Samba 3.6.3: Stalling after ca 30min
Goran Lowkrantz
goran.lowkrantz at ismobile.com
Tue Feb 21 03:55:56 MST 2012
I am trying to diagnose a traffic stall with the following environment:
Client: tor - Windows-7 Ultimate 64-bit
Server: midgard - FreeBSD 8.2-STABLE with Samba 3.6.3
Operation: Scanning picture files to generate previews in Capture One
MediaPro 1.2.
A full tcpdump (17G) of the operation and a full log, generated by tcpdump
-r on the capture file, is available but I think the last minute is
interesting.
Attached files:
running.txt - the open sockets and owners of smbd process plus smbstatus
when all is running.
stall.txt - the open sockets and owners of smbd process plus smbstatus when
the transfer has stalled for ca 3min.
tcpdump.txt - the traffic from 09:39:30.156662 up until the stall. No
traffic registered for about 3min after last packet.
Files for download:
http://people.hidden-powers.com/~glz/smb-last.tcap - captured packates
between 09:39:00 and 09:43, 730M
To me it looks like something happens at 09:39:30.355781:
09:39:30.355781 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack
3685569628, win 0, length 0
09:39:31.918776 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack
3685569628, win 0, length 1460WARNING: Packet is continued in later TCP
segments
as after that the Windows client only references 3685569628 until the stall:
09:39:31.923277 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack
3685569628, win 0, length 788SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923288 IP midgard.microsoft-ds > tor.64915: Flags [.], ack
898267180, win 16285, length 0
09:39:35.354733 IP midgard.microsoft-ds > tor.64915: Flags [.], ack
898267180, win 16384, length 1[|SMB]
09:39:35.354804 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack
3685569628, win 0, length 0
Any ideas? Anything more I can provide?
As said, I have the full dump and log available and if any Samba developer
need it, I can put it up for private download.
/glz
................................................... the future isMobile
Goran Lowkrantz <goran.lowkrantz at ismobile.com>
System Architect, isMobile AB
Sandviksgatan 81, PO Box 58, S-971 03 Luleå, Sweden
Mobile: +46(0)70-587 87 82
http://www.ismobile.com ...............................................
-------------- next part --------------
sockstat | grep smbd
glz smbd 47932 10 tcp4 10.255.253.1:445 10.255.253.2:64915
glz smbd 47932 30 stream -> /var/run/dbus/system_bus_socket
glz smbd 47932 33 stream -> /var/db/samba/winbindd_privileged/pipe
glz smbd 47932 34 dgram -> /var/run/log
root smbd 18463 10 stream (not connected)
root smbd 18456 26 tcp4 127.0.0.1:445 *:*
root smbd 18456 27 tcp6 fe80:5::1:445 *:*
root smbd 18456 28 tcp6 ::1:445 *:*
root smbd 18456 29 tcp4 10.255.253.1:445 *:*
root smbd 18456 30 stream -> /var/run/dbus/system_bus_socket
midgard# smbstatus
Samba version 3.6.3
PID Username Group Machine
-------------------------------------------------------------------
47932 glz glz tor (10.255.253.2)
Service pid machine Connected at
-------------------------------------------------------
photo 47932 tor Tue Feb 21 07:39:23 2012
Locked files:
Pid Uid DenyMode Access R/W Oplock SharePath Name Time
--------------------------------------------------------------------------------------------------
47932 1000 DENY_NONE 0x100081 RDONLY NONE /usr/data/glz/photo . Tue Feb 21 09:11:02 2012
midgard# smbstatus
Samba version 3.6.3
PID Username Group Machine
-------------------------------------------------------------------
47932 glz glz tor (10.255.253.2)
Service pid machine Connected at
-------------------------------------------------------
photo 47932 tor Tue Feb 21 07:39:23 2012
media 47932 tor Tue Feb 21 09:14:16 2012
Locked files:
Pid Uid DenyMode Access R/W Oplock SharePath Name Time
--------------------------------------------------------------------------------------------------
47932 1000 DENY_NONE 0x2019f RDWR EXCLUSIVE+BATCH /usr/data/glz/photo Catalogs/Master Catalogs/OM3CQ4~U_0 Tue Feb 21 09:14:39 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5249.CR2 Tue Feb 21 09:27:09 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5272.CR2 Tue Feb 21 09:27:19 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5188.CR2 Tue Feb 21 09:27:08 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5235.XMP Tue Feb 21 09:27:09 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5263.XMP Tue Feb 21 09:27:19 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5207.XMP Tue Feb 21 09:27:13 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5209.CR2 Tue Feb 21 09:27:16 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5188.XMP Tue Feb 21 09:27:05 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5235.CR2 Tue Feb 21 09:27:12 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5200.CR2 Tue Feb 21 09:27:13 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo Catalogs/Master Catalogs/Originals-2006.mpcatalog Tue Feb 21 09:24:01 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5275.XMP Tue Feb 21 09:27:16 2012
47932 1000 DENY_NONE 0x100081 RDONLY NONE /usr/data/glz/photo originals/2006/200607 Tue Feb 21 09:27:23 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5249.XMP Tue Feb 21 09:27:07 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5263.CR2 Tue Feb 21 09:27:22 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5200.XMP Tue Feb 21 09:27:10 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5275.CR2 Tue Feb 21 09:27:18 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5207.CR2 Tue Feb 21 09:27:15 2012
47932 1000 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_S2A_FTPII_5512_01_1.tif Tue Feb 21 09:27:19 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5272.XMP Tue Feb 21 09:27:16 2012
47932 1000 DENY_NONE 0x20089 RDONLY EXCLUSIVE+BATCH /usr/data/glz/photo originals/2006/200607/20060715/20060715_03_5209.XMP Tue Feb 21 09:27:13 2012
-------------- next part --------------
09:43
midgard# smbstatus
Samba version 3.6.3
PID Username Group Machine
-------------------------------------------------------------------
Service pid machine Connected at
-------------------------------------------------------
No locked files
midgard# sockstat | grep smbd
root smbd 18463 10 stream (not connected)
root smbd 18456 26 tcp4 127.0.0.1:445 *:*
root smbd 18456 27 tcp6 fe80:5::1:445 *:*
root smbd 18456 28 tcp6 ::1:445 *:*
root smbd 18456 29 tcp4 10.255.253.1:445 *:*
root smbd 18456 30 stream -> /var/run/dbus/system_bus_socket
-------------- next part --------------
09:39:30.156662 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156665 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156667 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156670 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156672 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156676 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156679 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156681 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742285, win 16384, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156734 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685503928, win 16425, length 63SMB PACKET: SMBreadX (REQUEST)
09:39:30.156750 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685506848, win 15695, length 0
09:39:30.156752 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685509768, win 14965, length 0
09:39:30.156753 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897742348, win 16376, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:30.156755 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685512688, win 14235, length 0
09:39:30.156859 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685515608, win 13505, length 0
09:39:30.156867 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685518528, win 12775, length 0
09:39:30.156873 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685521448, win 12045, length 0
09:39:30.156877 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685524368, win 11315, length 0
09:39:30.156983 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685527288, win 10585, length 0
09:39:30.156991 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685530208, win 9855, length 0
09:39:30.156996 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685533128, win 9125, length 0
09:39:30.157000 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685536048, win 8395, length 0
