Resolving Network Problems with packet_monitor.pm and pm.pm

Noah Davids
Customer Assistance Center
Stratus Computer, Inc.

Stratagy 1995
September 17-21
Los Angeles, CA

Assumptions, Goals, Strategy
and
Requests

	Some familiarity with Ethernet, IP, TCP and UDP

	Ability to run the tools and have some understanding of what the traces
	mean

	Example traces from working and non-working environments

	Ask questions

References

	TCP/IP and related Protocols by Uyless Black

	Internetworking with TCP/IP volumes 1 & II by Comer

	New Groups
		comp.dcom.lans.ethernet
		comp.dcom.lans.misc
		comp.protocols.misc
		comp.protocols.nfs
		comp.protocolstcp-ip

	Web pages:
		http://wwwhost.ots.utexas.edu/ethernet
		http://ds.internic.net

Caveats
	Caveats

		If you see it transmited it probably was

		If you don't see it received it probably wasn't sent.

		If you don't see it received it, and it was sent  it probably wasn't
		received

	Security

		Not necessary to be logged in as privileged

		passwords are transmitted in clear text by telnet and ftp

OS TCP/IP - packet_monitor.pm

	Location
		(master_disk)>system>tcp_os>command_library

	Releases
		Releases up to but not including 12.2
		Releases 13.0 and 13.0.1 but not 13.1
			12.2 and 13.1 use the new device type ioa_gdma and firmware hal

packet_monitor usage

	packet_monitor -form
	 -------------------------------- packet_monitor ------------------------------
	 -interface:  
	 -count:      0
	 -queue:      200
	 -hex_dump:   no     cycle to yes
	 -length:     128
	 -numeric:    no     cycle to yes
	 -time_stamp: no     cycle to yes
	 -verbose:    no     cycle to yes
	 -filter:     yes
	 ------------------------ packet_monitor: specify filter ----------------------
	 -host:     packets from/to this host to/from the module            
	 -dst:      only packets from the module to this host 
	 -src:      only packets to the module from this host
	 -protocol: choices are ICMP, IP, TCP, or UDP
	 -receive:         yes                   -transmit:        yes
	 -loopback:        yes                   -arp:             no (yes == only ARP)
	 -ip:              no                    -ether_host:0:0:c0:6f:a6:6b
	 -ether_dst:                             -ether_src:
	 -ether_broadcast: no                    -ip_broadcast:    no
	 -port:            0                     -src_port:        0
	 -dst_port:        0                     -filter:          no

Example Network

ARP

packet_monitor -count 200 -hex_dump -numeric -time_stamp -verbose -filter -arp

                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
14:26:39.264 Rcvd ARP Req Target 134.111.44.43   Src  134.111.44.50   [00:00:c0:
+b2:5c:70]

14:26:49.840 Rcvd ARP Req Target 134.111.44.72   Src  134.111.44.24   [00:aa:00:
+5c:63:1c]

14:27:54.905 Rcvd ARP Req Target 134.111.44.92   Src  134.111.44.61   [00:aa:00:
+5c:a2:5c]

14:36:00.114 Rcvd ARP Req Target 134.111.44.47   Src  134.111.44.6    [00:00:1d:
+00:94:e4]

14:36:00.116 Xmit ARP Rep Target 134.111.44.6    [00:00:1d:00:94:e4] Src  134.11
+1.44.47   [00:00:a8:00:34:22]

14:43:59.517 Xmit ARP Req Target 134.111.44.50   Src  134.111.44.47   [00:00:a8:
+00:34:22]

14:43:59.525 Rcvd ARP Rep Target 134.111.44.47   [00:00:a8:00:34:22] Src  134.11
+1.44.50   [00:00:c0:b2:5c:70]

No response to ARP

	Host not turned on or connected to network

	Gateway not doing proxy arps

	Wrong IP configured (either host)

packet_monitor -count 200 -hex_dump -numeric -time_stamp -verbose -filter -arp
                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
11:53:46.956 Xmit ARP Req Target 134.111.44.253  Src  134.111.44.47   [00:00:a8:
+00:34:22]

11:53:48.142 Xmit ARP Req Target 134.111.44.253  Src  134.111.44.47   [00:00:a8:
+00:34:22]

11:53:50.136 Xmit ARP Req Target 134.111.44.253  Src  134.111.44.47   [00:00:a8:
+00:34:22]

No ARP request transmitted

	MAC address already known

	Host not turned on or connected to network

	Gateway down

	MAC address wrong

TCP well known ports

	Another list taken from several unix sources (/etc/services) 
		1	tcpmux
		7	echo
		9	discard
		11	systat		Active Users
		13	daytime
		15	netstat
		17	qotd		Quote of the Day
		19	chargen
		20	ftp-data	FTP data
		21	ftp		FTP control
		23	telnet		Telnet
		25	smtp		Simple mail Transfer
		37	time		Time Serve
		39	rlp		Resource Location
		42	name		Host Name Server
		43	whois
		53	domain	Domain Name Server
		57	mtp
		67	bootps		BOOTP Server
		68	bootpc		BOOTP Client
		69	tftp		Trivial File Transfer
		77	rje
		79	finger
		87	link
		95	supdup
		101	hostnames
		102	iso-tsap	
		103	x400		ISO Mail
		104	x400-snd
		105	csnet-ns
		109	pop		Post Office Protocol
		111	portmapper	Sun Report Procedure Call
		113	auth
		115	sftp
		117	uucp-path
		119	nntp		Network News Transfer Protocol
		120	dialup-stat	Dialup IP Monitor
		123	ntp		Network Time Protocol
		137	netbios-ns	NetBIOS Name Service
		138	netbios-dgm	NetBIOS Datagrame Service
		139	netbios-ssn	NetBIOS Session Service
		144	NeWS		NeWS Windowing System
		146	iso-tpo
		147	iso-ip
		153	sgmp
		161	snmp		Simple Network Management Protocol
		162	snmptrap	Simple Network Management Protocol - Trap
		163	cmip-manage	Common Management Information Protocol manager
		164	cmip-agent	Common Management Information Protocol agent
		201	at-rmtp		Apple Talk Routing Maintenance
		202	at-nbp		Apple Talk Name Binding
		204	at-echo		Apple Talk echo
		206	at-zis		Apple Talk Zone Information
		512	exec		remote execution (rexec)
		513	login		remote login (rlogin)
		514	shell		remote shell (rshell)
		515	printer		remote printing
		517	talk
		518	ntalk
		520	efs
		525	timed
		526	tempo
		530	courier
		531	conference
		532	netnews
		533	netwall
		540	uucp		Unix to Unix Copy Protocol Server
		550	new-rwho
		556	remotefs
		560	rmonitor
		561	monitor
		600	pcserver
		601	keyserv
		602	statd		Status Monitor Daemon
		603	lockd		NFS lock Manager
		1524	ingreslock
		2766	listen		System V listen Daemon

TCP Connection Sequence

packet_monitor -count 200 -hex_dump -numeric -time_stamp -verbose -filter -host 134.111.44.50
                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
16:14:06.295 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID a27b, Flg/Frg    0, TTL 3
+c,  Prtl  6
          Cksum  7711, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3301 to 134.111.44.47.telnet
    seq  241d7201, ack     n.a., window 1000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 8180,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

16:14:06.302 Xmit IP   Ver/HL 45, ToS  0, Len   2c, ID a338, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  9454, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.telnet to 134.111.44.50.3301
    seq  70bc9001, ack 241d7202, window 4000, 4. data bytes, flags Syn Ack.
    X/Off 06, Flags 12, Cksum 4efd,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  5 b4                                       <<<4

16:14:06.313 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID a27c, Flg/Frg    0, TTL 3
+c,  Prtl  6
          Cksum  7714, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3301 to 134.111.44.47.telnet
    seq  241d7202, ack 70bc9002, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 96ba,  Urg-> 0000
No tcp data.

Rejected TCP Connection

	no server listening at port

packet_monitor -count 200 -hex_dump -numeric -time_stamp -verbose -filter -host 134.111.44.50
                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
12:18:04.184 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID 30fe, Flg/Frg    0, TTL 3
+c,  Prtl  6
          Cksum  e88e, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.1023 to 134.111.44.47.513
    seq  3a8e9401, ack     n.a., window 1000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 500b,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

12:18:04.189 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 6910, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  ce80, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.513 to 134.111.44.50.1023
    seq         0, ack 3a8e9402, window n.a., 0. data bytes, flags Rst Ack.
    X/Off 05, Flags 14, Cksum 7600,  Urg-> 0000
No tcp data.

Incomming telnet request rejected

	inetd not listing on the requested port

                dir                                                 icmp type
+         tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  d
+st port  type

16:18:51.560 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID 1752, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  023b, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3188 to 134.111.44.47.9998
    seq   3755e01, ack     n.a., window 1000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 8fa2,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

16:18:51.564 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 691c, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  ce74, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.9998 to 134.111.44.50.3188
    seq         0, ack  3755e02, window n.a., 0. data bytes, flags Rst Ack.
    X/Off 05, Flags 14, Cksum b597,  Urg-> 0000
No tcp data.

Incomming telnet request rejected

	No window terminal devices available

                dir                                                 icmp type
+         tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  d
+st port  type
16:15:36.492 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID 1744, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  0249, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3187 to 134.111.44.47.9999
    seq   1fe5e01, ack     n.a., window 1000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 9119,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

16:15:36.502 Xmit IP   Ver/HL 45, ToS  0, Len   2c, ID 67d0, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  cfbc, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.9999 to 134.111.44.50.3187
    seq  ec1c0e01, ack  1fe5e02, window 4000, 4. data bytes, flags Syn Ack.
    X/Off 06, Flags 12, Cksum 6536,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  5 b4                                       <<<4

16:15:36.513 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID 1745, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  024c, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3187 to 134.111.44.47.9999
    seq   1fe5e02, ack ec1c0e02, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum acf3,  Urg-> 0000
No tcp data.

