[linux-cifs-client] FC3 cifs hang circumvented
geoff
ot0006 at 0x29a.org.uk
Thu May 26 11:03:34 GMT 2005
Hi there,
see:
[linux-cifs-client] Re: Process hangs copying large file to cifs
Nuno Ferreira nuno.ferreira at graycell.biz
Thu Aug 12 16:31:41 GMT 2004
<1087997817.2406.14.camel at taz.graycell.biz>
I get highly similar symptoms, with
[svn at wdsnfs ~]$ uname -a
Linux wdsnfs 2.6.11-1.14_FC3 #1 Thu Apr 7 19:23:49 EDT 2005 i686 i686 i386 GNU/Linux
[svn at wdsnfs ~]$ /sbin/mount.cifs --version
mount.cifs version: 1.5
to various Windows boxes including an XP SP1, an XP SP2 and some kind of SBS box
that's the real target.
Symptoms: slooow transfer, 'send on sock [...] stuck' messages, FC3 hung,
magic-sysrq available but ineffective (unmount never completes) so it's a reset
button. The system was reinstalled on this hw platform from another x86 to
exclude hardware damage.
Trace shows Windows box sending an ack and nothing further from cifs-client end.
This is circumvented by one or all of:
[svn at wdsnfs ~]$ cat /etc/rc.d/rc.local
#!/bin/sh
# CIFS setup
# without these values set CIFS will hang up on large file xfers
# GS 050524
modprobe cifs
echo 0 > /proc/fs/cifs/LinuxExtensionsEnabled
echo 0 > /proc/fs/cifs/LookupCacheEnabled
echo 0 > /proc/fs/cifs/OplockEnabled
See kernel source tree for docs on these flags. With these set transfer is fast
and hang free.
I don't have hands on again tomorrow, I hope to post again which flag
it is.
Best regards,
Geoff
end of trace follows:
Frame 28075 (270 bytes on wire, 270 bytes captured)
Arrival Time: May 24, 2005 17:04:53.844396000
Time delta from previous packet: 0.100151000 seconds
Time relative to first packet: 174.904178000 seconds
Frame Number: 28075
Packet Length: 270 bytes
Capture Length: 270 bytes
Ethernet II, Src: 00:0b:db:1b:fe:ec, Dst: 00:01:6c:aa:18:2a
Destination: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Source: 00:0b:db:1b:fe:ec (192.168.1.213)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.213 (192.168.1.213), Dst Addr:
192.168.1.43 (192.168.1.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 256
Identification: 0x889f (34975)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xed07 (correct)
Source: 192.168.1.213 (192.168.1.213)
Destination: 192.168.1.43 (192.168.1.43)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 59635
(59635), Seq: 2081745850, Ack: 1545216193, Len: 204
Source port: microsoft-ds (445)
Destination port: 59635 (59635)
Sequence number: 2081745850
Next sequence number: 2081746054
Acknowledgement number: 1545216193
Header length: 32 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 41408
Checksum: 0x7fb6 (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 188540, tsecr 325932
NetBIOS Session Service
Message Type: Session message
Length: 47
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x80
1... .... = Request/Response: Message is a response to the
client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been
posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error
codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if
execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended
security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not
long file names
.... .... .... .0.. = Security Signatures: Security signatures are
not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are
not supported
.... .... .... ...1 = Long Names Allowed: Long file names are
allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 1
User ID: 2048
Multiplex ID: 5035
Write AndX Response (0x2f)
Word Count (WCT): 6
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 47
Count Low: 4096
Remaining: 65535
Count High (multiply with 64K): 0
Reserved: 0000
Byte Count (BCC): 0
NetBIOS Session Service
Message Type: Session message
Length: 47
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x80
1... .... = Request/Response: Message is a response to the
client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been
posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error
codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if
execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended
security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not
long file names
.... .... .... .0.. = Security Signatures: Security signatures are
not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are
not supported
.... .... .... ...1 = Long Names Allowed: Long file names are
allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 3228
User ID: 2048
Multiplex ID: 5036
Write AndX Response (0x2f)
Word Count (WCT): 6
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 47
Count Low: 4096
Remaining: 65535
Count High (multiply with 64K): 0
Reserved: 0000
Byte Count (BCC): 0
NetBIOS Session Service
Message Type: Session message
Length: 47
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x80
1... .... = Request/Response: Message is a response to the
client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been
posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error
codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if
execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended
security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not
long file names
.... .... .... .0.. = Security Signatures: Security signatures are
not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are
not supported
.... .... .... ...1 = Long Names Allowed: Long file names are
allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 3292
User ID: 2048
Multiplex ID: 5037
Write AndX Response (0x2f)
Word Count (WCT): 6
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 47
Count Low: 4096
Remaining: 65535
Count High (multiply with 64K): 0
Reserved: 0000
Byte Count (BCC): 0
NetBIOS Session Service
Message Type: Session message
Length: 47
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x80
1... .... = Request/Response: Message is a response to the
client/redirector
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been
posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error
codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if
execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended
security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not
long file names
.... .... .... .0.. = Security Signatures: Security signatures are
not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are
not supported
.... .... .... ...1 = Long Names Allowed: Long file names are
allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 3130
User ID: 2048
Multiplex ID: 5038
Write AndX Response (0x2f)
Word Count (WCT): 6
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 47
Count Low: 4096
Remaining: 65535
Count High (multiply with 64K): 0
Reserved: 0000
Byte Count (BCC): 0
Frame 28076 (78 bytes on wire, 78 bytes captured)
Arrival Time: May 24, 2005 17:04:53.844741000
Time delta from previous packet: 0.000345000 seconds
Time relative to first packet: 174.904523000 seconds
Frame Number: 28076
Packet Length: 78 bytes
Capture Length: 78 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 64
Identification: 0xa6fc (42748)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x0f6b (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545216193, Ack: 2081746054, Len: 0
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545216193
Acknowledgement number: 2081746054
Header length: 44 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0x39c7 (correct)
Options: (24 bytes)
NOP
NOP
Time stamp: tsval 326226, tsecr 188540
NOP
NOP
SACK:
left edge = 2081745952
right edge = 2081746054
Frame 28077 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: May 24, 2005 17:04:53.845435000
Time delta from previous packet: 0.000694000 seconds
Time relative to first packet: 174.905217000 seconds
Frame Number: 28077
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0xa6fe (42750)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x09cd (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545216193, Ack: 2081746054, Len: 1448
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545216193
Next sequence number: 1545217641
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0x767d (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326226, tsecr 188540
NetBIOS Session Service
Message Type: Session message
Length: 4160
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x00
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been
posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error
codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if
execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended
security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not
long file names
.... .... .... .0.. = Security Signatures: Security signatures are
not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are
not supported
.... .... .... ...1 = Long Names Allowed: Long file names are
allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 1
User ID: 2048
Multiplex ID: 5060
Write AndX Request (0x2f)
Word Count (WCT): 14
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Offset: 17772544
Reserved: FFFFFFFF
Write Mode: 0x0000
.... .... .... 0... = Message Start: This is NOT the start of a
message (pipe)
.... .... .... .0.. = Write Raw: DON'T use WriteRawNamedPipe (pipe)
.... .... .... ..0. = Return Remaining: DON'T return remaining
(pipe/dev)
.... .... .... ...0 = Write Through: Write through not requested
Remaining: 0
Data Length High (multiply with 64K): 0
Data Length Low: 4096
Data Offset: 64
High Offset: 0
Byte Count (BCC): 4097
Padding: 00
File Data: Incomplete. Only 1380 of 4096 bytes
Frame 28078 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: May 24, 2005 17:04:53.845521000
Time delta from previous packet: 0.000086000 seconds
Time relative to first packet: 174.905303000 seconds
Frame Number: 28078
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0xa700 (42752)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x09cb (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545217641, Ack: 2081746054, Len: 1448
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545217641