09:39:30.157108 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685538968, win 7665, length 0
09:39:30.157115 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685541888, win 6935, length 0
09:39:30.157119 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685544808, win 6205, length 0
09:39:30.157124 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685547728, win 5475, length 0
09:39:30.157128 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685550648, win 4745, length 0
09:39:30.157481 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685553568, win 4015, length 0
09:39:30.157606 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685556488, win 3285, length 0
09:39:30.157613 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685559408, win 2555, length 0
09:39:30.157617 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685562328, win 1825, length 0
09:39:30.157621 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685565248, win 1095, length 0
09:39:30.157625 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685568168, win 365, length 0
09:39:30.355781 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:39:31.918776 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460WARNING: Packet is continued in later TCP segments
SMB PACKET: SMBwriteX (REQUEST)
09:39:31.918798 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918820 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918823 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918826 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918828 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897745268, win 16019, length 0
09:39:31.918853 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897748188, win 15662, length 0
09:39:31.918855 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897748188, win 16384, length 0
09:39:31.918897 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918909 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918912 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897751108, win 16201, length 0
09:39:31.918914 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918916 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918918 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918921 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918923 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918926 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918929 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897754028, win 16019, length 0
09:39:31.918932 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.918938 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897756948, win 15654, length 0
09:39:31.918947 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897759868, win 15836, length 0
09:39:31.918949 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897759868, win 16384, length 0
09:39:31.918952 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897762788, win 16019, length 0
09:39:31.918966 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897762788, win 16384, length 0
09:39:31.919022 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919030 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919040 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919043 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897765708, win 16201, length 0
09:39:31.919044 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919047 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919049 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919052 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919056 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919058 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897768628, win 15836, length 0
09:39:31.919062 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919064 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919067 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919069 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897768628, win 16384, length 0
09:39:31.919076 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897771548, win 16019, length 0
09:39:31.919087 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897774468, win 15654, length 0
09:39:31.919091 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897774468, win 16384, length 0
09:39:31.919093 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897777388, win 16019, length 0
09:39:31.919102 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897778848, win 16384, length 0
09:39:31.919147 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919155 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919165 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919168 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919170 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897781768, win 16201, length 0
09:39:31.919171 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919174 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919177 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919179 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919184 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919190 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897784688, win 16019, length 0
09:39:31.919198 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897787608, win 15654, length 0
09:39:31.919205 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897789068, win 16384, length 0
09:39:31.919207 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897791988, win 16019, length 0
09:39:31.919218 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897791988, win 16384, length 0
09:39:31.919271 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919280 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919290 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919292 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919294 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897794908, win 16201, length 0
09:39:31.919299 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919302 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919304 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919307 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919312 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897797828, win 16201, length 0
09:39:31.919314 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919317 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919319 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 1364SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919322 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897800748, win 15836, length 0
09:39:31.919333 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897803668, win 15471, length 0
09:39:31.919339 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897803668, win 16384, length 0
09:39:31.919341 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897806588, win 16019, length 0
09:39:31.919350 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897807952, win 16384, length 0
09:39:31.919397 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460WARNING: Packet is continued in later TCP segments
SMB PACKET: SMBwriteX (REQUEST)
09:39:31.919407 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919417 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919420 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919421 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897810872, win 16019, length 0
09:39:31.919423 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919426 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919428 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919431 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919436 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919438 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919442 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897810872, win 16384, length 0
09:39:31.919450 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897813792, win 16019, length 0
09:39:31.919456 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897816712, win 15654, length 0
09:39:31.919466 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897819632, win 15289, length 0
09:39:31.919468 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897819632, win 16384, length 0