16:15:36.558 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 67d1, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  cfbf, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.9999 to 134.111.44.50.3187
    seq  ec1c0e02, ack  1fe5e02, window 4000, 0. data bytes, flags Fin Ack.
    X/Off 05, Flags 11, Cksum 7cf2,  Urg-> 0000
No tcp data.

16:15:36.568 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID 1746, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  024b, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3187 to 134.111.44.47.9999
    seq   1fe5e02, ack ec1c0e03, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum acf2,  Urg-> 0000
No tcp data.

16:15:36.569 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID 1747, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  024a, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3187 to 134.111.44.47.9999
    seq   1fe5e02, ack ec1c0e03, window 1000, 0. data bytes, flags Fin Ack.
    X/Off 05, Flags 11, Cksum acf1,  Urg-> 0000
No tcp data.

16:15:36.573 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 67d2, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  cfbe, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.9999 to 134.111.44.50.3187
    seq  ec1c0e03, ack  1fe5e03, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 7cf1,  Urg-> 0000
No tcp data.

Outgoing telnet connect
unresponsive host

                dir                                                 icmp type
+         tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  d
+st port  type
16:42:48.948 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 8aa0, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  ac16, Src 866f2c2f, Dst 866f2d0c
TCP from 134.111.44.47.1330 to 134.111.45.12.telnet
    seq  f887be01, ack     n.a., window   80, 0. data bytes, flags Syn.
    X/Off 05, Flags 02, Cksum 8d76,  Urg-> 0000
No tcp data.

16:42:54.744 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 8add, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  abd9, Src 866f2c2f, Dst 866f2d0c
TCP from 134.111.44.47.1330 to 134.111.45.12.telnet
    seq  f887be01, ack     n.a., window   80, 0. data bytes, flags Syn.
    X/Off 05, Flags 02, Cksum 8d76,  Urg-> 0000
No tcp data.

Interrupted telnet communication

17:30:55.694 Xmit IP   Ver/HL 45, ToS  0, Len  188, ID b4ac, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  81b0, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d1893f, ack  1dca9c8, window 4000, 352. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 7c45,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    6d 1b 5b 31 30 43 31 20  69 62 6d  d  a 6d 1b 5b  m<[10C1  ibm<<m<[
     10    31 30 43 33 20 6a 79 61  63 63  d  a 6d 1b 5b 31  10C3 jya cc<<m<[1
     20    30 43 31 20 6b 65 72 6d  69 74  d  a 6d 1b 5b 31  0C1 kerm it<<m<[1
     30    30 43 31 20 6d 61 69 6c  62 6f 78 5f 74 6f 6f 6c * 0C1 mailbox_tool
     40    73  d  a 6d 1b 5b 31 30  43 32 20 4e 65 58 54  d  s<<m<[10 C2 NeXT<
     50     a 6d 1b 5b 31 30 43 33  20 4e 46 53  d  a 6d 1b  <m<[10C3  NFS<<m<
     60    5b 31 30 43 31 20 6e 66  73 5f 74 65 73 74  d  a * [10C1 nfs_test<<
     70    6d 1b 5b 31 30 43 31 20  6f 73 6e 6d  d  a 6d 1b  m<[10C1  osnm<<m<

17:30:55.888 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID df07, Flg/Frg 4000, TTL
+20,  Prtl  6
          Cksum  16b5, Src 866f2c06, Dst 866f2c2f
TCP from 134.111.44.6.1059 to 134.111.44.47.telnet
    seq   1dca9c8, ack  4d18a9f, window 20d8, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum ea99,  Urg-> 0000
No tcp data.

17:30:55.895 Xmit IP   Ver/HL 45, ToS  0, Len  244, ID b4ad, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  80f3, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18a9f, ack  1dca9c8, window 4000, 540. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum bcbb,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     d  a 62 75 67 73 20 2d  3e 20 25 70 68 78 5f 63 * <<bugs -> %phx_c
     10    61 63 23 72 65 6c 31 31  3e 43 68 61 72 6c 65 73 * ac#rel11>Charles
     20    5f 53 70 69 74 7a 65 72  3e 62 75 67 73  d  a 63 * _Spitzer>bugs<<c
     30    6f 6d 6d 5f 67 72 6f 75  70 20 2d 3e 20 25 70 68 * omm_group -> %ph
     40    78 5f 63 61 63 23 6d 31  5f 75 73 65 72 3e 53 74 * x_cac#m1_user>St
     50    72 61 74 75 73 3e 44 65  6e 6e 69 73 5f 47 6f 73 * ratus>Dennis_Gos
     60    73 6d 61 6e 3e 63 6f 6d  6d 5f 67 72 70  d  a 43 * sman>comm_grp<<C
     70    53 5f 48 61 6e 64 62 6f  6f 6b 20 2d 3e 20 25 70 * S_Handbook -> %p

17:30:56.089 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e007, Flg/Frg 4000, TTL
+20,  Prtl  6
          Cksum  15b5, Src 866f2c06, Dst 866f2c2f
TCP from 134.111.44.6.1059 to 134.111.44.47.telnet
    seq   1dca9c8, ack  4d18cbb, window 1ebc, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum ea99,  Urg-> 0000
No tcp data.

17:30:56.094 Xmit IP   Ver/HL 45, ToS  0, Len   39, ID b4ae, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  82fd, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18cbb, ack  1dca9c8, window 4000, 17. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 7874,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    72 65 61 64 79 20 20 31  37 3a 33 30 3a 35 35  d * ready  17:30:55<
     10     a                                               * <

17:30:56.289 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e107, Flg/Frg 4000, TTL
+20,  Prtl  6
          Cksum  14b5, Src 866f2c06, Dst 866f2c2f
TCP from 134.111.44.6.1059 to 134.111.44.47.telnet
    seq   1dca9c8, ack  4d18ccc, window 1eab, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum ea99,  Urg-> 0000
No tcp data.

17:31:11.705 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b4d3, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  82ac, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:31:12.568 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b4d6, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  82a9, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:31:14.580 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b4da, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  82a5, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:31:18.599 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b4e5, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  829a, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:31:26.627 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b4f3, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  828c, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:31:42.673 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b4ff, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8280, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:32:14.760 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b539, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8246, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:33:18.961 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b59b, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  81e4, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:34:23.154 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b60f, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8170, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:35:27.337 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b637, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8148, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:36:31.518 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b680, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  80ff, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:37:35.662 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b6aa, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  80d5, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:38:39.762 Xmit IP   Ver/HL 45, ToS  0, Len   65, ID b6c1, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  80be, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack  1dca9c8, window 4000, 61. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum a44e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 37 1b 5b 37 6d 1b 5b  32 35 3b 31 48 1b 5b 37  <7<[7m<[ 25;1H<[7
     10    39 50 4d 61 69 6c 3a 20  59 6f 75 20 68 61 76 65 * 9PMail: You have
     20    20 6d 61 69 6c 20 66 72  6f 6d 20 52 69 63 6b 69 *  mail from Ricki
     30    65 20 42 72 69 6e 65 67  61 72 1b 38  7           e Brineg ar<8<

17:39:43.864 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID b6e3, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  80d9, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18d09, ack  1dca9c8, window 4000, 0. data bytes, flags Rst Ack.
    X/Off 05, Flags 14, Cksum c903,  Urg-> 0000
No tcp data.

17:43:30.203 Rcvd IP   Ver/HL 45, ToS  0, Len   2b, ID e907, Flg/Frg 4000, TTL
+20,  Prtl  6
          Cksum  0cb2, Src 866f2c06, Dst 866f2c2f
TCP from 134.111.44.6.1059 to 134.111.44.47.telnet
    seq   1dca9c8, ack  4d18ccc, window 1eab, 3. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 8d33,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    1b 5b 42                                          <[B

17:43:30.209 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID b754, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8068, Src 866f2c2f, Dst 866f2c06
TCP from 134.111.44.47.telnet to 134.111.44.6.1059
    seq   4d18ccc, ack     n.a., window 4000, 0. data bytes, flags Rst.
    X/Off 05, Flags 04, Cksum 74f5,  Urg-> 0000
No tcp data.

Timing is everything

	0	17:31:11.705
			~1 second
	1	17:31:12.568	
			~2 seconds
	2	17:31:14.580
			~4 seconds
	3	17:31:18.599
			~8 seconds
	4	17:31:26.627
			~16 seconds
	5	17:31:42.673
			~32 seconds
	6	17:32:14.760
			~64 seconds
	7	17:33:18.961
			~64 seconds
	8	17:34:23.154
			~64 seconds
	9	17:35:27.337
			~64 seconds
	10	17:36:31.518
			~64 seconds
	11	17:37:35.662
			~64 seconds
	12	17:38:39.762
			~64 seconds
	reset	17:39:43.864

Seq and Ack numbers

No Route Back to Host
or
Bad ARP entry

                dir                                                 icmp type 
+        tcp 
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
18:00:53.707 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID 5209, Flg/Frg    0, TTL 1
+d,  Prtl  6
          Cksum  3b1f, Src 5d010105, Dst 866f2c2f
TCP from 93.1.1.5.3878 to 134.111.44.47.telnet
    seq  6f3a8e01, ack     n.a., window 2000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 5cbd,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

18:00:53.715 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID a569, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  e6c2, Src 866f2c2f, Dst 5d010105
TCP from 134.111.44.47.telnet to 93.1.1.5.3878
    seq  7fd1e201, ack 6f3a8e02, window 4000, 0. data bytes, flags Syn Ack.
    X/Off 05, Flags 12, Cksum f0e0,  Urg-> 0000
No tcp data.

18:00:59.538 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID a587, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  e6a4, Src 866f2c2f, Dst 5d010105
TCP from 134.111.44.47.telnet to 93.1.1.5.3878
    seq  7fd1e201, ack 6f3a8e02, window 4000, 0. data bytes, flags Syn Ack.
    X/Off 05, Flags 12, Cksum f0e0,  Urg-> 0000
No tcp data.