Next sequence number: 1545219089
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0x2a9f (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326226, tsecr 188540
NetBIOS Session Service
Continuation data
Frame 28079 (66 bytes on wire, 66 bytes captured)
Arrival Time: May 24, 2005 17:04:53.845623000
Time delta from previous packet: 0.000102000 seconds
Time relative to first packet: 174.905405000 seconds
Frame Number: 28079
Packet Length: 66 bytes
Capture Length: 66 bytes
Ethernet II, Src: 00:0b:db:1b:fe:ec, Dst: 00:01:6c:aa:18:2a
Destination: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Source: 00:0b:db:1b:fe:ec (192.168.1.213)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.213 (192.168.1.213), Dst Addr:
192.168.1.43 (192.168.1.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x88a0 (34976)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xedd2 (correct)
Source: 192.168.1.213 (192.168.1.213)
Destination: 192.168.1.43 (192.168.1.43)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 59635
(59635), Seq: 2081746054, Ack: 1545219089, Len: 0
Source port: microsoft-ds (445)
Destination port: 59635 (59635)
Sequence number: 2081746054
Acknowledgement number: 1545219089
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 38512
Checksum: 0xa5ae (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 188540, tsecr 326226
Frame 28080 (1334 bytes on wire, 1334 bytes captured)
Arrival Time: May 24, 2005 17:04:53.845633000
Time delta from previous packet: 0.000010000 seconds
Time relative to first packet: 174.905415000 seconds
Frame Number: 28080
Packet Length: 1334 bytes
Capture Length: 1334 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1320
Identification: 0xa702 (42754)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x0a7d (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545219089, Ack: 2081746054, Len: 1268
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545219089
Next sequence number: 1545220357
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0x6c5c (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326226, tsecr 188540
NetBIOS Session Service
Continuation data
Frame 28081 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: May 24, 2005 17:04:53.846394000
Time delta from previous packet: 0.000761000 seconds
Time relative to first packet: 174.906176000 seconds
Frame Number: 28081
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0xa704 (42756)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x09c7 (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545220357, Ack: 2081746054, Len: 1448
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545220357
Next sequence number: 1545221805
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0xaa1b (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326227, tsecr 188540
NetBIOS Session Service
Message Type: Session message
Length: 4160
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
SMB Command: Write AndX (0x2f)
NT Status: STATUS_SUCCESS (0x00000000)
Flags: 0x00
0... .... = Request/Response: Message is a request to the server
.0.. .... = Notify: Notify client only on open
..0. .... = Oplocks: OpLock not requested/granted
...0 .... = Canonicalized Pathnames: Pathnames are not canonicalized
.... 0... = Case Sensitivity: Path names are case sensitive
.... ..0. = Receive Buffer Posted: Receive buffer has not been
posted
.... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported
Flags2: 0xc001
1... .... .... .... = Unicode Strings: Strings are Unicode
.1.. .... .... .... = Error Code Type: Error codes are NT error
codes
..0. .... .... .... = Execute-only Reads: Don't permit reads if
execute-only
...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs
.... 0... .... .... = Extended Security Negotiation: Extended
security negotiation is not supported
.... .... .0.. .... = Long Names Used: Path names in request are not
long file names
.... .... .... .0.. = Security Signatures: Security signatures are
not supported
.... .... .... ..0. = Extended Attributes: Extended attributes are
not supported
.... .... .... ...1 = Long Names Allowed: Long file names are
allowed in the response
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 2048
Process ID: 3228
User ID: 2048
Multiplex ID: 5061
Write AndX Request (0x2f)
Word Count (WCT): 14
AndXCommand: No further commands (0xff)
Reserved: 00
AndXOffset: 0
FID: 0x4000
Offset: 17285120
Reserved: FFFFFFFF
Write Mode: 0x0000
.... .... .... 0... = Message Start: This is NOT the start of a
message (pipe)
.... .... .... .0.. = Write Raw: DON'T use WriteRawNamedPipe (pipe)
.... .... .... ..0. = Return Remaining: DON'T return remaining
(pipe/dev)
.... .... .... ...0 = Write Through: Write through not requested
Remaining: 0
Data Length High (multiply with 64K): 0
Data Length Low: 4096
Data Offset: 64
High Offset: 0
Byte Count (BCC): 4097
Padding: 00
File Data: Incomplete. Only 1380 of 4096 bytes
Frame 28082 (66 bytes on wire, 66 bytes captured)
Arrival Time: May 24, 2005 17:04:53.846487000
Time delta from previous packet: 0.000093000 seconds