09:39:31.919471 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897822552, win 16019, length 0
09:39:31.919477 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897822552, win 16384, length 0
09:39:31.919522 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919531 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919541 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919544 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919545 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897825472, win 16201, length 0
09:39:31.919547 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919550 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919553 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919556 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919561 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919563 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919566 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897826932, win 16384, length 0
09:39:31.919577 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897829852, win 16019, length 0
09:39:31.919585 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897832772, win 15654, length 0
09:39:31.919589 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897832772, win 16384, length 0
09:39:31.919592 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897835692, win 16019, length 0
09:39:31.919597 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897837152, win 16384, length 0
09:39:31.919646 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919655 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919664 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919666 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919668 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897840072, win 16201, length 0
09:39:31.919670 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919673 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919675 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919678 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919683 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919686 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919691 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897841532, win 16384, length 0
09:39:31.919696 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897844452, win 16019, length 0
09:39:31.919704 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897847372, win 15654, length 0
09:39:31.919706 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897850292, win 15289, length 0
09:39:31.919723 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897851752, win 16384, length 0
09:39:31.919771 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919780 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919789 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919791 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897854672, win 16201, length 0
09:39:31.919792 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919795 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919797 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919801 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919803 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919806 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897857592, win 15836, length 0
09:39:31.919808 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919811 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919816 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897857592, win 16384, length 0
09:39:31.919828 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897860512, win 16019, length 0
09:39:31.919835 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897863432, win 15654, length 0
09:39:31.919837 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897863432, win 16384, length 0
09:39:31.919840 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897866352, win 16019, length 0
09:39:31.919847 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897866352, win 16384, length 0
09:39:31.919897 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919906 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919916 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919918 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897869272, win 16201, length 0
09:39:31.919920 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919922 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919925 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919927 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919930 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919933 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897872192, win 15836, length 0
09:39:31.919935 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919937 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.919943 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897872192, win 16384, length 0
09:39:31.919951 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897875112, win 16019, length 0
09:39:31.919958 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897878032, win 15654, length 0
09:39:31.919960 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897880952, win 15459, length 0
09:39:31.919994 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897880952, win 16384, length 0
09:39:31.920021 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920029 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920038 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920041 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897883872, win 16201, length 0
09:39:31.920042 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920045 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920047 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920050 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920053 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920056 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897886792, win 16019, length 0
09:39:31.920058 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920060 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920066 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897886792, win 16384, length 0
09:39:31.920077 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897889712, win 16019, length 0
09:39:31.920083 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897892632, win 15654, length 0
09:39:31.920085 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897892632, win 16384, length 0
09:39:31.920089 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897895552, win 16019, length 0
09:39:31.920095 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897895552, win 16384, length 0
09:39:31.920146 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920154 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920163 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920165 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897898472, win 16201, length 0
09:39:31.920167 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920169 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920171 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920174 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920176 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920181 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920183 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920186 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897901392, win 15836, length 0
09:39:31.920190 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897901392, win 16384, length 0
09:39:31.920201 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897904312, win 16019, length 0
09:39:31.920208 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897907232, win 15654, length 0
09:39:31.920210 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897907232, win 16384, length 0
09:39:31.920213 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897910152, win 16019, length 0
09:39:31.920220 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897910152, win 16384, length 0
09:39:31.920271 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920281 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920291 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920293 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897913072, win 16201, length 0