18:00:59.624 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID 520a, Flg/Frg    0, TTL 1
+d,  Prtl  6
          Cksum  3b1e, Src 5d010105, Dst 866f2c2f
TCP from 93.1.1.5.3878 to 134.111.44.47.telnet
    seq  6f3a8e01, ack     n.a., window 2000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 5cbd,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

18:00:59.629 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID a589, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  e6a2, Src 866f2c2f, Dst 5d010105
TCP from 134.111.44.47.telnet to 93.1.1.5.3878
    seq  7fd1e201, ack 6f3a8e02, window 4000, 0. data bytes, flags Syn Ack.
    X/Off 05, Flags 12, Cksum f0e0,  Urg-> 0000
No tcp data.

18:01:11.566 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID a599, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  e692, Src 866f2c2f, Dst 5d010105
TCP from 134.111.44.47.telnet to 93.1.1.5.3878
    seq  7fd1e201, ack 6f3a8e02, window 4000, 0. data bytes, flags Syn Ack.
    X/Off 05, Flags 12, Cksum f0e0,  Urg-> 0000
No tcp data.

18:01:11.625 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID 520b, Flg/Frg    0, TTL 1
+d,  Prtl  6
          Cksum  3b1d, Src 5d010105, Dst 866f2c2f
TCP from 93.1.1.5.3878 to 134.111.44.47.telnet
    seq  6f3a8e01, ack     n.a., window 2000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 5cbd,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

18:01:11.629 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID a59a, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  e691, Src 866f2c2f, Dst 5d010105
TCP from 134.111.44.47.telnet to 93.1.1.5.3878
    seq  7fd1e201, ack 6f3a8e02, window 4000, 0. data bytes, flags Syn Ack.
    X/Off 05, Flags 12, Cksum f0e0,  Urg-> 0000
No tcp data.

18:01:21.092 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID a5d6, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  e655, Src 866f2c2f, Dst 5d010105
TCP from 134.111.44.47.telnet to 93.1.1.5.3877
    seq  7efa1001, ack 6e61c202, window 4000, 0. data bytes, flags Syn Ack.
    X/Off 05, Flags 12, Cksum 9092,  Urg-> 0000
No tcp data.

No Route Back to Host

Bad ARP entry

TCP Window size shrinking example

                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
17:40:31.329 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID 32aa, Flg/Frg    0, TTL 3
+c,  Prtl  6
          Cksum  e6e2, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3274 to 134.111.44.47.6666
    seq  41c00201, ack     n.a., window 1000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum ba05,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

17:40:31.336 Xmit IP   Ver/HL 45, ToS  0, Len   2c, ID 957c, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  a210, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.6666 to 134.111.44.50.3274
    seq  767e3001, ack 41c00202, window 4000, 4. data bytes, flags Syn Ack.
    X/Off 06, Flags 12, Cksum e1c0,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  5 b4                                       <<<4

17:40:31.346 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID 32ab, Flg/Frg    0, TTL 3
+c,  Prtl  6
          Cksum  e6e5, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3274 to 134.111.44.47.6666
    seq  41c00202, ack 767e3002, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 297e,  Urg-> 0000
No tcp data.

17:41:50.979 Rcvd IP   Ver/HL 45, ToS  0, Len   6d, ID 32af, Flg/Frg    0, TTL 3
+c,  Prtl  6
          Cksum  e69c, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3274 to 134.111.44.47.6666
    seq  41c00202, ack 767e3002, window 1000, 69. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 0cc3,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    6e 6f 74 69 63 65 20 74  68 61 74 20 74 68 65 20 * notice that the
     10    77 69 6e 64 6f 77 20 73  69 7a 65 20 72 65 70 6f * window size repo
     20    72 74 65 64 20 69 6e 20  74 68 65 20 6c 61 73 74 * rted in the last
     30    20 41 43 4b 20 70 61 63  6b 65 74 20 69 73 20 34 *  ACK packet is 4
     40    30 30 30  d  a                                   * 000<<

17:41:51.183 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 95d0, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  a1c0, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.6666 to 134.111.44.50.3274
    seq  767e3002, ack 41c00247, window 3fbb, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum f97d,  Urg-> 0000
No tcp data.

17:43:07.658 Rcvd IP   Ver/HL 45, ToS  0, Len   3d, ID 32b2, Flg/Frg    0, TTL 3
+c,  Prtl  6
          Cksum  e6c9, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3274 to 134.111.44.47.6666
    seq  41c00247, ack 767e3002, window 1000, 21. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum aa8a,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    4e 6f 74 73 20 69 74 73  20 6f 6e 6c 79 20 33 66 * Nots its only 3f
     10    62 62 7f  d  a                                    bb<<<

17:43:07.862 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 9608, Flg/Frg    0, TTL 1
+e,  Prtl  6
          Cksum  a188, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.6666 to 134.111.44.50.3274
    seq  767e3002, ack 41c0025c, window 3fa6, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum f97d,  Urg-> 0000
No tcp data.

Calculating Window Size

	
	This is a worst case scenario, in the best case window size does not go
	down.

	As long as window size does not go to 0 data can still be sent.

FTP without problems

                dir                                                 icmp type
+         tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  d
+st port  type
12:13:11.381 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID e277, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3715, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe401, ack     n.a., window 1000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 84f5,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

12:13:11.390 Xmit IP   Ver/HL 45, ToS  0, Len   2c, ID 2f33, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  085a, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df401, ack aecbe402, window 4000, 4. data bytes, flags Syn Ack.
--PAUSE--
    X/Off 06, Flags 12, Cksum 7e10,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  5 b4                                       <<<4

12:13:11.401 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e278, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3718, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe402, ack e11df402, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum c5cd,  Urg-> 0000
No tcp data.

12:13:17.833 Xmit IP   Ver/HL 45, ToS  0, Len   55, ID 2f4e, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  0816, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df402, ack aecbe402, window 4000, 45. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 33da,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    32 32 30 20 70 68 78 63  61 63 2d 6d 31 20 46 54 * 220 phxcac-m1 FT
     10    50 20 73 65 72 76 65 72  20 28 4f 53 20 54 43 50 * P server (OS TCP
     20    2f 49 50 29 20 72 65 61  64 79 2e  d  a          * /IP) ready.<<

12:13:17.982 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e27b, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3715, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe402, ack e11df42f, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum c5a0,  Urg-> 0000
No tcp data.

12:13:22.325 Rcvd IP   Ver/HL 45, ToS  0, Len   33, ID e27c, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3709, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe402, ack e11df42f, window 1000, 11. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 290b,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    55 53 45 52 20 6e 6f 61  68  d  a                 USER noa h<<

12:13:22.337 Xmit IP   Ver/HL 45, ToS  0, Len   49, ID 2f73, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07fd, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df42f, ack aecbe40d, window 4000, 33. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum d128,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    33 33 31 20 50 61 73 73  77 6f 72 64 20 72 65 71 * 331 Password req
     10    75 69 72 65 64 20 66 6f  72 20 6e 6f 61 68 2e  d * uired for noah.<
     20     a                                               * <

12:13:22.392 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e27d, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3713, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe40d, ack e11df450, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum c574,  Urg-> 0000
No tcp data.

12:13:27.400 Rcvd IP   Ver/HL 45, ToS  0, Len   3b, ID e27e, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  36ff, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe40d, ack e11df450, window 1000, 19. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum ad72,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    50 41 53 53 20 61 61 61  61 61 61 61 61 61 61 61 * PASS aaaaaaaaaaa
     10    61  d  a                                         * a<<

12:13:27.604 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 2f8e, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  0803, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df450, ack aecbe420, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 9561,  Urg-> 0000
No tcp data.

12:13:27.908 Xmit IP   Ver/HL 45, ToS  0, Len   4d, ID 2f8f, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07dd, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df450, ack aecbe420, window 4000, 37. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum f452,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    32 33 30 20 55 73 65 72  20 4e 6f 61 68 5f 44 61 * 230 User Noah_Da
     10    76 69 64 73 2e 43 41 43  20 6c 6f 67 67 65 64 20 * vids.CAC logged
     20    69 6e 2e  d  a                                   * in.<<

12:13:28.061 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e27f, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3711, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe420, ack e11df475, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum c53c,  Urg-> 0000
No tcp data.

12:13:37.613 Rcvd IP   Ver/HL 45, ToS  0, Len   43, ID e281, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  36f4, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe420, ack e11df475, window 1000, 27. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 0c7a,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    50 4f 52 54 20 31 33 34  2c 31 31 31 2c 34 34 2c * PORT 134,111,44,
     10    35 30 2c 31 32 2c 31 39  36  d  a                * 50,12,196<<

12:13:37.624 Xmit IP   Ver/HL 45, ToS  0, Len   46, ID 2fbd, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07b6, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df475, ack aecbe43b, window 4000, 30. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum d813,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    32 30 30 20 50 4f 52 54  20 63 6f 6d 6d 61 6e 64 * 200 PORT command
     10    20 73 75 63 63 65 73 73  66 75 6c 2e  d  a       *  successful.<<

12:13:37.657 Rcvd IP   Ver/HL 45, ToS  0, Len   2e, ID e282, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3708, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe43b, ack e11df493, window 1000, 6. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 164b,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    4e 4c 53 54  d  a                                 NLST<<

12:13:37.687 Xmit IP   Ver/HL 45, ToS  0, Len   2c, ID 2fbe, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07cf, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp-data to 134.111.44.50.3268
    seq  e151b601, ack     n.a., window 4000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 4ebb,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  5 b4                                       <<<4

12:13:37.698 Rcvd IP   Ver/HL 45, ToS  0, Len   2c, ID e283, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3709, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3268 to 134.111.44.47.ftp-data
    seq  aefeac01, ack e151b602, window 1000, 4. data bytes, flags Syn Ack.
    X/Off 06, Flags 12, Cksum 255e,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  4  0                                       <<<

12:13:37.702 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 2fbf, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07d2, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp-data to 134.111.44.50.3268
    seq  e151b602, ack aefeac02, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 0b67,  Urg-> 0000
No tcp data.

