef
51 fa 2a 46 64 L
nW&7zYe...Q.*Fd
0360 4d c6 d8 21 e
f 2a 0a af 34 d4 fd
37 40 8e c2 e7 M
..!.*..4..7@...
0370 31 0a ce e2 2
3 ed b5
1
...#..
No. Time
Source
Destination
Protocol
Length Info
360 14.21873700
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=228631 Win=40115 L
en=0
Frame 360: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.268667000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.268667000 s
econds
[Time delta fro

m previous captured
frame: 0.000173000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017300
0 seconds]
[Time since ref
erence or first fra
me: 14.218737000 se
conds]
Frame Number: 3
60
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)

Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f9d (20381)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 22863

1, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 228631 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 40115
[Calculated win
dow size: 40115]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment

in frame: 359]
[The RTT to
ACK the segment wa
s: 0.000173000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 9d 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb df 44 50 10 .
....P..N.+..DP.
0030 9c b3 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
361 14.28856800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=22863
1 Ack=1 Win=46 Len=
1260
Frame 361: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.338498000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.338498000 s
econds
[Time delta fro
m previous captured
frame: 0.069831000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06983100
0 seconds]
[Time since ref
erence or first fra

me: 14.288568000 se
conds]
Frame Number: 3
61
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4

Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf241 (62017)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39e9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 228631, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]

[TCP Segment Le
n: 1260]
Sequence number
: 228631 (relati
ve sequence number)
[Next sequence
number: 229891 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x75b
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .

`n.dx..;.....E.
0010 05 14 f2 41 4
0 00 31 06 39 e9 4a
7c 0c 8a c0 a8 .
..A@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb df 44 9e
87 4e aa 50 10 .
..P..+..D..N.P.
0030 00 2e 75 bc 0
0 00 7e 4c 1c 40 cb
0f 20 02 35 98 .
.u...~L.@.. .5.
0040 19 02 c5 54 c
2 cc 58 5f c2 5a 84
d6 69 28 9b a8 .
..T..X_.Z..i(..
0050 f6 2e 3c 24 b
f 49 79 6b d6 5a 79
f0 77 40 1f b3 .
.<$.Iyk.Zy.w@..
0060 dd 58 10 fc 3
0 0b 13 93 db 31 cb
f8 af d1 57 05 .
X..0....1....W.
0070 4b 92 93 1b d
c bd 95 6e 15 8c ce
1b de f9 d7 ab K
......n........
0080 5f 16 13 72 f
e 2c 42 09 ff ff 96
29 bf 63 ff fb _
..r.,B....).c..
0090 92 04 ea 8f f
2 f4 42 58 81 e9 1a
e2 63 a8 4b 00 .
.....BX....c.K.
00a0 3d 25 5c 4c 2
9 2f 60 0c 18 6b c9
64 8b 6b c0 f4 =
%\L)/`..k.d.k..
00b0 8c e1 5f 14 d
7 0a de 24 dd ff fe
ef 1a ee 98 5e .
._....$.......^
00c0 0e 60 6d 17 8
c 69 e1 83 b0 61 0d
66 2e 3c 1c 90 .
`m..i...a.f.<..
00d0 30 32 1d 92 1
8 2d ea 6a 98 ed 7d
63 ad ae 9d 64 0
2...-.j..}c...d
00e0 5d c2 f6 61 d
9 c6 e6 62 e9 ea b5
86 f2 98 87 26 ]
..a...b.......&
00f0 cb 52 fb b3 9
3 3c db 3c 94 b6 cf
6a e9 ae ea 1b .
R...<.<...j....
0100 55 52 5d 9b 3
a ab b7 92 f3 f9 b1
df 6a ab 51 a1 U
R].:.......j.Q.
0110 dc e7 9f 68 6
6 87 4a f3 aa 33 a1
63 32 d3 a0 93 .
..hf.J..3.c2...

0120 21 30 3b cc 9
1 a0 52 33 62 4c 04
3c d1 96 7a d9 !
0;...R3bL.<..z.
0130 fa 53 ab 98 0
1 96 b7 ed cb 01 a2
42 f6 f5 c5 32 .
S.........B...2
0140 9a a6 99 9b 9
7 65 47 0c 4c 1f d0
d1 b0 9e b5 68 .
....eG.L......h
0150 a3 42 a3 e2 a
b 30 9c 37 96 a8 56
a5 75 6c 57 2d .
B...0.7..V.ulW0160 53 cf aa ef b
f b6 6b eb 14 79 f6
12 34 28 94 3c S
.....k..y..4(.<
0170 f0 98 78 ae 2
7 3c dd c8 57 af b6
43 7f 42 aa 99 .
.x.'<..W..C.B..
0180 58 e6 20 11 8
8 16 10 3c 30 ba a9
44 e0 fa e6 84 X
. ....<0..D....
0190 89 54 f1 ed 8
1 68 57 c7 39 d5 0c
71 a4 44 b0 33 .
T...hW.9..q.D.3
01a0 44 72 91 80 0
6 78 95 8c 28 5c 17
26 fd 51 2d 12 D
r...x..(\.&.Q-.
01b0 6f 49 64 93 b
8 7a 56 ea eb 73 db
7e 71 b4 d5 79 o
Id..zV..s.~q..y
01c0 f0 80 68 d0 8
8 99 27 92 6a c5 53
4b 89 4a 50 f1 .
.h...'.j.SK.JP.
01d0 0d 50 3b 89 3
1 ab 15 53 f7 ad ca
ff 52 1c 0e 14 .
P;.1..S....R...
01e0 66 26 b4 1d 9
c 0c 58 42 18 d8 01
ba 85 2c b4 77 f
&....XB.....,.w
01f0 13 f4 e0 97 4
2 0f 80 81 9f 4b 6a
43 c0 9e 37 a7 .
...B....KjC..7.
0200 36 7e b2 c6 6
a 63 68 84 a2 3c 73
3d d9 91 23 c2 6
~..jch..<s=..#.
0210 6b db 3b 3b e
3 c0 6e 9f b5 5e 99
f7 df f8 ff f8 k
.;;..n..^......
0220 5a c6 6d 6b 3
9 d8 f0 92 a4 19 14
15 8f 3a 28 b0 Z
.mk9........:(.
0230 ff fb 92 04 e

b 0f f3 17 17 d5 03
2f 61 c2 62 c9 .
........../a.b.
0240 ba 90 61 83 5
e 0b c0 91 4c 0d 61
e9 41 7c 12 29 .
.a.^...L.a.A|.)
0250 81 a7 a5 28 1
a e4 db 17 40 ab a5
49 22 cd 4a ec .
..(....@..I".J.
0260 a0 44 2c a9 1
5 3c 81 59 d3 74 bc
8b b6 a8 50 1b .
D,..<.Y.t....P.
0270 3d 4e 1d ea 0
5 19 3c 94 57 e7 69
54 1e 05 b1 cd =
N....<.W.iT....
0280 49 3c 26 fb b
7 5d c5 a3 e4 02 1b
f0 bc 66 10 45 I
<&..].......f.E
0290 af fc 03 de b
0 d4 76 cb cd 67 63
db a5 b5 e7 7b .
.....v..gc....{
02a0 67 5f 98 1f 1
1 48 58 60 2c 28 d4
89 54 c0 f1 f3 g
_...HX`,(..T...
02b0 0b 1f 61 d0 0
9 a9 b1 79 8d 13 22
b7 4d d3 ff a4 .
.a....y..".M...
02c0 2c 2c c4 4a 3
8 48 4c f0 63 88 11
09 24 db 9f 65 ,
,.J8HL.c...$..e
02d0 4c 38 21 14 9
9 24 34 cd 9f 47 4c
1c e6 ad 76 8a L
8!..$4..GL...v.
02e0 72 27 56 96 1
d 9d 71 22 95 a8 af
65 11 8a d9 fe r
'V...q"...e....
02f0 73 30 37 66 d
5 9f 45 65 7d b9 23
de 47 2c d2 b4 s
07f..Ee}.#.G,..
0300 81 49 ef e9 f
0 cb 4f e0 41 86 e5
fe 71 b9 f5 fd .
I....O.A...q...
0310 f3 88 76 01 1
f 68 79 a0 72 52 4e
c9 3a e3 7d 9a .
.v..hy.rRN.:.}.
0320 ea 0b 16 59 c
3 fc 53 9c e6 08 5c
15 d4 d8 81 81 .
..Y..S...\.....
0330 36 20 be 2b 5
f 23 53 88 b1 f4 44
74 ab 24 26 bd 6
.+_#S...Dt.$&.
0340 3d 5c 36 31 3
9 51 67 50 5d 1f 8d

5a 82 66 0c dc =
\619QgP]..Z.f..
0350 52 1c 0d 30 b
e b6 29 9b 7c e6 b4
81 ad d3 74 f8 R
..0..).|.....t.
0360 83 8f d9 25 d
c e7 c5 83 ce 4b 4f
a5 e2 e8 70 18 .
..%.....KO...p.
0370 ac 80 d1 88 0
2 54 e1 db 08 8a 2b
bf fe 8a 06 08 .
....T....+.....
0380 81 29 03 08 c
1 4f 8e c8 88 08 cd
82 18 83 be a6 .
)...O..........
0390 ca 38 ec 48 1
d b7 55 aa 89 11 51
cd 53 43 b4 50 .
8.H..U...Q.SC.P
03a0 d5 5a 5d 3c 9
6 bb 0f 59 88 b9 55
24 1c bd 02 5c .
Z]<...Y..U$...\
03b0 5c e3 78 4b 9
e 61 a6 e8 d9 1b 70
9e 5a 94 d6 71 \
.xK.a....p.Z..q
03c0 6a c7 c5 70 b
5 4f 88 7a 56 34 dd
82 20 23 c7 12 j
..p.O.zV4.. #..
03d0 3e 38 ff fb 9
2 04 e8 8f f2 fe 25
52 83 4f 7a 50 >
8........%R.OzP
03e0 5f 04 9a 50 6
9 ec 4a 0c 28 af 48
0d 61 e9 81 72 _
..Pi.J.(.H.a..r
03f0 12 69 01 97 b
d 28 b3 d8 57 53 58
b2 ed 23 ef 0f .
i...(..WSX..#..
0400 d2 20 22 00 8
c 4f 48 79 e8 a8 c2
f1 2e c5 58 2c .
"..OHy......X,
0410 28 b9 41 8c 4
9 0b 6b a4 aa 64 2c
22 31 35 28 72 (
.A.I.k..d,"15(r
0420 88 57 ae 5b 1
0 48 4b ed aa 74 b9
57 1f d4 d6 87 .
W.[.HK..t.W....
0430 21 97 6b c2 6
d c9 de e7 11 b2 3d
f7 7f 8b 6b 38 !
.k.m.....=...k8
0440 b3 64 4c 4b b
7 2a 7b 5f 0f 27 f4
f9 de 75 bf ed .
dLK.*{_.'...u..
0450 28 c4 b8 3a a
1 e7 73 8a 4b c2 ea
ec 6b 19 58 00 (

..:..s.K...k.X.
0460 0c 19 0c 69 a
0 c6 4e 12 18 f6 61
40 26 62 4b 6d .
..i..N...a@&bKm
0470 29 12 9d e1 7
f 19 e6 10 e3 90 2c
96 01 3f 62 09 )
.........,..?b.
0480 ca 96 5d 31 0
1 49 af 63 37 66 31
38 5a 85 9a 60 .
.]1.I.c7f18Z..`
0490 f4 26 d1 a2 e
2 1e 42 48 aa a5 9d
de 23 fd ff f7 .
&....BH....#...
04a0 4a f8 df 4d d
3 53 1e f5 8e ee 72
43 b9 e1 f9 cb J
..M.S....rC....
04b0 e8 24 da c9 c
e a1 e9 a9 75 02 02
99 6e c4 db 80 .
$......u...n...
04c0 80 4c 00 d0 c
4 a5 9b d0 50 78 d0
02 02 3d 2b e3 .
L......Px...=+.
04d0 a0 bc 2b 10 2
4 ba 31 c0 a9 5f 92
12 e1 e0 20 d3 .
.+.$.1.._.... .
04e0 ac aa b7 4f 0
e 47 e9 f3 c2 cd 87
a1 36 7d ac 5e .
..O.G......6}.^
04f0 71 3c 55 52 0
2 d4 78 2e 57 ce 3d
a9 57 39 b5 16 q
<UR..x.W.=.W9..
0500 16 a9 af ab c
e 7f 13 90 64 de c1
d8 7b f1 c9 5e .
.......d...{..^
0510 f0 9b 3f f5 9
4 01 df f6 df f3 7c
95 01 05 14 6c .
.?.......|....l
0520 0b 46
.
F
No. Time
Source
Destination
Protocol
Length Info
362 14.35157100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=22989
1 Ack=1 Win=46 Len=
1260

Frame 362: 1314 byt

es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.401501000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.401501000 s
econds
[Time delta fro
m previous captured
frame: 0.063003000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06300300
0 seconds]
[Time since ref
erence or first fra
me: 14.351571000 se
conds]
Frame Number: 3
62
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally

unique address (fac

tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf242 (62018)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (

6)
Header checksum
: 0x39e8 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 229891, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 229891 (relati
ve sequence number)
[Next sequence
number: 231151 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe0d
a [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 42 4
0 00 31 06 39 e8 4a
7c 0c 8a c0 a8 .
..B@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb e4 30 9e
87 4e aa 50 10 .
..P..+..0..N.P.
0030 00 2e e0 da 0
0 00 0f 96 80 d4 36
38 93 16 1c bc .
.........68....
0040 68 20 16 7d 2
4 0c c4 40 6d 00 d6
0d 35 a5 13 62 h
.}$..@m...5..b
0050 ea 76 15 30 d
0 54 45 da 81 d6 c0
ac e3 1f d2 a5 .
v.0.TE.........
0060 d0 17 91 63 d
5 25 61 ea 58 ca 4e
26 ed 26 26 c7 .
..c.%a.X.N&.&&.
0070 79 1a 3b 1d 6
f 8d 2d eb 4d d3 65
91 de 22 e7 70 y
.;.o.-.M.e..".p
0080 ab 8a e3 7f f
9 3e b3 19 ff fb 92
04 e9 0f f2 f7 .
....>..........
0090 25 51 83 78 7
a 50 5d c5 5a 30 69
ef 4c 0b 50 93 %
Q.xzP].Z0i.L.P.
00a0 46 0d e1 e9 4

1 89 12 28 81 a7 bd
29 82 71 59 fa F
...A..(...).qY.
00b0 1a 60 91 a0 2
4 ef dd d6 a2 ee 98
ec c1 8a 40 58 .
`..$.........@X
00c0 84 6c 56 08 c
f 16 0a 02 00 0a 54
e2 46 7a 0d 11 .
lV.......T.Fz..
00d0 18 3f 07 70 2
d c0 fd 0b 65 f0 d8
35 52 ac 08 50 .
?.p-...e..5R..P
00e0 3a d5 88 83 f
2 6e 2e 4c ea 7a 45
da 48 e0 d5 ea :
....n.L.zE.H...
00f0 ba b0 f5 34 5
d 4f 4d c1 89 49 b1
fd a3 c1 af b6 .
..4]OM..I......
0100 5c f5 9c 3a b
3 c9 fe b3 7c 45 10
de 97 96 7c 97 \
..:....|E....|.
0110 62 68 79 07 b
9 28 6f f5 14 09 18
8e 67 cb 91 11 b
hy..(o.....g...
0120 00 1d 8f 9b d
a 66 44 38 90 42 61
69 fc a5 82 10 .
....fD8.Bai....
0130 8b 0c bc 89 e
0 1d 74 6a ae fc 35
ca ef 42 62 30 .
.....tj..5..Bb0
0140 47 01 30 1a 1
c 42 ce 09 c2 da b2
b8 2e 08 5d 86 G
.0..B........].
0150 51 56 a6 79 d
c 55 8a c4 a3 1a 9f
d1 af 74 c6 35 Q
V.y.U.......t.5
0160 25 33 7a 66 9
f 58 fa df 45 39 ef
12 13 72 6d 25 %
3zf.X..E9...rm%
0170 a4 d3 34 32 2
e 9b d6 3c 48 59 a0
5f 83 44 20 2c .
.42...<HY._.D ,
0180 c7 44 eb 85 1
4 d1 3c 88 01 01 d6
aa 98 bc 0f ec .
D....<.........
0190 06 93 69 f1 2
9 a4 88 40 6d 22 38
a7 4e 43 b4 e1 .
.i.)..@m"8.NC..
01a0 c2 ee 36 cd 4
3 9c fc 70 50 2a 97
63 48 c3 9f 79 .
.6.C..pP*.cH..y
01b0 44 ed 08 4a d
d ae f7 83 16 f4 c6

ab 03 b6 62 d2 D
..J..........b.
01c0 6b 57 c5 61 7
5 d5 d4 80 23 4d 42
70 12 ad fc 15 k
W.au...#MBp....
01d0 7a 98 6b ff a
5 06 02 33 1b c1 44
86 f2 1d 41 ce z
.k....3..D...A.
01e0 48 a7 42 40 4
2 48 82 e3 cc 4f 68
0a 24 50 b5 00 H
.B@BH...Oh.$P..
01f0 43 ba 40 84 8
5 7d 52 34 27 6a 36
b3 99 82 8a a6 C
.@..}R4'j6.....
0200 ea 93 40 13 2
0 60 e2 dc 1c 82 d6
5d 8e 93 01 06 .
.@. `.....]....
0210 10 20 7b a5 9
b 1d ed b8 ef 75 02
15 2e ae b5 e1 .
{......u......
0220 e3 36 c4 37 0
d 7c 49 bf b8 d4 ff
fb 92 04 eb 0f .
6.7.|I.........
0230 f3 24 2d d0 8
3 4f 7a 60 5f a4 fa
20 69 ef 4a 0b .
$-..Oz`_.. i.J.
0240 d8 99 46 0d 6
1 e9 41 77 92 68 81
9c 3d 28 cb 1c .
.F.a.Aw.h..=(..
0250 6c b0 0b b9 f
6 df fe 73 49 84 31
a0 89 dc 10 3f l
......sI.1....?
0260 03 62 42 e5 1
b 8e 17 91 0c 20 21
ca 50 8a e9 7f .
bB...... !.P...
0270 16 10 d9 02 c
0 09 26 71 d4 83 82
7b 93 63 90 1c .
.....&q...{.c..
0280 22 66 31 c5 7
8 b6 0e b1 bc 1a 03
39 91 0d 52 21 "
f1.x......9..R!
0290 63 b8 55 a6 e
2 2b d4 4d 47 3c 57
0d 4d 2c 2d 4b c
.U..+.MG<W.M,-K
02a0 1e 4e cd 8b c
6 d7 b4 0d eb 71 a9
dd db 78 fb cc .
N.......q...x..
02b0 4d a5 cf 38 a
b ea 52 ef b9 de 90
61 43 59 04 cd M
..8..R....aCY..
02c0 2e 33 00 41 8
9 43 8c 18 ae 2c 64
c4 21 0e 03 03 .

3.A.C...,d.!...
02d0 aa f6 c0 97 5
2 45 74 2d 55 9b 65
ff dc 09 2f 88 .
...REt-U.e.../.
02e0 c5 1d f6 9b 1
2 86 5a 54 6a 52 a7
e5 6a 6b 1a 8d .
.....ZTjR..jk..
02f0 48 aa 0d 2a b
c b7 55 a8 2c d5 af
73 0c 65 97 f1 H
..*..U.,..s.e..
0300 c3 f9 cc 77 a
f fe d4 c3 f7 8e fd
fd a5 c3 b7 6a .
..w...........j
0310 e2 72 92 07 2
b 5b d0 b8 ce fc 54
00 70 20 b5 09 .
r..+[....T.p ..
0320 07 2a 02 2c 3
c 03 0d 99 7a b1 ab
7c 2d fb 70 65 .
*.,<...z..|-.pe
0330 96 9f 64 85 4
6 a7 25 fb 9f 76 20
7a 57 20 42 38 .
.d.F.%..v zW B8
0340 ec 8e 5b 01 4
9 e5 2d b4 6a e3 f5
2e 76 da 0a e8 .
.[.I.-.j...v...
0350 cc b0 55 8d 9
1 19 61 a9 35 a6 c7
0a d3 df 55 a2 .
.U...a.5.....U.
0360 b7 37 a4 0c 7
a e2 fb 52 d7 5e 5f
16 9f eb fb 6a .
7..z..R.^_....j
0370 34 81 f5 f9 e
e 85 0b 20 30 8c 8e
b0 e0 7e 70 3c 4
...... 0....~p<
0380 b3 16 34 d9 d
6 97 00 4d 12 88 21
13 c8 9e d3 d0 .
.4....M..!.....
0390 97 d8 79 6b 3
e 3b 2a 99 69 5c c6
cc f4 5f 3d d5 .
.yk>;*.i\..._=.
03a0 bb a4 0b 92 3
6 78 7d 10 5e a5 bb
72 e6 c0 e3 35 .
...6x}.^..r...5
03b0 e2 29 b3 2c 5
7 76 be 3e 71 0a 5a
e2 33 05 7f 8b .
).,Wv.>q.Z.3...
03c0 8c 1f d2 63 3
2 31 2b 9a 60 e7 94
45 ff fb 92 04 .
..c21+.`..E....
03d0 e9 8f f2 fd 2
5 51 83 58 7a 50 61
e5 0a 20 65 ef .
...%Q.XzPa.. e.

03e0 4a 0c 08 9d 4
4 0d 63 09 41 6b 15
e8 41 9c 3d 30 J
...D.c.Ak..A.=0
03f0 d2 d7 dd e9 0
2 20 32 87 80 e2 8e
e8 33 5e 14 c3 .
.... 2.....3^..
0400 97 11 10 67 c
3 42 9d 0b 31 96 04
c4 a4 d0 59 37 .
..g.B..1.....Y7
0410 de f7 c6 02 a
5 66 56 a5 15 50 12
94 5c bb 10 9f .
....fV..P..\...
0420 f6 bb 51 9c 5
2 ef 0f 89 33 fc ae
51 32 04 2c db .
.Q.R...3..Q2.,.
0430 78 ba ac 14 9
a 52 d7 c5 73 a8 4e
37 8b 68 10 fd x
....R..s.N7.h..
0440 a9 6c 29 a9 a
e f3 be de ff f9 dd
23 f1 68 f0 c2 .
l)........#.h..
0450 b1 67 ed d0 0
4 30 61 f6 1d a4 23
60 8c 61 e1 00 .
g...0a...#`.a..
0460 83 8d 26 1c 0
2 83 68 62 01 2f c5
91 49 07 c4 91 .
.&...hb./..I...
0470 11 4c 2a c0 7
3 2d 87 9f 9b b3 6e
be 31 ec b2 58 .
L*.s-....n.1..X
0480 6a d0 c4 b7 0
b 2a 75 03 ca 7b 6f
29 48 20 50 f4 j
....*u..{o)H P.
0490 aa a4 5f 09 6
5 af c7 79 65 43 5f
0c b3 fd 49 fb .
._.e..yeC_...I.
04a0 f8 d4 d3 d3 2
d fe 63 bf bd e0 1b
9f b1 3d e6 ae .
...-.c......=..
04b0 3c ca 0c 11 c
3 3f 80 3f 91 cf 0c
73 08 98 12 43 <
....?.?...s...C
04c0 20 5b 98 14 4
a 3e 27 a3 ec a3 53
10 f4 3a 3e c6
[..J>'...S..:>.
04d0 d1 d9 80 ec b
e f7 b2 b2 d8 15 d4
0b 2d 97 48 ac .
...........-.H.
04e0 3d 49 81 ce f
2 b1 47 32 16 a8 a2
e6 cb 90 13 17 =
I....G2........
04f0 98 a3 1e 72 b

9 38 f8 be 35 9b da
93 99 a7 6e 72 .
..r.8..5.....nr
0500 fd eb cb 22 e
0 ea 97 dc 28 d7 24
26 61 c1 93 2c .
.."....(.$&a..,
0510 43 45 df a5 1
4 2a 30 85 0d 8c a3
1d 2c ff 2a 3f C
E...*0.....,.*?
0520 82 4c
.
L
No. Time
Source
Destination
Protocol
Length Info
363 14.35174900
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=231151 Win=39485 L
en=0
Frame 363: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.401679000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.401679000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 14.351749000 se
conds]
Frame Number: 3
63
Frame Length: 5
4 bytes (432 bits)
Capture Length:

54 bytes (432 bits

)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))

0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f9e (20382)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 23115
1, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 231151 (
relative ack number
)

Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39485
[Calculated win
dow size: 39485]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 362]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 9e 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b

cb e9 1c 50 10 .
....P..N.+...P.
0030 9a 3d 18 d4 0
0 00
.
=....
No. Time
Source
Destination
Protocol
Length Info
364 14.36757300
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1300 http49
574 [PSH, ACK] Seq=
231151 Ack=1 Win=46
Len=1246
Frame 364: 1300 byt
es on wire (10400 b
its), 1300 bytes ca
ptured (10400 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.417503000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.417503000 s
econds
[Time delta fro
m previous captured
frame: 0.015824000
seconds]
[Time delta fro
m previous displaye
d frame: 0.01582400
0 seconds]
[Time since ref
erence or first fra
me: 14.367573000 se
conds]
Frame Number: 3
64
Frame Length: 1
300 bytes (10400 bi
ts)
Capture Length:
1300 bytes (10400
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype

:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab

le Transport) (0x00
)
Total Length: 1
286
Identification:
0xf243 (62019)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39f5 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 231151, Ack:
1, Len: 1246
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1246]
Sequence number
: 231151 (relati
ve sequence number)
[Next sequence
number: 232397 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018

(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x65b
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1246]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 06 f2 43 4
0 00 31 06 39 f5 4a
7c 0c 8a c0 a8 .
..C@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb e9 1c 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 65 b9 0
0 00 30 73 b6 c1 b5
54 01 42 6a 56 .
.e...0s...T.BjV
0040 50 86 44 b9 1
9 cb fa 01 2a 6a ca
e4 9f 29 b7 ab P

.D.....*j...)..
0050 2d da 13 35 f
9 5f da 8a f5 a5 c8
b0 db b4 bf fe ..5._..........
0060 92 f4 a2 a8 b
1 e9 30 c7 2e d3 df
de 5b c7 09 8b .
.....0.....[...
0070 d3 19 67 77 3
b 7d fa 6a 7c 5a 27
73 de 5f 7a 89 .
.gw;}.j|Z's._z.
0080 50 58 ff fb 9
2 04 ea 0f f2 d0 26
51 03 58 7a 50 P
X........&Q.XzP
0090 5f e5 8a 00 6
b 0f 4c 0b cc a1 42
0d 63 09 41 8b _
...k.L...B.c.A.
00a0 93 a7 c1 ac 3
d 28 47 81 9c ce 94
da fd df 41 88 .
...=(G.......A.
00b0 10 72 d4 9b 7
2 66 91 40 a9 90 72
11 e0 8e a8 59 .
r..rf.@..r....Y
00c0 62 81 aa b3 c
b 0f 37 56 72 ee 03
5a d4 27 60 2a b
.....7Vr..Z.'`*
00d0 b3 78 72 1e 5
5 7a 69 7f d9 93 ed
55 65 cb ce 5f .
xr.Uzi....Ue.._
00e0 d8 e8 a2 1f 9
6 42 e8 74 3d 09 f7
4f 26 8d 77 4e .
....B.t=..O&.wN
00f0 b1 6d c5 a3 c
8 2f 6b a7 fb 7f f2
e4 cf 53 b3 78 .
m.../k......S.x
0100 cd a2 42 df c
7 f5 c4 d0 36 b2 62
81 2a 22 bd ad .
.B.....6.b.*"..
0110 92 fa 8b 78 6
e c1 86 97 13 90 6d
5c 9a 33 47 78 .
..xn.....m\.3Gx
0120 7b 71 53 ec b
0 46 16 23 2e 60 31
a6 c6 28 67 4f {
qS..F.#.`1..(gO
0130 74 b8 cb ae e
e 24 e9 2a de dc ab
3f c5 3a ca 21 t
....$.*...?.:.!
0140 ae c9 b0 54 d
3 35 22 e5 74 42 c0
8e f3 a4 c9 21 .
..T.5".tB.....!
0150 33 2b eb 45 1
7 3c 4d b2 91 3a 44
99 68 a1 27 c8 3
+.E.<M..:D.h.'.

