Frame 3226: 1406 bytes on wire (11248 bits), 1406 bytes captured (11248 bits) Encapsulation type: Ethernet (1) Arrival Time: Jul 22, 2017 02:50:08.788546000 UTC UTC Arrival Time: Jul 22, 2017 02:50:08.788546000 UTC Epoch Arrival Time: 1500691808.788546000 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 0.000139000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 394.263197000 seconds] Frame Number: 3226 Frame Length: 1406 bytes (11248 bits) Capture Length: 1406 bytes (11248 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:http:data] Ethernet II, Src: Cisco_01:e9:5c (00:09:e8:01:e9:5c), Dst: Dell_c3:1b:e9 (00:26:b9:c3:1b:e9) Destination: Dell_c3:1b:e9 (00:26:b9:c3:1b:e9) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Cisco_01:e9:5c (00:09:e8:01:e9:5c) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) [Stream index: 3] Internet Protocol Version 4, Src: 204.79.197.200, Dst: 172.16.45.52 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 1392 Identification: 0x4632 (17970) 010. .... = Flags: 0x2, Don't fragment 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set ...0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 122 Protocol: TCP (6) Header Checksum: 0xd95e [validation disabled] [Header checksum status: Unverified] Source Address: 204.79.197.200 Destination Address: 172.16.45.52 [Source GeoIP: US, ASN 8068, MICROSOFT-CORP-MSN-AS-BLOCK] [Source GeoIP Country: United States] [Source or Destination GeoIP Country: United States] [Source GeoIP ISO Two Letter Country Code: US] [Source or Destination GeoIP ISO Two Letter Country Code: US] [Source GeoIP AS Number: 8068] [Source or Destination GeoIP AS Number: 8068] [Source GeoIP AS Organization: MICROSOFT-CORP-MSN-AS-BLOCK] [Source or Destination GeoIP AS Organization: MICROSOFT-CORP-MSN-AS-BLOCK] [Source GeoIP Latitude: 37.751] [Source or Destination GeoIP Latitude: 37.751] [Source GeoIP Longitude: -97.822] [Source or Destination GeoIP Longitude: -97.822] [Stream index: 31] Transmission Control Protocol, Src Port: 80, Dst Port: 49162, Seq: 2705, Ack: 797, Len: 1352 Source Port: 80 Destination Port: 49162 [Stream index: 45] [Stream Packet Number: 8] [Conversation completeness: Incomplete, DATA (15)] ..0. .... = RST: Absent ...0 .... = FIN: Absent .... 1... = Data: Present .... .1.. = ACK: Present .... ..1. = SYN-ACK: Present .... ...1 = SYN: Present [Completeness Flags: ··DASS] [TCP Segment Len: 1352] Sequence Number: 2705 (relative sequence number) Sequence Number (raw): 3117757373 [Next Sequence Number: 4057 (relative sequence number)] Acknowledgment Number: 797 (relative ack number) Acknowledgment number (raw): 3447442953 0101 .... = Header Length: 20 bytes (5) Flags: 0x010 (ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Accurate ECN: Not set .... 