12:13:37.707 Xmit IP   Ver/HL 45, ToS  0, Len   57, ID 2fc0, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07a2, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df493, ack aecbe441, window 4000, 47. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 2850,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    31 35 30 20 4f 70 65 6e  69 6e 67 20 41 53 43 49 * 150 Opening ASCI
     10    49 20 6d 6f 64 65 20 64  61 74 61 20 63 6f 6e 6e * I mode data conn
     20    65 63 74 69 6f 6e 20 66  6f 72 20 2a 2e  d  a    * ection for *.<<

12:13:37.720 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e284, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  370c, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe441, ack e11df4c2, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum c4ce,  Urg-> 0000
No tcp data.

12:13:39.467 Xmit IP   Ver/HL 45, ToS  0, Len  428, ID 2fc8, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  03c9, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp-data to 134.111.44.50.3268
    seq  e151ba02, ack aefeac02, window 4000, 1024. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 9b3d,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    64 65 6d 6f 73 2e 70 72  6e  d  a 64 69 61 6c 5f * demos.prn<<dial_
     10    6f 75 74 2e 6b 70  d  a  64 69 61 6c 5f 73 69 74 * out.kp<<dial_sit
     20    65 2e 6b 70  d  a 44 72  69 76 65 72 2e 6f  d  a * e.kp<<Driver.o<<
     30    44 72 69 76 65 72 2e 6f  5f 36 34 38 36 39 34  d * Driver.o_648694<
     40     a 65 6d 61 63 73 5f 74  65 73 74  d  a 65 6d 61 * <emacs_test<<ema
     50    63 73 5f 74 65 73 74 32   d  a 65 6d 61 63 73 5f * cs_test2<<emacs_
     60    74 65 73 74 5f 6f 70 63  6f 64 65 73  d  a 65 6e * test_opcodes<<en
     70    65 74 5f 6c 61 6e 63 65  64 2e 63  d  a 65 6e 65 * et_lanced.c<<ene

12:13:39.473 Xmit IP   Ver/HL 45, ToS  0, Len  373, ID 2fc9, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  047d, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp-data to 134.111.44.50.3268
    seq  e151be02, ack aefeac02, window 4000, 843. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 433f,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     d  a 72 33 32 39 78 30  30 2e 70 73  d  a 72 33 * <<r329x00.ps<<r3
     10    38 39 78 2d 30 30 2e 70  73  d  a 72 65 63 6f 72 * 89x-00.ps<<recor
     20    64 5f 74 63 70 5f 6d 65  74 65 72 73 2e 63 6d  d * d_tcp_meters.cm<
     30     a 72 6e 68 65 72 65 31  33 2e 7a 69 70 2e 65 6e * <rnhere13.zip.en
     40    63 6f 64 65 64  d  a 72  6e 68 65 72 65 31 34 2e * coded<<rnhere14.
     50    7a 69 70 2e 75 75 65 6e  63 6f 64 65 64  d  a 72 * zip.uuencoded<<r
     60    6e 68 65 72 65 31 36 2e  75 75 65  d  a 72 6e 69 * nhere16.uue<<rni
     70    2e 74 78 74  d  a 72 70  63 69 6e 66 6f 2e 70 6d * .txt<<rpcinfo.pm

12:13:39.611 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e285, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  370b, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3268 to 134.111.44.47.ftp-data
    seq  aefeac02, ack e151c14d, window  8b5, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 3767,  Urg-> 0000
No tcp data.

12:13:39.767 Xmit IP   Ver/HL 45, ToS  0, Len   40, ID 2fcd, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07ac, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp to 134.111.44.50.3267
    seq  e11df4c2, ack aecbe441, window 4000, 24. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum c5b8,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    32 32 36 20 54 72 61 6e  73 66 65 72 20 63 6f 6d * 226 Transfer com
     10    70 6c 65 74 65 2e  d  a                          * plete.<<

12:13:39.771 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 2fce, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07c3, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp-data to 134.111.44.50.3268
    seq  e151c14d, ack aefeac02, window 4000, 0. data bytes, flags Fin Ack.
    X/Off 05, Flags 11, Cksum 001b,  Urg-> 0000
No tcp data.

12:13:39.780 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e286, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  370a, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3268 to 134.111.44.47.ftp-data
    seq  aefeac02, ack e151c14e, window  8b5, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 3766,  Urg-> 0000
No tcp data.

12:13:39.820 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e287, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3709, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe441, ack e11df4da, window  fe8, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum c4ce,  Urg-> 0000
No tcp data.

12:13:39.835 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e288, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3708, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3268 to 134.111.44.47.ftp-data
    seq  aefeac02, ack e151c14e, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 301b,  Urg-> 0000
No tcp data.

12:13:40.628 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID e289, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  3707, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3268 to 134.111.44.47.ftp-data
    seq  aefeac02, ack e151c14e, window 1000, 0. data bytes, flags Fin Ack.
    X/Off 05, Flags 11, Cksum 301a,  Urg-> 0000
No tcp data.

12:13:40.632 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 2fcf, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07c2, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp-data to 134.111.44.50.3268
    seq  e151c14e, ack aefeac03, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 001a,  Urg-> 0000
No tcp data.

FTP data port calculation

12:13:37.613 Rcvd IP   Ver/HL 45, ToS  0, Len   43, ID e281, Flg/Frg    0, TTL
+3c,  Prtl  6
          Cksum  36f4, Src 866f2c32, Dst 866f2c2f
TCP from 134.111.44.50.3267 to 134.111.44.47.ftp
    seq  aecbe420, ack e11df475, window 1000, 27. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 0c7a,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    50 4f 52 54 20 31 33 34  2c 31 31 31 2c 34 34 2c * PORT 134,111,44,
     10    35 30 2c 31 32 2c 31 39  36  d  a                * 50,12,196<<

			PORT 134,111,44,50,12,196
			12,196 = C,C4
			CC4 = 3268

12:13:37.687 Xmit IP   Ver/HL 45, ToS  0, Len   2c, ID 2fbe, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  07cf, Src 866f2c2f, Dst 866f2c32
TCP from 134.111.44.47.ftp-data to 134.111.44.50.3268
    seq  e151b601, ack     n.a., window 4000, 4. data bytes, flags Syn.
    X/Off 06, Flags 02, Cksum 4ebb,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     2  4  5 b4                                       <<<4

FTP through a fire wall

                dir                                                 icmp type
+         tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  d
+st port  type
12:52:56.866 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 69ef, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  83d1, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a01, ack     n.a., window 4000, 0. data bytes, flags Syn.
    X/Off 05, Flags 02, Cksum 26a2,  Urg-> 0000
No tcp data.

12:52:57.346 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID d727, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  0699, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb8400, ack f33d9a02, window 1000, 0. data bytes, flags Syn Ack.
    X/Off 05, Flags 12, Cksum 6aa5,  Urg-> 0000
No tcp data.

12:52:57.351 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 69f4, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  83cc, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a02, ack 67eb8401, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 3aa6,  Urg-> 0000
No tcp data.

12:53:27.986 Rcvd IP   Ver/HL 45, ToS  0, Len  168, ID eeb8, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  edc7, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb8401, ack f33d9a02, window 1000, 320. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum d417,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    32 32 30 2d 50 72 69 6e  63 65 74 6f 6e 2e 45 44 * 220-Princeton.ED
     10    55 20 46 54 50 20 73 65  72 76 65 72 20 28 57 69 * U FTP server (Wi
     20    64 65 6e 65 72 20 33 2e  36 30 29 20 72 65 61 64 * dener 3.60) read
     30    79 2e  d  a 32 32 30 2d  52 65 70 6f 72 74 20 61 * y.<<220-Report a
     40    6e 79 20 70 72 6f 62 6c  65 6d 73 20 74 6f 20 66 * ny problems to f
     50    74 70 40 50 72 69 6e 63  65 74 6f 6e 2e 45 44 55 * tp@Princeton.EDU
     60    2e  d  a 32 32 30 2d 49  66 20 79 6f 75 20 61 72 * .<<220-If you ar
     70    65 20 6f 6e 20 61 6e 20  49 42 4d 20 6d 61 69 6e * e on an IBM main

12:53:28.191 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 6abb, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8305, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a02, ack 67eb8541, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 3966,  Urg-> 0000
No tcp data.

12:53:42.277 Xmit IP   Ver/HL 45, ToS  0, Len   38, ID 6b0e, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  82a2, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a02, ack 67eb8541, window 4000, 16. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum b171,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    55 53 45 52 20 61 6e 6f  6e 79 6d 6f 75 73  d  a * USER anonymous<<

12:53:42.491 Rcvd IP   Ver/HL 45, ToS  0, Len   5e, ID f4b9, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  e8d0, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb8541, ack f33d9a12, window 1000, 54. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 332d,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    33 33 31 20 47 75 65 73  74 20 6c 6f 67 69 6e 20 * 331 Guest login
     10    6f 6b 2c 20 73 65 6e 64  20 65 2d 6d 61 69 6c 20 * ok, send e-mail
     20    61 64 64 72 65 73 73 20  61 73 20 70 61 73 73 77 * address as passw
     30    6f 72 64 2e  d  a                                * ord.<<

12:53:42.510 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 6b11, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  82af, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a12, ack 67eb8577, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 3920,  Urg-> 0000
No tcp data.

12:54:15.087 Xmit IP   Ver/HL 45, ToS  0, Len   4f, ID 6bd6, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  81c3, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a12, ack 67eb8577, window 4000, 39. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum be81,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    50 41 53 53 20 4e 6f 61  68 5f 4e 6f 61 68 5f 44 * PASS Noah_Noah_D
     10    61 76 69 64 73 40 76 6f  73 2e 73 74 72 61 74 75 * avids@vos.stratu
     20    73 2e 63 6f 6d  d  a                             * s.com<<

12:54:15.411 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID ffdc, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  dde3, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb8577, ack f33d9a39, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 68f9,  Urg-> 0000
No tcp data.