0160 55 51 40 e3 6
b d1 63 08 b7 d8 b7
e5 db 4a 48 1a U
Q@.k.c......JH.
0170 5f 69 10 72 0
9 9b b3 46 6c 30 34
32 0e 98 74 6a _
i.r...Fl042..tj
0180 28 9d 21 b1 c
c 03 b9 8c 28 40 f0
39 91 aa c3 d5 (
.!.....(@.9....
0190 ad 76 af 42 5
3 88 e5 43 13 b6 c2
a1 a8 83 33 66 .
v.BS..C......3f
01a0 aa d0 75 dd 5
a b4 9f d8 66 ad 5d
5b 37 79 af f1 .
.u.Z...f.][7y..
01b0 ba d9 5a d7 f
d 60 be f2 f9 3b 92
dd 7d 71 0a 7e .
.Z..`...;..}q.~
01c0 b9 72 08 8f a
b 1b d3 a7 d3 1a 08
08 37 3c 71 c3 .
r..........7<q.
01d0 7f 1d 32 54 a
3 14 21 38 31 b0 e0
e1 a2 90 20 21 .
.2T..!81..... !
01e0 08 5d 75 87 4
a 0c 98 80 1d ac ca
6a dd c8 72 96 .
]u.J......j..r.
01f0 5f 4a cf 24 b
3 b1 ea 93 f7 32 8e
30 8a 2f 67 0f _
J.$.....2.0./g.
0200 92 05 98 91 5
8 5e 89 c1 17 33 5b
2e e1 a3 3d 37 .
...X^...3[...=7
0210 fa 95 c6 1c 7
9 24 95 62 b6 c3 8d
4f 54 14 4a 6f .
...y$.b...OT.Jo
0220 78 af ff fc f
f fb 92 04 eb 0f f3
05 27 d0 03 58 x
...........'..X
0230 c2 50 63 a5 8
9 f0 6b 0f 4c 0b 6c
b1 40 0d 62 49 .
Pc...k.L.l.@.bI
0240 81 6d 14 28 0
1 a7 bd 28 ea 41 b7
a2 c2 d6 bf 52 .
m.(...(.A.....R
0250 06 98 f6 66 f
0 11 af 0a 73 90 03
96 92 97 40 18 .
..f....s.....@.
0260 44 c4 29 78 d
2 f9 c7 5c ee db 90
4c 54 09 41 51 D
.)x...\...LT.AQ
0270 57 f5 94 4a 6

5 2f c4 46 59 49 24
be f3 4c 3b d5 W
..Je/.FYI$..L;.
0280 5f a9 9b 2d c
5 19 98 a9 98 d9 50
64 ec 41 c5 86 _
..-......Pd.A..
0290 c9 a5 a6 4d 5
3 7f b6 cc c5 e5 89
97 0d 59 95 86 .
..MS........Y..
02a0 ad 6e eb ef 2
7 8f fe b7 af 49 67
5e 89 6c 34 f4 .
n..'....Ig^.l4.
02b0 45 12 ac 46 5
0 9d 39 a5 04 6f 0a
86 0a 35 82 93 E
..FP.9..o...5..
02c0 31 4e 94 0d 3
d 68 e0 48 62 59 2f
26 5c 7e 9e d3 1
N..=h.HbY/&\~..
02d0 e8 f1 c3 74 6
e 03 b1 03 bf 11 8b
74 ef fc b9 c4 .
..tn......t....
02e0 b1 20 c9 81 4
a 33 5f c3 c2 72 22
61 b2 8d 70 e3 .
..J3_..r"a..p.
02f0 ed c2 25 b1 8
8 11 29 8d df 7e be
f9 85 4a cf aa .
.%...)..~...J..
0300 40 79 4d 5e f
1 0b 81 1d 13 9f 28
70 70 62 c5 9c @
yM^......(ppb..
0310 17 7f 4a 73 9
9 15 19 03 96 48 aa
9a 23 28 02 cc .
.Js.....H..#(..
0320 41 a7 e8 59 f
0 c8 90 60 55 84 fb
6c 78 ea 45 f3 A
..Y...`U..lx.E.
0330 9d f3 81 9b 7
6 e4 31 b5 5e a3 7c
86 1d 2d ce ce .
...v.1.^.|..-..
0340 16 83 13 f6 e
4 f2 82 76 3c ea 77
d8 58 79 6f 9b .
......v<.w.Xyo.
0350 b0 78 d4 4f c
b 10 db 5e b4 f4 7d
8b 3a d4 9d a4 .
x.O...^..}.:...
0360 cb 76 70 fd a
d 38 18 14 18 00 50
02 dd f2 ea 41 .
vp..8....P....A
0370 29 cf 22 28 6
5 2f 03 09 b1 c0 33
36 de 03 a5 53 )
."(e/....36...S
0380 16 24 d8 ff 3
3 ce f1 62 69 58 6c

21 67 0c 73 ba .
$..3..biXl!g.s.
0390 12 2d 48 53 9
e b0 51 68 84 4d 01
97 83 66 d5 3c .
-HS..Qh.M...f.<
03a0 92 85 1e 36 2
0 67 49 5e 91 45 85
36 27 a4 97 77 .
..6 gI^.E.6'..w
03b0 55 bb c6 ae b
b 57 6d bf ef 72 71
01 86 c2 8e 14 U
....Wm..rq.....
03c0 69 00 f9 27 2
c 4e ff fb 92 04 ec
8f f3 15 2b cf i
..',N........+.
03d0 83 78 7a 60 6
1 a5 79 f0 6b 0f 4c
0c 2c a5 48 0d .
xz`a.y.k.L.,.H.
03e0 61 e9 81 6f 1
5 e9 01 97 b1 30 20
30 e7 7b 7f 76 a
..o.....0 0.{.v
03f0 86 92 06 f0 6
4 55 ad f4 8d 23 db
1f 87 54 1c 8c .
...dU...#...T..
0400 74 9c 19 b8 3
e 1b 89 65 07 cb 6a
62 54 bc 86 6c t
...>..e..jbT..l
0410 32 34 3d 12 e
c 27 0f 82 5a 45 d3
b3 09 38 b0 91 2
4=..'..ZE...8..
0420 32 84 2f 23 6
4 0b d6 8c 4d b2 03
0b 03 e2 20 82 2
./#d...M..... .
0430 0f 49 b4 75 2
4 6a 69 b2 06 4d b9
b5 f7 2a 3b 15 .
I.u$ji..M...*;.
0440 93 48 24 7c a
1 a5 19 10 bc 54 55
ba 94 82 9a 72 .
H$|.....TU....r
0450 60 8c 15 16 6
e 04 4d 8b 33 71 e0
4e 39 71 ac f2 `
...n.M.3q.N9q..
0460 06 86 8f 0a 8
5 08 e5 05 56 6e 6c
aa d3 90 25 69 .
.......Vnl...%i
0470 52 21 ce ca 0
5 a4 9b a6 66 50 ad
d7 ce 7f 18 33 R
!......fP.....3
0480 d2 41 37 82 1
e 10 72 b4 de 16 e8
67 1c f1 1d dc .
A7...r....g....
0490 ff ca 55 7e 2
4 7a e5 e6 9a 57 22
4f ff 32 fc f7 .

.U~$z...W"O.2..
04a0 72 f9 cf fe 2
7 fe 2d c4 c2 2a 7d
6f d4 30 06 a1 r
...'.-..*}o.0..
04b0 8a 9c 28 65 2
1 40 29 80 d8 92 41
d2 72 d7 4c 3c .
.(e!@)...A.r.L<
04c0 f0 3f c2 a2 0
d 84 cd 99 a2 ba 32
59 8e 02 b0 2a .
?........2Y...*
04d0 14 c5 a1 08 9
4 28 2a 3c 26 6b 20
4c d2 92 3d a8 .
....(*<&k L..=.
04e0 a4 bb 46 9b 2
2 2c b3 26 62 c7 54
c4 65 fb b7 b3 .
.F.",.&b.T.e...
04f0 28 13 cf b5 1
5 09 43 e6 08 8a 92
1e 24 4b 9a 7c (
.....C.....$K.|
0500 40 2a ba 61 1
4 2b bf 51 bd 0e 97
c8 b8 4e 72 ff @
*.a.+.Q.....Nr.
0510 b5 df 31 4d
.
.1M
No. Time
Source
Destination
Protocol
Length Info
365 14.50457600
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=23239
7 Ack=1 Win=46 Len=
1260
Frame 365: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.554506000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.554506000 s

econds
[Time delta fro
m previous captured
frame: 0.137003000
seconds]
[Time delta fro
m previous displaye
d frame: 0.13700300
0 seconds]
[Time since ref
erence or first fra
me: 14.504576000 se
conds]
Frame Number: 3
65
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua

l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf244 (62020)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39e6 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro

l Protocol, Src Por

t: http (80), Dst P
ort: 49574 (49574),
Seq: 232397, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 232397 (relati
ve sequence number)
[Next sequence
number: 233657 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x6af
7 [validation disab
led]
[Good Check
sum: False]
[Bad Checks

um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2506]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 44 4
0 00 31 06 39 e6 4a
7c 0c 8a c0 a8 .
..D@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb ed fa 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 6a f7 0
0 00 4c 68 80 f1 1d
74 54 93 41 ed .
.j...Lh...tT.A.
0040 95 df 8c 00 0
2 73 20 db 28 83 24
c4 eb ce 30 40 .
....s .(.$...0@
0050 a4 49 ec 83 1
0 03 04 41 06 54 48
15 c2 e8 0d 5c .
I.....A.TH....\
0060 c9 20 38 86 6
6 5d 9c 76 a7 5a 1f
87 5e 55 c4 1f .
8.f].v.Z..^U..
0070 94 69 45 83 e
1 ee 69 8d 49 37 50
d1 04 17 0b 1f .
iE...i.I7P.....
0080 0b 36 4c 30 5
0 60 72 41 27 97 ff
fb 92 04 ea 8f .
6L0P`rA'.......
0090 f2 ec 28 54 8
3 4f 4a 50 5f e5 8a
e0 61 89 4c 0c .
.(T.OJP_...a.L.
00a0 81 35 58 0c 2
4 6b c1 7d 13 2b c1
84 a5 28 16 18 .
5X.$k.}.+...(..
00b0 fb c4 37 d8 4
0 58 bb 01 f0 7c 57
a2 8f 55 80 f0 .
.7.@X...|W..U..
00c0 d2 32 a6 33 0
f 20 d1 31 d3 48 4b
21 2d 89 be 07 .
2.3. .1.HK!-...
00d0 7b 02 82 6e 1
8 90 a1 13 0f c8 00
ab 0a ce 82 1c {
..n............
00e0 b9 7a 96 c4 f
2 7f 78 e5 52 1e 56
18 c1 9e 37 dd .
z....x.R.V...7.
00f0 8b 8c 7f e3 8

7 e1 d5 d4 f7 74 67
6f b9 dd 6d 7f .
........tgo..m.
0100 0b 1b fe d6 0
6 46 32 40 0f d8 9f
7f 7f 9e ff 3a .
....F2@.......:
0110 1f 16 e5 e0 8
e 8f 97 0a 87 65 05
d5 57 49 7a d0 .
........e..WIz.
0120 e9 20 19 e8 6
5 a2 43 c5 8d 3d 12
2c 0a 1e e4 33 .
..e.C..=.,...3
0130 92 a0 30 a0 1
0 e1 60 a2 51 64 ab
93 f7 ba b4 7f .
.0...`.Qd......
0140 77 bc 6f fd 9
2 ca 27 6c 8a 31 4e
52 e7 fc 33 3c w
.o...'l.1NR..3<
0150 93 7f e9 4f f
3 e2 ce ff 99 62 ba
4a 73 39 f1 61 .
..O.....b.Js9.a
0160 21 bd 93 66 a
9 92 9f 6f 59 6c f8
df 41 59 c1 10 !
..f...oYl..AY..
0170 92 86 d1 0d 2
8 91 e3 c8 0d 02 4c
33 52 62 1c 05 .
...(.....L3Rb..
0180 f6 45 7b 71 4
7 a6 a8 4c 2c 2f 6b
05 d5 59 e1 3d .
E{qG..L,/k..Y.=
0190 15 6a 2b 19 2
6 2c 7e 44 27 67 2b
d9 2f dd 28 4a .
j+.&,~D'g+./.(J
01a0 ea ae f7 fc c
5 a7 a6 d1 4c 05 44
c6 1a 63 fe 55 .
.......L.D..c.U
01b0 f4 61 ff 30 d
f f1 44 bd 8e ac 3f
36 6a e0 9a af .
a.0..D...?6j...
01c0 c4 e0 9d 28 3
a 99 fd f1 ab 76 23
71 31 1b b8 91 .
..(:....v#q1...
01d0 4f 7b ef c0 5
f e1 96 b4 ca 1e 09
60 82 a5 4a 81 O
{.._......`..J.
01e0 f9 a0 31 73 a
8 d8 3b 19 84 89 a1
12 b8 8f 67 e7 .
.1s..;.......g.
01f0 82 67 75 4f b
7 11 48 79 29 a4 f8
47 71 68 ed 4e .
guO..Hy)..Gqh.N
0200 29 a9 45 70 7
6 20 98 bb 7e 0b 75

83 ff 8d bb ee )
.Epv ..~.u.....
0210 dc bf dd f3 f
5 bf d5 fa ec 72 fe
9d e8 71 44 f9 .
........r...qD.
0220 7d ff 09 f0 a
5 e7 85 62 69 d9 05
78 ff fb 92 04 }
......bi..x....
0230 e9 0f f2 fe 2
5 d8 83 09 1a 50 5d
83 db 10 3d 26 .
...%....P]...=&
0240 4a 4c 3d 47 6
2 0c 18 6b c1 7d 0d
ec 00 f7 a4 e1 J
L=Gb..k.}......
0250 31 cf 7f 7c 2
9 ae 1d 8b bf 45 f8
6a a8 83 2b 16 1
..|)....E.j..+.
0260 72 c9 6e 51 9
6 19 3a 26 08 a1 41
39 14 2f 06 14 r
.nQ..:&..A9./..
0270 26 7a a8 23 4
9 53 41 f1 a7 a0 48
e3 87 61 76 de &
z.#ISA...H..av.
0280 51 36 60 b9 2
a 8d c9 fd 3d 2f 76
3e df cd 7a ef Q
6`.*...=/v>..z.
0290 8e fd 30 13 5
e 05 6b d9 73 d6 64
ee 13 22 78 16 .
.0.^.k.s.d.."x.
02a0 52 1a 12 7c 1
a 0e a1 92 c1 40 eb
0b 1e 8b 3e f7 R
..|.....@....>.
02b0 91 7d 8c 53 f
3 db 05 1e 85 16 d8
da 88 f7 40 de .
}.S..........@.
02c0 2c c6 70 c1 6
4 b5 89 52 67 1e d5
0b 10 4e 8a 68 ,
.p.d..Rg....N.h
02d0 e5 cd cd c2 3
6 66 a8 32 2d a7 db
8a 79 11 1e 24 .
...6f.2-...y..$
02e0 17 50 e0 39 1
f 57 20 3f a9 46 dc
bd 2b 91 b9 1b .
P.9.W ?.F..+...
02f0 5c fd aa a7 9
8 c9 ad b6 b7 84 3c
6c 3a 1d 3e 1a \
.........<l:.>.
0300 52 4e a8 e0 6
c 89 27 e2 08 09 18
48 40 49 ce da R
N..l.'....H@I..
0310 d0 bd a9 45 2
9 d6 bb bf 58 14 60
ed 03 87 0e 04 .

..E)...X.`.....
0320 f8 09 40 90 7
6 18 19 19 ad 0c c9
ac 14 a4 43 2c .
.@.v.........C,
0330 98 20 8c 62 8
9 19 89 e1 a2 a2 62
3a 3a fe 0f af .
.b......b::...
0340 b4 de 41 a8 1
1 09 49 d0 f1 87 5b
24 d0 a0 ab 0c .
.A...I...[$....
0350 82 8a 1e cf 4
6 96 d4 2d 6f 26 9a
6f 37 5c d2 65 .
...F..-o&.o7\.e
0360 e1 d5 bd b1 0
4 05 74 24 20 24 e7
12 a2 f7 35 63 .
.....t$ $....5c
0370 6d 4e dc 66 a
7 ff 62 ea 0b 29 33
81 cf 29 45 83 m
N.f..b..)3..)E.
0380 37 84 41 27 8
0 41 d6 08 1d a2 52
12 f0 56 8e d3 7
.A'.A....R..V..
0390 b1 b9 54 6f 8
8 12 1a 6a 48 2e 8d
5d e9 80 e6 cb .
.To...jH..]....
03a0 78 ee 50 da 9
5 aa 78 b0 1c e1 33
9d 05 08 a0 a9 x
.P...x...3.....
03b0 46 9f 04 c8 8
a 31 1a 1b 84 9a 9a
54 1b 11 04 5f F
....1.....T..._
03c0 34 7d ef db a
4 0d a7 24 cb df 49
ea 1e 05 ff fb 4
}.....$..I.....
03d0 92 04 e8 8f f
2 e3 16 d6 83 0f 49
c2 5f c4 ea c0 .
.........I._...
03e0 61 26 4a 0b f
0 7f 50 0c bd 89 41
7a 95 ea 01 96 a
&J...P...Az....
03f0 21 30 50 1a 0
e 61 2b 8c 23 62 bf
a8 44 f8 7d 11 !
0P..a+.#b..D.}.
0400 45 9a 54 66 0
5 1a 89 d4 03 07 2e
0d b5 2b 62 ad E
.Tf.........+b.
0410 81 f1 7b 43 1
1 4a cb dd 5d 3b 92
75 e1 ca c7 b4 .
.{C.J..];.u....
0420 f7 6c 46 c7 c
4 cd 2a c2 39 95 91
28 d2 e5 ed 82 .
lF...*.9..(....

0430 11 88 ac b5 3
e 7a 94 ae 09 e5 98
9b 30 f5 fe f6 .
...>z......0...
0440 fe cf dc f6 9
3 38 58 38 78 9e 06
c9 a4 ec f2 42 .
....8X8x......B
0450 31 53 85 61 8
7 45 09 6d c9 2a cf
ac c8 2a 31 0f 1
S.a.E.m.*...*1.
0460 cd 19 f0 78 6
3 76 1c d0 15 05 08
1c 10 05 10 9f .
..xcv..........
0470 62 b3 6a 2d 9
5 4b ea 4a 21 f5 04
76 5c 5c 5b e8 b
.j-.K.J!..v\\[.
0480 4d ba 06 c1 5
6 5f 28 a6 bb 9e 60
55 19 47 52 3d M
...V_(...`U.GR=
0490 d6 19 71 43 c
c a4 31 b6 a8 46 6b
5c 93 2a 21 ec .
.qC..1..Fk\.*!.
04a0 5f e0 e1 66 1
1 58 14 95 64 56 e3
49 48 c4 61 40 _
..f.X..dV.IH.a@
04b0 f3 34 15 bd c
7 64 3a fa 2b fa 4c
82 40 00 43 20 .
4...d:.+.L.@.C
04c0 60 7a 51 c5 0
c c5 43 1a ac 29 78
27 4b eb 18 c8 `
zQ...C..)x'K...
04d0 55 b6 1f e3 e
0 9b 1c aa 56 18 32
3f 52 2e d0 d4 U
.......V.2?R...
04e0 fb 43 e5 2c c
f f0 d9 a8 c5 13 f0
7a 31 cc 47 05 .
C.,.......z1.G.
04f0 75 99 05 a5 2
8 88 b5 67 26 7f 55
6a f1 cb 78 d3 u
...(..g&.Uj..x.
0500 ff b9 5d bb 5
6 e0 70 ba 2b 58 d7
1a 4c c2 35 1a .
.].V.p.+X..L.5.
0510 5a 58 82 a9 3
c 31 15 bb 68 b6 36
bb 3a aa 31 61 Z
X..<1..h.6.:.1a
0520 0c c3
.
.
No. Time
Source
Destination
Protocol

Length Info
366 14.50476100
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=233657 Win=39690 L
en=0
Frame 366: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.554691000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.554691000 s
econds
[Time delta fro
m previous captured
frame: 0.000185000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018500
0 seconds]
[Time since ref
erence or first fra
me: 14.504761000 se
conds]
Frame Number: 3
66
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17

:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4f9f (20383)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =

Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 23365
7, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 233657 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39690
[Calculated win
dow size: 39690]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 365]
[The RTT to
ACK the segment wa
s: 0.000185000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f 9f 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb f2 e6 50 10 .
....P..N.+...P.
0030 9b 0a 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
367 14.57258300
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=23365
7 Ack=1 Win=46 Len=

1260
Frame 367: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.622513000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.622513000 s
econds
[Time delta fro
m previous captured
frame: 0.067822000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06782200
0 seconds]
[Time since ref
erence or first fra
me: 14.572583000 se
conds]
Frame Number: 3
67
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .

... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf245 (62021)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4

9
Protocol: TCP (
6)
Header checksum
: 0x39e5 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 233657, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 233657 (relati
ve sequence number)
[Next sequence
number: 234917 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set

.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xfb1
0 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 45 4
0 00 31 06 39 e5 4a
7c 0c 8a c0 a8 .
..E@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb f2 e6 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e fb 10 0
0 00 70 d1 a2 4b 8c
69 80 79 60 30 .
.....p..K.i.y`0
0040 74 39 18 b7 6
8 50 48 b5 be ec b5
e7 67 8e 40 b4 t
9..hPH.....g.@.
0050 68 ec cb d0 1
3 2f ed 48 0a fc 62
a4 b6 59 a9 6e h
..../.H..b..Y.n
0060 fa ee d3 01 d
e 25 8d 12 7c 38 fc
fc af a2 de e5 .
....%..|8......
0070 bf bf 36 bf 6
4 50 0b 5c d4 51 a4
cd e5 2a f4 10 .
.6.dP.\.Q...*..
0080 5d f5 e3 ce f
f fb 92 04 ea 0f f2
fe 2b d3 83 4f ]
...........+..O
0090 42 60 60 05 6
a 60 65 e9 4c 0b d0
99 4c 0d 61 09 B

``.j`e.L...L.a.
00a0 41 8c 14 a9 4
1 a7 a5 30 7b 1d aa
cb 71 7f bd f7 A
...A..0{...q...
00b0 f7 fe 77 fa e
f d9 32 46 f0 e0 c5
41 cb 81 d8 07 .
.w...2F...A....
00c0 1e 11 34 02 1
0 14 80 80 ad 08 e2
1c 99 4a 1a a4 .
.4..........J..
00d0 42 8e cb 59 5
6 b3 2b 91 6a 54 31
c2 56 c4 43 33 B
..YV.+.jT1.V.C3
00e0 14 d2 b7 01 3
b 98 4c ef 05 36 5d
48 29 be d6 21 .
...;.L..6]H)..!
00f0 95 ae 5a 93 c
c c4 ad aa 8d e4 25
93 b6 10 f0 23 .
.Z.......%....#
0100 dc 74 5d c9 5
c 62 a3 16 50 51 e5
0d db 3b 7d 4b .
t].\b..PQ...;}K
0110 0c 3a 0e 72 7
6 07 01 c6 1c 20 67
28 00 70 06 88 .
:.rv.... g(.p..
0120 09 58 f5 c5 5
1 2d 7e 11 4e 13 0c
c3 c2 53 ad 5a .
X..Q-~.N....S.Z
0130 db 30 9e ab 4
9 04 58 e7 27 71 81
12 02 66 f0 70 .
0..I.X.'q...f.p
0140 bc 43 f1 0a 2
2 9b 69 75 87 38 57
d4 09 be 71 9b .
C..".iu.8W...q.
0150 5e 98 ce 66 c
7 de b3 98 4d b1 40
e7 03 e1 71 ec ^
..f....M.@...q.
0160 30 09 37 60 3
8 16 a9 a2 b7 b4 eb
4e 14 4d 62 bf 0
.7`8......N.Mb.
0170 41 94 68 3b 8
0 a3 25 be 02 42 61
10 3c e3 c2 87 A
.h;..%..Ba.<...
0180 57 21 40 35 8
2 d0 5c cc 54 34 6f
19 a7 4a ba 22 W
!@5..\.T4o..J."
0190 b5 f6 9e 30 c
3 9a d1 7a c8 98 66
8e d9 20 de ab .
..0...z..f.. ..
01a0 9c 7b cd 98 5
6 b9 fe 63 26 93 59
ba 87 b2 f5 b7 .
{..V..c&.Y.....