09:39:31.920294 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920307 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920310 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897914532, win 16384, length 0
09:39:31.920311 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920315 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920317 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920320 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897917452, win 16019, length 0
09:39:31.920322 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920325 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920328 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920330 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920333 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897920372, win 16201, length 0
09:39:31.920341 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897923292, win 15836, length 0
09:39:31.920348 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897926212, win 15471, length 0
09:39:31.920351 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897926212, win 16384, length 0
09:39:31.920397 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920412 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920414 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897929132, win 16201, length 0
09:39:31.920416 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920426 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920428 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897932052, win 16019, length 0
09:39:31.920429 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920432 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920434 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897932052, win 16384, length 0
09:39:31.920436 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920438 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920443 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920447 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897934972, win 16019, length 0
09:39:31.920459 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897937892, win 15654, length 0
09:39:31.920461 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897937892, win 16384, length 0
09:39:31.920463 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897940812, win 16019, length 0
09:39:31.920508 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897940812, win 16384, length 0
09:39:31.920520 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920527 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920536 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920538 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920540 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897943732, win 16201, length 0
09:39:31.920541 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920545 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920547 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920549 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920553 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920559 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897946652, win 16019, length 0
09:39:31.920572 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897949572, win 15654, length 0
09:39:31.920574 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897951032, win 16384, length 0
09:39:31.920576 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897953952, win 16019, length 0
09:39:31.920586 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897953952, win 16384, length 0
09:39:31.920646 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920655 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920664 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920667 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897956872, win 16201, length 0
09:39:31.920668 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920671 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920673 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920676 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920678 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920682 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897959792, win 15836, length 0
09:39:31.920684 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920687 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920689 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920691 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897959792, win 16384, length 0
09:39:31.920702 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897962712, win 16019, length 0
09:39:31.920711 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897965632, win 15836, length 0
09:39:31.920714 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897965632, win 16384, length 0
09:39:31.920716 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897968552, win 16019, length 0
09:39:31.920721 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897970012, win 16384, length 0
09:39:31.920771 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920779 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920788 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920790 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897972932, win 16201, length 0
09:39:31.920792 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920795 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920798 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920800 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920803 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920805 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897975852, win 15836, length 0
09:39:31.920808 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920810 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897977312, win 16201, length 0
09:39:31.920812 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920825 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897980232, win 15836, length 0
09:39:31.920827 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897983152, win 15471, length 0
09:39:31.920846 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897984612, win 16384, length 0
09:39:31.920897 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920905 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920915 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920917 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897987532, win 16201, length 0
09:39:31.920918 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920921 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920923 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920926 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920928 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920931 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897990452, win 15836, length 0
09:39:31.920934 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920936 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.920940 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897990452, win 16384, length 0
09:39:31.920952 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897993372, win 16019, length 0
09:39:31.920958 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897996292, win 15654, length 0
09:39:31.920960 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897996292, win 16384, length 0
09:39:31.920963 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897999212, win 16019, length 0
09:39:31.920971 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 897999212, win 16384, length 0
09:39:31.921021 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921030 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921040 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921042 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898002132, win 16201, length 0
09:39:31.921043 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921046 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921048 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921051 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921054 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921057 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898005052, win 15836, length 0