12:54:16.017 Rcvd IP   Ver/HL 45, ToS  0, Len   58, ID   80, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  dd10, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb8577, ack f33d9a39, window 1000, 48. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum bcda,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    32 33 30 20 47 75 65 73  74 20 6c 6f 67 69 6e 20 * 230 Guest login
     10    6f 6b 2c 20 61 63 63 65  73 73 20 72 65 73 74 72 * ok, access restr
     20    69 63 74 69 6f 6e 73 20  61 70 70 6c 79 2e  d  a * ictions apply.<<

12:54:16.023 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 6bde, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  81e2, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a39, ack 67eb85a7, window 3fd0, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 38f9,  Urg-> 0000
No tcp data.

12:54:40.629 Xmit IP   Ver/HL 45, ToS  0, Len   43, ID 6c34, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8171, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a39, ack 67eb85a7, window 4000, 27. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 8506,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    50 4f 52 54 20 31 33 34  2c 31 31 31 2c 34 34 2c * PORT 134,111,44,
     10    34 37 2c 31 32 2c 32 32  31  d  a                * 47,12,221<<

12:54:40.961 Rcvd IP   Ver/HL 45, ToS  0, Len   46, ID  707, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  d69b, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb85a7, ack f33d9a54, window 1000, 30. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum aba0,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    32 30 30 20 50 4f 52 54  20 63 6f 6d 6d 61 6e 64 * 200 PORT command
     10    20 73 75 63 63 65 73 73  66 75 6c 2e  d  a       *  successful.<<

12:54:40.977 Xmit IP   Ver/HL 45, ToS  0, Len   2e, ID 6c38, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8182, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a54, ack 67eb85c5, window 4000, 6. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum 89d7,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    4e 4c 53 54  d  a                                 NLST<<

12:54:41.670 Rcvd IP   Ver/HL 45, ToS  0, Len   28, ID  784, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  d63c, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb85c5, ack f33d9a5a, window 1000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 688a,  Urg-> 0000
No tcp data.

12:54:41.673 Rcvd IP   Ver/HL 45, ToS  0, Len   5f, ID  792, Flg/Frg    0, TTL
+2e,  Prtl  6
          Cksum  d5f7, Src 80707c01, Dst 866f2c2f
TCP from 128.112.124.1.ftp to 134.111.44.47.3292
    seq  67eb85c5, ack f33d9a5a, window 1000, 55. data bytes, flags Push Ack.
    X/Off 05, Flags 18, Cksum cc5f,  Urg-> 0000
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    34 32 35 20 43 61 6e 27  74 20 62 75 69 6c 64 20 * 425 Can't build
     10    64 61 74 61 20 63 6f 6e  6e 65 63 74 69 6f 6e 3a * data connection:
     20    20 48 6f 73 74 20 69 73  20 75 6e 72 65 61 63 68 *  Host is unreach
     30    61 62 6c 65 2e  d  a                             * able.<<

12:54:41.877 Xmit IP   Ver/HL 45, ToS  0, Len   28, ID 6c3d, Flg/Frg    0, TTL
+1e,  Prtl  6
          Cksum  8183, Src 866f2c2f, Dst 80707c01
TCP from 134.111.44.47.3292 to 128.112.124.1.ftp
    seq  f33d9a5a, ack 67eb85fc, window 4000, 0. data bytes, flags Ack.
    X/Off 05, Flags 10, Cksum 3853,  Urg-> 0000
No tcp data.

UDP Server not listening

                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
17:17:17.671 Xmit IP   Ver/HL 45, ToS  0, Len   1e, ID bd6b, Flg/Frg    0, TTL 1
+e,  Prtl 11
          Cksum  7a43, Src 866f2c2f, Dst 866f2c13
UDP from 134.111.44.47.1024 to 134.111.44.19.9999 Cksum 62a0, 10. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     d  a                                             <<

17:17:17.690 Rcvd IP   Ver/HL 45, ToS  0, Len   38, ID 4d17, Flg/Frg    0, TTL 7
+8,  Prtl  1
          Cksum  908d, Src 866f2c13, Dst 866f2c2f
ICMP from 134.111.44.19 to 134.111.44.47     unreach
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0     3  3 6c a7  0  0  0  0                           <<l'

Well Known Program Numbers

	100000	rpcbind		aka portmapper converts RPC
						program numbers into port numbers
	100001	rstatd 
	100002	rusersd
	100003	nfs			network file system
	100004	ypserv  
	100005	mountd		answers file system mount requests
	100007	ypbind 
	100008	walld 
	100009	yppasswdd
	100010	etherstatd 
	100011	rquotad 
	100012	sprayd 
	100013	3270_mapper 
	100014	rje_mapper 
	100015	selection_svc selnsvc 
	100016	database_svc 
	100017	rexd rex 
	100018	alis 
	100019	sched 
	100020	llockmgr 
	100021	nlockmgr 
	100022	x25.inr 
	100023	statmon 
	100024	status 
	100028	ypupdated 
	100029	keyserv  
	100026	bootparam 
	100033	sunlink_mapper 
	100037	tfsd 
	100038	nsed 
	100039	nsemntd 
	100043	showfhd 
	100055	ioadmd 
	100062	NETlicense 
	100065	sunisamd 
	100066	debug_scv 
	100071	bugtraqd 
	100078	kerbd 
	100087	admind 
	100101	event 
	100102	logger 
	100104	sync 
	100107	hostperf  
	100109	activity 
	100112	hostmem 
	100113	sample 
	100114	x25 
	100115	ping 
	100116	rpcnfs 
	100117	hostif
	100118	etherif 
	100120	iproutes 
	100121	layers
	100122	snmp 
	100123	traffic
	100227	nfs_acl
	100200	nisd
	100303	nispasswd
	100999	ufsd
	150001	pcnfsd

RPC accept status codes

	from rpc_msh.h

	SUCCESS			0
	PROG_UNAVAIL		1	requested program unavailable
	PROG_MISMATCH		2	requested program version mismatch
	PROC_UNAVAIL		3	requested procedure unavailable
	GARBAGE_ARGS		4
	SYSTEM_ERR		5

portmapper procedures

	0	PMAPPROC_NULL
			Null proc call
	1	PMAPPROC_SET
			Set a program,version to port mapping
	2	PMAPPROC_UNSET
			Remove a program,version to port mapping
	3	PMAPPROC_GETPORT
			Lookup the mapping for a program,version and return its port number
	4	PMAPPROC_DUMP
			Return the current set of mapped program,version
	5	PMAPPROC_CALLIT
			Calls a procedure on the local machine. If the requested procedure is
			not registered this procedure does not return error information!! This
			procedure is only supported on rpc/udp and calls via rpc/udp. It passes
			null authentication parameters.

portmapper

8:16:23.267 Rcvd IP   Ver/HL 45, ToS  0, Len   54, ID c6ef, Flg/Frg    0, TTL
+3c,  Prtl 11
          Cksum  526a, Src 866f2c32, Dst 866f2c2f
UDP from 134.111.44.50.3261 to 134.111.44.47.111 Cksum b03b, 64. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30  c  5  b  0  0  0  0   0  0  0  2  0  1 86 a0  0<<<        < <>
     10     0  0  0  2  0  0  0  3   0  0  0  0  0  0  0  0     <   <
     20     0  0  0  0  0  0  0  0  21  0  0  0  0  0  0  1           !      <
     30     0  0  0  6  0  0  0  0                              <

offset	data		meaning
RPC level
0	30 c  5  b	transaction ID
4	0  0  0  0	type 0 (call)
8	0  0  0  2	RPC version 2
12	0  1 86 a0	program number (100000, portmapper)
16	0  0  0  2	program version (2)
20	0  0  0  3	procedure (3, look up a mapping)
24	0  0  0  0	credentials, authentication value NULL
28	0  0  0  0	credentials, bytes of authentication (0)
32	0  0  0  0	verifier, authentication value NULL
36	0  0  0  0	verifier, bytes of authentication (0)
Port Map level
40	21  0  0  0	program number (553648128)
44	0   0  0  1	program version (1)
48	0  0  0  6	protocol (6, TCP)
52	0  0  0  0

 8:16:23.278 Xmit IP   Ver/HL 45, ToS  0, Len   38, ID  572, Flg/Frg    0, TTL
+1e,  Prtl 11
          Cksum  3204, Src 866f2c2f, Dst 866f2c32
UDP from 134.111.44.47.111 to 134.111.44.50.3261 Cksum 5422, 36. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30  c  5  b  0  0  0  1   0  0  0  0  0  0  0  0  0<<<   <
     10     0  0  0  0  0  0  0  0   0  0  4  0                         <

offset	data		meaning
RPC level
0	30 c  5  b	transaction ID
4	0  0  0  1	type (1, reply)
8	0  0  0  0	status (0, accepted)
12	0  0  0  0	verifier authentication flavor (NULL)
16	0  0  0  0	verifier, bytes of authentication (0)
20	0  0  0  0	accept status (0, success)
Port Map level
24	0  0  4  0	port number (1024)