01b0 5a 76 b6 85 5
0 d9 51 fb a8 04 82
fe b5 5a bf f4 Z
v..P.Q......Z..
01c0 f2 f3 c9 8f 7
4 e3 1f ff 7f fe d5
18 84 65 8f 1b .
...t........e..
01d0 02 66 98 09 b
d 1e 70 52 b2 74 39
9c 50 49 9e 04 .
f....pR.t9.PI..
01e0 80 a2 0a 80 6
9 a1 ee 04 b4 13 47
22 56 38 fb 54 .
...i.....G"V8.T
01f0 ed 72 d4 a3 d
b 9d 55 5d 9e b0 8e
37 f5 57 13 69 .
r....U]...7.W.i
0200 f1 22 76 4b b
8 d3 11 7b eb 67 d2
db 9e 49 29 5c .
"vK...{.g...I)\
0210 61 c7 7a d5 b
6 fa 0c c4 4e 1c 55
8d 12 82 ca 36 a
.z.....N.U....6
0220 89 d0 a5 ac 8
9 69 ff fb 90 04 e8
0f f2 fd 21 d2 .
....i........!.
0230 83 58 62 52 5
a 64 fa 50 65 e9 4a
0c 14 93 4a 0d .
XbRZd.Pe.J...J.
0240 61 e9 41 66 1
2 29 41 97 b1 29 95
6b c5 ff 15 f4 a
.Af.)A..).k....
0250 74 88 93 19 0
0 2e 73 3c 05 86 15
12 10 d9 22 c9 t
.....s<......".
0260 87 41 ac 82 7
9 23 17 6b b6 c8 19
c1 14 a5 af 3c .
A..y#.k.......<
0270 82 9a 43 7e 2
f 17 a9 2e 97 d0 d9
ad 6e 28 d7 a9 .
.C~/.......n(..
0280 73 71 a0 34 f
6 0f 43 eb 1d 58 8f
3f d5 3f b7 ff s
q.4..C..X.?.?..
0290 f7 8b d5 c7 6
9 47 27 bd ac ca d3
2c d5 dc 9c a7 .
...iG'....,....
02a0 cc fb 52 2e 1
6 16 62 27 42 8f 6b
2b 30 91 33 37 .
.R...b'B.k+0.37
02b0 8c 1c bf f4 7
5 2c 30 eb 63 21 14
e4 95 32 eb 8c .
...u,0.c!...2..
02c0 e4 24 2a 10 9

7 35 13 c9 82 92 e9
b1 0e 30 15 e7 .
$*..5.......0..
02d0 a9 7c 31 12 3
6 f6 bc b9 a6 4b b9
01 4a 18 fb f5 .
|1.6....K..J...
02e0 35 62 1c 74 2
8 5e 17 1f bf 45 93
9b 43 f3 21 05 5
b.t(^...E..C.!.
02f0 a6 5a 72 66 f
5 7a 67 ab 1d 6b 35
48 a3 36 ce 49 .
Zrf.zg..k5H.6.I
0300 01 a7 01 20 a
1 1c b1 67 ef 06 6d
30 a4 e7 28 4d .
.. ...g..m0..(M
0310 53 ff 5b 3e a
0 ba a6 72 43 4d 0b
62 69 50 b9 85 S
.[>...rCM.biP..
0320 99 1e 08 bf 8
b 7d 43 9b e2 43 23
65 c6 90 97 ac .
....}C..C#e....
0330 62 3d 23 97 c
4 e6 be 32 9e b3 57
31 96 4b 24 b0 b
=#....2..W1.K$.
0340 86 03 e2 8e c
b 23 38 4e 9c a2 99
2a ab 9f 5a 5b .
....#8N...*..Z[
0350 41 ee 9e 9a a
e 51 ac 44 92 2e d6
38 3a 08 82 85 A
....Q.D...8:...
0360 41 20 a3 d4 6
9 6f 50 c4 a9 0b 63
98 b3 f4 d1 fa A
..ioP...c.....
0370 2e b7 ff a1 3
2 83 8d 58 a0 36 e3
1e 78 4f a8 ac .
...2..X.6..xO..
0380 91 00 a0 e4 8
6 59 e2 9a 24 52 1a
08 a0 5b f7 ea .
....Y..$R...[..
0390 04 59 c8 4b 7
5 d8 13 41 59 f0 d4
22 03 87 dd a9 .
Y.Ku..AY.."....
03a0 65 25 1b 88 9
d 55 9e 88 c2 de 94
57 9f c2 31 06 e
%...U.....W..1.
03b0 f1 0e 6a 11 8
5 65 9b e0 6b 7b ff
78 f8 a6 ad 9a .
.j..e..k{.x....
03c0 e5 6f 34 c4 6
9 d7 4e ff fb 92 04
ec 0f f3 11 25 .
o4.i.N........%
03d0 52 03 4f 7a 5
0 64 05 8a 30 6b 0c

4c 0b ec 8f 44 R
.OzPd..0k.L...D
03e0 0d 61 89 41 7
d 11 a8 81 9c 31 28
78 dc fd cd 60 .
a.A}....1(x...`
03f0 81 4e 4c 78 d
a 29 70 6e 3e b2 69
4f 12 4b b0 1a .
NLx.)pn>.iO.K..
0400 00 0f 52 c1 6
6 18 85 c4 5c ea b4
97 10 41 14 1f .
.R.f...\....A..
0410 a8 73 40 2d c
b 7a 2d 24 95 d3 e5
04 3d 19 08 44 .
s@-.z-$....=..D
0420 ae cd 04 e9 9
6 9c 2b 0b fb 43 1b
10 f0 cc 65 2a .
.....+..C....e*
0430 1d 42 78 ac b
3 1c 0d 2f b4 fa e7
1f 1d 93 cb 9f .
Bx..../........
0440 7c c0 f9 b3 5
6 da 14 b9 81 00 ad
32 2e e7 cb 13 |
...V......2....
0450 ef 8c 52 a3 4
6 bc f6 92 3a c5 8e
db 53 67 00 c0 .
.R.F...:...Sg..
0460 97 7d cc 28 9
0 28 04 05 ab d2 45
29 73 9b 82 57 .
}.(.(....E)s..W
0470 84 79 fd 7f 2
4 6a 63 19 89 53 a4
2b 22 48 92 fb .
y..$jc..S.+"H..
0480 2b e2 e4 99 0
2 c4 bb 1d 27 b1 93
08 81 2b db 54 +
.......'....+.T
0490 29 26 49 50 b
5 0d a0 5f 4d db fe
0e a3 49 b8 df )
&IP..._M....I..
04a0 30 72 c9 6c e
6 26 2e ee 88 43 93
34 49 37 13 e9 0
r.l.&...C.4I7..
04b0 7b c9 32 b5 0
c 81 32 7b 40 cc 09
88 07 af 30 e2 {
.2...2{@.....0.
04c0 94 21 fb 2f 8
8 c0 40 f4 9f 59 02
c9 12 73 1e 48 .
!./..@..Y...s.H
04d0 76 56 19 96 8
e 98 47 19 2d 16 c1
0d 08 10 ea 01 v
V....G.-.......
04e0 64 e0 25 cf 8
d 43 78 e9 8e 2e ca
36 13 a5 b1 28 d

.%..Cx....6...(
04f0 d6 96 61 dd 2
3 eb 0e ff 83 a8 d0
ac a7 d6 60 f6 .
.a.#.........`.
0500 48 59 d3 85 a
7 bc 0e 64 55 27 92
9b c8 11 3a 8c H
Y.....dU'....:.
0510 ea 50 30 dd b
4 3b fd 0a 05 11 33
b4 4d 58 73 25 .
P0..;....3.MXs%
0520 14 e4
.
.
No. Time
Source
Destination
Protocol
Length Info
368 14.64158100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=23491
7 Ack=1 Win=46 Len=
1260
Frame 368: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.691511000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.691511000 s
econds
[Time delta fro
m previous captured
frame: 0.068998000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06899800
0 seconds]
[Time since ref
erence or first fra
me: 14.641581000 se
conds]
Frame Number: 3
68
Frame Length: 1

314 bytes (10512 bi

ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl

e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf246 (62022)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39e4 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 234917, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 234917 (relati
ve sequence number)

[Next sequence
number: 236177 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x596
8 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2520]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 46 4
0 00 31 06 39 e4 4a
7c 0c 8a c0 a8 .
..F@.1.9.J|....

0020 01 0b 00 50 c
1 a6 2b cb f7 d2 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 59 68 0
0 00 c8 3b 8b 4c 91
c5 50 36 c7 40 .
.Yh...;.L..P6.@
0040 c2 4a b5 9b 1
8 52 15 b7 ef 8a 9c
09 e2 9a 31 61 .
J...R........1a
0050 f6 c6 6a dc e
c 7d ee b0 ff 53 b0
af 9c cd 12 ea .
.j..}...S......
0060 85 b8 1a f3 c
5 ca ae c7 2a 52 45
ec 76 2d de f8 .
.......*RE.v-..
0070 dd 21 3d 77 f
1 8c 67 d7 50 74 88
8f 54 ff fb 92 .
!=w..g.Pt..T...
0080 04 e8 8f f3 0
c 26 d1 83 58 7a 50
58 84 9a 30 65 .
....&..XzPX..0e
0090 ef 4a 0c 44 9
5 46 0d 61 e9 41 8d
12 e8 81 a7 bd .
J.D.F.a.A......
00a0 28 85 4e 25 4
2 c7 68 a0 2f ad b2
ed e8 31 99 36 (
.N%B.h./....1.6
00b0 e7 39 06 35 5
5 00 60 6d 02 28 74
61 9c 2d 14 db .
9.5U.`m.(ta.-..
00c0 7f 55 4d 82 2
d 67 05 44 05 93 9c
6a 6e 59 02 4a .
UM.-g.D...jnY.J
00d0 a9 df 75 ea f
d 58 7f a5 8a 55 c9
cc a7 ce 25 3d .
.u..X...U....%=
00e0 03 7d dd 6e 8
f 84 86 a1 10 92 1f
c8 83 a5 3e 60 .
}.n..........>`
00f0 49 05 86 3d 6
9 ab e3 31 58 72 c1
7f ef 9c 4f b4 I
..=i..1Xr....O.
0100 84 ae b8 e5 3
a f5 c5 fb bf a9 27
0c 44 2c d7 07 .
...:.....'.D,..
0110 8d 8c 44 eb 8
1 81 dc 66 4e 52 54
0c 31 35 24 fa .
.D....fNRT.15$.
0120 4e f2 83 8a 5
2 45 00 3b 81 80 04
46 96 37 4b 04 N
...RE.;...F.7K.
0130 d1 e7 4d 07 c

8 e1 cd c6 7d a8 5d
15 cd ed 54 c3 .
.M.....}.]...T.
0140 79 3a 9a 23 0
b 15 82 4e 9b 5b c3
87 84 eb 2f ff y
:.#...N.[..../.
0150 c6 1b 21 df 7
8 78 a8 f7 8f 6d b9
39 1c 8b 8d 6a .
.!.xx...m.9...j
0160 81 0f 24 fd b
d 4e 09 3d 60 c0 86
76 e1 b4 28 6a .
.$..N.=`..v..(j
0170 43 1d 21 a0 6
b 6c 9a 38 10 39 75
0d 12 b8 36 45 C
.!.kl.8.9u...6E
0180 dc e8 28 09 2
1 3f ba 7d c6 22 52
e8 a3 3f 27 85 .
.(.!?.}."R..?'.
0190 28 b2 d4 3b 1
1 d8 47 41 b1 de 6f
52 24 12 01 30 (
..;..GA..oR$..0
01a0 8f ad ad b6 3
4 6e eb 57 7f eb 12
13 63 13 96 bc .
...4n.W....c...
01b0 07 b9 ce e3 6
1 9b 67 e2 01 a4 92
5c ff 09 b7 2b .
...a.g....\...+
01c0 45 8e e6 3a 6
a 30 09 4c 99 c3 f0
b8 de c4 34 36 E
..:j0.L......46
01d0 4e e2 e3 20 3
2 48 6c 6a a0 40 28
10 b0 43 8a 2c N
.. 2Hlj.@(..C.,
01e0 66 9b 3e 2c 9
8 be cd a3 f1 6d ba
5f af 3c ec b7 f
.>,.....m._.<..
01f0 ef 6d dc 70 e
1 b9 70 c4 cf de 2e
03 16 62 60 7b .
m.p..p......b`{
0200 6c 0c 0d cf 2
3 0c 37 1b bd a6 71
af 83 2f 5e 3f l
...#.7...q../^?
0210 96 63 8b 4a 9
e 28 30 10 c6 16 33
cf 68 6f 0b ff .
c.J.(0...3.ho..
0220 fb 92 04 e7 8
f f2 e8 25 51 03 58
7a 50 5c c5 0a .
......%Q.XzP\..
0230 10 67 0f 4a 0
b d4 93 42 0d e1 e9
41 6f 92 68 01 .
g.J...B...Ao.h.
0240 a7 bd 28 e8 3
0 c0 33 43 88 34 43

b0 20 b1 a7 86 .
.(.0.3C.4C. ...
0250 99 20 53 21 6
f 4c 34 2d b4 7e 11
a8 60 b2 56 bb .
S!oL4-.~..`.V.
0260 1b 1a 19 42 9
a 0b a9 84 4e 5b 19
a2 61 2d bb eb .
..B....N[..a-..
0270 4f 52 9f de f
c 12 72 23 ca 3e 3a
5a d6 2e 1b 7c O
R....r#.>:Z...|
0280 ac 26 fa 4f 1
e 3b 6f 81 57 df c2
b7 8d 1f 13 c0 .
&.O.;o.W.......
0290 dc fa 86 c1 4
5 27 ae 35 4a 4b ff
df fb 83 49 14 .
...E'.5JK....I.
02a0 11 3e 71 8b 6
6 59 9b 96 60 c5 26
2e 3c 6b cd 26 .
>q.fY..`.&.<k.&
02b0 94 02 75 a7 8
6 72 a7 2f 61 e6 38
60 0c 07 19 16 .
.u..r./a.8`....
02c0 66 c4 34 16 0
a 9f 8e 93 24 d0 ce
c1 db 9a 8a 6a f
.4.....$......j
02d0 66 46 c7 de 7
a 5a 90 75 58 06 00
78 32 ef a8 93 f
F..zZ.uX..x2...
02e0 9f ab d7 70 a
7 02 85 c2 10 8c 3a
60 90 cb 7d 75 .
..p......:`..}u
02f0 07 1c b7 a6 4
6 b4 5c 6e b1 61 e7
c3 94 64 ff fb .
...F.\n.a...d..
0300 df c7 53 fd 4
4 d7 3e af f6 d6 56
48 e0 a2 32 cc .
.S.D.>...VH..2.
0310 49 be 80 1b 1
9 13 ea 0e b6 cc b0
f5 58 c8 17 f1 I
...........X...
0320 54 aa a5 03 6
6 5b c5 6c 8f 34 1c
30 9c ab 9b 75 T
...f[.l.4.0...u
0330 6a 2c da 5b 5
a d6 6e ce 6b 49 fc
a9 00 81 1b 73 j
,.[Z.n.kI.....s
0340 aa 6e f1 5e 9
8 6e 44 22 95 76 5d
aa f5 7d 7a f7 .
n.^.nD".v]..}z.
0350 88 b7 79 b6 5
9 67 ac 46 f7 8f 37
4a 5a da 85 9f .

.y.Yg.F..7JZ...
0360 ff c6 24 97 0
f 69 d2 28 7a 84 ba
55 f5 ea 30 0c .
.$..i.(z..U..0.
0370 44 09 0c 24 b
3 20 ac fd 1c 11 48
5e 8e e9 ad 48 D
..$. ....H^...H
0380 44 39 04 52 a
2 a1 03 88 f9 4a 93
b4 d4 98 cd 3d D
9.R.....J.....=
0390 d8 2e 77 71 0
8 eb 67 a6 ec d6 ec
ea 31 7a f8 80 .
.wq..g.....1z..
03a0 1a ca aa d7 2
d db 23 ed 1a 21 af
19 fa 6f 19 f7 .
...-.#..!...o..
03b0 de ac c7 7f 7
8 2d 58 ef 67 d2 ac
19 84 46 5e 29 .
...x-X.g....F^)
03c0 75 ff fb 92 0
4 ec 0f f2 d8 24 d0
83 59 62 50 63 u
........$..YbPc
03d0 e5 89 f0 6f 0
f 4c 0c 40 d1 40 0d
e1 6b 81 90 96 .
..o.L.@.@..k...
03e0 67 c1 ac 3d 3
0 01 be bf c8 89 11
11 85 1b 6e 0e g
..=0.........n.
03f0 02 69 86 81 1
2 02 80 a2 a1 80 48
c8 d5 59 be 1d .
i........H..Y..
0400 3b 27 5e b2 f
4 08 a1 8c 01 b9 b7
4e f5 da 28 0d ;
'^........N..(.
0410 28 1e 4b dd d
e 4f a4 6d a2 ce fd
c5 31 c9 71 16 (
.K..O.m....1.q.
0420 56 2d 94 ce e
1 3d 3e dc 92 66 df
ce 60 66 bb 7d V
-...=>..f..`f.}
0430 3f be 54 96 c
7 cd 1d da d4 ce 20
6a 27 ff df 52 ?
.T....... j'..R
0440 1c 6b b4 a9 e
6 34 2f a0 c8 2b 34
90 8f 1d 83 12 .
k...4/..+4.....
0450 98 df 4b 33 d
1 d7 20 e8 d3 09 74
be 09 6c e2 af .
.K3.. ...t..l..
0460 02 90 5a 9c 3
8 59 a2 8a da 6d ca
93 77 79 1d a1 .
.Z.8Y...m..wy..

0470 68 4d ad 24 f
d ea ed 5e d4 33 49
3f 08 28 4a 9d h
M.$...^.3I?.(J.
0480 f7 8c 1b 07 4
5 13 e9 33 59 fc 63
1a 23 24 3f 3c .
...E..3Y.c.#$?<
0490 26 f6 eb 56 2
a ed 8e 9f e3 9c 11
eb 9b 56 4f 4d &
..V*........VOM
04a0 67 1f 5d a8 f
a d8 66 6b 07 35 be
59 fd 63 c4 0d g
.]...fk.5.Y.c..
04b0 20 13 e2 58 9
9 d8 da 20 a9 d5 61
58 63 42 6d 4b
..X... ..aXcBmK
04c0 92 91 4e 4b 0
f 69 ac d9 eb 50 26
54 f0 5a ec cd .
.NK.i...P&T.Z..
04d0 ff 9e 5f 69 2
3 15 9b 95 de ba 15
cb c3 04 af c3 .
._i#...........
04e0 f1 ec f1 22 b
0 c7 15 8b 0a 75 f5
76 97 26 df a5 .
..".....u.v.&..
04f0 e9 89 2a 85 6
3 d6 1b 1b cf 68 10
9a 33 2e 6d 99 .
.*.c....h..3.m.
0500 2c e2 66 81 f
9 c1 84 c6 94 7c 3d
1e 2a 82 6a 7a ,
.f......|=.*.jz
0510 f5 ff ff d3 4
7 03 6a 60 60 ca 9c
5c e2 d5 2c b8 .
...G.j``..\..,.
0520 68 08
h
.
No. Time
Source
Destination
Protocol
Length Info
369 14.64175300
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=236177 Win=39690 L
en=0
Frame 369: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.691683000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.691683000 s
econds
[Time delta fro
m previous captured
frame: 0.000172000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017200
0 seconds]
[Time since ref
erence or first fra
me: 14.641753000 se
conds]
Frame Number: 3
69
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4fa0 (20384)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]

[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 23617
7, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 236177 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39690
[Calculated win

dow size: 39690]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 368]
[The RTT to
ACK the segment wa
s: 0.000172000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f a0 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cb fc be 50 10 .
....P..N.+...P.
0030 9b 0a 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
370 14.65158100
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
447 http49
574 [PSH, ACK] Seq=
236177 Ack=1 Win=46
Len=393
Frame 370: 447 byte
s on wire (3576 bit
s), 447 bytes captu
red (3576 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.701511000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.701511000 s
econds
[Time delta fro
m previous captured
frame: 0.009828000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00982800
0 seconds]
[Time since ref
erence or first fra
me: 14.651581000 se
conds]
Frame Number: 3
70
Frame Length: 4
47 bytes (3576 bits
)
Capture Length:
447 bytes (3576 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
33
Identification:
0xf247 (62023)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3d46 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.

11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 236177, Ack:
1, Len: 393
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 393]
Sequence number
: 236177 (relati
ve sequence number)
[Next sequence
number: 236570 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0x753
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 393]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 01 b1 f2 47 4
0 00 31 06 3d 46 4a
7c 0c 8a c0 a8 .
..G@.1.=FJ|....
0020 01 0b 00 50 c
1 a6 2b cb fc be 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 75 3e 0
0 00 13 d2 6b 3c 1c
e7 81 08 4a 9e .
.u>....k<....J.
0040 27 46 14 0e 0
9 35 1b e7 47 39 e7
0a ad ec 41 40 '
F...5..G9....A@
0050 9e 51 24 27 6
6 31 c1 d5 fa fc b8
7c ea 73 b6 9c .
Q$'f1.....|.s..
0060 ba a8 79 ce 6
f f6 07 19 ed fa 4c
11 6b ff d7 fe .
.y.o.....L.k...
0070 8d 82 6f 10 2
9 c5 c3 ff fb 92 04
e8 8f f2 b9 24 .
.o.)..........$
0080 50 83 58 7a 5
0 5e a5 7a 00 6b 0f
4c 0c b4 af 40 P
.XzP^.z.k.L...@
0090 0d 65 e9 81 9
a 13 e8 01 ac 3d 28
0d 69 02 74 1a .
e.......=(.i.t.
00a0 6e 9b ee d5 f
f fe a7 7d 2a 45 43
81 0c 00 5a 6b n
......}*EC...Zk
00b0 41 4e 97 7c 6
1 7e bd a7 b2 70 4e
cc 63 a1 85 c6 A
N.|a~...pN.c...
00c0 2d 31 a6 f5 7
b e7 4a 78 8f 99 1b
55 c7 42 e6 36 1..{.Jx...U.B.6
00d0 1f 9f e2 e0 1
1 94 7e 22 b9 13 32
5c 36 40 c8 ae .

.....~"..2\6@..
00e0 48 3c 32 6a 1
8 f6 be 78 64 ca 45
1c 9b f3 9e 6f H
<2j...xd.E....o
00f0 9e ff 0b da 8
5 eb 7d a3 54 e7 aa
e9 31 5e 8f ff .
.....}.T...1^..
0100 fe a4 27 99 d
5 98 66 dc 87 13 45
4c 5d 38 5c 9c .
.'...f...EL]8\.
0110 77 3c 0d 52 d
6 e4 14 46 a8 44 c0
98 21 12 98 4b w
<.R...F.D..!..K
0120 01 aa 21 57 c
9 c9 19 94 35 41 00
40 d3 26 15 79 .
.!W....5A.@.&.y
0130 08 94 4c 14 1
9 03 69 3e 9a 39 a6
b5 df 7b 7a fb .
.L...i>.9...{z.
0140 fe e7 ac ff 2
f 3b 5d e2 62 a9 05
8f b3 6e 59 14 .
.../;].b....nY.
0150 a9 75 3f 32 d
4 a9 6d d9 4d ea 38
40 a6 c8 98 cb .
u?2..m.M.8@....
0160 5c 7f 30 a5 c
e 66 5e 82 36 f1 76
a8 fc 6d cb 6e \
.0..f^.6.v..m.n
0170 d1 68 d4 42 7
6 bc 96 5b 36 3d 2f
0e 83 90 7a 64 .
h.Bv..[6=/...zd
0180 c5 16 29 70 b
d 30 42 3c ca 14 44
0b 22 4e d8 c9 .
.)p.0B<..D."N..
0190 64 19 c5 ed 2
6 13 93 7d ec fe ad
03 e5 c7 9e 6a d
...&..}.......j
01a0 40 2c 99 75 e
7 8f 87 01 b5 6b e5
dd a5 b2 3a d2 @
,.u.....k....:.
01b0 20 7c 2f 57 3
f d0 7c 99 04 62 16
1f 76 b7 10
|/W?.|..b..v..
No. Time
Source
Destination
Protocol
Length Info
371 14.73458600
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49

574 [ACK] Seq=23657

0 Ack=1 Win=46 Len=
1260
Frame 371: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.784516000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.784516000 s
econds
[Time delta fro
m previous captured
frame: 0.083005000
seconds]
[Time delta fro
m previous displaye
d frame: 0.08300500
0 seconds]
[Time since ref
erence or first fra
me: 14.734586000 se
conds]
Frame Number: 3
71
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08

:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf248 (62024)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset

:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39e2 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 236570, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 236570 (relati
ve sequence number)
[Next sequence
number: 237830 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .

... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa10
9 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1653]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 48 4
0 00 31 06 39 e2 4a
7c 0c 8a c0 a8 .
..H@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cb fe 47 9e
87 4e aa 50 10 .
..P..+..G..N.P.
0030 00 2e a1 09 0
0 00 2a a4 3c 0d e8
d3 15 cc 34 a6 .
.....*.<.....4.
0040 53 6f ab 8b 3
f 29 67 32 3e 83 02
60 2c 9e 26 4b S
o..?)g2>..`,.&K
0050 d9 98 db 9d f
1 52 f8 85 35 b5 f0
6d 12 07 eb 2b .
....R..5..m...+
0060 46 b2 35 1f e
f 7f dd 52 a7 f3 3a
68 9e a8 d5 a9 F
.5....R..:h....
0070 19 ff fa 9e a
f 57 b3 72 35 ae 84
57 67 57 91 5c .
....W.r5..WgW.\
0080 a7 3c 8e c5 d
f 32 67 53 a3 55 eb
23 24 bf b6 fa .
<...2gS.U.#$...
0090 ff fb 92 04 e

6 8f f2 e8 27 d4 83
2f 62 50 58 85 .
.......'../bPX.
00a0 ca 90 61 e9 4
c 0c 40 b5 5a 0c b0
c9 81 6e 0f eb .
.a.L.@.Z....n..
00b0 41 96 25 28 a
4 c4 e4 7d aa 0d 21
16 c7 10 a4 32 A
.%(...}..!....2
00c0 8a d0 a3 14 c
d c9 dc a7 74 e3 a0
e8 a4 f2 67 64 .
.......t.....gd
00d0 da 25 4f 27 1
c 54 f2 47 9d 2a 54
5e 11 2e 93 ae .
%O'.T.G.*T^....
00e0 99 23 12 b9 a
7 67 c8 7f df 7f dd
32 1e 9c 67 0c .
#...g.....2..g.
00f0 fe 8c ef 44 1
7 fe bb fe 3f 4f 1f
83 bc c2 9b 81 .
..D....?O......
0100 38 3c fa 9c 1
d e2 d2 b9 f7 b0 7a
b4 b9 fe e0 27 8
<........z....'
0110 7f f5 af ce 8
8 3e e1 92 74 f1 05
9c 3c 43 0b c0 .
....>..t...<C..
0120 86 0b 88 6f 3
7 86 0c 85 d2 8b f7
2c 76 02 da 47 .
..o7......,v..G
0130 cc 37 cf 24 b
3 c6 96 4a 6b 5f ea
de 5b f7 f8 cd .
7.$...Jk_..[...
0140 f7 f9 fc b8 e
b b1 15 85 91 ea a8
8b f0 fa 47 ff .
.............G.
0150 d3 e2 7b dc c
3 7d 2c ea 43 33 43
be 5b de 13 ca .
.{..},.C3C.[...
0160 f6 0b 37 29 5
b 63 7f 1a 98 25 23
f5 62 e0 3d 2b .
.7)[c...%#.b.=+
0170 15 82 d1 bd b
f 2d aa 0d 89 4a 2e
e0 42 48 70 0b .
....-...J..BHp.
0180 4b 21 34 6d 2
7 7b 4e 2a 98 70 c7
46 a0 52 36 4c K
!4m'{N*.p.F.R6L
0190 b3 2d ca 44 4
9 2f 70 c0 64 9f 75
d3 85 9f eb fd .
-.DI/p.d.u.....
01a0 dc af 9b fc f
f f3 b5 cf ac 85 4d

9e a5 23 2e 8f .
.........M..#..
01b0 56 7f af b6 5
6 30 67 da e5 6b 9a
43 2e ca eb 42 V
...V0g..k.C...B
01c0 bb 1d 5d 8c e
e d3 ee 67 ca a6 08
ad ca 67 79 dd .
.]....g.....gy.
01d0 8e 9b 39 19 6
8 f7 05 38 24 ca a4
de 38 8a 41 e4 .
.9.h..8$...8.A.
01e0 f4 16 38 7a d
8 03 ae 24 ab c0 6c
73 5a ac ba f2 .
.8z...$..lsZ...
01f0 67 88 a3 e5 d
d cc 06 a7 c0 70 e3
06 14 02 ac c1 g
........p......
0200 c8 60 d1 b9 d
e 36 db 6b b2 df 7b
42 2d f8 ba f0 .
`...6.k..{B-...
0210 97 f0 ad fc d
2 3e 29 a8 82 5c a4
21 a4 e7 8b ba .
....>)..\.!....
0220 79 4a 26 9f 8
a 20 9a f9 fe 6d 46
f0 6f b5 2f cb y
J&.. ...mF.o./.
0230 ab ff ff fb 9
2 04 ec 0f f3 19 5f
58 03 09 13 72 .
........._X...r
0240 5f a3 da f0 6
1 26 4a 4b f9 57 60
07 98 6b c9 86 _
...a&JK.W`..k..
0250 2d 2c 00 f3 0
9 b9 12 9b 8b b2 7d
ff fa 98 c1 64 ,........}....d
0260 28 7a 97 27 5
b 16 56 cb 2c 3e 07
98 a7 21 54 a6 (
z.'[.V.,>...!T.
0270 8c 99 46 25 8
3 6b a1 5b 49 66 ac
72 a9 a4 d0 b5 .
.F%.k.[If.r....
0280 24 e1 91 c9 4
2 3f cf e4 6b eb e4
7a 3f 33 ba 56 $
...B?..k..z?3.V
0290 f9 5a b4 b9 a
8 67 bf 64 6c a5 d9
0c 5f 47 47 6a .
Z...g.dl..._GGj
02a0 aa 96 e5 5a 6
5 47 2f 2b 18 c5 56
4e 6d 1d 02 b9 .
..ZeG/+..VNm...
02b0 47 a7 98 57 b
6 9d 5d 41 41 c5 62
e4 8d 08 53 6a G

..W..]AA.b...Sj
02c0 38 c7 07 1a 1
8 1d 26 0c 4b d8 aa
41 2e 59 9e 4d 8
.....&.K..A.Y.M
02d0 c7 a3 d1 69 5
7 35 36 30 b3 c0 83
97 d7 71 4e c8 .
..iW560.....qN.
02e0 db d9 2a 87 5
5 30 11 59 74 a5 b0
6d a5 d1 d6 2f .
.*.U0.Yt..m.../
02f0 d8 ba da 9c 2
3 4e 9b 8a 1a 0f 85
da 18 40 89 a4 .
...#N.......@..
0300 96 f9 a0 28 5
1 93 a0 42 67 96 82
2f 5a 2f 60 64 .
..(Q..Bg../Z/`d
0310 b9 3d d2 2c 4
6 43 4b c7 5b 41 51
48 2c 50 d5 64 .
=.,FCK.[AQH,P.d
0320 4a 2b 1e 34 1
0 60 3c 59 56 e2 50
33 b1 38 b1 2e J
+.4.`<YV.P3.8..
0330 8e b1 a8 c4 e
2 bc d0 fd f3 0c 69
a1 aa 5e c8 3d .
.........i..^.=
0340 8b 34 54 7d 1
8 10 db bc 72 59 c2
e7 c0 86 b4 b0 .
4T}....rY......
0350 8d 0e 42 b1 9
8 64 44 b3 62 e5 1c
e0 65 2e 27 48 .
.B..dD.b...e.'H
0360 08 14 14 61 5
4 84 40 d6 8c 03 5a
e4 ca 2c 7b 90 .
..aT.@...Z..,{.
0370 0f 3d 0f 6b a
a 76 45 ac fd 3a 7a
d5 16 a0 26 60 .
=.k.vE..:z...&`
0380 88 ce 23 04 c
f 05 0e 26 9c 68 2e
12 a9 15 50 04 .
.#....&.h....P.
0390 8d 2d 05 76 0
5 21 d6 fd c5 70 f5
92 f0 1b e8 a1 .
-.v.!...p......
03a0 aa 93 67 ec d
e 38 90 c0 ce 0f 1c
9a 21 cf 96 18 .
.g..8......!...
03b0 1e dd 31 ad 4
b 45 a5 6c db fb e9
a8 62 10 19 31 .
.1.KE.l....b..1
03c0 62 01 63 ee 4
a 0e 89 44 a5 c6 9b
62 60 30 fb d0 b
.c.J..D...b`0..

03d0 b1 7d 4c d0 f
f fb 92 04 e9 0f f2
d7 13 d6 83 0c .
}L.............
03e0 19 c2 5b a9 a
a d0 61 22 5e 0c 24
85 50 0d 3d 29 .
.[...a"^.$.P.=)
03f0 41 86 90 6a 0
1 a7 a1 28 79 b3 4b
76 ad da 83 16 A
..j...(y.Kv....
0400 8f 5e 39 e2 9
4 14 bb 05 93 02 8e
da e6 7a 9c 26 .
^9..........z.&
0410 a2 a2 5c 28 5
4 e1 aa 25 33 c5 44
41 56 37 b6 31 .
.\(T..%3.DAV7.1
0420 a0 1b 74 e1 b
7 f1 b6 f2 98 91 20
d3 5d cd 7d 0f .
.t....... .].}.
0430 58 c2 b9 6e 4
7 d2 2a 53 51 d5 0e
cc f1 6f 24 32 X
..nG.*SQ....o$2
0440 0d c4 cb d7 6
6 7b 7b bf fe fc 99
93 4b 37 6f 33 .
...f{{.....K7o3
0450 d9 4f 7a 03 f
2 0e 17 5b 48 84 16
21 b4 56 6d c4 .
Oz....[H..!.Vm.
0460 91 e8 04 a8 1
5 62 66 03 1d 22 a6
18 b0 8c 21 b6 .
....bf.."....!.
0470 14 ec 96 06 b
5 b5 1c 93 08 2a 09
88 ed 03 00 69 .
........*.....i
0480 51 a9 20 e4 e
5 88 54 65 88 d5 6f
47 aa 78 10 37 Q
. ...Te..oG.x.7
0490 86 22 9d ca f
3 ac f1 96 7c 26 71
a9 69 bc a4 b5 .
"......|&q.i...
04a0 29 88 c6 4b c
d c9 47 25 fd b4 57
ee b9 78 8f cb )
..K..G%..W..x..
04b0 96 d6 ff f2 c
e 30 04 e2 e4 8a 95
b0 d9 13 df 5f .
....0........._
04c0 45 dd 22 35 0
4 92 c1 42 89 88 0b
21 2a 04 31 02 E
."5...B...!*.1.
04d0 64 c9 3a f5 d
b 6f 25 0c 37 27 f5
50 0f 2a 59 27 d
.:..o%.7'.P.*Y'
04e0 98 97 da b1 9

c cb 4d 8d 65 35 6f
7d a7 ed 26 0a .
.....M.e5o}..&.
04f0 24 33 2e 5d 2
0 e5 16 a7 2c 3f 13
07 91 73 21 f9 $
3.] ...,?...s!.
0500 26 1b 3a fd 3
e 19 07 be e2 99 f2
bf 4d 43 d5 68 &
.:.>.......MC.h
0510 a6 2e 6c e0 0
a f2 42 10 99 39 f6
33 e2 ee f1 ae .
.l...B..9.3....
0520 74 9f
t
.
No. Time
Source
Destination
Protocol
Length Info
372 14.73476600
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=237830 Win=39276 L
en=0
Frame 372: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.784696000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.784696000 s
econds
[Time delta fro
m previous captured
frame: 0.000180000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00018000
0 seconds]
[Time since ref
erence or first fra
me: 14.734766000 se
conds]
Frame Number: 3

72
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0

0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4fa1 (20385)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 23783
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)

Acknowledgment
number: 237830 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39276
[Calculated win
dow size: 39276]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 371]
[The RTT to
ACK the segment wa
s: 0.000180000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f a1 4
0 00 80 06 00 00 c0

a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cc 03 33 50 10 .
....P..N.+..3P.
0030 99 6c 18 d4 0
0 00
.
l....
No. Time
Source
Destination
Protocol
Length Info
373 14.87698500
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=23783
0 Ack=1 Win=46 Len=
1260
Frame 373: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.926915000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.926915000 s
econds
[Time delta fro
m previous captured
frame: 0.142219000
seconds]
[Time delta fro
m previous displaye
d frame: 0.14221900
0 seconds]
[Time since ref
erence or first fra
me: 14.876985000 se
conds]
Frame Number: 3
73
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]

[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)

.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf249 (62025)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39e1 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 237830, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 237830 (relati
ve sequence number)
[Next sequence
number: 239090 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)

Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x479
1 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 49 4
0 00 31 06 39 e1 4a
7c 0c 8a c0 a8 .
..I@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cc 03 33 9e
87 4e aa 50 10 .
..P..+..3..N.P.
0030 00 2e 47 91 0
0 00 b3 a5 11 d6 64
9a 72 34 67 86 .

.G.......d.r4g.
0040 76 16 02 44 e
7 6d e5 0a 08 a1 a5
c9 08 14 d1 12 v
..D.m..........
0050 52 b2 08 68 1
e 13 ec 7c f1 a4 b1
91 28 37 27 90 R
..h...|....(7'.
0060 e7 8c dd 75 d
c 6d 3c 43 36 4d aa
19 e3 b8 9c 6a .
..u.m<C6M.....j
0070 e0 eb 91 7d d
7 5c 3d b6 fd 26 4c
69 dd db 23 8d .
..}.\=..&Li..#.
0080 fd f7 47 35 8
8 5e 13 6a 12 1c ff
fb 92 04 eb 0f .
.G5.^.j........
0090 f2 f2 24 d3 8
3 2f 5a 50 63 c6 aa
60 69 e6 5c 0c .
.$../ZPc..`i.\.
00a0 0c c7 4a 0d 3
c cb 81 85 96 e9 41
ac 2d 30 51 73 .
.J.<.....A.-0Qs
00b0 64 81 14 35 2
e 38 8a fd f9 1a 3a
44 64 4c 3d 13 d
..5.8....:DdL=.
00c0 64 41 a3 86 3
3 30 80 c0 c8 9d 96
18 f6 33 9a aa d
A..30.......3..
00d0 61 c0 93 60 0
a b0 6e 21 e8 fa b8
5a 8f 1d 20 1b a
..`..n!...Z.. .
00e0 98 27 72 53 3
e b2 95 e6 4f 10 4a
71 b4 09 50 44 .
'rS>...O.Jq..PD
00f0 01 94 78 32 c
2 52 6f 84 e0 a2 2d
eb 18 a9 25 f7 .
.x2.Ro...-...%.
0100 a4 71 25 dd c
d a0 e2 c2 c1 b8 4c
88 68 28 c2 cf .
q%.......L.h(..
0110 9c 8d 19 7d 6
f 6a b3 6c 55 f4 6c
59 33 13 8e 69 .
..}oj.lU.lY3..i
0120 26 4e a9 02 7
0 e1 87 8d 02 e7 a4
b6 e4 20 9a 45 &
N..p........ .E
0130 61 da 1b f2 c
2 08 50 2c de b1 5c
ee 89 0d e2 9c a
.....P,..\.....
0140 a6 ad 62 6a 0
b 24 45 9c 6b 9e a5
64 59 63 7b 93 .
.bj.$E.k..dYc{.

0150 c9 9e 3f 55 5
6 d0 3e 35 9d 63 57
df c6 d9 fd 6b .
.?UV.>5.cW....k
0160 6d b6 5b 5f 1
5 bc 27 34 44 14 30
a5 84 0d 39 6e m
.[_..'4D.0...9n
0170 32 7a 92 4f 9
6 4f 38 bf bb d6 b5
19 61 46 ac 81 2
z.O.O8.....aF..
0180 dc 2c c4 cc 5
9 02 d3 09 38 6f 86
01 2b 14 06 d0 .
,..Y...8o..+...
0190 1b a3 c9 18 8
9 95 44 5e 5c 2f 52
4a ae e1 3f 12 .
.....D^\/RJ..?.
01a0 53 d1 1c ea d
3 69 32 5e 4a e7 14
c3 64 46 ef bb S
....i2^J...dF..
01b0 82 07 38 9c e
3 b4 7c be 76 f6 30
dd e6 d7 47 ce .
.8...|.v.0...G.
01c0 d5 0a e9 b3 a
7 36 eb b9 66 80 81
fc 3c 4c 31 69 .
....6..f...<L1i
01d0 a7 e3 85 d1 4
9 10 cd 14 37 90 fa
55 31 5b 35 52 .
...I...7..U1[5R
01e0 3a 5b 32 86 1
0 28 08 04 dd f5 ca
0a 07 2b 77 59 :
[2..(.......+wY
01f0 a4 78 79 d0 c
b 62 01 04 0c e9 63
65 b5 1f c2 41 .
xy..b....ce...A
0200 1b 9b b3 07 4
d ea 52 f9 2d 90 99
13 90 a5 4e ba .
...M.R.-.....N.
0210 d0 39 60 24 6
a b9 94 0f 67 6d b9
99 93 f7 d9 c3 .
9`$j...gm......
0220 4f ce ee 7a d
9 d2 f0 ba 09 0a 80
8b ff fb 92 04 O
..z............
0230 e8 0f f2 fa 2
b 52 83 2f 5a 60 60
65 5a 40 69 e8 .
...+R./Z``eZ@i.
0240 4c 0b f0 9f 4
8 0d 3d e9 41 80 94
28 c1 ac 31 28 L
...H.=.A..(..1(
0250 0a 2c b1 de 5
a e7 ad 75 3f d3 f6
a4 04 78 a6 c5 .
,..Z..u?....x..
0260 24 a6 88 48 8

0 c0 44 b7 99 0a 87
44 2b e3 30 91 $
..H..D....D+.0.
0270 0d d8 8a 60 0
a 42 fb 25 fd 99 4a
96 54 c1 84 4d .
..`.B.%..J.T..M
0280 54 8c 6d 4c 3
3 3e 4a 03 8b 12 c0
2f 37 a4 80 82 T
.mL3>J..../7...
0290 00 19 0a d1 1
2 d2 85 6a e9 2d 97
1b 6e aa 84 b5 .
......j.-..n...
02a0 90 41 12 c0 0
3 e1 d3 a0 17 12 0d
8a 1c 16 10 2a .
A.............*
02b0 b9 e2 b2 dd 3
d 2c 34 63 a0 91 31
0e 12 7a 03 18 .
...=,4c..1..z..
02c0 a1 e3 42 0a b
3 89 49 8c 1e 40 48
d0 d0 34 08 82 .
.B...I..@H..4..
02d0 8b 30 16 b4 5
2 b2 bd 33 d6 90 b5
d6 8b 4e 58 77 .
0..R..3.....NXw
02e0 05 24 d0 46 f
9 21 a2 8f 2c c0 a8
4e 9a 86 11 aa .
$.F.!..,..N....
02f0 65 b2 a1 e5 3
b 03 13 41 fd 63 dd
96 16 12 b2 55 e
...;..A.c.....U
0300 92 4c 78 8d 5
8 a4 68 75 9b 0a bd
5a b9 b3 c0 5e .
Lx.X.hu...Z...^
0310 2e 1c 31 92 5
9 d7 5a 3a 57 e8 33
bd 37 98 34 1d .
.1.Y.Z:W.3.7.4.
0320 31 9c 01 66 e
6 18 cb 0a aa 3c 6a
58 32 74 d1 2f 1
..f.....<jX2t./
0330 a3 76 84 c1 8
4 6f 16 2b 65 9e 62
ed 45 a9 2b b7 .
v...o.+e.b.E.+.
0340 75 3c 96 0d d
4 47 05 82 63 83 71
b0 86 c8 bb 47 u
<...G..c.q....G
0350 a7 5d a6 e0 3
7 3d 77 09 7e 68 16
59 92 d2 62 9e .
]..7=w.~h.Y..b.
0360 24 98 f1 e3 e
6 b8 77 ab 66 1e 26
9b 6f 59 e9 b2 $
.....w.f.&.oY..
0370 0c 26 fc e9 e
9 5f 31 b7 5f d0 43

41 2d 06 05 41 .
&..._1._.CA-..A
0380 ae 62 2a 71 8
9 9a 1d e8 88 80 b1
e1 09 b4 b0 45 .
b*q...........E
0390 fa 89 12 04 4
c e6 08 0c 9e 1b 69
2d 76 4d 43 48 .
...L.....i-vMCH
03a0 bd 5a 2a 54 4
6 a8 98 74 d4 a5 41
26 25 c3 fc e5 .
Z*TF..t..A&%...
03b0 43 43 84 f0 a
4 ac aa dc 28 e6 81
a9 a9 19 f5 b7 C
C......(.......
03c0 9a b8 c9 26 e
3 ee 1d 69 fe 22 48
ba ce 37 ff fb .
..&...i."H..7..
03d0 92 04 e7 0f f
2 de 26 d1 83 38 62
50 5b 24 8a 30 .
.....&..8bP[$.0
03e0 65 e9 4a 0c 6
4 91 48 0d 61 e9 41
7f 92 a8 c1 9c e
.J.d.H.a.A.....
03f0 3d 28 5f 28 7
d 2f 18 96 1a 7e 6e
5d fa ea 00 29 =
(_(}/...~n]...)
0400 03 d2 c4 c3 0
5 e0 61 2c ad 06 dd
62 a0 02 48 07 .
.....a,...b..H.
0410 1c 5d d5 dc 5
d 76 0c 89 c3 41 18
11 6a d4 75 94 .
]..]v...A..j.u.
0420 be ce 8c 26 2
e 99 ab 08 cf e9 e5
cc db 66 f1 3a .
..&.........f.:
0430 44 08 f3 91 0
9 32 4c d3 15 70 db
58 ca 96 d9 9a D
....2L..p.X....
0440 f1 02 1c 28 1
8 83 af 34 98 92 d7
be b5 af e9 02 .
..(...4........
0450 16 75 6f e5 0
8 67 49 cd 32 b4 d6
28 32 0a 74 37 .
uo..gI.2..(2.t7
0460 d3 23 85 11 3
6 40 54 d6 31 a9 c5
2f 00 02 27 23 .
#..6@T.1../..'#
0470 13 28 16 1e 4
4 c2 10 c4 03 1d 86
83 ea 75 18 56 .
(..D........u.V
0480 70 1e 76 66 5
6 05 d8 83 a1 54 ae
09 e2 48 e2 3e p

.vfV....T...H.>
0490 83 bc 42 04 a
4 d4 a6 e3 98 b3 ce
c6 b3 85 da c7 .
.B.............
04a0 d7 f9 8f 88 1
6 92 34 ce be 24 95
9d ce 4d 7a fa .
.....4..$...Mz.
04b0 62 31 4c 52 c
8 d5 13 ad 2f bd ca
4d 64 8b cc b2 b
1LR..../..Md...
04c0 23 7a f8 48 8
9 88 56 1c 8c d0 4c
2e 79 87 56 98 #
z.H..V...L.y.V.
04d0 4e ab 67 51 5
5 6d 49 c8 30 e0 30
85 40 b2 a9 ca N
.gQUmI.0.0.@...
04e0 b9 c3 2f 21 2
9 1f e9 eb 78 59 ac
dc e9 59 3d bb .
./!)...xY...Y=.
04f0 87 f3 40 58 c
4 6e 6f ae 55 2a 27
6c 6a 98 a9 07 .
.@X.no.U*'lj...
0500 0c 6b ef 31 d
b 15 7e 5c 44 71 d6
3b dd c6 93 3f .
k.1..~\Dq.;...?
0510 37 8b 37 fa d
7 c5 a3 ba 42 2c 95
c9 69 5d 32 41 7
.7.....B,..i]2A
0520 8c c2
.
.
No. Time
Source
Destination
Protocol
Length Info
374 14.88359200
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1302 http49
574 [PSH, ACK] Seq=
239090 Ack=1 Win=46
Len=1248
Frame 374: 1302 byt
es on wire (10416 b
its), 1302 bytes ca
ptured (10416 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N

ov 10, 2014 11:27:0

7.933522000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.933522000 s
econds
[Time delta fro
m previous captured
frame: 0.006607000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00660700
0 seconds]
[Time since ref
erence or first fra
me: 14.883592000 se
conds]
Frame Number: 3
74
Frame Length: 1
302 bytes (10416 bi
ts)
Capture Length:
1302 bytes (10416
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)

.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
288
Identification:
0xf24a (62026)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39ec [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)

Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 239090, Ack:
1, Len: 1248
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1248]
Sequence number
: 239090 (relati
ve sequence number)
[Next sequence
number: 240338 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc

aling factor: -1 (u
nknown)]
Checksum: 0x453
c [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2508]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 08 f2 4a 4
0 00 31 06 39 ec 4a
7c 0c 8a c0 a8 .
..J@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cc 08 1f 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 45 3c 0
0 00 b3 67 0c ee b6
33 24 46 9c 01 .
.E<...g...3$F..
0040 3c af 03 02 0
1 40 d0 12 f7 a9 d4
36 99 20 02 1f <
....@.....6. ..
0050 e6 14 26 a2 3
3 cf a7 70 d5 58 72
d7 f2 de 4f e7 .
.&.3..p.Xr...O.
0060 68 77 ca 29 c
7 8c 98 ba bb a1 ef
f2 a5 df ab 8e h
w.)............
0070 31 f3 89 ab 2
e af 7b 3a fb bc 0c
32 fc fd ee 5b 1
.....{:...2...[
0080 ff 5d fd 7f f
f fb 92 04 e9 0f f3
09 27 52 03 58 .
]..........'R.X
0090 7a 50 5b c4 e
a 40 67 0f 4a 0c 30
a1 42 0d e5 e9 z
P[..@g.J.0.B...
00a0 41 85 15 e8 4
1 ac 3d 30 34 fb 4b
26 bb fe 48 99 A
...A.=04.K&..H.
00b0 40 c8 09 ce 1
c 30 33 7c cf c0 cc
20 10 55 46 2a @
....03|... .UF*
00c0 02 2c 41 08 8
8 0a 15 7d 40 27 8b
74 02 9a 03 20 .
,A....}@'.t...
00d0 89 4d fa 0c 2