09:39:31.921059 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921061 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921066 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898005052, win 16348, length 0
09:39:31.921074 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898007972, win 15983, length 0
09:39:31.921081 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898010892, win 15618, length 0
09:39:31.921083 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898013812, win 15253, length 0
09:39:31.921102 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898013812, win 16384, length 0
09:39:31.921145 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921154 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921163 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921165 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898016732, win 16201, length 0
09:39:31.921167 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921169 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921172 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921174 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921176 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921181 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921183 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921186 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898019652, win 15836, length 0
09:39:31.921195 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898019652, win 16384, length 0
09:39:31.921202 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898022572, win 16019, length 0
09:39:31.921209 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898025492, win 15654, length 0
09:39:31.921211 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898025492, win 16384, length 0
09:39:31.921214 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898028412, win 16019, length 0
09:39:31.921222 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898028412, win 16384, length 0
09:39:31.921270 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921278 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921289 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921291 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898031332, win 16201, length 0
09:39:31.921292 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921295 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921299 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921301 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921304 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921306 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898034252, win 15836, length 0
09:39:31.921309 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921311 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921313 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898034252, win 16384, length 0
09:39:31.921326 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898037172, win 16019, length 0
09:39:31.921332 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898040092, win 15654, length 0
09:39:31.921335 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898040092, win 16384, length 0
09:39:31.921337 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898043012, win 16019, length 0
09:39:31.921345 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898043012, win 16384, length 0
09:39:31.921396 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921405 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921415 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921417 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898045932, win 16201, length 0
09:39:31.921419 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921421 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921424 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921426 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921429 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921433 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921436 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921442 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898048852, win 15836, length 0
09:39:31.921448 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898048852, win 16384, length 0
09:39:31.921454 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898051772, win 16019, length 0
09:39:31.921459 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898054692, win 15654, length 0
09:39:31.921461 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898056152, win 16201, length 0
09:39:31.921474 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898057612, win 16384, length 0
09:39:31.921521 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921529 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921539 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921541 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898060532, win 16201, length 0
09:39:31.921543 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921552 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921555 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898063452, win 16201, length 0
09:39:31.921557 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921559 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921562 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921567 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921569 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898066372, win 15836, length 0
09:39:31.921571 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921573 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921576 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898067832, win 16201, length 0
09:39:31.921588 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898070752, win 16019, length 0
09:39:31.921590 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898073672, win 15971, length 0
09:39:31.921628 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898073672, win 16384, length 0
09:39:31.921645 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921654 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921664 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921666 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898076592, win 16201, length 0
09:39:31.921668 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921670 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921673 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921676 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921678 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921683 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898078052, win 16384, length 0
09:39:31.921685 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921689 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921694 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898080972, win 16019, length 0
09:39:31.921700 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898083892, win 15654, length 0
09:39:31.921707 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898085352, win 16384, length 0
09:39:31.921709 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898088272, win 16019, length 0
09:39:31.921720 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898088272, win 16384, length 0
09:39:31.921770 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921778 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921787 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921790 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898091192, win 16201, length 0
09:39:31.921791 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921803 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921805 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898094112, win 16201, length 0
09:39:31.921806 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921809 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921812 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921816 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921818 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898097032, win 15836, length 0
09:39:31.921820 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921829 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898098492, win 16384, length 0
09:39:31.921834 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898101412, win 16019, length 0
09:39:31.921846 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898102872, win 16384, length 0
