head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC6:1.1.1.2 netbsd-11-0-RC5:1.1.1.2 netbsd-11-0-RC4:1.1.1.2 netbsd-11-0-RC3:1.1.1.2 tcpdump-4-99-6:1.1.1.2 netbsd-11-0-RC2:1.1.1.2 netbsd-11-0-RC1:1.1.1.2 perseant-exfatfs-base-20250801:1.1.1.2 netbsd-11:1.1.1.2.0.2 netbsd-11-base:1.1.1.2 tcpdump-4-99-5:1.1.1.2 perseant-exfatfs-base-20240630:1.1.1.1 perseant-exfatfs:1.1.1.1.0.2 perseant-exfatfs-base:1.1.1.1 tcpdump-4-99-4:1.1.1.1 TCPDUMP:1.1.1; locks; strict; comment @# @; 1.1 date 2023.08.17.15.57.16; author christos; state Exp; branches 1.1.1.1; next ; commitid 6SL2uKbgSix3J9BE; 1.1.1.1 date 2023.08.17.15.57.16; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; commitid 6SL2uKbgSix3J9BE; 1.1.1.2 date 2024.09.02.15.50.14; author christos; state Exp; branches; next ; commitid E0666bfLa9iupfoF; 1.1.1.1.2.1 date 2025.08.02.05.23.30; author perseant; state Exp; branches; next ; commitid 23j6GFaDws3O875G; desc @@ 1.1 log @Initial revision @ text @ 1 17:16:39.743518 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.2.1 tell 1.0.2.2, length 28 2 17:16:39.743599 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.2.1 is-at e2:c3:b4:8e:87:60, length 28 3 17:16:39.743662 IP (tos 0xc0, ttl 1, id 7400, offset 0, flags [DF], proto TCP (6), length 60) 1.0.2.2.42741 > 1.0.2.1.179: Flags [S], cksum 0x9871 (correct), seq 2331667506, win 29200, options [mss 1460,sackOK,TS val 667578586 ecr 0,nop,wscale 9], length 0 4 17:16:39.743720 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) 1.0.2.1.179 > 1.0.2.2.42741: Flags [S.], cksum 0xee84 (correct), seq 3603708762, ack 2331667507, win 28960, options [mss 1460,sackOK,TS val 667578586 ecr 667578586,nop,wscale 9], length 0 5 17:16:39.743766 IP (tos 0xc0, ttl 1, id 7401, offset 0, flags [DF], proto TCP (6), length 52) 1.0.2.2.42741 > 1.0.2.1.179: Flags [.], cksum 0x8e39 (correct), ack 1, win 58, options [nop,nop,TS val 667578586 ecr 667578586], length 0 6 17:16:39.744246 IP (tos 0xc0, ttl 1, id 7402, offset 0, flags [DF], proto TCP (6), length 107) 1.0.2.2.42741 > 1.0.2.1.179: Flags [P.], cksum 0xa6d1 (correct), seq 1:56, ack 1, win 58, options [nop,nop,TS val 667578586 ecr 667578586], length 55: BGP Open Message (1), length: 55 Version 4, my AS 23456, Holdtime 180s, ID 0.0.1.1 Optional parameters, length: 26 Option Capabilities Advertisement (2), length: 24 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) Route Refresh (2), length: 0 Graceful Restart (64), length: 2 Restart Flags: [R], Restart Time 300s 32-Bit AS Number (65), length: 4 4 Byte AS 2764334674 Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 7 17:16:39.744347 IP (tos 0xc0, ttl 255, id 19329, offset 0, flags [DF], proto TCP (6), length 52) 1.0.2.1.179 > 1.0.2.2.42741: Flags [.], cksum 0x8e03 (correct), ack 56, win 57, options [nop,nop,TS val 667578586 ecr 667578586], length 0 8 17:16:39.744506 IP (tos 0xc0, ttl 1, id 19330, offset 0, flags [DF], proto TCP (6), length 95) 1.0.2.1.179 > 1.0.2.2.42741: Flags [P.], cksum 0x62db (correct), seq 1:44, ack 56, win 57, options [nop,nop,TS val 667578586 