9 25 68 ec ca 24 19
c1 3f 43 21 5e .
M..)%h..$..?C!^
00e0 a5 dd 1f 21 e
2 55 b3 07 ca ea c6
5a bf 26 ee ef .
..!.U.....Z.&..
00f0 24 5a 53 df 1
3 35 bf cd ab 19 a3
ed ae 7a 2b 61 $
ZS..5.......z+a
0100 40 de e4 cc 5
c 6a 36 95 38 04 4c
ea c8 7a 79 61 @
...\j6.8.L..zya
0110 81 c3 44 47 0
8 61 35 a0 e3 53 0c
32 f1 73 4d 88 .
.DG.a5..S.2.sM.
0120 2e 58 c8 fa 1
2 5f 59 92 a0 92 55
c8 48 18 49 40 .
X..._Y...U.H.I@
0130 77 5e e6 f7 e
9 bb 94 f4 79 82 46
30 e5 aa 8f f5 w
^......y.F0....
0140 24 22 9a bd 9
8 55 31 b5 43 86 28
30 12 f1 52 0e $
"...U1.C.(0..R.
0150 52 3e 9a f9 f
a 9b 31 d4 34 a6 ac
f6 d5 80 e9 d2 R
>....1.4.......
0160 1c f2 b5 d5 3
5 8d 67 18 f6 c4 bd
4b 49 8a d0 79 .
...5.g....KI..y
0170 db 0f f5 8e 1
e 33 90 4f 5a 12 39
e0 43 06 0c 59 .
....3.OZ.9.C..Y
0180 89 7c a9 c8 9
1 2f 01 93 4b 17 db
77 8a 32 31 31 .
|.../..K..w.211
0190 09 75 f6 ce 7
6 47 76 6a b4 6d ac
41 d9 59 fa 22 .
u..vGvj.m.A.Y."
01a0 a0 0a 43 9d d
8 de c5 fa 8a 74 c4
0f c4 bc 53 d3 .
.C......t....S.
01b0 18 6c 89 7c f
d 4d 76 e4 56 f1 5b
3d b5 5f 44 89 .
l.|.Mv.V.[=._D.
01c0 02 06 33 a9 1
c 83 14 24 41 08 84
81 41 26 ae 86 .
.3....$A...A&..
01d0 52 df a5 31 c
6 8e 40 93 81 08 f8
2b 34 82 87 0a R
..1..@....+4...
01e0 1d ab 29 c2 6
1 86 3f 09 a4 e7 92

19 71 4c 0e 14 .
.).a.?.....qL..
01f0 dc e5 01 7d 2
5 d2 ce 59 ca 5a e9
c0 8f 6e 78 f6 .
..}%..Y.Z...nx.
0200 c5 f6 46 87 3
d 68 ff 35 21 d6 3b
3d 84 b3 a9 9d .
.F.=h.5!.;=....
0210 b4 78 4e be 3
3 bf 16 67 0f 9d 36
e7 d2 35 ae 7e .
xN.3..g..6..5.~
0220 ea 26 f7 68 f
3 2d ff fb 92 04 e8
0f f2 c6 2c 51 .
&.h.-........,Q
0230 03 58 7a 60 6
0 c5 0a 00 6f 0f 4a
0c 74 b1 40 0d .
Xz``...o.J.t.@.
0240 e5 e9 81 7e 9
3 a8 01 ac 3d 28 eb
0a 50 49 21 56 .
..~....=(..PI!V
0250 ad 48 fb 47 1
9 44 46 c9 c9 10 c3
38 60 3c 01 20 .
H.G.DF....8`<.
0260 43 3c b5 cd 1
6 30 b5 9d 2b 2a a3
7a 85 3b c2 8e C
<...0..+*.z.;..
0270 5a ad da 8f 1
6 e3 4f 33 16 42 64
d5 db f6 fb 51 Z
.....O3.Bd....Q
0280 f5 88 5c a4 d
3 2c 73 11 ca 21 d8
af b0 75 3c 74 .
.\..,s..!...u<t
0290 dc e3 44 64 d
2 d3 3b cc 18 97 d5
b4 c3 9c 6d c2 .
.Dd..;.......m.
02a0 58 eb 9c 6b 7
b 91 ab 5a ce ff c4
c8 70 d0 82 eb X
..k{..Z....p...
02b0 9c 76 8f 58 5
2 11 a8 0c 12 64 d6
87 37 83 c0 48 .
v.XR....d..7..H
02c0 4f 5b 46 a6 2
4 08 50 43 fa fc 26
92 01 b2 53 a1 O
[F.$.PC..&...S.
02d0 b5 1a cc cd 1
d 0d b9 65 49 74 09
4b 21 e7 e7 83 .
......eIt.K!...
02e0 79 b0 ea c6 e
c 93 0f 16 ca e5 8a
10 5e b9 c7 48 y
...........^..H
02f0 ac 31 b3 3a b
e f3 b9 24 79 8d 52
07 81 ac c4 79 .

1.:...$y.R....y
0300 10 f8 cb 06 1
8 02 0b 8e 09 04 96
68 9d 95 a3 a7 .
..........h....
0310 c9 82 25 1a 2
0 27 99 71 ee 08 09
1a 9f 26 84 83 .
.%. '.q.....&..
0320 3f 12 37 1b 7
6 60 59 98 5d 87 d0
36 0b 5e 49 ab ?
.7.v`Y.]..6.^I.
0330 4f 85 34 cc 8
5 5b a9 6c 5f 8e db
ca 55 1c 6e 76 O
.4..[.l_...U.nv
0340 f2 8e a5 22 3
7 dc 94 90 85 75 dc
ed f1 24 55 7b .
.."7....u...$U{
0350 ef 3b b4 94 6
b c5 69 e2 7b 57 18
52 7a fa f8 1f .
;..k.i.{W.Rz...
0360 14 ce 77 89 7
8 5d 66 83 87 99 2e
8e bf 36 02 28 .
.w.x]f......6.(
0370 05 02 30 0d c
e a9 a3 de 20 c2 90
13 c0 9c 06 28 .
.0..... ......(
0380 58 84 ba a9 c
4 e0 29 e6 76 87 20
58 c6 9d 00 5c X
.....).v. X...\
0390 96 4b f3 95 c
b d4 cd 87 b5 c5 34
6b 10 c2 81 86 .
K........4k....
03a0 23 1b 7d 6b 0
0 74 cd e1 31 ca 3d
a4 56 36 b8 b7 #
.}k.t..1.=.V6..
03b0 dd d4 0a e7 c
3 63 89 2e 3d bc bb
d5 1d 49 87 6c .
....c..=....I.l
03c0 42 28 1c 90 8
5 2c 88 a9 ff fb 92
04 e8 8f f2 e9 B
(...,..........
03d0 27 d0 83 58 7
a 50 5f 85 6a 00 6b
0f 4c 0b b0 93 '
..XzP_.j.k.L...
03e0 42 0d 65 e9 4
1 73 15 e8 41 ac 3d
30 46 aa 78 74 B
.e.As..A.=0F.xt
03f0 d8 22 12 c6 1
3 d8 64 04 8d 2e 10
86 05 70 66 a0 .
"....d......pf.
0400 a7 a3 a4 55 8
d f4 9b 55 cf 5b 3e
01 8c 7d 6f ab .
..U...U.[>..}o.

0410 1f 96 d7 ca 5
9 37 01 a8 1b 38 50
45 d8 ee 28 2e .
...Y7...8PE..(.
0420 d4 8f 73 7b 0
5 a0 5a 75 a4 4a 76
53 61 5c e0 ad .
.s{..Zu.JvSa\..
0430 9a e9 ed 3c 8
9 9c ea 2e 99 31 8c
5a 5d c2 80 ea .
..<.....1.Z]...
0440 46 e7 78 68 c
c 62 8e 5a c3 1c 45
c5 55 ca 91 d5 F
.xh.b.Z..E.U...
0450 f6 7d 22 22 0
6 d4 11 34 73 54 68
dd 03 2f e8 0d .
}""...4sTh../..
0460 5a 99 10 90 4
5 50 09 59 13 35 59
f0 c3 42 31 81 Z
...EP.Y.5Y..B1.
0470 84 66 b0 8f 2
c 17 05 49 1f 67 72
61 5b 1b 48 43 .
f..,..I.gra[.HC
0480 54 d9 ac 30 8
e c3 b9 5b 72 d8 b6
f2 ec 6e e8 ae T
..0...[r....n..
0490 82 b4 b9 58 9
a 1d 63 db 75 8f e0
45 92 95 cb 64 .
..X..c.u..E...d
04a0 b6 8b 3c 91 4
2 b6 bd 67 48 83 f8
79 33 ec 7e a4 .
.<.B..gH..y3.~.
04b0 c7 18 16 2f 7
e 34 61 23 55 41 a9
0e 52 89 a5 2f .
../~4a#UA..R../
04c0 f8 b9 4a cc 0
5 28 bb 80 ab 42 13
a2 e6 76 42 06 .
.J..(...B...vB.
04d0 30 6d 17 51 a
4 70 b5 a6 19 18 84
e1 44 90 42 1d 0
m.Q.p......D.B.
04e0 18 0b 67 90 e
6 1d 89 e5 6d 2d 1d
ab 2b b7 78 57 .
.g.....m-..+.xW
04f0 55 5c c8 8c f
1 1f c7 fb ab 7d f5
12 98 cd 20 5f U
\.......}.... _
0500 d6 71 08 55 5
7 ac 24 a0 ed 04 ac
3e 96 3e a4 8a .
q.UW.$....>.>..
0510 8e 30 d2 ec e
3 6a
.
0...j

No. Time
Source
Destination
Protocol
Length Info
375 14.88374700
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=240338 Win=38649 L
en=0
Frame 375: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
7.933677000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615227.933677000 s
econds
[Time delta fro
m previous captured
frame: 0.000155000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00015500
0 seconds]
[Time since ref
erence or first fra
me: 14.883747000 se
conds]
Frame Number: 3
75
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A

sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4fa2 (20386)
Flags: 0x02 (Do
n't Fragment)

0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 24033
8, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 240338 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .

... = ECN-Echo: Not

set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38649
[Calculated win
dow size: 38649]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 374]
[The RTT to
ACK the segment wa
s: 0.000155000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f a2 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cc 0c ff 50 10 .
....P..N.+...P.
0030 96 f9 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
376 15.01159900
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home

TCP
1314 http49
574 [ACK] Seq=24033
8 Ack=1 Win=46 Len=
1260
Frame 376: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.061529000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.061529000 s
econds
[Time delta fro
m previous captured
frame: 0.127852000
seconds]
[Time delta fro
m previous displaye
d frame: 0.12785200
0 seconds]
[Time since ref
erence or first fra
me: 15.011599000 se
conds]
Frame Number: 3
76
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf24b (62027)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39df [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 240338, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 240338 (relati
ve sequence number)
[Next sequence
number: 241598 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xcd2
6 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 4b 4
0 00 31 06 39 df 4a
7c 0c 8a c0 a8 .
..K@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cc 0c ff 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e cd 26 0
0 00 2a c0 5b 22 cb
09 2b 39 c5 a1 .
..&..*.["..+9..
0040 b2 2b 01 19 6
7 10 0a 18 16 55 47
67 a7 5d fd d4 .
+..g....UGg.]..
0050 7a 80 e8 00 0
0 b0 e1 c7 34 ac 00
6a 1c 39 de 16 z
.......4..j.9..
0060 61 15 ce 9e 2
d 28 77 80 05 9a 7e
a4 e0 ff f4 e1 a
...-(w...~.....
0070 98 19 02 3c e
c f8 82 e7 ec 01 c9
27 73 18 18 b9 .
..<.......'s...
0080 80 07 c0 33 0
3 3c c2 2d 07 e0 ff
fb 92 04 ec 0f .

..3.<.-........
0090 f2 f5 24 d1 0
3 58 7a 50 61 c4 aa
10 6b 0f 4a 0c .
.$..XzPa...k.J.
00a0 6c 91 46 0d 6
1 e9 41 7e 11 a8 c1
97 bd 28 60 7b l
.F.a.A~.....(`{
00b0 c3 f8 67 ff f
f ff 47 ff fe d1 23
cd 9e 71 63 55 .
.g...G...#..qcU
00c0 a0 51 07 ea 9
0 b9 c3 02 02 4b 25
25 61 d0 f7 38 .
Q.......K%%a..8
00d0 a9 4f d1 5b 4
c 2f 06 14 27 3c b4
ef 9f 48 31 60 .
O.[L/..'<...H1`
00e0 34 cf df 64 c
b 5a 16 ce 4f 63 62
6d 3f 97 7d a2 4
..d.Z..Ocbm?.}.
00f0 1d 88 1f 41 7
b e3 dd dd c4 20 e0
e1 c1 1d aa 0c .
..A{.... ......
0100 13 26 08 04 4
b d1 59 c9 44 72 e7
dc a0 41 d6 43 .
&..K.Y.Dr...A.C
0110 e2 01 e1 ff e
a 2e 1f 02 6c 3f 02
d5 19 54 9d 27 .
.......l?...T.'
0120 69 da 3a 68 3
f 05 29 34 a2 20 a2
8a 0a 5e 48 5f i
.:h?.)4. ...^H_
0130 10 20 2c a2 7
6 bb 2a 29 0e c9 59
c3 23 bc 38 60 .
,.v.*)..Y.#.8`
0140 31 cd 2f 64 8
8 36 e5 b0 33 43 ae
84 f0 bd 24 2a 1
./d.6..3C....$*
0150 e4 e7 f8 8c c
b 72 f9 13 f2 61 79
d7 34 cf c1 5b .
....r...ay.4..[
0160 64 87 f2 f5 4
7 39 d4 bf 7d 1b 4f
f3 e9 4f f1 dd d
...G9..}.O..O..
0170 7c b3 a7 d0 8
c 97 fb d7 3f 82 ee
0e 40 e2 22 12 |
.......?...@.".
0180 08 d4 2d 73 2
3 0a cb c2 32 77 49
81 1c 5d 0c 3d .
.-s#...2wI..].=
0190 eb c5 3f b9 6
3 0a 65 1b 05 34 65
3c 12 0e 94 38 .
.?.c.e..4e<...8

01a0 7b a6 a6 97 b
5 68 8c ad 1e 59 ad
de df 69 9b b1 {
....h...Y...i..
01b0 77 8e f1 94 8
f a8 f5 9f c7 da ff
18 f8 0c 6a ef w
.............j.
01c0 51 5a 5f 7b 0
7 ff 13 d9 a8 ca ee
39 43 9c 2b fa Q
Z_{.......9C.+.
01d0 67 c1 fb e6 7
b 0e c7 11 1f 87 f6
fc 05 c8 47 89 g
...{.........G.
01e0 01 7a 46 1f a
8 03 89 92 33 12 ac
46 23 d4 d6 7c .
zF.....3..F#..|
01f0 d9 3b 16 94 9
9 49 bc 8e 3a a2 2c
73 6a 27 08 4f .
;...I..:.,sj'.O
0200 f4 ed 78 e7 b
8 6a 6c d0 da ee b1
8a 28 ee dc 62 .
.x..jl.....(..b
0210 4c be 9d cb e
6 bd 2a 59 64 53 cf
cf 52 9d ff ad L
.....*YdS..R...
0220 0b 87 cf db f
b c5 06 ec 28 44 44
52 ff fb 92 04 .
.......(DDR....
0230 e9 0f f2 fa 2
3 d8 01 e9 1a 52 5d
c5 eb 00 3d 26 .
...#....R]...=&
0240 4c 0c 4c d7 6
6 07 a4 6b 89 8a 9a
ec c0 f3 19 71 L
.L.f..k.......q
0250 85 c8 97 6a 1
c c9 ea 1b 2d 9c 75
62 0a 15 44 1a .
..j....-.ub..D.
0260 3a 51 3a e8 d
b bb f0 ab 05 07 05
92 93 1c 6c c5 :
Q:...........l.
0270 37 e5 92 0b c
7 28 95 a1 51 e1 af
b5 cb db 0f df 7
....(..Q.......
0280 d0 da aa eb 8
b e5 91 ba 28 93 81
6e ec 37 cf 93 .
.......(..n.7..
0290 25 f7 9f 54 5
6 9b 82 a6 1f a4 07
d9 78 a8 59 f9 %
..TV.......x.Y.
02a0 e3 11 d3 47 5
8 87 8e a7 3b 81 23
6b a7 6b 5c 46 .
..GX...;.#k.k\F
02b0 8b ff ed ff f

f 7d fe fe c8 3f 49
c9 3c 22 2b 45 .
....}...?I.<"+E
02c0 4c b6 c6 ec d
2 3e f4 e4 e0 40 ad
24 95 2a 92 73 L
....>...@.$.*.s
02d0 0b 52 12 39 1
2 ca 6b ca 40 5d 0a
ec 04 66 90 bb .
R.9..k.@]...f..
02e0 19 d2 9e 08 f
2 e1 77 0a c6 70 77
3b e6 ee 28 31 .
.....w..pw;..(1
02f0 91 f9 61 d2 f
f f9 a0 fc 96 00 87
7f d4 16 28 b1 .
.a...........(.
0300 d9 c5 a8 ab 8
c 78 26 df bd 7a ac
b9 59 e8 fb 79 .
....x&..z..Y..y
0310 37 d5 67 91 f
2 33 77 9d 55 18 ad
1d a6 18 ef 56 7
.g..3w.U......V
0320 2a 1b 16 5b 2
4 30 94 18 e2 ce 07
d3 98 6a 25 27 *
..[$0.......j%'
0330 52 27 0e 14 b
5 ca 7e 79 ed 06 aa
2c 77 c5 0e 66 R
'....~y...,w..f
0340 82 63 b6 11 0
e 18 52 09 2e ce ce
bb 10 81 48 35 .
c....R.......H5
0350 91 5e 9e 51 d
e 93 c1 b5 f5 fe 88
88 fd 5b 78 d4 .
^.Q.........[x.
0360 55 c6 ce 48 a
2 6e 5b ef 77 23 7d
9f ef 2b 6e 59 U
..H.n[.w#}..+nY
0370 af 35 cd ef 9
b 21 30 08 69 14 ad
8a 2e f3 bf 92 .
5...!0.i.......
0380 97 91 c0 ed 7
4 3c 15 47 30 64 9c
e2 3e dc 95 a4 .
...t<.G0d..>...
0390 4f 59 82 14 d
4 26 29 9d 7a 6d 69
47 e1 b0 52 1e O
Y...&).zmiG..R.
03a0 50 49 3d a0 4
3 46 7a 14 10 74 22
ef 3b 61 f0 95 P
I=.CFz..t".;a..
03b0 7e d4 f2 b3 d
a 72 bc 6e 7e 97 aa
44 d7 ad c2 f3 ~
....r.n~..D....
03c0 9a a9 35 fc 0
9 87 25 0d 24 60 98

54 8b 68 73 ff .
.5...%.$`.T.hs.
03d0 fb 92 04 e7 0
f f2 db 46 5a 01 e9
1a e0 5f 05 cb .
......FZ...._..
03e0 40 3c c6 4c 4
b ac 89 68 0c 24 69
49 71 15 2d 00 @
<.LK..h.$iIq.-.
03f0 f3 09 31 3a 6
8 43 29 a5 0e c1 56
a6 b3 28 5c ec .
.1:hC)...V..(\.
0400 6d d4 98 a4 b
d 76 12 86 43 77 61
10 5d 02 ad be m
....v..Cwa.]...
0410 a5 b0 b9 20 6
7 a2 94 23 fa 53 cc
8d 2b a8 d0 9a .
.. g..#.S..+...
0420 d8 61 06 4d f
8 19 18 43 b8 e2 68
b0 82 6d 4e 35 .
a.M...C..h..mN5
0430 5a ce e9 6c e
d 4a 65 44 f2 5e d3
e6 08 cc 91 c9 Z
..l.JeD.^......
0440 4c 88 13 d7 9
c cf 69 2d 26 5f 80
9a 6a 94 64 15 L
.....i-&_..j.d.
0450 60 b0 ba 59 2
9 34 91 89 55 32 f2
2f e8 91 85 84 `
..Y)4..U2./....
0460 94 2a c6 97 8
8 2c fe df 7e 98 75
25 4b 34 45 33 .
*...,..~.u%K4E3
0470 28 5c 17 fa a
a e2 68 15 52 26 11
d4 eb 63 9b 3c (
\....h.R&...c.<
0480 4f ec 26 49 5
9 dc 83 03 2f 71 55
45 1a 2c 3d 02 O
.&IY.../qUE.,=.
0490 91 1e 84 95 5
9 d4 8c fa b5 25 a9
51 8e 76 3d 15 .
...Y....%.Q.v=.
04a0 fd 91 91 d9 5
c d5 44 bd 19 51 a7
73 73 dc 46 d2 .
...\.D..Q.ss.F.
04b0 82 89 06 92 5
4 37 a0 7a 31 74 e8
67 d7 2f 10 11 .
...T7.z1t.g./..
04c0 58 59 ba a0 6
9 d8 da 66 f1 71 09
1a 70 22 56 45 X
Y..i..f.q..p"VE
04d0 e2 18 4c 6d 5
5 ee 09 cb 61 f6 2f
eb 5f bd 7f e0 .

.LmU...a./._...
04e0 99 da c1 f7 5
c e0 d3 fd 91 98 39
c3 ea e0 f4 83 .
...\.....9.....
04f0 ff ef de f6 4
a 0b 45 04 1f 4e 6e
17 d3 b1 33 e6 .
...J.E..Nn...3.
0500 d4 0a d3 36 a
6 39 b3 6c 94 5f 6d
5d f4 22 c4 6b .
..6.9.l._m].".k
0510 fe 3f f9 9a f
f b6 d9 24 2a c8 1e
fa 81 88 88 cb .
?.....$*.......
0520 da 85
.
.
No. Time
Source
Destination
Protocol
Length Info
377 15.03359800
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1306 http49
574 [PSH, ACK] Seq=
241598 Ack=1 Win=46
Len=1252
Frame 377: 1306 byt
es on wire (10448 b
its), 1306 bytes ca
ptured (10448 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.083528000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.083528000 s
econds
[Time delta fro
m previous captured
frame: 0.021999000
seconds]
[Time delta fro
m previous displaye
d frame: 0.02199900
0 seconds]
[Time since ref
erence or first fra
me: 15.033598000 se

conds]
Frame Number: 3
77
Frame Length: 1
306 bytes (10448 bi
ts)
Capture Length:
1306 bytes (10448
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:

20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
292
Identification:
0xf24c (62028)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39e6 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 241598, Ack:
1, Len: 1252
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le

n: 1252]
Sequence number
: 241598 (relati
ve sequence number)
[Next sequence
number: 242850 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xc53
3 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2512]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.