Requested program not registered

                dir                                                 icmp type
+         tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  d
+st port  type
 8:16:23.238 Rcvd IP   Ver/HL 45, ToS  0, Len   54, ID c6ec, Flg/Frg    0, TTL
+3c,  Prtl 11
          Cksum  526d, Src 866f2c32, Dst 866f2c2f
UDP from 134.111.44.50.3260 to 134.111.44.47.111 Cksum e649, 64. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30  d e5 39  0  0  0  0   0  0  0  2  0  1 86 a0  0<e9        < <>
     10     0  0  0  2  0  0  0  3   0  0  0  0  0  0  0  0     <   <
     20     0  0  0  0  0  0  0  0  20 70 ea 40  0  0  0 13            pj@   <
     30     0  0  0  6  0  0  0  0                              <

offset	data		meaning
RPC level
0	30 d e5 39	transaction ID
4	0  0  0  0	type 0 (call)
8	0  0  0  2	RPC version 2
12	0  1 86 a0	program number (100000, portmapper)
16	0  0  0  2	program version (2)
20	0  0  0  3	procedure (3, look up a mapping)
24	0  0  0  0	credentials, authentication value NULL
28	0  0  0  0	credentials, bytes of authentication (0)
32	0  0  0  0	verifier, authentication value NULL
36	0  0  0  0	verifier, bytes of authentication (0)
Port Map level
40	20 70 ea 40	program number (544270912)
44	0   0  0 13	program version (19)
48	0  0  0  6	protocol (6, TCP)
52	0  0  0  0

 8:16:23.253 Xmit IP   Ver/HL 45, ToS  0, Len   38, ID  570, Flg/Frg    0, TTL
+1e,  Prtl 11
          Cksum  3206, Src 866f2c2f, Dst 866f2c32
UDP from 134.111.44.47.111 to 134.111.44.50.3260 Cksum 77f3, 36. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30  d e5 39  0  0  0  1   0  0  0  0  0  0  0  0  0<e9   <
     10     0  0  0  0  0  0  0  0   0  0  0  0

offset	data		meaning
RPC level
0	30 d e5 39	transaction ID
4	0  0  0  1	type (1, reply)
8	0  0  0  0	status (0, accepted)
12	0  0  0  0	verifier authentication flavor (NULL)
16	0  0  0  0	verifier, bytes of authentication (0)
20	0  0  0  0	accept status (0, success)
Port Map level
24	0  0  0  0	port number (0)

NFS Procedures

	0	NFSPROC_NULL ()
			Does Nothinig
	1	NFSPROC_GETATTR (fhandle)
			Get attributes of file identified by fhandle
	2	NFSPROC_SETATTR (fhandle, fattr)
			Set attributes of file identified by fhandle to fattr
	3	NFSPROC_ROOT (void)
			obsolete
	4	NFSPROC_LOOKUP (fhandle, filename)
			Returns a file handle to a file
	5	NFSPROC_READLINK (fhandle)
			Returns the pathname contained in a symbolic link identified by fhandle
	6	NFSPROC_READ (fhandle, offset, count, totalcount)
			Returns upto count bytes of data from the file idetified by fhandle,
			starting at offset bytes from the beginning of the file (totalcount is
			unused)			
	7	NFSPROC_WRITECACHE (void)
			Reserved for version 3
	8	NFSPROC_WRITE (fhandle, boffset, offset, totalcount)
			Writes data beginning at offset bytes from the beginning of the file
			identified by fhandle (boffset and totalcount are unused)
	9	NFSPROC_CREATE (fhandle, filename, fattr)
			Creates a file name filename with attributes fattr in the directory
			identified by fhandle
	10	NFSPROC_REMOVE (fhandle, filename)
			Removes the file named filename from the directory identified by
			fhandle
	11	NFSPROC_RENAME (fromfh, fromname, tofh, toname)
			Changes file fromname in the directory identified by fromfh to the name
			toname in the directory identified by tofh
	12	NFSPROC_LINK (fromfh, tofh, toname)
			Creates a new link named toname in the directory identified by tofh
			pointing to the file identified by fromfh
	13	NFSPROC_SYMLINK (fromdir, fromname, toname, fattr)
			Creates a symbolic link named fromname in the directory fromdir
			containing the pathname toname with attributes fattr
	14	NFSPROC_MKDIR (fhandle, name, fattr)
			creates a directory named name in the directory identified by fhandle
			with attributes fattr
	15	NFSPROC_RMDIR (fhandle, name)
			Deletes the directory named name from the directory identified by
			fhandle
	16	NFSPROC_READDIR (fhandle, index, count)
			Read directory entries from the directory identified by fhandle with total
			size up to count beginning with entry number index
	17	NFSPROC_STATFS (filesystem)
			Return attributes of filesystem

NFS Errors

	0 	no error
	1 	Not owner
	2 	No such file or directory
	5 	I/O error
	6 	No such device or address
	13	Permission denied
	17	File exists
	19 	No such device
	20 	Not a directory
	21 	Is a directory
	27 	File too large
	28 	No space left on device
	30 	Read-only file system
	63 	File name too long
	66 	Directory not empty
	69 	Disc quota exceeded
	70 	Stale NFS file handle

NFS mount - success

                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type
14:05:05.519 Rcvd IP   Ver/HL 45, ToS  0, Len   54, ID 27e1, Flg/Frg    0, TTL 3
+c,  Prtl 11
          Cksum  f178, Src 866f2c32, Dst 866f2c2f
UDP from 134.111.44.50.3272 to 134.111.44.47.111 Cksum a204, 64. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30 1f ad 72  0  0  0  0   0  0  0  2  0  1 86 a0  0<-r        < <>
     10     0  0  0  2  0  0  0  3   0  0  0  0  0  0  0  0     <   <
     20     0  0  0  0  0  0  0  0   0  1 86 a5  0  0  0  1            <>%   <
     30     0  0  0 11  0  0  0  0                              <

0  1 86 a0		program number 100000, portmapper
0  0  0  2		RPC version 2
0  0  0  3		procedure 3, lookup a mapping
0  1 86 a5		program 100005, mountd
0  0  0  1		program version 1
0  0  0 11		protocol 17, UDP

14:05:05.528 Xmit IP   Ver/HL 45, ToS  0, Len   38, ID 8ac4, Flg/Frg    0, TTL 1
+e,  Prtl 11
          Cksum  acb1, Src 866f2c2f, Dst 866f2c32
UDP from 134.111.44.47.111 to 134.111.44.50.3272 Cksum ab8e, 36. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30 1f ad 72  0  0  0  1   0  0  0  0  0  0  0  0  0<-r   <
     10     0  0  0  0  0  0  0  0   0  0  4  e                         <<

0  0  4  e		port number 40e = 1038

14:05:05.542 Rcvd IP   Ver/HL 45, ToS  0, Len   b4, ID 27e2, Flg/Frg    0, TTL 3
+c,  Prtl 11
          Cksum  f117, Src 866f2c32, Dst 866f2c2f
UDP from 134.111.44.50.901 to 134.111.44.47.1038 Cksum f3ac, 160. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30 1f d6  f  0  0  0  0   0  0  0  2  0  1 86 a5  0<V<        < <>%
     10     0  0  0  1  0  0  0  1   0  0  0  1  0  0  0 40     <   <    <   @
     20    2f 11 a5 9e  0  0  0  e  70 61 72 61 64 69 73 65  /<%>   < paradise
     30    76 61 6c 6c 65 79  0  0   0  0  0  0  0  0  0  1  valley          <
     40     0  0  0  7  0  0  0  1   0  0  0  a  0  0  0  0     <   <    <
     50     0  0  0  3  0  0  0 2c   0  0  0 29  0  0  3 e6     <   ,    )  <f
     60     0  0  0  0  0  0  0  0   0  0  0 29 25 70 68 78              )%phx
     70    5f 63 61 63 23 6d 31 5f  75 73 65 72 3e 53 74 72 * _cac#m1_user>Str

offset	data		meaning
RPC level
0	30 1f d6 f	transaction ID
4	0  0  0  0	type (0 = call)
8	0  0  0  2	RPC version
12	0  1 86 a5	program (100005, mountd)
16	0  0  0  1	program version 1
20	0  0  0  1	procedure (1 = add mount entry)
24	0  0  0  1	credentials: authentication flavor (1 = unix)
28	0  0  0 40	length 
32	2f 11 a5 9e	time stamp 
36	0  0  0  e	machine name length
40 	70 61 72 61 64 69 73 65 76 61 6c 6c 65 79  0  0
				paradisevalley
56	0  0  0  0	UID
60	0  0  0  1	GID
64	0  0  0  7	other GIDs (7)
68	0  0  0  1	GID = 1
72	0  0  0  a	GID = 10
76	0  0  0  0	GID = 0
80	0  0  0  3	GID = 3
84	0  0  0 2c	GID = 44
88	0  0  0 29	GID = 41
92	0  0  3 e6	GID = 998
96	0  0  0  0	verifier authentication flavor (0 = NULL)
100	0  0  0  0	verifier bytes of autentication data
Mountd level
104	0  0  0 29	length of directory
108	25 70 68 78 5f 63 61 63 23 6d 31 5f 75 73 65 72 3e 53 74 72
				%phx_cac#m1_user>Str

<<Only 128 bytes of data was captured so rest of path is missing>>

14:05:06.339 Xmit IP   Ver/HL 45, ToS  0, Len   58, ID 8acf, Flg/Frg    0, TTL 1
+e,  Prtl 11
          Cksum  ac86, Src 866f2c2f, Dst 866f2c32
UDP from 134.111.44.47.1038 to 134.111.44.50.901 Cksum 8c39, 68. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30 1f d6  f  0  0  0  1   0  0  0  0  0  0  0  0  0<V<   <
     10     0  0  0  0  0  0  0  0   0  0  0  0  0  0  0 2a                  *
     20     0  0  0  0  0  0  0  0   0  0  0  0  0  0  0  0
     30     0  0  0  0  0  0  0  0   0  0  0  0

offset	data		meaning
RPC level
0	30 1f d6 f	transaction ID
4	0  0  0  1	type (1 = reply)
8	0  0  0  0	status (0 = accepted)
12	0  0  0  0	verifier authentication flavor (0 = NULL) 
16	0  0  0  0	verifier bytes of authentication data
20	0  0  0  0	accept status (0 = success)
Mountd level
24	0  0  0  0	status (0 = OK)
28	0  0  0 2a 0  0  0  0  0  0  0  0  0  0  0  0
	0  0  0  0 0  0  0  0  0  0  0  0  0  0  0  0
				file handle