ecr 667578586], length 43: BGP Open Message (1), length: 43 Version 4, my AS 200, Holdtime 180s, ID 0.0.2.1 Optional parameters, length: 14 Option Capabilities Advertisement (2), length: 12 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 9 17:16:39.744560 IP (tos 0xc0, ttl 1, id 7403, offset 0, flags [DF], proto TCP (6), length 52) 1.0.2.2.42741 > 1.0.2.1.179: Flags [.], cksum 0x8dd7 (correct), ack 44, win 58, options [nop,nop,TS val 667578586 ecr 667578586], length 0 10 17:16:39.744600 IP (tos 0xc0, ttl 1, id 19331, offset 0, flags [DF], proto TCP (6), length 71) 1.0.2.1.179 > 1.0.2.2.42741: Flags [P.], cksum 0x89aa (correct), seq 44:63, ack 56, win 57, options [nop,nop,TS val 667578586 ecr 667578586], length 19: BGP Keepalive Message (4), length: 19 11 17:16:39.744633 IP (tos 0xc0, ttl 1, id 7404, offset 0, flags [DF], proto TCP (6), length 52) 1.0.2.2.42741 > 1.0.2.1.179: Flags [.], cksum 0x8dc4 (correct), ack 63, win 58, options [nop,nop,TS val 667578586 ecr 667578586], length 0 12 17:16:39.744742 IP (tos 0xc0, ttl 1, id 7405, offset 0, flags [DF], proto TCP (6), length 71) 1.0.2.2.42741 > 1.0.2.1.179: Flags [P.], cksum 0x8996 (correct), seq 56:75, ack 63, win 58, options [nop,nop,TS val 667578586 ecr 667578586], length 19: BGP Keepalive Message (4), length: 19 13 17:16:39.745302 IP (tos 0xc0, ttl 1, id 19332, offset 0, flags [DF], proto TCP (6), length 147) 1.0.2.1.179 > 1.0.2.2.42741: Flags [P.], cksum 0xef2d (correct), seq 63:158, ack 75, win 57, options [nop,nop,TS val 667578586 ecr 667578586], length 95: BGP Update Message (2), length: 95 Origin (1), length: 1, Flags [T]: Incomplete AS Path (2), length: 12, Flags [T]: 200 1 23456 23456 23456 Next Hop (3), length: 4, Flags [T]: 1.0.2.1 AS4 Path (17), length: 18, Flags [OTP]: 1 222222 333333 4294967290 Updated routes: 4.4.4.4/32 5.5.5.5/32 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 14 17:16:39.747791 IP (tos 0xc0, ttl 1, id 7406, offset 0, flags [DF], proto TCP (6), length 71) 1.0.2.2.42741 > 1.0.2.1.179: Flags [P.], cksum 0x8923 (correct), seq 75:94, ack 158, win 58, options [nop,nop,TS val 667578587 ecr 667578586], length 19: BGP Keepalive Message (4), length: 19 15 17:16:39.747859 IP (tos 0xc0, ttl 1, id 19333, offset 0, flags [DF], proto TCP (6), length 71) 1.0.2.1.179 > 1.0.2.2.42741: Flags [P.], cksum 0x8910 (correct), seq 158:177, ack 94, win 57, options [nop,nop,TS val 667578587 ecr 667578587], length 19: BGP Keepalive Message (4), length: 19 16 17:16:39.789886 IP (tos 0xc0, ttl 1, id 7407, offset 0, flags [DF], proto TCP (6), length 52) 1.0.2.2.42741 > 1.0.2.1.179: Flags [.], cksum 0x8d1f (correct), ack 177, win 58, options [nop,nop,TS val 667578598 ecr 667578587], length 0 17 17:16:39.973548 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.3.1 tell 1.0.3.2, length 28 18 17:16:39.973652 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.3.1 is-at 02:01:00:01:00:00, length 28 19 17:16:39.973684 IP (tos 0xc0, ttl 1, id 15676, offset 0, flags [DF], proto TCP (6), length 60) 1.0.3.2.43415 > 1.0.3.1.179: Flags [S], cksum 