0010 05 0c f2 4c 4
0 00 31 06 39 e6 4a
7c 0c 8a c0 a8 .
..L@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cc 11 eb 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e c5 33 0
0 00 13 59 4e f9 0e
7c 4a 5a 8e c6 .
..3...YN..|JZ..
0040 4e 0b 3a ba b
e 96 81 34 17 de 5b
47 3a 0f b4 5a N
.:....4..[G:..Z
0050 fd 6b 1c 18 2
8 c3 f9 1a 15 d3 a7
87 9a 17 9c 24 .
k..(..........$
0060 a2 07 be 8e d
c cc 2f 14 da f8 ce
66 36 e7 aa 6f .
...../....f6..o
0070 fc 77 48 eb 2
f 24 cc 44 d4 76 38
46 2e 0b 0c 68 .
wH./$.D.v8F...h
0080 74 f1 a9 21 8
d ff fb 92 04 ec 0f
f2 f6 46 59 03 t
..!.........FY.
0090 09 1a e0 65 4
9 2b 10 61 23 5e 0b
fd 19 62 0c 24 .
..eI+.a#^...b.$
00a0 ab 81 68 95 2
c 41 84 99 31 32 c0
36 b2 fe 39 4b .
.h.,A..12.6..9K
00b0 24 06 bb d2 2
7 22 2c 12 a3 dd 90
a5 46 a9 50 67 $
...'",.....F.Pg
00c0 eb 0b 70 72 0
f 52 61 f0 e0 0a c4
9e 87 14 8c 32 .
.pr.Ra........2
00d0 e4 cb 16 2b a
6 19 15 6a 99 c6 8c
0b 5f 64 05 7f .
..+...j...._d..
00e0 a3 a8 f1 e3 7
0 f6 42 41 02 c2 cf
b3 44 5c 40 e9 .
...p.BA....D\@.
00f0 8d 2e 39 8b 5
1 a9 dc cc 37 1a fe
39 c6 47 31 cd .
.9.Q...7..9.G1.
0100 f1 1b 5f d7 3
3 4b 23 2c 54 3a 0a
ae f3 84 9c 94 .
._.3K#,T:......
0110 f7 38 35 81 6
4 e4 18 ea 1c d5 22
54 12 33 24 73 .
85.d....."T.3$s
0120 fb 4b 51 98 3

4 99 fb 0f 61 c0 b3
8e a0 56 2b eb .
KQ.4...a....V+.
0130 30 32 0b 2a d
6 4e 54 91 b3 75 e5
98 52 10 63 a3 0
2.*.NT..u..R.c.
0140 14 57 64 47 5
2 05 07 47 8e 41 ce
65 4a 7a b3 95 .
WdGR..G.A.eJz..
0150 98 dd b2 b9 8
7 4a ee eb da ac 49
d9 ca a8 fb 6c .
....J....I....l
0160 34 2c 4c b0 0
d 44 c8 08 c3 a3 00
4c d5 fd a5 0d 4
,L..D.....L....
0170 2e 95 96 01 d
2 2e 84 80 39 83 99
48 bb 60 60 b2 .
.......9..H.``.
0180 da 62 38 1a 9
b 3a 76 c8 27 16 67
07 d2 8d 6e d3 .
b8..:v.'.g...n.
0190 d4 cf 39 7b b
9 41 51 45 bd 44 23
7b a8 a3 ae 14 .
.9{.AQE.D#{....
01a0 1a 86 ac 42 6
2 5d ea d7 e3 fd 26
bb f5 b5 9e cd .
..Bb]....&.....
01b0 d6 ae ee 7e b
6 ef d2 a6 67 e6 e3
a5 aa 7b 18 a3 .
..~....g....{..
01c0 cd 50 e7 c2 0
0 c9 e3 8d 2b ab e7
5c db 9f ae 2c .
P......+..\...,
01d0 21 a2 ad b0 e
0 bc c1 80 7b f3 60
6a 19 0b a1 7b !
.......{.`j...{
01e0 c6 a7 d9 d4 c
0 92 13 55 24 8c 23
b6 44 46 75 a8 .
......U$.#.DFu.
01f0 57 1b b3 c7 7
2 6c a8 a5 cb d3 f7
92 4d 27 0f dc W
...rl......M'..
0200 dc b5 7f 8a 6
8 cd df 33 fb d3 76
ec ff 77 e6 65 .
...h..3..v..w.e
0210 7c 7b f1 1e a
c b7 b6 72 bb 97 9b
fd f7 6a 7e b6 |
{.....r.....j~.
0220 38 26 0c 87 0
d 03 ad ff fb 92 04
ec 0f f3 27 3e 8
&............'>
0230 d7 83 0c 42 e
0 64 68 5b 00 3d 08

5c 0b 3c f9 60 .
..B.dh[.=.\.<.`
0240 0c 20 ab 81 7
2 a0 6c 00 f4 a1 70
3e 90 92 08 3e .
..r.l...p>...>
0250 d1 57 dc 2e d
f d4 1c 2c 29 47 4b
01 52 96 28 b5 .
W.....,)GK.R.(.
0260 20 58 fc 65 d
6 86 25 07 c1 58 4a
e8 42 17 91 ca
X.e..%..XJ.B...
0270 a2 3a 43 41 e
c bb 34 cf 4d dd e9
4a 35 23 a2 93 .
:CA..4.M..J5#..
0280 85 9c f8 f8 6
6 f5 82 01 0c 38 24
5e 4b 36 44 a9 .
...f....8$^K6D.
0290 09 6e 92 7d 3
6 8e fa ef e3 f3 17
3d 9a ef f8 fb .
n.}6......=....
02a0 ae 44 be 5c f
5 9f 97 65 2c 5e eb
c8 31 2c b7 10 .
D.\...e,^..1,..
02b0 b9 21 76 ff b
5 2f ff fd 3f 42 53
66 49 22 ac f6 .
!v../..?BSfI"..
02c0 1f 8b 70 22 c
a 93 50 63 c2 d7 da
7d 0c 3f fb 5f .
.p"..Pc...}.?._
02d0 4f 77 ad ee d
2 27 29 4a 7d 6b 5d
a5 98 66 cd 25 O
w...')J}k]..f.%
02e0 c7 5e c4 d8 c
f 71 b1 36 5a f0 e3
4e c6 c3 b4 d8 .
^...q.6Z..N....
02f0 9e 4e 73 e9 f
e ea 9b f9 97 46 9d
cd 71 bf d7 ae .
Ns......F..q...
0300 44 18 0e 1b 0
d d8 1b 48 6c c9 d3
23 d2 d1 ae 70 D
......Hl..#...p
0310 71 44 dc bf b
f a0 e6 06 b9 72 51
1a 21 9e cd 1c q
D.......rQ.!...
0320 9a 97 d5 e7 f
2 1b 1d 6a 23 97 35
7d 98 8e c3 4d .
......j#.5}...M
0330 43 45 16 2b a
3 6a 92 f2 62 4d d9
b4 09 e7 6c b2 C
E.+.j..bM....l.
0340 46 b5 b3 8d 4
6 90 75 64 c5 b6 bf
2f f3 f2 f6 d5 F

...F.ud.../....
0350 f3 b9 fa d1 c
a ad ed bd fc e6 ff
fe 3f 8d 6a de .
...........?.j.
0360 da dd be 3b f
b 6d 9d f0 58 4d 21
d1 7b 98 a6 d5 .
..;.m..XM!.{...
0370 f2 f5 55 56 2
4 5e d8 18 90 ad 16
37 65 c6 4b 79 .
.UV$^.....7e.Ky
0380 0c bc 98 00 6
8 51 3a 00 a1 f4 f1
13 14 ab b9 2c .
...hQ:........,
0390 8c 6b 4d 46 a
a 5b cd 14 66 e2 1d
fa a0 d1 1b 42 .
kMF.[..f......B
03a0 c2 c3 86 8d 1
b 0b 16 d6 d4 91 d7
d3 bc d5 37 75 .
.............7u
03b0 1d 6b 6f 5c f
a 4a f1 52 f7 dc f2
d1 09 71 e3 62 .
ko\.J.R.....q.b
03c0 19 37 b2 0d 8
6 0f 2d 8a 13 ff fb
92 04 eb 0f f3 .
7....-.........
03d0 20 42 57 03 0
b 32 e0 61 27 2a e0
60 c6 5c 4b b4
BW..2.a'*.`.\K.
03e0 d7 5c 0c 31 6
b 81 6e a2 eb c0 f4
19 70 1e 41 40 .
\.1k.n.....p.A@
03f0 b6 a4 ef 77 d
0 2c a5 cd 16 7e 09
72 41 d3 8a c2 .
..w.,...~.rA...
0400 f8 f9 e1 dd 9
c e6 81 81 a8 a8 f9
39 1c b2 1e 29 .
..........9...)
0410 23 7c 37 34 d
b 10 fd 45 d4 60 86
5f 8b 84 fc 35 #
|74...E.`._...5
0420 19 40 da cd 3
c 17 18 2e 34 aa 4b
a6 6b 8f 58 87 .
@..<...4.K.k.X.
0430 1c 35 16 e6 2
5 66 e3 cb df 85 f4
d3 ef 17 f4 18 .
5..%f..........
0440 f0 f5 fc 1b f
5 9c 28 6c 07 04 25
41 91 34 63 c8 .
.....(l..%A.4c.
0450 bf 63 e8 43 f
4 54 8c 43 09 98 c6
1c b3 8c 05 01 .
c.C.T.C........

0460 35 09 29 8e e
5 cb c4 95 8b 8a 0d
87 f1 ef c7 17 5
.).............
0470 30 f2 73 3d 5
f 2b 9b de dd 8a 19
8e bf 4f 7a 3e 0
.s=_+.......Oz>
0480 d8 8b ed 4e 2
6 60 88 89 e3 04 0d
a0 b3 bd e8 65 .
..N&`.........e
0490 41 66 3b ca 5
a 14 89 d5 06 52 ca
e9 a5 f6 59 51 A
f;.Z....R....YQ
04a0 08 24 46 12 7
b 51 48 f6 b9 eb ab
65 b1 9e 5b b6 .
$F.{QH....e..[.
04b0 82 0e dd 36 f
a 2b 61 0f b0 d2 34
4b 62 b0 ce 3f .
..6.+a...4Kb..?
04c0 09 69 ba a3 6
7 64 66 59 38 27 0e
b0 aa 41 5b ff .
i..gdfY8'...A[.
04d0 14 4b 9e 8c c
e 55 d5 73 7b 5a b1
4d a7 c3 7d f4 .
K...U.s{Z.M..}.
04e0 f8 ff f5 5c 6
1 0c 75 0e 94 a3 c0
a2 e4 80 e3 54 .
..\a.u........T
04f0 49 d1 ca 8e a
c 63 bd 55 7b 5d c7
b4 ea 97 37 9d I
....c.U{]....7.
0500 08 96 35 69 a
5 dd 4c 74 3b 2a 2a
b8 bb a9 69 a1 .
.5i..Lt;**...i.
0510 ce 23 79 d3 d
0 00 fd b5 f4 2a
.
#y......*
No. Time
Source
Destination
Protocol
Length Info
378 15.03377600
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=242850 Win=39060 L
en=0
Frame 378: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.083706000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.083706000 s
econds
[Time delta fro
m previous captured
frame: 0.000178000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017800
0 seconds]
[Time since ref
erence or first fra
me: 15.033776000 se
conds]
Frame Number: 3
78
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)

Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4fa3 (20387)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]

[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 24285
0, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 242850 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39060
[Calculated win

dow size: 39060]

[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 377]
[The RTT to
ACK the segment wa
s: 0.000178000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f a3 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cc 16 cf 50 10 .
....P..N.+...P.
0030 98 94 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
379 15.14560400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=24285
0 Ack=1 Win=46 Len=
1260
Frame 379: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.195534000 Romance

Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.195534000 s
econds
[Time delta fro
m previous captured
frame: 0.111828000
seconds]
[Time delta fro
m previous displaye
d frame: 0.11182800
0 seconds]
[Time since ref
erence or first fra
me: 15.145604000 se
conds]
Frame Number: 3
79
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....

= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf24d (62029)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39dd [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.

11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 242850, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 242850 (relati
ve sequence number)
[Next sequence
number: 244110 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]

Checksum: 0xcac
b [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 4d 4
0 00 31 06 39 dd 4a
7c 0c 8a c0 a8 .
..M@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cc 16 cf 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e ca cb 0
0 00 60 3b 00 77 0c
35 20 b7 26 62 .
.....`;.w.5 .&b
0040 ab 82 91 a5 5
b 46 d4 da b2 c0 63
45 2c b2 a6 15 .
...[F....cE,...
0050 0b 0f e2 54 7
a b9 0d 13 ef 56 3f
bc ef 44 09 05 .
..Tz....V?..D..
0060 00 8a 6c 29 b
9 71 45 59 11 ca 1b
8a 3d 4b cf af .
.l).qEY....=K..
0070 fd 1f 3c cf f
8 a8 c7 c2 a9 97 99
94 74 f3 3b 41 .
.<.........t.;A
0080 ff 4b bc 87 e
a 20 11 ff fb 92 04
ea 8f f2 f7 43 .
K... .........C
0090 d7 03 08 42 e
0 61 08 2a e0 3d 28
5c 0c 05 3d 5c .
..B.a.*.=(\..=\
00a0 07 b0 ab c1 8
c a4 eb c0 f6 15 78
49 95 a1 8e ab .
.........xI....
00b0 a8 6b d1 1e 5
7 01 6c b4 62 78 d8
ab 9c 8c ce a3 .
k..W.l.bx......
00c0 94 ac d8 c1 f
6 b1 56 59 9b 0c 1a
60 f9 10 63 c6 .
.....VY...`..c.
00d0 dd 4a f5 e7 e
1 a9 18 0e e1 54 e2
54 5e 7f a5 1e .

J.......T.T^...
00e0 44 a0 c0 2d e
c fb fa 38 ab 74 66
f2 68 65 1f 88 D
..-...8.tf.he..
00f0 16 f4 19 ac 3
c 96 be e4 16 9f ec
f6 1a 8b f6 bf .
...<...........
0100 ee 15 ff 9d 7
7 eb b2 60 54 ce 2c
6a 02 23 2b 1a .
...w..`T.,j.#+.
0110 26 40 d1 f4 b
e 6f 2d 34 d0 95 66
8f d0 80 fa 26 &
@...o-4..f....&
0120 b5 46 d6 57 3
6 71 6f e9 ee a7 2f
36 9b 4e ad 3d .
F.W6qo.../6.N.=
0130 5c 40 1b c0 d
2 f8 a6 91 14 82 9c
21 3c 46 19 20 \
@.........!<F.
0140 e8 76 b1 33 f
9 b7 15 26 40 72 74
dd 4f 7c 0b c8 .
v.3...&@rt.O|..
0150 83 3e f5 ff e
3 1f 11 07 f2 4d a2
ad ac ac 4d 5c .
>.......M....M\
0160 4d 7b 16 a3 0
9 39 a5 1d 9f 61 36
12 dc c4 7b bf M
{...9...a6...{.
0170 5b fa 3e 70 0
8 13 29 1c d0 03 15
b4 e5 4b e5 fb [
.>p..)......K..
0180 2c 1a 55 66 d
2 10 0c 9c 6a 07 b6
fe cd 06 f8 cf ,
.Uf....j.......
0190 f4 11 4e 7e 5
4 b2 af a0 5d 73 76
b2 68 63 37 64 .
.N~T...]sv.hc7d
01a0 88 a2 81 d0 8
e 06 86 9d 47 87 2a
26 d8 77 e2 1c .
.......G.*&.w..
01b0 64 0d c6 8b b
4 bf 33 f0 db 2d f9
88 d5 9f 8c a8 d
.....3..-......
01c0 ab 85 5b 6b 9
b 8b 86 57 9a 4d 67
9a ed 16 fc 74 .
.[k...W.Mg....t
01d0 23 47 fd f2 3
b a5 72 0a bb a6 93
07 0c 18 a4 d6 #
G..;.r.........
01e0 1c 53 01 47 7
8 96 88 57 2d a2 48
f8 7d a5 49 48 .
S.Gx..W-.H.}.IH

01f0 89 1b 0d 38 9
c 42 b9 4d 4b 17 ad
ba a6 8d f9 3b .
..8.B.MK......;
0200 25 49 09 6a 3
6 12 6a 14 2c c2 85
81 30 69 5d 08 %
I.j6.j.,...0i].
0210 22 24 e8 dc 7
2 cb 4f c6 dd b7 c5
52 e9 dc db ff "
$..r.O....R....
0220 31 73 3b d4 9
e 45 d9 95 c5 ff fb
92 04 e7 8f f2 1
s;..E..........
0230 bd 43 d7 01 e
c 1a e0 54 c4 9a f0
3d 26 4a 4d 49 .
C.....T...=&JMI
0240 11 56 0c 31 0
b 81 a4 a7 6b 01 84
a1 78 4d 3b 7d .
V.1....k...xM;}
0250 71 14 46 2a 2
6 42 18 e5 ad 8c 6e
41 c4 b7 9d 21 q
.F*&B....nA...!
0260 d8 ba 3e d0 b
9 8e 76 5a 44 70 d8
d5 44 5a de 3b .
.>...vZDp..DZ.;
0270 95 14 eb 15 e
5 e3 59 b5 b0 72 ac
df 13 34 e1 ee .
.....Y..r...4..
0280 57 b3 56 d1 2
1 df 66 ce 63 46 63
a5 c3 db 11 1f W
.V.!.f.cFc.....
0290 0e d4 37 f5 5
4 ce cd b4 ec 6f fe
e6 a5 aa 85 96 .
.7.T....o......
02a0 14 24 89 64 3
2 b0 d9 f8 32 2a 48
b9 45 09 d7 68 .
$.d2...2*H.E..h
02b0 57 ad cd e9 7
0 53 28 b7 cb 0e 5e
e0 ca 24 73 ea W
...pS(...^..$s.
02c0 bb 95 b5 8f d
a 52 00 a5 b4 9a f2
1c ed cc ad 36 .
....R.........6
02d0 a2 07 b9 49 4
3 f5 c3 47 df e5 34
5c 99 b7 c3 20 .
..IC..G..4\...
02e0 fd 79 48 19 5
c ca 89 9d c1 d7 8c
1b 13 51 53 b9 .
yH.\........QS.
02f0 b2 db 8a 6b 2
f 98 75 ed d2 af 67
f4 d9 a8 d5 67 .
..k/.u...g....g
0300 32 ea 9d b7 3

c 45 4c d4 5c 7a 72
80 c9 d4 97 31 2
...<EL.\zr....1
0310 5a cf 36 d6 7
4 d1 08 d4 92 68 f2
8d 25 fc 87 23 Z
.6.t....h..%..#
0320 2d 92 d9 35 8
c 09 88 f7 a3 5c 74
76 55 b6 ad 9c ..5.....\tvU...
0330 a3 53 2a 94 6
1 9e 51 6c 5c 39 14
5c 41 bd 7c 9c .
S*.a.Ql\9.\A.|.
0340 70 f1 3e b6 0
f 80 e6 0d ca 01 87
2e 49 5e 42 0f p
.>.........I^B.
0350 9b e1 b0 89 b
3 9a ad ee d9 7c f1
7b 72 80 f4 ed .
........|.{r...
0360 24 0d 28 54 e
1 06 c2 50 1b 14 b6
18 1f 60 62 aa $
.(T...P.....`b.
0370 ee 5e aa 64 2
3 d5 07 30 b6 8a ec
08 65 6d 80 5b .
^.d#..0....em.[
0380 a8 89 10 33 b
a c4 c1 de 7c 8e 60
1c 3f e5 eb b9 .
..3....|.`.?...
0390 e6 ac aa 7a 6
b 5f 7b 1f 3f 33 4d
22 c3 be 45 de .
..zk_{.?3M"..E.
03a0 b7 40 bb 96 3
0 6d cd 07 a5 01 1d
9a 92 2e 98 72 .
@..0m.........r
03b0 5b 47 7f f7 d
b bc 8d 54 44 f9 fa
8e 86 cf d1 75 [
G.....TD......u
03c0 ba 6f 0d da 5
8 d7 55 e4 8a 28 2a
ff fb 92 04 e6 .
o..X.U..(*.....
03d0 8f f2 ee 44 5
5 83 0b 42 e0 58 46
1a d0 3d 2b 4c .
..DU..B.XF..=+L
03e0 0c 25 11 56 0
c 2d 6b 81 75 98 6b
01 84 ad 30 c1 .
%.V.-k.u.k...0.
03f0 31 77 57 4a 3
d d4 32 87 64 ac 02
22 28 32 c7 71 1
wWJ=.2.d.."(2.q
0400 b7 43 5b b9 5
9 38 17 50 e2 31 32
80 92 f2 91 b9 .
C[.Y8.P.12.....
0410 ec d5 63 20 5
f 67 79 9d 7b 8f f7

8d c8 ea 4f ec .
.c _gy.{.....O.
0420 96 69 5f b2 f
0 35 76 6e 3f 8e e6
20 6a 50 10 77 .
i_..5vn?.. jP.w
0430 77 0e a6 39 c
f 97 e8 4f 7f 17 74
fc d9 b2 f6 47 w
..9...O..t....G
0440 1f 50 c6 eb 3
f 7d 7b 10 dd 5d c4
d4 be 9d cc 7f .
P..?}{..]......
0450 ec e1 9b 94 e
3 61 bf eb d1 0e a4
88 00 a3 d9 1c .
....a..........
0460 ab 19 6e 12 e
9 42 12 9a 8b ec a3
c3 53 f9 c3 00 .
.n..B......S...
0470 d9 f5 26 64 8
a 88 72 6f 4d cf 8a
7f 10 b4 45 29 .
.&d..roM.....E)
0480 50 4c fc f9 6
4 ff f1 21 0e 43 8e
4b 5d 47 63 43 P
L..d..!.C.K]GcC
0490 39 db dd b5 d
7 b1 86 56 f9 f7 d8
87 47 be 7f ff 9
......V....G...
04a0 fa c6 e8 91 a
b 78 2c a2 a0 03 7b
8d 34 fc a2 ce .
....x,...{.4...
04b0 c2 7f 4f 4b 6
b fa 5e 80 3d 21 7b
29 8e b4 0c 22 .
.OKk.^.=!{)..."
04c0 da c0 a8 a0 b
6 b7 93 16 18 0f 9a
cb 7b 1e a9 b6 .
...........{...
04d0 ef b1 aa 52 f
a 9c 3e d2 a4 cd 59
18 81 fe 47 cf .
..R..>...Y...G.
04e0 9c de 9a 83 b
9 85 45 5b e5 c6 9d
08 56 c9 f9 1c .
.....E[....V...
04f0 94 b7 69 34 0
9 7f be be e4 ca b2
00 46 6c 36 c3 .
.i4........Fl6.
0500 97 0c 1a 51 c
8 24 f7 9a 5b 2c 46
bb be da 5d 4d .
..Q.$..[,F...]M
0510 77 18 92 64 a
4 29 53 22 14 a3 ed
14 64 65 32 99 w
..d.)S"....de2.
0520 97 d4
.

.
No. Time
Source
Destination
Protocol
Length Info
380 15.18460700
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
879 http49
574 [PSH, ACK] Seq=
244110 Ack=1 Win=46
Len=825
Frame 380: 879 byte
s on wire (7032 bit
s), 879 bytes captu
red (7032 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.234537000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.234537000 s
econds
[Time delta fro
m previous captured
frame: 0.039003000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03900300
0 seconds]
[Time since ref
erence or first fra
me: 15.184607000 se
conds]
Frame Number: 3
80
Frame Length: 8
79 bytes (7032 bits
)
Capture Length:
879 bytes (7032 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp

.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
65
Identification:

0xf24e (62030)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3b8f [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 244110, Ack:
1, Len: 825
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 825]
Sequence number
: 244110 (relati
ve sequence number)
[Next sequence
number: 244935 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .

... = Nonce: Not se

t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x641
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2085]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 61 f2 4e 4
0 00 31 06 3b 8f 4a
7c 0c 8a c0 a8 .
a.N@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cc 1b bb 9e
87 4e aa 50 18 .
..P..+.....N.P.
0030 00 2e 64 14 0
0 00 2a af d5 2f 5b
ed 49 67 87 5f .
.d...*../[.Ig._
0040 96 e7 90 a4 8
f 69 6b 3d a1 d7 fb
c6 8c c7 0b 37 .
....ik=.......7
0050 3e ea de 76 9
2 07 6b 12 32 9f a2
72 7f c2 d9 be >
..v..k.2..r....

0060 35 ce 7f 5d e
7 ff 5f e6 d5 f7 7e
d9 f9 6d f5 e7 5
..].._...~..m..
0070 ba 6c 68 bc 6
8 68 c9 9b 4c b9 57
15 0c 48 2d b7 .
lh.hh..L.W..H-.
0080 a3 ff fb 92 0
4 eb 0f f3 04 44 55
83 0b 42 e0 61 .
........DU..B.a
0090 69 4a c0 61 2
b 5e 0b ac dd 56 0c
2c cb 81 65 98 i
J.a+^...V.,..e.
00a0 ab 00 f4 a5 3
0 23 b2 04 20 71 14
de b6 45 b1 21 .
...0#.. q...E.!
00b0 0a d1 b4 30 5
a d7 07 81 dd 05 8c
6a 46 1b a2 58 .
..0Z......jF..X
00c0 84 8f c6 fd a
7 89 a8 61 4d 62 11
8c e4 bc 72 f6 .
......aMb....r.
00d0 6b 31 21 ed 9
7 b4 a4 f2 ad b9 24
05 df 25 4b 24 k
1!.......$..%K$
00e0 ce 5e 1b b3 a
b 7c f1 54 d4 79 4a
37 57 1e ca 7f .
^...|.T.yJ7W...
00f0 b6 7f af f3 b
6 2a 7d 09 2b 18 2a
de c1 82 59 b0 .
....*}.+.*...Y.
0100 a0 4a 42 f2 e
f b6 18 a9 d0 44 40
f2 ef ae a5 41 .
JB......D@....A
0110 3e 0b 58 5d 0
d 90 91 33 be 65 21
86 b3 e4 a4 05 >
.X]...3.e!.....
0120 de 91 1d 83 a
1 b0 a9 7a 1f 4e 32
84 8f 9c 67 77 .
......z.N2...gw
0130 6c bf 6c 0a 8
8 1c e9 1c a1 e1 a9
b0 92 18 40 07 l
.l...........@.
0140 51 65 44 1f a
8 fb d1 5e e4 49 f2
3b 1c 73 99 86 Q
eD....^.I.;.s..
0150 b7 37 e3 65 c
9 b5 2a 28 76 c7 da
d5 b2 28 35 0b .
7.e..*(v....(5.
0160 93 ae 83 b6 b
7 98 bd 47 e7 75 ab
4a b0 e9 2f 4a .
......G.u.J../J
0170 f2 64 e2 b8 4

b 33 cd 09 7b 11 a7
20 eb 81 97 43 .
d..K3..{.. ...C
0180 fe 9c 63 01 6
b ba 8f f3 c9 de 7a
3a e2 54 03 22 .
.c.k.....z:.T."
0190 b3 7f 53 53 2
1 b0 27 30 f5 92 84
13 d4 50 a5 63 .
.SS!.'0.....P.c
01a0 a5 a2 45 17 2
1 d5 99 d5 0c 6a b3
a3 89 75 5a bc .
.E.!....j...uZ.
01b0 aa 4a 52 bb 1
1 a2 0d de bb 2d 6d
f2 b3 48 b4 d6 .
JR......-m..H..
01c0 db f2 af 4a f
f de ff c6 f5 aa 96
bc eb 39 2c 8b .
..J.........9,.
01d0 c8 6d 13 a9 7
e 54 3a 48 0d ba e2
c1 1a aa a9 12 .
m..~T:H........
01e0 31 37 33 94 d
5 dc 7a 37 db 12 6a
fa c5 e2 35 8d 1
73...z7..j...5.
01f0 f3 4e 26 ed 9
4 f3 ff 64 85 9d 54
81 01 b8 d2 49 .
N&....d..T....I
0200 f1 c9 7a b8 b
c 94 94 80 1a c6 03
06 94 f2 f6 24 .
.z............$
0210 a1 f4 a0 00 8
2 81 e2 06 49 90 78
d3 ac 6c 86 51 .
.......I.x..l.Q
0220 4e 5c 55 ff f
b 90 04 ed 8f f3 24
3a 55 83 0f 32 N
\U.......$:U..2
0230 e0 62 06 ea c
0 3d 2b 5c 0b 74 dd
58 07 ac ab 81 .
b...=+\.t.X....
0240 7c 2f ab 00 f
4 95 b8 cf 7e 53 ba
ba 92 2a e3 b1 |
/......~S...*..
0250 44 65 15 09 4
7 cd f1 6b 93 91 43
49 b5 01 39 8f D
e..G..k..CI..9.
0260 0f 51 c6 a0 a
c 99 73 ee 75 3b dc
f8 b5 58 85 02 .
Q....s.u;...X..
0270 00 8d e2 29 b
7 59 18 6c a1 70 6e
60 a1 c1 f0 36 .
..).Y.l.pn`...6
0280 0e 41 cb 14 8
2 61 50 c2 cc 51 91