09:39:31.921896 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921904 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921914 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921916 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898105792, win 16201, length 0
09:39:31.921918 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921920 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921922 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921925 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921927 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921932 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921934 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898108712, win 15836, length 0
09:39:31.921936 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.921943 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898111632, win 15471, length 0
09:39:31.921954 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898114552, win 15106, length 0
09:39:31.921957 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898114552, win 16384, length 0
09:39:31.921959 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898117472, win 16019, length 0
09:39:31.921970 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898117472, win 16384, length 0
09:39:31.922020 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922028 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922037 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922039 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898120392, win 16201, length 0
09:39:31.922041 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922051 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922053 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898123312, win 15836, length 0
09:39:31.922055 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922058 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922060 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898123312, win 16384, length 0
09:39:31.922061 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922066 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922068 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922073 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898126232, win 16019, length 0
09:39:31.922081 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898129152, win 15654, length 0
09:39:31.922084 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898129152, win 16384, length 0
09:39:31.922086 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898132072, win 16019, length 0
09:39:31.922096 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898132072, win 16384, length 0
09:39:31.922145 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922154 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922163 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922165 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898134992, win 16201, length 0
09:39:31.922167 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922169 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922172 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922175 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922177 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922179 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898137912, win 15836, length 0
09:39:31.922182 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922185 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922194 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898140832, win 15776, length 0
09:39:31.922200 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898143752, win 15411, length 0
09:39:31.922203 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898146672, win 15046, length 0
09:39:31.922222 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898146672, win 16384, length 0
09:39:31.922270 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922278 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922289 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922291 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898149592, win 16201, length 0
09:39:31.922292 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922303 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922305 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898152512, win 16201, length 0
09:39:31.922307 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922317 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922320 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898155432, win 15836, length 0
09:39:31.922322 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922325 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898155432, win 16384, length 0
09:39:31.922327 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922330 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922333 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922335 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898158352, win 16019, length 0
09:39:31.922337 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922350 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898159812, win 16384, length 0
09:39:31.922353 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898162732, win 16019, length 0
09:39:31.922363 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898164192, win 16384, length 0
09:39:31.922396 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922406 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922416 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922419 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898167112, win 16201, length 0
09:39:31.922420 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922423 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922425 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922427 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922434 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898170032, win 16201, length 0
09:39:31.922439 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898172952, win 15836, length 0
09:39:31.922450 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898174412, win 16384, length 0
09:39:31.922520 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922529 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922539 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922541 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898177332, win 16201, length 0
09:39:31.922542 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922545 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922548 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922551 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922553 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922555 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898180252, win 15836, length 0
09:39:31.922557 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922560 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898181712, win 16201, length 0
09:39:31.922561 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922564 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922577 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898184632, win 15836, length 0
09:39:31.922584 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898187552, win 16019, length 0
09:39:31.922586 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898187552, win 16384, length 0
09:39:31.922589 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898190472, win 16019, length 0
09:39:31.922596 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898190472, win 16384, length 0
09:39:31.922645 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922654 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922664 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922666 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898193392, win 16201, length 0
09:39:31.922667 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922670 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922673 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922676 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922678 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922681 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898196312, win 15836, length 0
