Frame 38: Packet, 1514 bytes on wire (12112 bits), 1514 bytes captured (12112 bits) on interface unknown, id 0 Section number: 1 Interface id: 0 (unknown) Interface name: unknown Encapsulation type: Ethernet (1) Arrival Time: Apr 21, 2015 00:41:56.004724000 UTC UTC Arrival Time: Apr 21, 2015 00:41:56.004724000 UTC Epoch Arrival Time: 1429576916.004724000 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 2.537000 milliseconds] [Time since reference or first frame: 3.008117000 seconds] Frame Number: 38 Frame Length: 1514 bytes (12112 bits) Capture Length: 1514 bytes (12112 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:http:data] Character encoding: ASCII (0) Ethernet II, Src: VMware_8d:0a:0c (00:0c:29:8d:0a:0c), Dst: VMware_8c:8b:4a (00:0c:29:8c:8b:4a) Destination: VMware_8c:8b:4a (00:0c:29:8c:8b:4a) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: VMware_8d:0a:0c (00:0c:29:8d:0a:0c) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) [Stream index: 0] Internet Protocol Version 4, Src: 178.62.126.102, Dst: 10.0.1.4 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 1500 Identification: 0x8f09 (36617) 010. .... = Flags: 0x2, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set ...0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 51 Protocol: TCP (6) Header Checksum: 0x776a [validation disabled] [Header checksum status: Unverified] Source Address: 178.62.126.102 Destination Address: 10.0.1.4 [Source GeoIP: London, GB] [Source GeoIP City: London] [Source or Destination GeoIP City: London] [Source GeoIP Country: United Kingdom] [Source or Destination GeoIP Country: United Kingdom] [Source GeoIP ISO Two Letter Country Code: GB] [Source or Destination GeoIP ISO Two Letter Country Code: GB] [Source GeoIP Latitude: 51.5353] [Source or Destination GeoIP Latitude: 51.5353] [Source GeoIP Longitude: -0.6658] [Source or Destination GeoIP Longitude: -0.6658] [Stream index: 3] Transmission Control Protocol, Src Port: 80, Dst Port: 59700, Seq: 1, Ack: 420, Len: 1448 Source Port: 80 Destination Port: 59700 [Stream index: 3] [Stream Packet Number: 6] [Conversation completeness: Incomplete, DATA (15)] ..0. .... = RST: Absent ...0 .... = FIN: Absent .... 1... = Data: Present .... .1.. = ACK: Present .... ..1. = SYN-ACK: Present .... ...1 = SYN: Present [Completeness Flags: ··DASS] [TCP Segment Len: 1448] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 3473186903 [Next Sequence Number: 1449 (relative sequence number)] Acknowledgment Number: 420 (relative ack number) Acknowledgment number (raw): 2263567294 1000 .... = Header Length: 32 bytes (8) Flags: 0x010 (ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Accurate ECN: Not set .... 0... .... = Congestion Window Reduced: Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 0... = Push: Not set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······A····] Window: 235 [Calculated window size: 30080] [Window size scaling factor: 128] Checksum: 0x50db [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - No-Operation (NOP) Kind: No-Operation (1) TCP Option - Timestamps: TSval 1787375455, TSecr 10806043 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 1787375455 Timestamp echo reply: 10806043 [Timestamps] [Time since first frame in this TCP stream: 42.974000 milliseconds] [Time since previous frame in this TCP stream: 2.537000 milliseconds] [SEQ/ACK analysis] [iRTT: 20.332000 milliseconds] [Bytes in flight: 1448] [Bytes sent since last PSH flag: 1448] [Client Contiguous Streams: 1] [Server Contiguous Streams: 1] TCP payload (1448 bytes) Hypertext Transfer Protocol HTTP/1.1 200 OK\r\n Response Version: HTTP/1.1 Status Code: 200 [Status Code Description: OK] Response Phrase: OK Server: nginx/1.6.2 (Ubuntu)\r\n Date: Tue, 21 Apr 2015 00:41:55 GMT\r\n Content-Type: application/octet-stream\r\n Content-Length: 1182190\r\n [Content length: 1182190] Last-Modified: Sat, 17 Jan 2015 19:08:18 GMT\r\n Connection: keep-alive\r\n ETag: "54bab322-1209ee"\r\n Accept-Ranges: bytes\r\n \r\n [Request in frame: 36] [Time since request: 22.152000 milliseconds] [Request URI: /a/7z938.exe] [Full request URI: http://d.7-zip.org/a/7z938.exe] File Data: 1180 bytes Data (1180 bytes) 0000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ.............. 0010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@....... 0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0030 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 ................ 0040 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 ........!..L.!Th 0050 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f is program canno 0060 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 t be run in DOS 0070 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 mode....$....... 0080 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 1..:u..iu..iu..i 0090 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 ...iw..iu..i...i 00a0 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 ...id..i!..i...i 00b0 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 ...it..iRichu..i 00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00d0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ........PE..L... 00e0 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 ...K............ 00f0 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 .....\.......... 0100 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 <2.......p....@. 0110 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 ................ 0120 04 00 00 00 00 00 00 00 00 20 03 00 00 04 00 00 ......... ...... 0130 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 ................ 0140 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ................ 0150 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 .........s...... 0160 00 d0 02 00 18 41 00 00 00 00 00 00 00 00 00 00 .....A.......... 0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01b0 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 .p.............. 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 .text...ZZ...... 01e0 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 .\.............. 01f0 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 .... ..`.rdata.. 0200 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 .....p.......`.. 0210 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 ............@..@ 0220 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 .data........... 0230 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 .....r.......... 0240 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 ....@....ndata.. 0250 00 90 00 00 00 40 02 00 00 00 00 00 00 00 00 00 .....@.......... 0260 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 ................ 0270 2e 72 73 72 63 00 00 00 18 41 00 00 00 d0 02 00 .rsrc....A...... 0280 00 42 00 00 00 76 00 00 00 00 00 00 00 00 00 00 .B...v.......... 0290 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 ....@..@........ 02a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 03a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 03b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 03c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 03d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 03e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 03f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0400 55 8b ec 83 ec 5c 83 7d 0c 0f 74 2b 83 7d 0c 46 U....\.}..t+.}.F 0410 8b 45 14 75 0d 83 48 18 10 8b 0d a8 3e 42 00 89 .E.u..H.....>B.. 0420 48 04 50 ff 75 10 ff 75 0c ff 75 08 ff 15 48 72 H.P.u..u..u...Hr 0430 40 00 e9 42 01 00 00 53 56 8b 35 b0 3e 42 00 8d @..B...SV.5.>B.. 0440 45 a4 57 50 ff 75 08 ff 15 4c 72 40 00 83 65 f4 E.WP.u...Lr@..e. 0450 00 89 45 0c 8d 45 e4 50 ff 75 08 ff 15 50 72 40 ..E..E.P.u...Pr@ 0460 00 8b 7d f0 83 65 f0 00 8b 1d 44 70 40 00 e9 80 ..}..e....Dp@... 0470 00 00 00 0f b6 46 52 0f b6 56 56 0f af 55 e8 8b .....FR..VV..U.. 0480 cf 2b 4d e8 0f af c1 03 c2 89 4d 10 99 f7 ff 33 .+M.......M....3 0490 d2 8a f0 0f b6 46 51 0f af c1 0f b6 .....FQ..... Data […]: 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000d80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6 [Length: 1180]