16 8b 2d ff dd .
A...aP..Q...-..
0290 b0 ff 6f fe f
9 fa 9d f8 86 49 3e
b6 a2 e7 a0 6a .
.o......I>....j
02a0 a6 c6 88 ae 9
f aa 8b 77 fc 84 db
f0 5d 48 10 74 .
......w....]H.t
02b0 48 a0 a4 94 5
5 ea 7d db f2 39 0a
71 78 53 aa 1c H
...U.}..9.qxS..
02c0 dc 20 9d 91 6
2 39 38 b3 41 6c 89
1d 91 f3 8b e6 .
..b98.Al......
02d0 f7 26 3c cd a
b dc 54 1e 73 c6 e6
3d 7e ed 81 4f .
&<...T.s..=~..O
02e0 05 a4 8e e2 7
b b0 e8 fa 7b ff e3
29 d6 00 38 24 .
...{...{..)..8$
02f0 7b 55 9c 16 8
3 74 17 49 f7 3e 54
c5 08 55 8e 65 {
U...t.I.>T..U.e
0300 cd 02 98 83 e
f 23 9e 7e 87 a2 e4
48 1c 72 1a e0 .
....#.~...H.r..
0310 11 88 25 52 a
4 c1 6d 99 8c 19 41
03 84 01 b2 86 .
.%R..m...A.....
0320 4d a0 99 8b 1
0 39 94 48 51 32 93
2f 61 12 14 49 M
....9.HQ2./a..I
0330 bd 1c d0 a2 1
e c8 2e 26 8e aa c4
ca ff be da 4f .
......&.......O
0340 29 85 22 82 9
3 7b 6d 2f 7c b4 de
56 bf 48 d6 0e )
."..{m/|..V.H..
0350 25 e3 91 55 4
8 08 4a 21 22 8e d0
c8 99 0a 62 86 %
..UH.J!".....b.
0360 1e 45 a0 43 c
a 04 17 ad 94 50 b4
5d a9 b2 75
.
E.C.....P.]..u
No. Time
Source
Destination
Protocol
Length Info
381 15.18478100
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP

54 49574h
ttp [ACK] Seq=1 Ack
=244935 Win=39060 L
en=0
Frame 381: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.234711000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.234711000 s
econds
[Time delta fro
m previous captured
frame: 0.000174000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00017400
0 seconds]
[Time since ref
erence or first fra
me: 15.184781000 se
conds]
Frame Number: 3
81
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90

:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4fa4 (20388)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset

:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 24493
5, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 244935 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set

.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 39060
[Calculated win
dow size: 39060]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 380]
[The RTT to
ACK the segment wa
s: 0.000174000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f a4 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cc 1e f4 50 10 .
....P..N.+...P.
0030 98 94 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
382 15.22360600
0 Netgear_2e:1a:0
9
Broadcast
HomePlug
AV 60 MAC Manag
ement, Get Bridge I
nformations Confirm
ation
Frame 382: 60 bytes
on wire (480 bits)
, 60 bytes captured
(480 bits) on inte
rface 0

Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.273536000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.273536000 s
econds
[Time delta fro
m previous captured
frame: 0.038825000
seconds]
[Time delta fro
m previous displaye
d frame: 0.03882500
0 seconds]
[Time since ref
erence or first fra
me: 15.223606000 se
conds]
Frame Number: 3
82
Frame Length: 6
0 bytes (480 bits)
Capture Length:
60 bytes (480 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:homeplug-av]
[Coloring Rule
Name: Broadcast]
[Coloring Rule
String: eth[0] & 1]
Ethernet II, Src: N
etgear_2e:1a:09 (20
:0c:c8:2e:1a:09), D
st: Broadcast (ff:f
f:ff:ff:ff:ff)
Destination: Br
oadcast (ff:ff:ff:f
f:ff:ff)
Address: Br
oadcast (ff:ff:ff:f
f:ff:ff)
.... ..1. .
... .... .... ....
= LG bit: Locally a
dministered address
(this is NOT the f
actory default)
.... ...1 .
... .... .... ....
= IG bit: Group add
ress (multicast/bro
adcast)
Source: Netgear

_2e:1a:09 (20:0c:c8
:2e:1a:09)
Address: Ne
tgear_2e:1a:09 (20:
0c:c8:2e:1a:09)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: Homeplug
AV (0x88e1)
HomePlug AV protoco
l
MAC Management
Header
.... ...1 =
Version: 1.1 (1)
Type: Get B
ridge Informations
Confirmation (0x602
1)
.... ..
01 = LSB: Confirm (
0x01)
.... .0
0. = MSB: STA - Cen
tral Coordinator (0
x00)
Fragmentati
on Info: 0x0000
.... 00
00 = Fragment count
:0
0000 ..
.. = Fragment index
:0
Fragmen
t Sequence number:
0
Get Bridge Info
rmations Confirmati
on
Bridging: T
rue
Bridge Term
inal Equipement Ide
ntifier: 5
Number of s
tations: 4
Bridged Des
tination Address: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1)
Bridged Des
tination Address: A
pple_86:da:3d (04:e
5:36:86:da:3d)
Bridged Des
tination Address: H
onHaiPr_be:71:b9 (8
4:4b:f5:be:71:b9)
Bridged Des
tination Address: H
onHaiPr_c9:0e:4a (0

0:1f:3a:c9:0e:4a)
0000 ff ff ff ff f
f ff 20 0c c8 2e 1a
09 88 e1 01 21 .
..... ........!
0010 60 00 00 01 0
5 04 90 01 3b d0 17
e1 04 e5 36 86 `
.......;.....6.
0020 da 3d 84 4b f
5 be 71 b9 00 1f 3a
c9 0e 4a 00 00 .
=.K..q...:..J..
0030 00 00 00 00 0
0 00 00 00 00 00 00
00
.
...........
No. Time
Source
Destination
Protocol
Length Info
383 15.28561000
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=24493
5 Ack=1 Win=46 Len=
1260
Frame 383: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.335540000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.335540000 s
econds
[Time delta fro
m previous captured
frame: 0.062004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.06200400
0 seconds]
[Time since ref
erence or first fra
me: 15.285610000 se
conds]
Frame Number: 3
83

Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0

0 (DSCP 0x00: Defau

lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf24f (62031)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39db [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 244935, Ack:
1, Len: 1260
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 244935 (relati

ve sequence number)
[Next sequence
number: 246195 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x6de
e [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 4f 4
0 00 31 06 39 db 4a
7c 0c 8a c0 a8 .

..O@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cc 1e f4 9e
87 4e aa 50 10 .
..P..+.....N.P.
0030 00 2e 6d ee 0
0 00 5e 04 45 1c 81
65 d7 62 82 be .
.m...^.E..e.b..
0040 f0 45 1a 68 c
0 76 04 b7 c5 a7 e5
22 23 46 7e 92 .
E.h.v....."#F~.
0050 f6 51 1b 1a 6
3 b8 84 7c bb a3 43
75 da f7 75 64 .
Q..c..|..Cu..ud
0060 32 04 67 08 7
0 b3 db 59 48 16 e4
1a 46 2f c9 8f 2
.g.p..YH...F/..
0070 ff be d4 90 8
f ab a9 fc 5f ec 85
9c dc 1e 55 4e .
......._.....UN
0080 07 d4 d5 11 2
5 2a a6 0c 35 71 32
ff fb 92 04 eb .
...%*..5q2.....
0090 0f f2 f2 29 d
5 83 0f 32 60 5e 68
0a d0 3d 28 5c .
..)...2`^h..=(\
00a0 0c 74 ab 5c 0
c 3c c9 81 80 95 eb
c1 84 99 30 e6 .
t.\.<........0.
00b0 98 5d 4c eb 7
8 a8 b0 de b7 aa f1
e3 08 1a eb bc .
]L.x...........
00c0 5d f4 3d 8d b
7 78 d4 5d fd a3 ee
15 69 11 60 c7 ]
.=..x.]....i.`.
00d0 18 d4 56 18 7
8 29 77 5a 1e 53 9c
43 3e 64 61 c4 .
.V.x)wZ.S.C>da.
00e0 8d d7 f0 cf e
b 23 81 ce 61 49 8f
08 60 7a ca 4b .
....#..aI..`z.K
00f0 cb 5f 7c e5 8
9 a3 7f bf e2 89 b5
a1 3b 43 33 58 .
_|.........;C3X
0100 8f d3 ef fc f
5 3c 37 bb e7 5a 85
44 40 e3 bf e8 .
....<7..Z.D@...
0110 eb dd af ff b
0 6b b7 e1 e8 b8 5c
50 94 1a c2 04 .
....k....\P....
0120 d7 24 56 c9 a
2 ac 51 2b 9a 63 13
25 54 58 d8 64 .
$V...Q+.c.%TX.d

0130 96 a4 1c da c
7 0a d0 50 81 57 2a
35 b8 23 07 15 .
......P.W*5.#..
0140 f1 df 37 85 3
4 50 56 4b 7e f2 77
eb 93 fb 26 13 .
.7.4PVK~.w...&.
0150 56 af 77 bf 7
e 9a b1 98 bf d5 fe
ac ef 63 60 5b V
.w.~........c`[
0160 0e f1 5b 8b 7
7 1d 16 cc 34 33 6e
57 ac 13 6b 23 .
.[.w...43nW..k#
0170 09 15 56 1a 3
2 44 b2 78 c1 c8 59
ac 89 de 55 08 .
.V.2D.x..Y...U.
0180 94 62 1a 16 5
c 71 44 c8 c6 e5 56
8c 17 34 e2 eb .
b..\qD...V..4..
0190 b8 82 d2 d3 c
d 09 f2 6c e1 d4 81
52 cd b6 c8 b4 .
......l...R....
01a0 fd ff 1a 17 c
a af 0c 3b 1a 9e d4
f5 7f 9a c7 9e .
......;........
01b0 0d 20 f5 5a 3
1 4f 69 99 5b f9 35
3f 5f 7d b8 ec .
.Z1Oi.[.5?_}..
01c0 ff 0c be 5b 6
b b4 e1 0a d4 7b aa
fd 3e 70 78 4b .
..[k....{..>pxK
01d0 ea 8b d4 e5 7
7 92 4f e0 c5 81 92
d5 c1 de 63 14 .
...w.O.......c.
01e0 51 b7 41 3f a
9 2a 4f 25 1d 96 d4
55 43 e7 ae 27 Q
.A?.*O%...UC..'
01f0 9b c6 c4 26 a
d ff 9a de b4 82 97
1c 1a 98 90 f1 .
..&............
0200 c2 e7 7c 88 4
9 b3 28 27 98 65 ef
e7 4a 67 98 5f .
.|.I.('.e..Jg._
0210 90 15 e3 b5 f
4 df fa 2c e0 a9 53
29 0b 6b b5 f6 .
......,..S).k..
0220 df be ee d5 c
6 b6 91 db 6d 52 b3
ed 24 ff fb 92 .
.......mR..$...
0230 04 e9 8f f3 0
b 3a 57 83 0c 1a e0
5d 04 1a f0 60 .
....:W....]...`
0240 c6 4a 4b a0 5

f 5c 0c bc 67 09 81
10 6b 81 86 19 .
JK._\..g...k...
0250 29 c9 6f e7 3
a 64 3f f6 8b df 14
16 a2 1c 10 71 )
.o.:d?........q
0260 32 0a c2 14 1
6 bc a1 65 bd 69 03
e3 b0 03 2a 5a 2
......e.i....*Z
0270 92 3e 87 17 7
6 66 11 3a 4f 2f 33
94 54 cc fe f7 .
>..vf.:O/3.T...
0280 e5 78 e8 fd 7
7 6f 68 fd 63 46 43
a8 23 f1 f7 4a .
x..woh.cFC.#..J
0290 99 b4 69 0a 1
d f0 b6 eb 92 ff 9f
04 5b 5a 1d ae .
.i.........[Z..
02a0 fe 73 13 02 e
d e9 bb f2 c6 c1 7d
84 8d d4 bf 68 .
s........}....h
02b0 d1 b0 14 7f 1
c bf cb f9 69 da 51
33 5d 30 5d 07 .
.......i.Q3]0].
02c0 30 60 00 c6 0
5 86 9e 48 0e 46 30
b0 9b c0 71 b5 0
`.....H.F0...q.
02d0 47 90 88 99 f
3 1b f7 b4 34 8e 4a
8c ce 8a a0 fd G
.......4.J.....
02e0 58 60 c6 33 5
5 dd df 53 6e c1 d2
c0 e9 c5 d1 03 X
`.3U..Sn.......
02f0 20 7a 1a 2f 4
2 c1 2d 64 d6 b4 3f
23 0f ad ca 96
z./B.-d..?#....
0300 01 2e 90 09 b
3 e9 73 1e e0 09 50
e0 c7 0b 98 5c .
.....s...P....\
0310 80 a8 0b 11 5
e b2 11 a4 58 f0 12
35 35 98 da 6f .
...^...X..55..o
0320 4c ac 57 91 1
c c6 c5 8a 3d 86 34
9a 53 bd cb 76 L
.W.....=.4.S..v
0330 7b f2 ff 76 1
4 87 fa ec 09 09 df
b9 9b 30 a2 02 {
..v.........0..
0340 17 b8 a1 66 4
e 6a 65 3f 94 de 17
96 83 a6 b7 1f .
..fNje?........
0350 60 96 08 a0 b
9 83 5b 1e 2a e0 a5

82 17 19 30 a4 `
.....[.*.....0.
0360 20 1e 85 50 0
d 98 92 0e 1a 22 9b
27 8d 1e e7 3a
..P.....".'...:
0370 6a 0b 1e 23 4
c e6 b4 28 40 5a d1
52 5d 98 15 96 j
..#L..(@Z.R]...
0380 22 eb 52 d9 5
7 92 6c ca 70 30 c8
49 dc 7b 5d 9b "
.R.W.l.p0.I.{].
0390 ab 12 d8 6f e
e d2 db ba 0f eb 79
74 54 a3 78 cf .
..o......ytT.x.
03a0 0b c8 f5 b3 f
1 ad 34 07 1a 6a 92
20 13 c8 ae f5 .
.....4..j. ....
03b0 0c 66 d7 29 c
9 7c 72 26 cb bd 00
ad 04 9c 1a 40 .
f.).|r&.......@
03c0 fc 5d 20 77 1
1 5b 6a 06 4a 22 f5
3f 58 25 53 ff .
] w.[j.J".?X%S.
03d0 fb 92 04 ea 8
f f3 07 2a d5 83 0f
1a 62 5f 24 4a .
......*....b_$J
03e0 c0 3d 26 4a 4
b 70 83 54 0c b0 a9
41 6b 16 2a c1 .
=&JKp.T...Ak.*.
03f0 84 8d 30 43 8
1 45 96 d8 c4 b4 0a
2e d2 72 8e 06 .
.0C.E.......r..
0400 04 5a 09 6d 0
0 43 e4 35 22 bb 3e
6f ea 71 6e a8 .
Z.m.C.5".>o.qn.
0410 ca c5 6d cd 6
6 59 ad e7 f2 93 9a
cf 8c 94 12 8a .
.m.fY..........
0420 5b 68 76 ab 1
4 59 04 1d 86 f3 55
88 e9 12 9b 79 [
hv..Y....U....y
0430 64 7e 75 b7 d
9 bd 59 df 9d 91 eb
5e fb 9c 85 e9 d
~u...Y....^....
0440 41 e5 cc 18 9
a b4 e8 a3 9e a1 8c
62 5c a3 c7 7a A
..........b\..z
0450 d8 91 e8 25 3
9 06 0d d8 f3 14 c5
14 22 a1 ec ae .
..%9......."...
0460 bd ee e1 e5 3
1 19 73 08 0b e2 6a
aa 6a 26 91 e4 .

...1.s...j.j&..
0470 aa 51 5b eb 7
8 27 56 f3 31 76 d4
68 52 bc 91 e6 .
Q[.x'V.1v.hR...
0480 0b d1 7e b1 b
5 f9 a3 fb b1 31 d2
34 61 a0 88 f1 .
.~......1.4a...
0490 61 f1 43 47 e
c c2 2f a1 5a a0 74
62 9b 14 e2 0b a
.CG../.Z.tb....
04a0 37 89 5c c0 9
3 98 d1 8f 3e 84 3d
0d 88 61 dd c7 7
.\.....>.=..a..
04b0 0e e3 c4 40 b
a e7 49 c8 49 16 d4
b9 00 29 b0 52 .
..@..I.I....).R
04c0 b4 7b 81 25 0
5 1a c1 7c c2 db 77
57 c2 6c b2 a6 .
{.%...|..wW.l..
04d0 26 ab 9b b8 6
6 b6 f6 ff 12 1a 9f
58 6d cf b6 9f &
...f......Xm...
04e0 44 f5 ae 77 9
a ec 77 0a 31 58 c1
c8 96 b5 14 cc D
..w..w.1X......
04f0 54 44 33 59 e
d dd 46 26 9d d2 bc
b7 ae a6 83 99 T
D3Y..F&........
0500 eb a0 a2 96 f
b ae d4 12 c5 d2 29
61 a4 16 74 da .
.........)a..t.
0510 56 95 0f a3 7
b 58 d5 0c 2f 61 a5
51 8a 89 47 46 V
...{X../a.Q..GF
0520 06 06
.
.
No. Time
Source
Destination
Protocol
Length Info
384 15.33261400
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
878 http49
574 [PSH, ACK] Seq=
246195 Ack=1 Win=46
Len=824
Frame 384: 878 byte
s on wire (7024 bit
s), 878 bytes captu
red (7024 bits) on

interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.382544000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.382544000 s
econds
[Time delta fro
m previous captured
frame: 0.047004000
seconds]
[Time delta fro
m previous displaye
d frame: 0.04700400
0 seconds]
[Time since ref
erence or first fra
me: 15.332614000 se
conds]
Frame Number: 3
84
Frame Length: 8
78 bytes (7024 bits
)
Capture Length:
878 bytes (7024 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....

= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
64
Identification:
0xf250 (62032)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3b8e [validatio
n disabled]

[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 246195, Ack:
1, Len: 824
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 824]
Sequence number
: 246195 (relati
ve sequence number)
[Next sequence
number: 247019 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .

.0. = Syn: Not set

.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xa24
f [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2084]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 60 f2 50 4
0 00 31 06 3b 8e 4a
7c 0c 8a c0 a8 .
`.P@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cc 23 e0 9e
87 4e aa 50 18 .
..P..+.#...N.P.
0030 00 2e a2 4f 0
0 00 bb 44 60 52 b6
12 01 15 2d 24 .
..O...D`R....-$
0040 65 1c 09 25 d
1 37 3e a0 8a 5c 68
cc 0a 98 d7 73 e
..%.7>..\h....s
0050 b4 aa 1a e2 c
9 df 01 80 aa 4c 08
0e 21 5d 0e be .
........L..!]..
0060 11 bb f1 ea f
5 da 54 ad 0e d8 3a
89 da 83 49 42 .
.....T...:...IB
0070 c0 56 c7 8a 9
4 8a 11 16 61 11 cc
99 1e 24 b8 7d .
V......a....$.}
0080 b1 eb ec 52 7
2 ff fb 92 04 ee 0f
f2 fb 20 d4 03 .
..Rr........ ..
0090 2f 32 50 5e 0
8 ea 90 61 85 5c 0b
fc 85 4e 0c bd /
2P^...a.\...N..
00a0 09 41 97 24 a
9 c1 97 89 78 c9 09
85 38 19 dc 8a .
A.$....x...8...
00b0 16 68 39 29 b

a 89 03 a9 2f 20 4a
6b b4 01 02 4b .
h9)..../ Jk...K
00c0 9a 8c ab e6 5
c 78 44 d7 4a cd 46
78 f7 37 a6 29 .
...\xD.J.Fx.7.)
00d0 17 50 19 a4 b
6 bd 18 09 4e dc 14
51 52 54 45 3b .
P......N..QRTE;
00e0 c2 07 bf 61 a
b 27 50 d2 8e 45 1a
35 d0 da ea fb .
..a.'P..E.5....
00f0 7b 5b db 65 f
d 77 3c 25 69 62 a2
89 4d c8 10 9d {
[.e.w<%ib..M...
0100 01 2c d0 b6 6
c a0 bb 58 d5 dc 06
f1 50 d8 c6 e5 .
,..l..X....P...
0110 dc d1 33 24 0
1 81 8c f8 73 42 08
cb 04 30 11 89 .
.3$....sB...0..
0120 8d 19 90 6f 7
2 d8 52 f1 40 f8 80
9a c2 3e 6e 88 .
..or.R.@....>n.
0130 72 fc 50 94 4
d 76 05 88 b1 5c bd
d1 97 41 8e 39 r
.P.Mv...\...A.9
0140 0b b4 40 dc e
b 8a f1 03 30 27 87
d6 63 7e 92 4a .
.@.....0'..c~.J
0150 51 da 8c 66 9
8 26 15 02 07 5c 1a
4b 56 64 82 e5 Q
..f.&...\.KVd..
0160 da eb ad 21 9
6 d8 ec b1 25 56 ea
fa 92 fe 75 a9 .
..!....%V....u.
0170 67 40 31 08 2
7 8b 0f 3c 3f e4 d3
28 db ee 5f 61 g
@1.'..<?..(.._a
0180 10 85 a8 d0 2
3 6f d0 10 4d 02 6f
32 0e 3c 46 0b .
...#o..M.o2.<F.
0190 5b 3a d3 52 1
1 53 a5 12 48 6e 94
17 4c c4 f5 03 [
:.R.S..Hn..L...
01a0 60 dd ec 33 c
c 3b 12 b2 d9 e6 da
58 db ee cf 5f `
..3.;.....X..._
01b0 9f 81 86 0b 0
a 19 59 37 09 6b 74
7d 6e 23 7a 04 .
.....Y7.kt}n#z.
01c0 47 aa 41 c7 d
5 5c d2 c8 dc 32 76

e1 0b c5 1d 65 G
.A..\...2v....e
01d0 ff 5b 97 6c 6
7 0d 24 16 0b d8 63
ac 06 34 f2 18 .
[.lg.$...c..4..
01e0 1c 3a 76 03 4
f 42 03 4c c8 2d eb
eb 07 e9 72 34 .
:v.OB.L.-....r4
01f0 8d d2 fe 92 3
8 15 6a 41 86 73 07
5b 02 fa 28 b0 .
...8.jA.s.[..(.
0200 0c 33 ed d3 3
a 1f 08 d0 36 ed 0e
ca 0c bb 81 11 .
3..:...6.......
0210 fe 2b 0e 05 f
e fb bd cb 6a 6f 56
f9 a5 ed e9 32 .
+......joV....2
0220 96 b6 f6 bf 7
3 fd 8b ff fb 92 04
eb 8f f3 02 23 .
...s..........#
0230 d3 03 2f 42 5
0 64 06 2a 60 61 eb
4c 0b ac 87 4a .
./BPd.*`a.L...J
0240 0d 3d 29 41 8
5 13 e9 41 87 99 28
a1 62 fb 7d d5 .
=)A...A..(.b.}.
0250 ff ab 16 f6 7
f 2a a2 47 28 63 05
32 c4 4d 41 b1 .
....*.G(c.2.MA.
0260 6f 0b d7 7c 2
a 90 5c 01 fd 2a 9f
22 8d 02 ee 60 o
..|*.\..*."...`
0270 1d 42 32 75 a
4 96 1d aa 0f f4 f0
ff 48 17 74 50 .
B2u........H.tP
0280 30 01 65 b3 9
3 f2 5b c6 a3 2a 43
63 cb a3 61 14 0
.e...[..*Cc..a.
0290 ac ad d8 bc f
c dd 63 33 da bc f1
40 11 51 8c 1e .
.....c3...@.Q..
02a0 2e bb 40 cf 4
3 19 ff d9 f4 d3 fd
85 bf 65 4a 0b .
.@.C........eJ.
02b0 2a 32 11 dc 4
1 d6 40 05 32 37 4e
b3 c4 8f 42 4c *
2..A.@.27N...BL
02c0 55 09 d1 41 0
8 4a c2 20 12 62 38
6f 64 36 ba 2e U
..A.J. .b8od6..
02d0 4b 9c 26 5a e
a c7 1b a4 a5 4e 98
33 b6 4a 47 e9 K

.&Z.....N.3.JG.
02e0 fc 24 cd 27 1
3 e5 89 68 f3 0f e8
a7 a5 20 44 cc .
$.'...h..... D.
02f0 1a 7d 67 d2 2
4 e5 81 c7 8a 85 cb
02 62 e1 c5 8b .
}g.$.......b...
0300 e8 df 0a f6 e
e a9 3f da 4b fa fa
db e9 27 b3 bf .
.....?.K....'..
0310 20 20 0d 3c 8
d 20 4c 39 0c c1 d3
a4 3a 35 62 2f
.<. L9....:5b/
0320 68 8c 91 18 6
a 2a 4f 22 96 01 14
38 51 63 fa 68 h
...j*O"...8Qc.h
0330 cb c9 14 25 a
9 3c a9 62 06 92 8c
dd 34 52 43 e9 .
..%.<.b....4RC.
0340 6d 44 dc a7 8
b 0f e2 7d b7 c5 d2
67 5e 5a 7d 7f m
D.....}...g^Z}.
0350 0e 3f f6 b5 6
9 fd 63 9d 40 5c 89
35 b6 a2 74 cb .
?..i.c.@\.5..t.
0360 1f f7 a3 8b a
2 ee 73 fd 7f 7d 74
37 ff a9
.
.....s..}t7..
No. Time
Source
Destination
Protocol
Length Info
385 15.33281100
0 pc13.home
cust-74-12412-138.dllstx01.cor
exchange.com TCP
54 49574h
ttp [ACK] Seq=1 Ack
=247019 Win=38539 L
en=0
Frame 385: 54 bytes
on wire (432 bits)
, 54 bytes captured
(432 bits) on inte
rface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.382741000 Romance
Standard Time
[Time shift for

this packet: 0.000

000000 seconds]
Epoch Time: 141
5615228.382741000 s
econds
[Time delta fro
m previous captured
frame: 0.000197000
seconds]
[Time delta fro
m previous displaye
d frame: 0.00019700
0 seconds]
[Time since ref
erence or first fra
me: 15.332811000 se
conds]
Frame Number: 3
85
Frame Length: 5
4 bytes (432 bits)
Capture Length:
54 bytes (432 bits
)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: A
sustekC_7f:64:78 (0
8:60:6e:7f:64:78),
Dst: Sagemcom_d0:17
:e1 (90:01:3b:d0:17
:e1)
Destination: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Asustek
C_7f:64:78 (08:60:6
e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)