Time relative to first packet: 174.906269000 seconds
Frame Number: 28082
Packet Length: 66 bytes
Capture Length: 66 bytes
Ethernet II, Src: 00:0b:db:1b:fe:ec, Dst: 00:01:6c:aa:18:2a
Destination: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Source: 00:0b:db:1b:fe:ec (192.168.1.213)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.213 (192.168.1.213), Dst Addr:
192.168.1.43 (192.168.1.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x88a1 (34977)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xedd1 (correct)
Source: 192.168.1.213 (192.168.1.213)
Destination: 192.168.1.43 (192.168.1.43)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 59635
(59635), Seq: 2081746054, Ack: 1545221805, Len: 0
Source port: microsoft-ds (445)
Destination port: 59635 (59635)
Sequence number: 2081746054
Acknowledgement number: 1545221805
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 35796
Checksum: 0xa5ae (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 188540, tsecr 326226
Frame 28083 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: May 24, 2005 17:04:53.846496000
Time delta from previous packet: 0.000009000 seconds
Time relative to first packet: 174.906278000 seconds
Frame Number: 28083
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0xa706 (42758)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x09c5 (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545221805, Ack: 2081746054, Len: 1448
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545221805
Next sequence number: 1545223253
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0xcdda (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326227, tsecr 188540
NetBIOS Session Service
Continuation data
Frame 28084 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: May 24, 2005 17:04:53.846565000
Time delta from previous packet: 0.000069000 seconds
Time relative to first packet: 174.906347000 seconds
Frame Number: 28084
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0xa708 (42760)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x09c3 (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545223253, Ack: 2081746054, Len: 1448
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545223253
Next sequence number: 1545224701
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0x4ef2 (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326227, tsecr 188540
NetBIOS Session Service
Continuation data
Frame 28085 (66 bytes on wire, 66 bytes captured)
Arrival Time: May 24, 2005 17:04:53.846654000
Time delta from previous packet: 0.000089000 seconds
Time relative to first packet: 174.906436000 seconds
Frame Number: 28085
Packet Length: 66 bytes
Capture Length: 66 bytes
Ethernet II, Src: 00:0b:db:1b:fe:ec, Dst: 00:01:6c:aa:18:2a
Destination: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Source: 00:0b:db:1b:fe:ec (192.168.1.213)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.213 (192.168.1.213), Dst Addr:
192.168.1.43 (192.168.1.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x88a2 (34978)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xedd0 (correct)
Source: 192.168.1.213 (192.168.1.213)
Destination: 192.168.1.43 (192.168.1.43)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 59635
(59635), Seq: 2081746054, Ack: 1545224701, Len: 0
Source port: microsoft-ds (445)
Destination port: 59635 (59635)
Sequence number: 2081746054
Acknowledgement number: 1545224701
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 32900
Checksum: 0xa5ad (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 188540, tsecr 326227
Frame 28086 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: May 24, 2005 17:04:53.847251000
Time delta from previous packet: 0.000597000 seconds
Time relative to first packet: 174.907033000 seconds
Frame Number: 28086
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0xa70a (42762)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x09c1 (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545224701, Ack: 2081746054, Len: 1448
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545224701
Next sequence number: 1545226149
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0x1646 (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326228, tsecr 188540
NetBIOS Session Service
Continuation data
Frame 28087 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: May 24, 2005 17:04:53.847322000
Time delta from previous packet: 0.000071000 seconds
Time relative to first packet: 174.907104000 seconds
Frame Number: 28087
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0xa70c (42764)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x09bf (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545226149, Ack: 2081746054, Len: 1448
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545226149
Next sequence number: 1545227597
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0xf652 (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326228, tsecr 188540
NetBIOS Session Service
Continuation data
Frame 28088 (66 bytes on wire, 66 bytes captured)