0x3fa6 (correct), seq 4276964399, win 29200, options [mss 1460,sackOK,TS val 667578643 ecr 0,nop,wscale 9], length 0 20 17:16:39.973736 IP (tos 0xc0, ttl 64, id 38566, offset 0, flags [DF], proto TCP (6), length 40) 1.0.3.1.179 > 1.0.3.2.43415: Flags [R.], cksum 0xb265 (correct), seq 0, ack 4276964400, win 0, length 0 21 17:16:40.228227 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.4.1 tell 1.0.4.2, length 28 22 17:16:40.228290 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.4.1 is-at 02:01:00:01:00:00, length 28 23 17:16:40.228315 IP (tos 0xc0, ttl 1, id 62340, offset 0, flags [DF], proto TCP (6), length 60) 1.0.4.2.34995 > 1.0.4.1.179: Flags [S], cksum 0x12b9 (correct), seq 332890839, win 29200, options [mss 1460,sackOK,TS val 667578707 ecr 0,nop,wscale 9], length 0 24 17:16:40.228362 IP (tos 0xc0, ttl 64, id 37983, offset 0, flags [DF], proto TCP (6), length 40) 1.0.4.1.179 > 1.0.4.2.34995: Flags [R.], cksum 0x85b8 (correct), seq 0, ack 332890840, win 0, length 0 25 17:16:41.765508 IP (tos 0xc0, ttl 1, id 31524, offset 0, flags [DF], proto TCP (6), length 60) 1.0.3.1.35169 > 1.0.3.2.179: Flags [S], cksum 0xad42 (correct), seq 4060023287, win 29200, options [mss 1460,sackOK,TS val 667579091 ecr 0,nop,wscale 9], length 0 26 17:16:41.765624 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) 1.0.3.2.179 > 1.0.3.1.35169: Flags [S.], cksum 0x6880 (correct), seq 1839152484, ack 4060023288, win 28960, options [mss 1460,sackOK,TS val 667579091 ecr 667579091,nop,wscale 9], length 0 27 17:16:41.765672 IP (tos 0xc0, ttl 1, id 31525, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.1.35169 > 1.0.3.2.179: Flags [.], cksum 0x0835 (correct), ack 1, win 58, options [nop,nop,TS val 667579091 ecr 667579091], length 0 28 17:16:41.765953 IP (tos 0xc0, ttl 1, id 31526, offset 0, flags [DF], proto TCP (6), length 107) 1.0.3.1.35169 > 1.0.3.2.179: Flags [P.], cksum 0x20cc (correct), seq 1:56, ack 1, win 58, options [nop,nop,TS val 667579092 ecr 667579091], length 55: BGP Open Message (1), length: 55 Version 4, my AS 23456, Holdtime 180s, ID 0.0.1.1 Optional parameters, length: 26 Option Capabilities Advertisement (2), length: 24 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) Route Refresh (2), length: 0 Graceful Restart (64), length: 2 Restart Flags: [R], Restart Time 300s 32-Bit AS Number (65), length: 4 4 Byte AS 2764334674 Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 29 17:16:41.766003 IP (tos 0xc0, ttl 255, id 20406, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.2.179 > 1.0.3.1.35169: Flags [.], cksum 0x07fd (correct), ack 56, win 57, options [nop,nop,TS val 667579092 ecr 667579092], length 0 30 17:16:41.766223 IP (tos 0xc0, ttl 1, id 20407, offset 0, flags [DF], proto TCP (6), length 101) 1.0.3.2.179 > 1.0.3.1.35169: Flags [P.], cksum 0x9f22 (correct), seq 1:50, ack 56, win 57, options [nop,nop,TS val 667579092 ecr 667579092], length 49: BGP Open Message (1), length: 49 Version 4, my AS 300, Holdtime 180s, ID 0.0.3.1 Optional parameters, length: 20 Option Capabilities Advertisement (2), length: 18 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) 32-Bit AS Number (65), length: 4 4 Byte AS 300 Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 31 17:16:41.766257 IP (tos 0xc0, ttl 1, id 31527, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.1.35169 > 1.0.3.2.179: Flags [.], cksum 0x07cb (correct), ack 50, win 58, options [nop,nop,TS val 667579092 ecr 667579092], length 0 32 17:16:41.766325 IP (tos 0xc0, ttl 1, id 20408, offset 0, flags [DF], proto TCP (6), length 71) 1.0.3.2.179 > 1.0.3.1.35169: Flags [P.], cksum 0x039e (correct), seq 50:69, ack 56, win 57, options [nop,nop,TS val 667579092 ecr 667579092], length 19: BGP Keepalive Message (4), length: 19 33 17:16:41.766382 IP (tos 0xc0, ttl 1, id 31528, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.1.35169 > 1.0.3.2.179: Flags [.], cksum 0x07b8 (correct), ack 69, win 58, options [nop,nop,TS val 667579092 ecr 667579092], length 0 34 17:16:41.766407 IP (tos 0xc0, ttl 1, id 31529, offset 0, flags [DF], proto TCP (6), length 71) 1.0.3.1.35169 > 1.0.3.2.179: Flags [P.], cksum 0x038a (correct), seq 56:75, ack 69, win 58, options [nop,nop,TS val 667579092 ecr 667579092], length 19: BGP Keepalive Message (4), length: 19 35 17:16:41.767217 IP (tos 0xc0, ttl 1, id 20409, offset 0, flags [DF], proto TCP (6), length 71) 1.0.3.2.179 > 1.0.3.1.35169: Flags [P.], cksum 0x0378 (correct), seq 69:88, ack 75, win 57, options [nop,nop,TS val 667579092 ecr 667579092], length 19: BGP Keepalive Message (4), length: 19 36 17:16:41.809917 IP (tos 0xc0, ttl 1, id 31530, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.1.35169 > 1.0.3.2.179: Flags [.], cksum 0x0787 (correct), ack 88, win 58, options [nop,nop,TS val 667579103 ecr 667579092], length 0 37 17:16:41.910018 IP (tos 0xc0, ttl 1, id 31531, offset 0, flags [DF], proto TCP (6), length 140) 1.0.3.1.35169 > 1.0.3.2.179: Flags [P.], cksum 0xab88 (correct), seq 75:163, ack 88, win 58, options [nop,nop,TS val 667579128 ecr 667579092], length 88: BGP Update Message (2), length: 88 Origin (1), length: 1, Flags [T]: Incomplete AS Path (2), length: 26, Flags [T]: 2764334674 200 1 222222 333333 4294967290 Next Hop (3), length: 4, Flags [T]: 1.0.3.1 Updated routes: 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 4.4.4.4/32 5.5.5.5/32 38 17:16:41.953948 IP (tos 0xc0, ttl 1, id 20410, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.2.179 > 1.0.3.1.35169: Flags [.], cksum 0x06e8 (correct), ack 163, win 57, options [nop,nop,TS val 667579139 ecr 667579128], length 0 39 17:16:41.953985 IP (tos 0xc0, ttl 1, id 31532, offset 0, flags [DF], proto TCP (6), length 71) 1.0.3.1.35169 > 1.0.3.2.179: Flags [P.], cksum 0x02ae (correct), seq 163:182, ack 88, win 58, options [nop,nop,TS val 667579139 ecr 667579139], length 19: BGP Keepalive Message (4), length: 19 40 17:16:41.954030 IP (tos 0xc0, ttl 1, id 20411, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.2.179 > 1.0.3.1.35169: Flags [.], cksum 0x06ca (correct), ack 182, win 57, options [nop,nop,TS val 667579139 ecr 667579139], length 0 