14:05:06.353 Rcvd IP   Ver/HL 45, ToS  0, Len   a4, ID 27e3, Flg/Frg    0, TTL 3
+c,  Prtl 11
          Cksum  f126, Src 866f2c32, Dst 866f2c2f
UDP from 134.111.44.50.1023 to 134.111.44.47.2049 Cksum cf67, 144. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    4a 29 11  0  0  0  0  0   0  0  0  2  0  1 86 a3  J)<         < <>#
     10     0  0  0  2  0  0  0  1   0  0  0  1  0  0  0 40     <   <    <   @
     20    2f 11 a5 9f  0  0  0  e  70 61 72 61 64 69 73 65  /<%>   < paradise
     30    76 61 6c 6c 65 79  0  0   0  0  0  0  0  0  0  1  valley          <
     40     0  0  0  7  0  0  0  1   0  0  0  a  0  0  0  0     <   <    <
     50     0  0  0  3  0  0  0 2c   0  0  0 29  0  0  3 e6     <   ,    )  <f
     60     0  0  0  0  0  0  0  0   0  0  0 2a  0  0  0  0              *

offset	data		meaning
RPC level
0	4a 29 11 0	Transaction ID
4	0  0  0  0	type (0 = call)
8	0  0  0  2	RPC version
12	0  1 86 a3	program (100003, NFS)
16	0  0  0  2	program version
20	0  0  0  1	procedure (1 = get file attributes)
24	0  0  0  1	credentials authentication flavor (1 = Unix)
28	0  0  0 40	length
32	2f 11 a5 9f	time stamp
36	0  0  0  e	machine name length
40	70 61 72 61 64 69 73 65 76 61 6c 6c 65 79  0  0
				paradisevalley
56	0  0  0  0	UID
60	0  0  0  1	GID
64	0  0  0  7	other GIDs (7)
68	0  0  0  1	GID = 1
72	0  0  0  a	GID = 10
76	0  0  0  0	GID = 0
80	0  0  0  3	GID = 3
84	0  0  0 2c	GID = 44
88	0  0  0 29	GID = 41
92	0  0  3 e6	GID = 998
96	0  0  0  0	verifier authentication flavor (0 = NULL)
100	0  0  0  0	verifier bytes of autentication data
NFS level
104	0  0  0 2a  0  0  0  0
				file handle (rest of file handle is truncated)

14:05:06.363 Xmit IP   Ver/HL 45, ToS  0, Len   7c, ID 8ad0, Flg/Frg    0, TTL 1
+e,  Prtl 11
          Cksum  ac61, Src 866f2c2f, Dst 866f2c32
UDP from 134.111.44.47.2049 to 134.111.44.50.1023 Cksum b5fd, 104. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
       70 to       7f contains 16. (0x10) bytes of 0x00 control-@ (null)
      0    4a 29 11  0  0  0  0  1   0  0  0  0  0  0  0  0  J)<    <
     10     0  0  0  0  0  0  0  0   0  0  0  0  0  0  0  2                  <
     20     0  0 41 fd  0  0  0  4   0  0 1c e8  0  0  3 e5    A}   <   <h  <e
     30     0  0 10  0  0  0  4  0   0  0  0  0  0  0  0  4    <   <         <
     40     0  0  0  1  0  0  0 2a  2f 11 a1 68  0  0  0  0     <   * /<!h
     50    2e f4 6b aa  0  0  0  0  2e f4 6b aa  0  0  0  0  .tk*     .tk*

offset	data		meaning
RPC level
0	4a 29 11 0	transaction ID
4	0  0  0  1	type (1 = reply)
8	0  0  0  0	status (0 = accepted)
12	0  0  0  0	verifier authentication flavor (0 = NULL)
16	0  0  0  0	verifier bytes of authentication
20	0  0  0  0	accept status (0 = success)
NFS level
24	0  0  0  0	status (0 = OK)
28	0  0  0  2	file type (2 = directory)
32	0  0 41 fd	mode (040775 (octal))
				type = directory
				owner permissions = 7 = rwx
				group permissions = 7 = rwx
				other permissions = 5 = r-x
36	0  0  0  4	link count
40	0  0 1c e8	UID (7400)
44	0  0  3 e5	GID (997)
48	0  0 10  0	file size (4096)
52	0  0  4  0	block size (1024)
56	0  0  0  0  0  0  0  4	
				number of blocks
64	0  0  0  1	file system ID
68	0  0  0 2a	file ID
72	2f 11 a1 68  0  0  0  0
				access time
80	2e f4 6b aa  0  0  0  0
				modification time
88	2e f4 6b aa  0  0  0  0
				inode change time

14:05:06.375 Rcvd IP   Ver/HL 45, ToS  0, Len   a4, ID 27e4, Flg/Frg    0, TTL 3
+c,  Prtl 11
          Cksum  f125, Src 866f2c32, Dst 866f2c2f
UDP from 134.111.44.50.1023 to 134.111.44.47.2049 Cksum ce57, 144. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    4b 29 11  0  0  0  0  0   0  0  0  2  0  1 86 a3  K)<         < <>#
     10     0  0  0  2  0  0  0 11   0  0  0  1  0  0  0 40     <   <    <   @
     20    2f 11 a5 9f  0  0  0  e  70 61 72 61 64 69 73 65  /<%>   < paradise
     30    76 61 6c 6c 65 79  0  0   0  0  0  0  0  0  0  1  valley          <
     40     0  0  0  7  0  0  0  1   0  0  0  a  0  0  0  0     <   <    <
     50     0  0  0  3  0  0  0 2c   0  0  0 29  0  0  3 e6     <   ,    )  <f
     60     0  0  0  0  0  0  0  0   0  0  0 2a  0  0  0  0              *

offset	data		meaning
RPC level
0	4a 29 11 0	Transaction ID
4	0  0  0  0	type (0 = call)
8	0  0  0  2	RPC version
12	0  1 86 a3	program (100003, NFS)
16	0  0  0  2	program version
20	0  0  1  1	procedure (17 = get file system attributes)
24	0  0  0  1	credentials authentication flavor (1 = Unix)
28	0  0  0 40	length
32	2f 11 a5 9f	time stamp
36	0  0  0  e	machine name length
40	70 61 72 61 64 69 73 65 76 61 6c 6c 65 79  0  0
				paradisevalley
56	0  0  0  0	UID
60	0  0  0  1	GID
64	0  0  0  7	other GIDs (7)
68	0  0  0  1	GID = 1
72	0  0  0  a	GID = 10
76	0  0  0  0	GID = 0
80	0  0  0  3	GID = 3
84	0  0  0 2c	GID = 44
88	0  0  0 29	GID = 41
92	0  0  3 e6	GID = 998
96	0  0  0  0	verifier authentication flavor (0 = NULL)
100	0  0  0  0	verifier bytes of autentication data
NFS level
104	0  0  0 2a  0  0  0  0
				file handle (rest of file handle is truncated)

14:05:06.385 Xmit IP   Ver/HL 45, ToS  0, Len   4c, ID 8ad1, Flg/Frg    0, TTL 1
+e,  Prtl 11
          Cksum  ac90, Src 866f2c2f, Dst 866f2c32
UDP from 134.111.44.47.2049 to 134.111.44.50.1023 Cksum 1404, 56. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
       70 to       7f contains 16. (0x10) bytes of 0x00 control-@ (null)
      0    4b 29 11  0  0  0  0  1   0  0  0  0  0  0  0  0  K)<    <
     10     0  0  0  0  0  0  0  0   0  0  0  0  0  0 20  0
     20     0  0  4  0  0 5f 83  0   0 24 3b 34  0 24 3b 34    <  _>   $;4 $;4

offset	data		meaning
RPC level
0	4b 29 11 0	transaction ID
4	0  0  0  1	type (1 = reply)
8	0  0  0  0	status (0 = accepted)
12	0  0  0  0	verifier authentication flavor (0 = NULL)
16	0  0  0  0	verifier bytes of authentication data
20	0  0  0  0	accept status (0 = success)
NFS level
24	0  0  0  0	status (0 = OK)
28	0  0 20  0	transfer size (8192)
32	0  0  4  0	block size (1024)
36	0 5f 83  0	total blocks
40	0 24 3b 34	free blocks
44	0 24 3b 34	available blocks

NFS mount - failure

                dir                                                 icmp type
+        tcp
hh:mm:ss.ttt dir   len proto source             destination         src port  ds
+t port  type

14:21:04.274 Xmit IP   Ver/HL 45, ToS  0, Len   38, ID a47f, Flg/Frg    0, TTL 1
+e,  Prtl 11
          Cksum  92f6, Src 866f2c2f, Dst 866f2c32
UDP from 134.111.44.47.1038 to 134.111.44.50.949 Cksum 30a4, 36. data bytes.
     offset 0  .  .  .  4  .  .  .   8  .  .  .  C  .  .  .  0...4... 8...C...
      0    30 15 31 e7  0  0  0  1   0  0  0  0  0  0  0  0  0<1g   <
     10     0  0  0  0  0  0  0  0   0  0  0  2                          <

offset	data		meaning
RPC level
0	30 15 31 e7	transaction ID
4	0  0  0  1	type (1 = reply)
8	0  0  0  0	status (0 = accepted)
12	0  0  0  0	verifier authentication flavor (0 = NULL) 
16	0  0  0  0	verifier bytes of authentication data
20	0  0  0  0	accept status (0 = success)
Mount level
24	0  0  0  2	status (2 = No such file)

TCP/IP - pm.pm

	Location
		(master_disk)>system>tcp/ip_command_library

	Releases
		Releases up to but not including 13.0

pm usage

 -------------------------------- packet monitor ------------------------------
 adapter:       %phx_cac#e3.16.52
 -online:       yes		if no then you cannot change to online later
 -display_data: ascii		ascii or hex - hex is better