Arrival Time: May 24, 2005 17:04:53.847413000
Time delta from previous packet: 0.000091000 seconds
Time relative to first packet: 174.907195000 seconds
Frame Number: 28088
Packet Length: 66 bytes
Capture Length: 66 bytes
Ethernet II, Src: 00:0b:db:1b:fe:ec, Dst: 00:01:6c:aa:18:2a
Destination: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Source: 00:0b:db:1b:fe:ec (192.168.1.213)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.213 (192.168.1.213), Dst Addr:
192.168.1.43 (192.168.1.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x88a3 (34979)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xedcf (correct)
Source: 192.168.1.213 (192.168.1.213)
Destination: 192.168.1.43 (192.168.1.43)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 59635
(59635), Seq: 2081746054, Ack: 1545227597, Len: 0
Source port: microsoft-ds (445)
Destination port: 59635 (59635)
Sequence number: 2081746054
Acknowledgement number: 1545227597
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 30004
Checksum: 0xa5ac (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 188540, tsecr 326228
Frame 28089 (1154 bytes on wire, 1154 bytes captured)
Arrival Time: May 24, 2005 17:04:53.847421000
Time delta from previous packet: 0.000008000 seconds
Time relative to first packet: 174.907203000 seconds
Frame Number: 28089
Packet Length: 1154 bytes
Capture Length: 1154 bytes
Ethernet II, Src: 00:01:6c:aa:18:2a, Dst: 00:0b:db:1b:fe:ec
Destination: 00:0b:db:1b:fe:ec (192.168.1.213)
Source: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.43 (192.168.1.43), Dst Addr:
192.168.1.213 (192.168.1.213)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1140
Identification: 0xa70e (42766)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x0b25 (correct)
Source: 192.168.1.43 (192.168.1.43)
Destination: 192.168.1.213 (192.168.1.213)
Transmission Control Protocol, Src Port: 59635 (59635), Dst Port: microsoft-ds
(445), Seq: 1545227597, Ack: 2081746054, Len: 1088
Source port: 59635 (59635)
Destination port: microsoft-ds (445)
Sequence number: 1545227597
Next sequence number: 1545228685
Acknowledgement number: 2081746054
Header length: 32 bytes
Flags: 0x0018 (PSH, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 1728
Checksum: 0x1568 (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 326228, tsecr 188540
NetBIOS Session Service
Continuation data
Frame 28090 (66 bytes on wire, 66 bytes captured)
Arrival Time: May 24, 2005 17:04:54.044672000
Time delta from previous packet: 0.197251000 seconds
Time relative to first packet: 175.104454000 seconds
Frame Number: 28090
Packet Length: 66 bytes
Capture Length: 66 bytes
Ethernet II, Src: 00:0b:db:1b:fe:ec, Dst: 00:01:6c:aa:18:2a
Destination: 00:01:6c:aa:18:2a (Foxconn_aa:18:2a)
Source: 00:0b:db:1b:fe:ec (192.168.1.213)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.213 (192.168.1.213), Dst Addr:
192.168.1.43 (192.168.1.43)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x88a4 (34980)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xedce (correct)
Source: 192.168.1.213 (192.168.1.213)
Destination: 192.168.1.43 (192.168.1.43)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 59635
(59635), Seq: 2081746054, Ack: 1545228685, Len: 0
Source port: microsoft-ds (445)
Destination port: 59635 (59635)
Sequence number: 2081746054
Acknowledgement number: 1545228685
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 28916
Checksum: 0xa5aa (correct)
Options: (12 bytes)
NOP
NOP
Time stamp: tsval 188542, tsecr 326228
Frame 28091 (90 bytes on wire, 90 bytes captured)
Arrival Time: May 24, 2005 17:05:06.833245000
Time delta from previous packet: 12.788573000 seconds
Time relative to first packet: 187.893027000 seconds
Frame Number: 28091
Packet Length: 90 bytes
Capture Length: 90 bytes
Ethernet II, Src: 00:0b:db:1b:fe:ec, Dst: 00:01:64:ff:cc:eb
Destination: 00:01:64:ff:cc:eb (Cisco_ff:cc:eb)
Source: 00:0b:db:1b:fe:ec (192.168.1.213)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.213 (192.168.1.213), Dst Addr:
212.13.201.101 (212.13.201.101)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 76
Identification: 0x8a17 (35351)
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x5099 (correct)
Source: 192.168.1.213 (192.168.1.213)
Destination: 212.13.201.101 (212.13.201.101)
User Datagram Protocol, Src Port: ntp (123), Dst Port: ntp (123)
Source port: ntp (123)
Destination port: ntp (123)
Length: 56
Checksum: 0xb5bc (correct)
Network Time Protocol
Flags: 0x19
00.. .... = Leap Indicator: no warning (0)
..01 1... = Version number: NTP Version 3 (3)
.... .001 = Mode: symmetric active (1)
Peer Clock Stratum: secondary reference (3)
Peer Polling Interval: 4 (16 sec)
Peer Clock Precision: 0.015625 sec
Root Delay: 0.0176 sec
Clock Dispersion: 7.9238 sec
Reference Clock ID: 80.253.108.112
Reference Clock Update Time: 2005-05-24 15:40:33.0412 UTC
Originate Time Stamp: NULL
Receive Time Stamp: NULL
Transmit Time Stamp: 2005-05-24 16:05:06.4274 UTC
--
best,
geoff
regrettably the email address above will bounce
More information about the linux-cifs-client
mailing list