41 17:16:44.004905 IP (tos 0xc0, ttl 1, id 32529, offset 0, flags [DF], proto TCP (6), length 60) 1.0.4.1.34883 > 1.0.4.2.179: Flags [S], cksum 0xa4b7 (correct), seq 4150069778, win 29200, options [mss 1460,sackOK,TS val 667579651 ecr 0,nop,wscale 9], length 0 42 17:16:44.005000 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) 1.0.4.2.179 > 1.0.4.1.34883: Flags [S.], cksum 0xfbe8 (correct), seq 328595786, ack 4150069779, win 28960, options [mss 1460,sackOK,TS val 667579651 ecr 667579651,nop,wscale 9], length 0 43 17:16:44.005041 IP (tos 0xc0, ttl 1, id 32530, offset 0, flags [DF], proto TCP (6), length 52) 1.0.4.1.34883 > 1.0.4.2.179: Flags [.], cksum 0x9b9d (correct), ack 1, win 58, options [nop,nop,TS val 667579651 ecr 667579651], length 0 44 17:16:44.005158 IP (tos 0xc0, ttl 1, id 32531, offset 0, flags [DF], proto TCP (6), length 107) 1.0.4.1.34883 > 1.0.4.2.179: Flags [P.], cksum 0xb435 (correct), seq 1:56, ack 1, win 58, options [nop,nop,TS val 667579651 ecr 667579651], length 55: BGP Open Message (1), length: 55 Version 4, my AS 23456, Holdtime 180s, ID 0.0.1.1 Optional parameters, length: 26 Option Capabilities Advertisement (2), length: 24 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) Route Refresh (2), length: 0 Graceful Restart (64), length: 2 Restart Flags: [R], Restart Time 300s 32-Bit AS Number (65), length: 4 4 Byte AS 2764334674 Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 45 17:16:44.005201 IP (tos 0xc0, ttl 255, id 35912, offset 0, flags [DF], proto TCP (6), length 52) 1.0.4.2.179 > 1.0.4.1.34883: Flags [.], cksum 0x9b67 (correct), ack 56, win 57, options [nop,nop,TS val 667579651 ecr 667579651], length 0 46 17:16:44.005349 IP (tos 0xc0, ttl 1, id 35913, offset 0, flags [DF], proto TCP (6), length 95) 1.0.4.2.179 > 1.0.4.1.34883: Flags [P.], cksum 0x6d77 (correct), seq 1:44, ack 56, win 57, options [nop,nop,TS val 667579651 ecr 667579651], length 43: BGP Open Message (1), length: 43 Version 4, my AS 400, Holdtime 180s, ID 0.0.4.1 Optional parameters, length: 14 Option Capabilities Advertisement (2), length: 12 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 47 17:16:44.005380 IP (tos 0xc0, ttl 1, id 32532, offset 0, flags [DF], proto TCP (6), length 52) 1.0.4.1.34883 > 1.0.4.2.179: Flags [.], cksum 0x9b3b (correct), ack 44, win 58, options [nop,nop,TS val 667579651 ecr 667579651], length 0 48 17:16:44.005420 IP (tos 0xc0, ttl 1, id 35914, offset 0, flags [DF], proto TCP (6), length 71) 1.0.4.2.179 > 1.0.4.1.34883: Flags [P.], cksum 0x970e (correct), seq 44:63, ack 56, win 57, options [nop,nop,TS val 667579651 ecr 667579651], length 19: BGP Keepalive Message (4), length: 19 49 17:16:44.005454 IP (tos 0xc0, ttl 1, id 32533, offset 0, flags [DF], proto TCP (6), length 52) 1.0.4.1.34883 > 1.0.4.2.179: Flags [.], cksum 0x9b28 (correct), ack 63, win 58, options [nop,nop,TS val 667579651 ecr 667579651], length 0 50 17:16:44.005544 IP (tos 0xc0, ttl 1, id 32534, offset 0, flags [DF], proto TCP (6), length 71) 1.0.4.1.34883 > 1.0.4.2.179: Flags [P.], cksum 0x96fa (correct), seq 