Frame 1931: 126 bytes on wire (1008 bits), 126 bytes captured (1008 bits)
    Encapsulation type: Ethernet (1)
    Arrival Time: Mar 19, 2019 02:00:06.746488000 UTC
    UTC Arrival Time: Mar 19, 2019 02:00:06.746488000 UTC
    Epoch Arrival Time: 1552960806.746488000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 0.000277000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 911.109722000 seconds]
    Frame Number: 1931
    Frame Length: 126 bytes (1008 bits)
    Capture Length: 126 bytes (1008 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp:nbss:smb2]
Ethernet II, Src: Dell_c2:09:6a (a4:1f:72:c2:09:6a), Dst: Intel_57:2b:42 (64:32:a8:57:2b:42)
    Destination: Intel_57:2b:42 (64:32:a8:57:2b:42)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Dell_c2:09:6a (a4:1f:72:c2:09:6a)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
    [Stream index: 1]
Internet Protocol Version 4, Src: 10.0.90.9, Dst: 10.0.90.215
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 112
    Identification: 0x2a8c (10892)
    010. .... = Flags: 0x2, Don't fragment
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 128
    Protocol: TCP (6)
    Header Checksum: 0x936c [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 10.0.90.9
    Destination Address: 10.0.90.215
    [Stream index: 1]
Transmission Control Protocol, Src Port: 445, Dst Port: 49207, Seq: 1147, Ack: 3988, Len: 72
    Source Port: 445
    Destination Port: 49207
    [Stream index: 51]
    [Stream Packet Number: 21]
    [Conversation completeness: Incomplete, DATA (15)]
        ..0. .... = RST: Absent
        ...0 .... = FIN: Absent
        .... 1... = Data: Present
        .... .1.. = ACK: Present
        .... ..1. = SYN-ACK: Present
        .... ...1 = SYN: Present
        [Completeness Flags: ··DASS]
    [TCP Segment Len: 72]
    Sequence Number: 1147    (relative sequence number)
    Sequence Number (raw): 3674722174
    [Next Sequence Number: 1219    (relative sequence number)]
    Acknowledgment Number: 3988    (relative ack number)
    Acknowledgment number (raw): 908161086
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x018 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Accurate ECN: Not set
        .... 0... .... = Congestion Window Reduced: Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ·······AP···]
    Window: 253
    [Calculated window size: 64768]
    [Window size scaling factor: 256]
    Checksum: 0xbc97 [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    [Timestamps]
        [Time since first frame in this TCP stream: 10.491557000 seconds]
        [Time since previous frame in this TCP stream: 0.000277000 seconds]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 1930]
        [The RTT to ACK the segment was: 0.000277000 seconds]
        [iRTT: 0.000529000 seconds]
        [Bytes in flight: 72]
        [Bytes sent since last PSH flag: 72]
    TCP payload (72 bytes)
NetBIOS Session Service
    Message Type: Session message (0x00)
    Length: 68
SMB2 (Server Message Block Protocol version 2)
    SMB2 Header
        ProtocolId: 0xfe534d42
        Header Length: 64
        Credit Charge: 1
        NT Status: STATUS_SUCCESS (0x00000000)
        Command: Session Logoff (2)
        Credits granted: 1
        Flags: 0x00000009, Response, Signing
            .... .... .... .... .... .... .... ...1 = Response: This is a RESPONSE
            .... .... .... .... .... .... .... ..0. = Async command: This is a SYNC command
            .... .... .... .... .... .... .... .0.. = Chained: This pdu is NOT a chained command
            .... .... .... .... .... .... .... 1... = Signing: This pdu is SIGNED
            .... .... .... .... .... .... .000 .... = Priority: This pdu does NOT contain a PRIORITY
            ...0 .... .... .... .... .... .... .... = DFS operation: This is a normal operation
            ..0. .... .... .... .... .... .... .... = Replay operation: This is NOT a replay operation
        Chain Offset: 0x00000000
        Message ID: 6
        Reserved: 0x0000feff
        Tree Id: 0x00000000
        Session Id: 0x0000040008000039
            [Authenticated in Frame: 1916]
        Signature: 7e9fbc71d974078101d4b1d878777e74
        [Response to: 1930]
        [Time from request: 0.000277000 seconds]
    Session Logoff Response (0x02)
        StructureSize: 0x0004
            0000 0000 0000 010. = Fixed Part Length: 2
            .... .... .... ...0 = Dynamic Part: False
        Reserved: 0000