Net Monitor Commands

Clear      : Clear all received packets
Earliest   : Display earliest packet
Latest     : Display latest packet
Next       : Display next packet
Previous   : Display previous packet
Redraw     : Redraw screen
Quit       : Exit pm
Write      : Output received packets to a file
Input      : Receive packets from a file
Filter     : Filter packets
On/Offline : Toggle online status

Commands correspond to the first letter of the command name, lower case works 

Using filters

	3 filters, press f to get the choose_filter form. use_filter is a cycle field

	all fields in a filter are ANDed together, fields without a value mean any 
	valid data

	filters are ORed, 2 filters required to view 2-way traffic between two hosts

	don't forget to enable the filter

Filter Example

 -------------------------------- choose_filter -------------------------------
 use_filter: 1
 
 -------------------------------- specify_filter ------------------------------
 enet_source:
 enet_dest:
 inet_source: 134.111.44.81				(host names are OK)
 inet_dest:
 source_port: 0
 dest_port:   0
 -enabled:  yes
 
 -------------------------------- choose_filter -------------------------------
 use_filter: 2
 
 -------------------------------- specify_filter ------------------------------
 enet_source:
 enet_dest:
 inet_source:
 inet_dest: 134.111.44.81
 source_port: 0
 dest_port:   0
 -enabled:  yes

ARP transmit request and receive response

Total    packets:       29              Total received:      29       OFFLINE

Packet   number:        26
  "      length:        60
  "        time:        11151515          (144105)
Ethernet destination:   ffffffffffff
  "      source:        0000a8017427
  "      type:          ADDRESS RESOLUTION PROTOCOL
 
Link Layer Address Type: AF_ETHER       Protocol Address Type: AF_INET
Link Layer Address Length: 6            Protocol Address Length: 4
Opcode : REQUEST

Link Layer Source Address: 0000a8017427
Protocol Source Address: 134.111.44.81
Link Layer Destination Address: 000000000000
Protocol Destination Address: 134.111.44.19

=======================================================================

Total    packets:       29              Total received:      29       OFFLINE

Packet   number:        27
  "      length:        60
  "        time:        11151515          (0)
Ethernet destination:   0000a8017427
  "      source:        0000a8008002
  "      type:          ADDRESS RESOLUTION PROTOCOL
 
Link Layer Address Type: AF_ETHER       Protocol Address Type: AF_INET
Link Layer Address Length: 6            Protocol Address Length: 4
Opcode : REPLY

Link Layer Source Address: 0000a8008002
Protocol Source Address: 134.111.44.19
Link Layer Destination Address: 0000a8017427
Protocol Destination Address: 134.111.44.81

Receive TCP Connection request and refuse it

Total    packets:       2               Total received:      32

Packet   number:        1
  "      length:        60

Ethernet destination:   0000a8008002
  "      source:        0000c0b25c70
  "      type:          DARPA INTERNET PROTOCOL

Version:       4        IHL:           5          Type of Service: 0---
Total length:  44       Id:            37211      Flags:           ---
Fragment Offset: 0      Time to Live:  60
Protocol:      TCP      Header Checksum: 0x884d
Src 134.111.44.50                     Dest 134.111.44.19

Source port: 2736       Destination port: 9999
Seq no:      147543041  Ack no:      0            D.O.:        6
Control:     ----S-     Window:      4096         Checksum:    0x962b
Urgent pointer: 0                                 Maximum Segment Size: 1024
=======================================================================
Total    packets:       2               Total received:      75

Packet   number:        2
  "      length:        60

Ethernet destination:   0000c0b25c70
  "      source:        0000a8008002
  "      type:          DARPA INTERNET PROTOCOL

Version:       4        IHL:           5          Type of Service: 0---
Total length:  40       Id:            15082      Flags:           ---
Fragment Offset: 0      Time to Live:  120
Protocol:      TCP      Header Checksum: 0xa2c2
Src 134.111.44.19                     Dest 134.111.44.50

Source port: 9999       Destination port: 2736
Seq no:      0          Ack no:      147543042    D.O.:        5
Control:     -A-R--     Window:      0            Checksum:    0xbc20
Urgent pointer: 0

Reported error is "Connection Refused"

packet_dump command

Location:
	ftp://magic.stratus.com/tools/packet_dump.pm

 --------------------------------- packet_dump --------------------------------
 packet_trace_file:
 output_path:

	Note that dump includes more data then the display.

	Also data is in ascii even though the display was in hex

successful mount from workstation to m3

Packet number : 1
Time received: 52559910  (delta : 52559910)
Ethernet destination : 0000a8008002
Ethernet source      : 0000c0b25c70
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  84  Id:         1703     Flags:           ---
Fragment Offset: 0 Time to Live:  60
Protocol :   UDP        Header Checksum: 0x12cf
Src: 134.111.44.50    Dest: 134.111.44.19
Source port:   3015 Dest port:   111
Length:        64  Checksum:        0x158e
UDP Data: 0<df>:F<NUL><NUL><NUL><NUL><NUL><NUL><NUL><02><NUL><01><86><a0>
<NUL><NUL><NUL><02><NUL><NUL><NUL><03><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL>
<01><86><a5><NUL><NUL><NUL><01><NUL><NUL>

Packet number : 2
Time received: 52559975  (delta : 65)
Ethernet destination : 0000c0b25c70
Ethernet source      : 0000a8008002
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  56  Id:        53073     Flags:           ---
Fragment Offset: 0 Time to Live:  121
Protocol :   UDP        Header Checksum: 0x0d40
Src: 134.111.44.19    Dest: 134.111.44.50
Source port:   111 Dest port:   3015
Length:        36  Checksum:        0x1498
UDP Data: 0<df>:F<NUL><NUL><NUL><01><NUL><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><0e><8e>

Packet number : 3
Time received: 52559975  (delta : 0)
Ethernet destination : 0000a8008002
Ethernet source      : 0000c0b25c70
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  172  Id:         1704     Flags:           ---
Fragment Offset: 0 Time to Live:  60
Protocol :   UDP        Header Checksum: 0x1276
Src: 134.111.44.50    Dest: 134.111.44.19
Source port:   841 Dest port:   3726
Length:        152  Checksum:        0x99bb
UDP Data: 0<df><98><d6><NUL><NUL><NUL><NUL><NUL><NUL><NUL><02><NUL><01>
<86><a5><NUL><NUL><NUL><01><NUL><NUL><NUL><01><NUL><NUL><NUL>
<01><NUL><NUL><NUL>@/<da>(<d4><NUL><NUL><NUL><0e>paradiseva

Packet number : 4
Time received: 52561275  (delta : 1300)
Ethernet destination : 0000c0b25c70
Ethernet source      : 0000a8008002
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  88  Id:        53074     Flags:           ---
Fragment Offset: 0 Time to Live:  121
Protocol :   UDP        Header Checksum: 0x0d1f
Src: 134.111.44.19    Dest: 134.111.44.50
Source port:   3726 Dest port:   841
Length:        68  Checksum:        0x593f
UDP Data: 0<df><98><d6><NUL><NUL><NUL><01><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL>eu<NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL>

Packet number : 5
Time received: 52561275  (delta : 0)
Ethernet destination : 0000a8008002
Ethernet source      : 0000c0b25c70
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  164  Id:         1705     Flags:           ---
Fragment Offset: 0 Time to Live:  60
Protocol :   UDP        Header Checksum: 0x127d
Src: 134.111.44.50    Dest: 134.111.44.19
Source port:   1023 Dest port:   2049
Length:        144  Checksum:        0x9a20
UDP Data: <98>B<0f><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><02><NUL><01>
<86><a3><NUL><NUL><NUL><02><NUL><NUL><NUL><01><NUL><NUL><NUL>
<01><NUL><NUL><NUL>@/<da>(<d5><NUL><NUL><NUL><0e>paradiseva

Packet number : 6
Time received: 52561275  (delta : 0)
Ethernet destination : 0000c0b25c70
Ethernet source      : 0000a8008002
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  124  Id:        53075     Flags:           ---
Fragment Offset: 0 Time to Live:  121
Protocol :   UDP        Header Checksum: 0x0cfa
Src: 134.111.44.19    Dest: 134.111.44.50
Source port:   2049 Dest port:   1023
Length:        104  Checksum:        0x3777
UDP Data: <98>B<0f><NUL><NUL><NUL><NUL><01><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL><NUL><02><NUL><NUL>A<fd><NUL><NUL><NUL>"
<NUL><NUL><1c><e8><NUL><NUL><03><e5><NUL><NUL>

Packet number : 7
Time received: 52561275  (delta : 0)
Ethernet destination : 0000a8008002
Ethernet source      : 0000c0b25c70
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  164  Id:         1706     Flags:           ---
Fragment Offset: 0 Time to Live:  60
Protocol :   UDP        Header Checksum: 0x127c
Src: 134.111.44.50    Dest: 134.111.44.19
Source port:   1023 Dest port:   2049
Length:        144  Checksum:        0x9910
UDP Data: <99>B<0f><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><02><NUL><01>
<86><a3><NUL><NUL><NUL><02><NUL><NUL><NUL><11><NUL><NUL><NUL>
<01><NUL><NUL><NUL>@/<da>(<d5><NUL><NUL><NUL><0e>paradiseva

Packet number : 8
Time received: 52561340  (delta : 65)
Ethernet destination : 0000c0b25c70
Ethernet source      : 0000a8008002
Ethernet type        : DARPA INTERNET PROTOCOL
Version:       4  IHL:           5      Type of Service: 0---
Total length:  76  Id:        53076     Flags:           ---
Fragment Offset: 0 Time to Live:  121
Protocol :   UDP        Header Checksum: 0x0d29
Src: 134.111.44.19    Dest: 134.111.44.50
Source port:   2049 Dest port:   1023
Length:        56  Checksum:        0x74ff
UDP Data: <99>B<0f><NUL><NUL><NUL><NUL><01><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL><NUL>
<NUL><NUL><NUL><NUL> <NUL><NUL><NUL><04><NUL><NUL>_<83><NUL>
<NUL><ESC><e4><c0><NUL><ESC><e4><c0>