0... .... = Congestion Window Reduced: Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 0... = Push: Not set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······A····] Window: 1024 [Calculated window size: 262144] [Window size scaling factor: 256] Checksum: 0x3094 [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 [Timestamps] [Time since first frame in this TCP stream: 2.628105000 seconds] [Time since previous frame in this TCP stream: 0.000196000 seconds] [SEQ/ACK analysis] [iRTT: 0.065448000 seconds] [Bytes in flight: 4056] [Bytes sent since last PSH flag: 4056] TCP payload (1352 bytes) Hypertext Transfer Protocol File Data: 1352 bytes Data (1352 bytes) 0000 15 fc c8 67 d3 e2 9c 7f c4 ce ca 2b a8 81 c3 47 ...g.......+...G 0010 3c 41 f3 f9 8a c5 bb f8 75 e1 0d 67 7b 5b 58 3d K3e....Os. 0220 c1 fe 7f 8d 6e e9 be 3c f0 f5 fd c2 45 1e ad 2d ....n..<....E..- 0230 ab cf 22 aa 5b dc da b2 f2 48 00 06 5c 8c e4 f5 ..".[....H..\... 0240 cd 79 21 11 b7 76 5f af 35 a1 e1 ab 28 ae bc 5b .y!..v_.5...(..[ 0250 a7 25 c3 13 0c 72 f9 d2 34 5c b0 08 09 07 1f ef .%...r..4\...... 0260 6d ae 1a d8 0a 51 83 92 ba 3a e8 e3 6a ca 4a 2f m....Q...:..j.J/ 0270 53 dc 2e ac 59 64 66 67 2e 30 00 18 03 6f d0 8a S...Ydfg.0...o.. 0280 ce 90 49 11 c4 a0 9f 46 f5 a7 88 25 45 69 60 d7 ..I....F...%Ei`. 0290 19 d4 a7 0d 80 cb f9 1e 6a 79 83 ae 9f ba 73 10 ........jy....s. 02a0 99 c8 5d ca df ba 27 b6 7d 33 eb 5e 34 5d ba 9e ..]...'.}3.^4].. 02b0 bb 57 33 dd 52 5f f5 88 ae 07 4c 8a 29 f3 4b 0c .W3.R_....L.).K. 02c0 32 34 77 16 77 16 ee a7 19 56 de ad f4 f4 a2 b7 24w.w....V...... 02d0 4d db 43 16 91 9f 77 e2 55 d3 df ec d7 51 3c 97 M.C...w.U....Q<. 02e0 3b 73 92 36 a0 27 ee 83 cf eb 4b 3c c2 64 13 40 ;s.6.'....K<.d.@ 02f0 91 b3 a8 dc 41 e8 7d b3 de a9 f8 8e 34 7d 3a 79 ....A.}.....4}:y 0300 1d 43 3b 49 b0 b1 e4 e0 74 15 6b 62 ad 9a ed 50 .C;I....t.kb...P 0310 3e 5c f0 3d ab cd 51 82 8c 65 15 a9 db 79 39 34 >\.=..Q..e...y94 0320 ca 21 1e e5 cd a1 53 24 a4 96 32 1e 9d 78 1e 9d .!....S$..2..x.. 0330 e9 b7 da 6b 68 e8 b7 37 91 28 31 fc c8 8a 33 e6 ...kh..7.(1...3. 0340 01 d7 91 d3 f1 ab 16 b3 c9 e7 3f cd d1 88 1c 74 ..........?....t 0350 e2 ae ff 00 c7 cd 9b b4 ff 00 39 1c 8c d6 fc ed ..........9..... 0360 3f 23 3e 54 d1 81 16 97 3d dd c6 24 9e 38 63 64 ?#>T....=..$.8cd 0370 f3 88 8c 6f c0 ce 40 c6 45 43 65 a8 be 9d a8 dd ...o..@.ECe..... 0380 5c 48 8f 73 6e a3 09 b8 b4 04 8c e0 38 07 9f c0 \H.sn.......8... 0390 67 de b5 6e 25 7b 8b 5f df 91 21 66 e4 b0 04 9f g..n%{._..!f.... 03a0 c7 ad 53 f1 40 dd a1 59 2b 7c c1 14 63 3c 9e 9e ..S.@..Y+|..c<.. 03b0 b5 d3 09 f3 3e 59 75 33 94 79 55 d7 41 6d 35 09 ....>Yu3.yU.Am5. 03c0 35 5b 4b bb b3 36 c9 a2 7d c1 65 39 56 4d bd 41 5[K..6..}.e9VM.A 03d0 c7 51 8c 7b e6 a0 93 5c fb 5d 84 b6 37 8a 65 b6 .Q.{...\.]..7.e. 03e0 9a 32 8f 19 18 c8 23 d4 77 ac 6d 24 90 db 01 3b .2....#.w.m$...; 03f0 73 d3 3c 55 ab d8 91 63 62 ab 82 08 ad 65 4a 3c s.