09:39:31.922683 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922686 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922690 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898196312, win 16384, length 0
09:39:31.922701 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898199232, win 16019, length 0
09:39:31.922708 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898202152, win 15654, length 0
09:39:31.922710 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898202152, win 16312, length 0
09:39:31.922713 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898205072, win 15947, length 0
09:39:31.922743 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898205072, win 16384, length 0
09:39:31.922770 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922777 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922786 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922788 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898207992, win 16201, length 0
09:39:31.922790 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922801 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922803 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898210912, win 16201, length 0
09:39:31.922804 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922807 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922810 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922814 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922816 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898213832, win 15836, length 0
09:39:31.922817 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922823 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922827 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898215292, win 16384, length 0
09:39:31.922835 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898218212, win 16019, length 0
09:39:31.922839 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898221132, win 15654, length 0
09:39:31.922841 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898221132, win 16384, length 0
09:39:31.922896 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922904 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922914 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922917 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898224052, win 16201, length 0
09:39:31.922918 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922933 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922935 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898225512, win 16384, length 0
09:39:31.922937 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922940 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922942 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922946 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922949 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922951 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898228432, win 16019, length 0
09:39:31.922952 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.922955 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898231352, win 16019, length 0
09:39:31.922964 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898231352, win 16384, length 0
09:39:31.922971 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898234272, win 16019, length 0
09:39:31.922973 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898237192, win 15654, length 0
09:39:31.922976 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898237192, win 16384, length 0
09:39:31.923020 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923028 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923040 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923042 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898240112, win 16201, length 0
09:39:31.923043 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923046 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923049 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923051 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923053 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923058 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898241572, win 16384, length 0
09:39:31.923067 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898244492, win 16019, length 0
09:39:31.923070 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898247412, win 15654, length 0
09:39:31.923074 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898248872, win 16384, length 0
09:39:31.923145 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923154 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923166 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923169 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898251792, win 16201, length 0
09:39:31.923170 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923173 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923176 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923178 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923180 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923182 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898254712, win 16201, length 0
09:39:31.923186 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923188 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923191 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923197 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898257632, win 15836, length 0
09:39:31.923207 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898260552, win 16019, length 0
09:39:31.923210 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898260552, win 16384, length 0
09:39:31.923212 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898263472, win 16019, length 0
09:39:31.923221 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898264932, win 16384, length 0
09:39:31.923269 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 1460SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923277 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 788SMB-over-TCP packet:(raw data or continuation?)
09:39:31.923288 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267180, win 16285, length 0
09:39:35.354733 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267180, win 16384, length 1[|SMB]
09:39:35.354804 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:39:40.354578 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267180, win 16384, length 1[|SMB]
09:39:40.354643 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:39:45.354428 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267180, win 16384, length 1[|SMB]
09:39:45.354496 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:39:50.354277 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267180, win 16384, length 1[|SMB]
09:39:50.354345 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:39:53.930467 IP tor.64915 > midgard.microsoft-ds: Flags [P.], ack 3685569628, win 0, length 45SMB PACKET: SMBclose (REQUEST)
09:39:54.030165 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 0
09:39:55.354131 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:39:55.354201 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:00.353975 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:00.354047 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:05.353823 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:05.353904 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:10.353676 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:10.353741 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:15.353523 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:15.353602 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:20.353369 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:20.353438 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:25.353221 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:25.353288 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:30.353069 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:30.353137 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:35.352916 IP midgard.microsoft-ds > tor.64915: Flags [.], ack 898267225, win 16384, length 1[|SMB]
09:40:35.352984 IP tor.64915 > midgard.microsoft-ds: Flags [.], ack 3685569628, win 0, length 0
09:40:35.930895 IP tor.64915 > midgard.microsoft-ds: Flags [R.], seq 898267225, ack 3685569628, win 0, length 0
More information about the samba-technical
mailing list