.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: pc13
.home (192.168.1.11
), Dst: cust-74-124
-12-138.dllstx01.co
rexchange.com (74.1
24.12.138)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 4
0
Identification:
0x4fa5 (20389)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 1
28
Protocol: TCP (
6)
Header checksum
: 0x0000 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: pc13.ho
me (192.168.1.11)
Destination: cu
st-74-124-12-138.dl
lstx01.corexchange.
com (74.124.12.138)
[Source GeoIP:
Unknown]
[Destination Ge

oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: 49574 (49574), D
st Port: http (80),
Seq: 1, Ack: 24701
9, Len: 0
Source Port: 49
574 (49574)
Destination Por
t: http (80)
[Stream index:
0]
[TCP Segment Le
n: 0]
Sequence number
: 1 (relative se
quence number)
Acknowledgment
number: 247019 (
relative ack number
)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 38539
[Calculated win
dow size: 38539]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0x18d
4 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]

Urgent pointer:
0
[SEQ/ACK analys
is]
[This is an
ACK to the segment
in frame: 384]
[The RTT to
ACK the segment wa
s: 0.000197000 seco
nds]
0000 90 01 3b d0 1
7 e1 08 60 6e 7f 64
78 08 00 45 00 .
.;....`n.dx..E.
0010 00 28 4f a5 4
0 00 80 06 00 00 c0
a8 01 0b 4a 7c .
(O.@.........J|
0020 0c 8a c1 a6 0
0 50 9e 87 4e aa 2b
cc 27 18 50 10 .
....P..N.+.'.P.
0030 96 8b 18 d4 0
0 00
.
.....
No. Time
Source
Destination
Protocol
Length Info
386 15.43061300
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home
TCP
1314 http49
574 [ACK] Seq=24701
9 Ack=1 Win=46 Len=
1260
Frame 386: 1314 byt
es on wire (10512 b
its), 1314 bytes ca
ptured (10512 bits)
on interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.480543000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.480543000 s
econds
[Time delta fro
m previous captured
frame: 0.097802000
seconds]

[Time delta fro

m previous displaye
d frame: 0.09780200
0 seconds]
[Time since ref
erence or first fra
me: 15.430613000 se
conds]
Frame Number: 3
86
Frame Length: 1
314 bytes (10512 bi
ts)
Capture Length:
1314 bytes (10512
bits)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust

-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 1
300
Identification:
0xf251 (62033)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No
t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x39d9 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 247019, Ack:
1, Len: 1260

Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 1260]
Sequence number
: 247019 (relati
ve sequence number)
[Next sequence
number: 248279 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
0000 = Flags: 0x010
(ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s
et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 0
... = Push: Not set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xe59
2 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]

[Bytes in f
light: 1260]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 05 14 f2 51 4
0 00 31 06 39 d9 4a
7c 0c 8a c0 a8 .
..Q@.1.9.J|....
0020 01 0b 00 50 c
1 a6 2b cc 27 18 9e
87 4e aa 50 10 .
..P..+.'...N.P.
0030 00 2e e5 92 0
0 00 53 10 88 03 d6
0d 89 c1 61 40 .
.....S.......a@
0040 0a 4a 59 07 a
9 53 4d 8b 42 19 c5
cd 57 08 bc d9 .
JY..SM.B...W...
0050 fc f6 6e 92 d
6 ae 19 98 a7 8b 0a
df 38 ed 53 d3 .
.n.........8.S.
0060 19 9f 4a ed 9
9 1d ef 55 55 ab 2b
aa dd 6d 5e 9e .
.J....UU.+..m^.
0070 bd bb 7a bf 9
1 5f de 95 a1 f5 39
99 4e eb d4 e7 .
.z.._....9.N...
0080 16 86 56 f2 e
0 fb 8f b3 58 8e a4
1f 6d 73 8f 02 .
.V.....X...ms..
0090 46 ff fb 92 0
4 e9 0f f2 f7 24 d3
03 2f 7a 50 59 F
........$../zPY
00a0 24 0a 60 65 e
c 4a 0c 3c 79 4c 0c
e1 e9 41 73 91 $
.`e.J.<yL...As.
00b0 69 81 97 bd 2
8 85 c7 20 fa 17 29
11 05 ae 14 1b i
...(.. ..).....
00c0 2f 2a a0 0c 4
5 d0 a2 c9 a2 76 1d
87 03 52 16 a7 /
*..E....v...R..
00d0 63 39 ce 82 1
b 0d cd ca 5f 0a 03
9c 38 16 40 81 c
9......_...8.@.
00e0 0a 5f d2 37 3
d c7 6b a7 f3 7c 6f
7a ef 0e 79 70 .
_.7=.k..|oz..yp
00f0 88 f6 81 d0 2
7 72 b6 ce 5c e5 b1
65 09 e3 82 0d .
...'r..\..e....
0100 c0 e1 c6 81 c
b c1 f2 aa 9f 3f 71

92 e5 dd 26 41 .
........?q...&A
0110 b1 01 64 ed 1
0 54 64 e4 f8 7c 3e
69 94 19 02 b3 .
.d..Td..|>i....
0120 4c 4c 2a e5 9
3 8a 26 95 d9 5f 72
d9 8a 07 39 86 L
L*...&.._r...9.
0130 02 45 13 11 1
7 03 92 ae 8b 5f 99
8f c4 81 bb f5 .
E......._......
0140 d6 fa a5 27 f
e 74 e0 7a 54 6f 97
41 7c 34 d3 e1 .
..'.t.zTo.A|4..
0150 6f 3a 73 ed c
b 99 f2 a7 c8 79 c8
45 f5 89 fa f1 o
:s......y.E....
0160 c1 43 a0 db 7
3 32 e4 7c dc 89 61
c4 26 22 9a 19 .
C..s2.|..a.&"..
0170 2b d3 d1 7a 7
b f9 fd a8 9d 34 a8
b1 b0 92 cb 04 +
..z{....4......
0180 bf 05 e9 32 1
1 1e 1b 3b de 0a 9c
3b 36 a5 0e 1c .
..2...;...;6...
0190 38 25 20 29 1
d 9d 06 14 19 dd df
24 a2 c5 49 8a 8
% ).......$..I.
01a0 61 ef e7 de c
7 5d 29 10 71 ef ad
4b 8a 42 85 f3 a
....]).q..K.B..
01b0 b9 68 3b 52 e
c d5 46 a4 8e 9a 67
4e 9a ad bb d1 .
h;R..F...gN....
01c0 59 a8 8f 74 4
6 6d 4c cb ee 8e e7
07 27 b9 f6 de Y
..tFmL.....'...
01d0 f4 a7 08 ac e
9 1f 39 e2 3a 18 8f
df 3b dc 5a 76 .
.....9.:...;.Zv
01e0 41 30 d5 5b 4
7 46 dc 56 25 95 01
5c ce 70 4b a0 A
0.[GF.V%..\.pK.
01f0 73 08 72 a6 d
0 b5 e3 6c 5a f1 23
4d 5c f5 9c 44 s
.r....lZ.#M\..D
0200 59 9b 1a 64 2
1 12 bf 36 16 8f 16
44 b0 9c 0f fd Y
..d!..6...D....
0210 9b cf 9b 86 6
f fd ae 3f 5f c1 bf
fc 7b 26 9c 70 .

...o..?_...{&.p
0220 de 34 fe 8b 8
a ef 0a 85 2b 8a 83
0d 85 d7 7f a5 .
4......+.......
0230 fa d8 88 ff f
b 92 04 ec 8f f2 fa
43 55 03 0f 12 .
..........CU...
0240 e0 62 83 da 9
0 61 e6 4a 0c 8d 83
56 0c 20 6d c9 .
b...a.J...V. m.
0250 8f a1 2a c1 8
6 09 71 b7 b6 2b 2b
83 76 dc a9 df .
.*...q..++.v...
0260 bf 2b d3 2f 8
b 00 77 12 3c b7 e8
dc 48 73 a0 b3 .
+./..w.<...Hs..
0270 a0 6a 8c 92 9
e 13 29 be dc f9 76
d7 af 94 8c b2 .
j....)...v.....
0280 a4 e6 5d 0e 4
1 49 a1 fe 91 84 b3
d2 d9 2d b6 9f .
.].AI.......-..
0290 be 5c 3b 1a 6
4 f0 cf 3b e5 b4 b6
37 bb 7f 9b 09 .
\;.d..;...7....
02a0 f1 72 cb 27 c
b 2f c5 6c 57 58 28
51 64 53 71 a7 .
r.'./.lWX(QdSq.
02b0 f4 5f e4 15 d
1 92 e5 b3 75 fd 74
b8 f5 ce 6f ff .
_......u.t...o.
02c0 9e f1 aa b0 4
1 ba 46 16 10 51 f9
bc 48 67 c4 18 .
...A.F..Q..Hg..
02d0 e7 b0 29 00 3
0 21 c5 36 43 45 66
45 a3 30 e5 6b .
.).0!.6CEfE.0.k
02e0 b5 d2 ea e0 c
6 c7 5a 04 8e de 3c
a4 b3 c8 09 fa .
.....Z...<.....
02f0 d4 fd 5d 55 b
d a3 5c 88 9f 57 a7
88 56 8b ad f4 .
.]U..\..W..V...
0300 7b 27 fa d8 e
4 d9 ea d8 e7 3b ad
ad 09 5a 36 0d {
'.......;...Z6.
0310 c9 3b b2 e4 7
0 6b 9d ef f1 ee fe
57 a9 f3 dd 9f .
;..pk.....W....
0320 51 62 4b 0a 4
e 38 a1 10 40 d0 82
a0 25 86 f5 9c Q
bK.N8..@...%...

0330 10 d6 87 0a 9
6 04 82 18 ab 34 4f
a2 f4 2d 48 6a .
........4O..-Hj
0340 71 fd 12 08 c
6 76 6b d5 90 d7 c2
49 da 9c 9f 1a q
....vk....I....
0350 04 ce ab 1b d
8 48 ca 4d ae 8c 17
ab a7 12 16 98 .
....H.M........
0360 bd d1 d3 ab b
4 5d 54 e6 24 25 6e
0d 2c 93 94 3b .
....]T.$%n.,..;
0370 ab c1 ae 4a 9
b fd ee ff f2 bf 22
31 23 f3 1f 08 .
..J......"1#...
0380 3a 62 93 c3 4
a 35 a6 c3 4f 74 35
95 47 51 76 18 :
b..J5..Ot5.GQv.
0390 39 00 b2 84 c
3 90 00 8b 46 1c ce
43 6c 44 4d 64 9
.......F..ClDMd
03a0 cf b7 10 80 1
0 25 47 86 fd e8 71
e9 b0 3d 7c c5 .
....%G...q..=|.
03b0 7a 19 d1 c1 6
5 74 f8 e2 23 80 e1
8a 73 d4 78 2a z
...et..#...s.x*
03c0 a5 b3 be 8f 3
3 5c e7 20 da b9 88
ea 65 7e b5 fe .
...3\. ....e~..
03d0 1c 80 ea 3a c
1 ff fb 92 04 e6 8f
f2 e5 16 54 83 .
..:..........T.
03e0 0f 41 c2 5e 8
3 1a 80 61 e9 38 4b
e8 9d 44 0d 61 .
A.^...a.8K..D.a
03f0 89 41 62 13 a
8 c1 a7 ad 28 f6 33
6d 25 19 59 cf .
Ab.....(.3m%.Y.
0400 d5 ff 41 8c 5
e 68 d0 1d 64 23 0c
04 69 4c 3c a3 .
.A.^h..d#..iL<.
0410 25 71 f5 4d 1
7 40 1a 07 dd 84 2c
f4 e6 4e 98 e3 %
q.M.@....,..N..
0420 d9 40 4d 07 3
a 69 b1 3c b4 12 97
9e e3 08 62 d9 .
@M.:i.<......b.
0430 a4 1f 57 15 e
9 85 25 21 13 92 94
49 3b 25 29 a8 .
.W...%!...I;%).
0440 95 f8 56 8f d

7 76 20 9b ef e7 43
9c 5f 62 f7 e8 .
.V..v ...C._b..
0450 23 ef 7d 77 c
5 32 8e 08 a9 8d 52
1b 95 d0 f3 ad #
.}w.2....R.....
0460 7a 75 5b ff 5
1 8b 11 9b 41 51 af
8c 98 68 31 a9 z
u[.Q...AQ...h1.
0470 ca 18 18 81 b
f 19 b7 04 aa 30 13
f4 f9 49 14 b6 .
........0...I..
0480 60 e2 b2 de 8
b 84 27 18 4b 8b 12
b6 7c b8 60 5a `
.....'.K...|.`Z
0490 dd b7 12 7c 3
3 c1 cd 46 0b 5f a9
8f 3a d2 b9 29 .
..|3..F._..:..)
04a0 83 36 2e e4 6
9 ca ea 3f c6 b3 48
b1 7e 3b ea 62 .
6..i..?..H.~;.b
04b0 98 8c f3 49 d
c 6b 56 cc b3 2d 6d
2a 45 bb 5d b1 .
..I.kV..-m*E.].
04c0 49 a6 b7 7f a
c ca 19 3b 45 8e 99
63 28 94 98 90 I
......;E..c(...
04d0 72 23 55 46 1
e 6b 4b f1 35 98 a2
b3 24 d8 c0 e0 r
#UF.kK.5...$...
04e0 14 f9 16 3a c
8 69 70 34 4e 62 ac
1d 5a 0f eb ac .
..:.ip4Nb..Z...
04f0 c9 38 c2 a6 a
c 3d ed 5c 2e 45 3e
69 23 f3 ec a1 .
8...=.\.E>i#...
0500 74 76 1b fb e
d d3 ff ac b0 23 22
c7 c6 20 53 10 t
v.......#".. S.
0510 61 47 93 b6 f
d 56 8d ad f3 2e c4
06 6a 88 00 dd a
G...V......j...
0520 ee bb
.
.
No. Time
Source
Destination
Protocol
Length Info
387 15.48061500
0 cust-74-124-12138.dllstx01.corexc
hange.com pc13.home

TCP
888 http49
574 [PSH, ACK] Seq=
248279 Ack=1 Win=46
Len=834
Frame 387: 888 byte
s on wire (7104 bit
s), 888 bytes captu
red (7104 bits) on
interface 0
Interface id: 0
(\Device\NPF_{12F8
8443-390D-4509-8D2B
-440395E44894})
Encapsulation t
ype: Ethernet (1)
Arrival Time: N
ov 10, 2014 11:27:0
8.530545000 Romance
Standard Time
[Time shift for
this packet: 0.000
000000 seconds]
Epoch Time: 141
5615228.530545000 s
econds
[Time delta fro
m previous captured
frame: 0.050002000
seconds]
[Time delta fro
m previous displaye
d frame: 0.05000200
0 seconds]
[Time since ref
erence or first fra
me: 15.480615000 se
conds]
Frame Number: 3
87
Frame Length: 8
88 bytes (7104 bits
)
Capture Length:
888 bytes (7104 bi
ts)
[Frame is marke
d: False]
[Frame is ignor
ed: False]
[Protocols in f
rame: eth:ethertype
:ip:tcp:http:data]
[Coloring Rule
Name: HTTP]
[Coloring Rule
String: http || tcp
.port == 80 || http
2]
Ethernet II, Src: S
agemcom_d0:17:e1 (9
0:01:3b:d0:17:e1),
Dst: AsustekC_7f:64
:78 (08:60:6e:7f:64
:78)
Destination: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)

Address: As
ustekC_7f:64:78 (08
:60:6e:7f:64:78)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Source: Sagemco
m_d0:17:e1 (90:01:3
b:d0:17:e1)
Address: Sa
gemcom_d0:17:e1 (90
:01:3b:d0:17:e1)
.... ..0. .
... .... .... ....
= LG bit: Globally
unique address (fac
tory default)
.... ...0 .
... .... .... ....
= IG bit: Individua
l address (unicast)
Type: IP (0x080
0)
Internet Protocol V
ersion 4, Src: cust
-74-124-12-138.dlls
tx01.corexchange.co
m (74.124.12.138),
Dst: pc13.home (192
.168.1.11)
Version: 4
Header Length:
20 bytes
Differentiated
Services Field: 0x0
0 (DSCP 0x00: Defau
lt; ECN: 0x00: NotECT (Not ECN-Capabl
e Transport))
0000 00.. =
Differentiated Ser
vices Codepoint: De
fault (0x00)
.... ..00 =
Explicit Congestio
n Notification: Not
-ECT (Not ECN-Capab
le Transport) (0x00
)
Total Length: 8
74
Identification:
0xf252 (62034)
Flags: 0x02 (Do
n't Fragment)
0... .... =
Reserved bit: Not
set
.1.. .... =
Don't fragment: Se
t
..0. .... =
More fragments: No

t set
Fragment offset
:0
Time to live: 4
9
Protocol: TCP (
6)
Header checksum
: 0x3b82 [validatio
n disabled]
[Good: Fals
e]
[Bad: False
]
Source: cust-74
-124-12-138.dllstx0
1.corexchange.com (
74.124.12.138)
Destination: pc
13.home (192.168.1.
11)
[Source GeoIP:
Unknown]
[Destination Ge
oIP: Unknown]
Transmission Contro
l Protocol, Src Por
t: http (80), Dst P
ort: 49574 (49574),
Seq: 248279, Ack:
1, Len: 834
Source Port: ht
tp (80)
Destination Por
t: 49574 (49574)
[Stream index:
0]
[TCP Segment Le
n: 834]
Sequence number
: 248279 (relati
ve sequence number)
[Next sequence
number: 249113 (
relative sequence n
umber)]
Acknowledgment
number: 1 (relat
ive ack number)
Header Length:
20 bytes
.... 0000 0001
1000 = Flags: 0x018
(PSH, ACK)
000. .... .
... = Reserved: Not
set
...0 .... .
... = Nonce: Not se
t
.... 0... .
... = Congestion Wi
ndow Reduced (CWR):
Not set
.... .0.. .
... = ECN-Echo: Not
set
.... ..0. .
... = Urgent: Not s

et
.... ...1 .
... = Acknowledgmen
t: Set
.... .... 1
... = Push: Set
.... .... .
0.. = Reset: Not se
t
.... .... .
.0. = Syn: Not set
.... .... .
..0 = Fin: Not set
Window size val
ue: 46
[Calculated win
dow size: 46]
[Window size sc
aling factor: -1 (u
nknown)]
Checksum: 0xbe3
5 [validation disab
led]
[Good Check
sum: False]
[Bad Checks
um: False]
Urgent pointer:
0
[SEQ/ACK analys
is]
[Bytes in f
light: 2094]
0000 08 60 6e 7f 6
4 78 90 01 3b d0 17
e1 08 00 45 00 .
`n.dx..;.....E.
0010 03 6a f2 52 4
0 00 31 06 3b 82 4a
7c 0c 8a c0 a8 .
j.R@.1.;.J|....
0020 01 0b 00 50 c
1 a6 2b cc 2c 04 9e
87 4e aa 50 18 .
..P..+.,...N.P.
0030 00 2e be 35 0
0 00 76 8a 30 81 8e
b2 70 68 63 c0 .
..5..v.0...phc.
0040 28 1b 10 76 f
9 df 34 ba de b4 a1
5e 83 a8 41 a8 (
..v..4....^..A.
0050 60 d0 04 7f b
2 5f 46 c8 ce db c9
0c 04 a4 dd f7 `
...._F.........
0060 6d d7 76 1a c
3 56 94 4a 72 ae 11
15 7e c0 9f 12 m
.v..V.Jr...~...
0070 f1 31 c5 93 6
2 74 b5 05 9f 1e c7
dc 2c 6b 12 c3 .
1..bt......,k..
0080 d5 b1 96 1d 5
e fe 78 fd 7a b1 b3
ff fb 92 04 ec .

...^.x.z.......
0090 0f f3 1d 27 c
f 83 79 62 50 62 05
0a 00 6b 0c 4a .
..'..ybPb...k.J
00a0 0c 04 9f 40 0
d e5 e9 41 7b 13 e8
01 ac 3d 28 af .
..@...A{....=(.
00b0 78 dd 53 db a
9 91 6f f1 c6 18 61
ca 9e 10 30 30 x
.S...o...a...00
00c0 d8 80 b1 87 8
6 6b 5f 2b 1b 2e 21
50 92 28 48 56 .
....k_+..!P.(HV
00d0 48 20 44 46 e
4 aa e2 21 4c 28 35
24 9a 61 71 b8 H
DF...!L(5$.aq.
00e0 f0 1b cf 0e 3
0 d1 e4 4a 25 56 af
27 2a fd 8c d0 .
...0..J%V.'*...
00f0 19 f4 c6 0d c
5 a2 a2 34 65 57 f8
4d c2 c6 be 5a .
......4eW.M...Z
0100 f5 bc 65 ee a
1 dd c1 dc 3e d9 e3
7d 78 7b 70 45 .
.e.....>..}x{pE
0110 06 ca 2f 41 0
e d7 69 41 82 2c 68
d3 9a 56 86 b0 .
./A..iA.,h..V..
0120 c8 97 d3 40 e
4 ef 05 1e 20 e4 0c
0c 70 82 d3 4a .
..@.... ...p..J
0130 4b e5 b7 72 4
3 80 6a 3b 9d 31 45
1f 6e 23 c3 6e K
..rC.j;.1E.n#.n
0140 ad 66 79 7d 5
9 62 b4 64 f5 4c b6
bf 22 f6 c4 f4 .
fy}Yb.d.L.."...
0150 bf 28 ea f0 7
d 38 a8 90 88 ca ad
c2 d9 e5 eb 5c .
(..}8.........\
0160 b0 ba dc 7a d
5 d4 af b1 07 73 55
74 f8 d1 f3 ab .
..z.....sUt....
0170 54 d1 cd 6b 0
e e9 bf d5 a4 c1 28
18 06 08 3e 65 T
..k......(...>e
0180 c1 13 a0 00 1
9 37 cf 4b a1 0e 18
b6 ab 0a 4a 54 .
....7.K......JT
0190 a8 c4 b8 76 5
4 c8 c8 97 ee 5f 47
36 d1 d2 8d d1 .
..vT...._G6....

01a0 69 37 df 66 b
2 84 35 9c 98 f4 8e
0b 94 60 b8 34 i
7.f..5......`.4
01b0 8c e7 27 16 0
2 65 a6 65 04 63 a9
29 09 cd 1d ba .
.'..e.e.c.)....
01c0 d7 2b ea 8d 4
2 ac ac 39 a5 9c b7
aa c9 26 f5 bf .
+..B..9.....&..
01d0 5c fb ea 99 f
e 0c 55 72 0f a9 e4
2a 59 a8 e6 09 \
.....Ur...*Y...
01e0 28 26 2c 89 9
9 8c 20 3e ba a4 0e
a5 6d a0 74 16 (
&,... >....m.t.
01f0 44 60 94 7c 9
9 04 53 03 2b 3b e5
29 8e ad 80 a9 D
`.|..S.+;.)....
0200 78 aa 56 35 a
e 42 58 87 91 e2 18
60 b1 98 cb bc x
.V5.BX....`....
0210 7a 62 b8 90 c
b f4 37 8f 73 b5 fa
56 f2 8d 87 57 z
b....7.s..V...W
0220 c1 d5 dc 7c 6
1 00 b0 d1 08 39 0b
00 09 ff fb 92 .
..|a....9......
0230 04 e8 8f f2 e
3 27 d0 03 58 7a 52
5f 44 fa 00 6b .
....'..XzR_D..k
0240 0f 4a 0c 24 9
3 3e 0d 61 e9 41 8a
16 27 c1 ac 3d .
J.$.>.a.A..'..=
0250 30 b2 d7 e7 0
7 81 00 7f a5 07 dd
da 35 2f 62 c6 0
...........5/b.
0260 7a d6 00 a4 6
a 90 16 a9 45 12 2a
8e b2 60 5b 12 z
...j...E.*..`[.
0270 88 45 b6 57 5
1 c1 fb 9c 58 70 62
45 99 da b2 0b .
E.WQ...XpbE....
0280 45 1c 46 b1 b
a 88 b3 11 6f b2 48
55 b7 21 6e 1f E
.F.....o.HU.!n.
0290 6f 61 71 53 1
1 c8 da 8e 47 4e f5
ff f2 c5 c1 81 o
aqS....GN......
02a0 20 0c 40 91 0
0 61 f5 97 c7 04 40
62 02 7f c6 81
.@..a....@b....
02b0 3a c7 27 fe 3

a 28 a2 f1 06 2d 1a
50 c0 e4 47 62 :
.'.:(...-.P..Gb
02c0 ac 36 1f 7e c
2 87 91 9b 13 00 05
24 65 a0 0e 50 .
6.~.......$e..P
02d0 81 b8 9e d3 6
6 14 79 56 a4 d7 31
93 ca 7d a6 c6 .
...f.yV..1..}..
02e0 b6 cc b7 fc 9
8 80 96 c6 86 16 0b
28 49 22 b5 71 .
..........(I".q
02f0 c9 3d 3a 75 d
f 2c cb bc e1 38 77
3b 29 e5 9f b8 .
=:u.,...8w;)...
0300 84 cf f7 33 0
8 44 75 df ae 79 76
b8 80 c1 77 c4 .
..3.Du..yv...w.
0310 0e 6f c8 2c 3
e 5f 97 37 d1 00 41
c2 e8 c9 3f 0d .
o.,>_.7..A...?.
0320 c1 d0 7f 95 8
8 d2 63 47 82 f2 58
46 40 a3 d0 94 .
.....cG..XF@...
0330 0b b9 46 d9 5
5 26 d0 c8 d1 0d 1f
5b a2 d6 8d 8f .
.F.U&.....[....
0340 34 f1 94 b2 2
5 6e 73 f6 f0 ab 7f
50 91 18 59 b5 4
...%ns....P..Y.
0350 e3 1b 0a 78 a
8 8f 88 54 b6 6d d6
74 c1 f3 e8 7a .
..x...T.m.t...z
0360 d2 2e 74 38 0
b 06 2d 7b 09 89 84
8c 74 50 69 16 .
.t8..-{....tPi.
0370 bb a9 72 6c 6
3 6d fd 35
.
.rlcm.5