56:75, ack 63, win 58, options [nop,nop,TS val 667579651 ecr 667579651], length 19: BGP Keepalive Message (4), length: 19 51 17:16:44.006416 IP (tos 0xc0, ttl 1, id 35915, offset 0, flags [DF], proto TCP (6), length 71) 1.0.4.2.179 > 1.0.4.1.34883: Flags [P.], cksum 0x96e7 (correct), seq 63:82, ack 75, win 57, options [nop,nop,TS val 667579652 ecr 667579651], length 19: BGP Keepalive Message (4), length: 19 52 17:16:44.006470 IP (tos 0xc0, ttl 1, id 32535, offset 0, flags [DF], proto TCP (6), length 176) 1.0.4.1.34883 > 1.0.4.2.179: Flags [P.], cksum 0x77e2 (correct), seq 75:199, ack 82, win 58, options [nop,nop,TS val 667579652 ecr 667579652], length 124: BGP Update Message (2), length: 105 Origin (1), length: 1, Flags [T]: Incomplete AS Path (2), length: 14, Flags [T]: 23456 200 1 23456 23456 23456 Next Hop (3), length: 4, Flags [T]: 1.0.4.1 AS4 Path (17), length: 26, Flags [OT]: 2764334674 200 1 222222 333333 4294967290 Updated routes: 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 4.4.4.4/32 5.5.5.5/32 Keepalive Message (4), length: 19 53 17:16:44.049939 IP (tos 0xc0, ttl 1, id 35916, offset 0, flags [DF], proto TCP (6), length 52) 1.0.4.2.179 > 1.0.4.1.34883: Flags [.], cksum 0x9a7a (correct), ack 199, win 57, options [nop,nop,TS val 667579663 ecr 667579652], length 0 54 17:16:44.757924 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.2.2 tell 1.0.2.1, length 28 55 17:16:44.757956 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.2.2 is-at 02:01:00:01:00:00, length 28 56 17:16:48.787086 IP (tos 0xc0, ttl 1, id 19334, offset 0, flags [DF], proto TCP (6), length 100) 1.0.2.1.179 > 1.0.2.2.42741: Flags [P.], cksum 0x0a66 (correct), seq 177:225, ack 94, win 57, options [nop,nop,TS val 667580847 ecr 667578598], length 48: BGP Update Message (2), length: 48 Withdrawn routes: 5.5.5.5/32 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 4.4.4.4/32 End-of-Rib Marker (empty NLRI) 57 17:16:48.787130 IP (tos 0xc0, ttl 1, id 7408, offset 0, flags [DF], proto TCP (6), length 52) 1.0.2.2.42741 > 1.0.2.1.179: Flags [.], cksum 0x7b52 (correct), ack 225, win 58, options [nop,nop,TS val 667580847 ecr 667580847], length 0 58 17:16:48.787715 IP (tos 0xc0, ttl 1, id 31533, offset 0, flags [DF], proto TCP (6), length 100) 1.0.3.1.35169 > 1.0.3.2.179: Flags [P.], cksum 0x8636 (correct), seq 182:230, ack 88, win 58, options [nop,nop,TS val 667580847 ecr 667579139], length 48: BGP Update Message (2), length: 48 Withdrawn routes: 4.4.4.4/32 5.5.5.5/32 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 End-of-Rib Marker (empty NLRI) 59 17:16:48.787775 IP (tos 0xc0, ttl 1, id 20412, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.2.179 > 1.0.3.1.35169: Flags [.], cksum 0xf941 (correct), ack 230, win 57, options [nop,nop,TS val 667580847 ecr 667580847], length 0 60 17:16:48.787882 IP (tos 0xc0, ttl 1, id 32536, offset 0, flags [DF], proto TCP (6), length 100) 1.0.4.1.34883 > 1.0.4.2.179: Flags [P.], cksum 0x1be8 (correct), seq 199:247, ack 82, win 58, options [nop,nop,TS val 667580847 ecr 667579663], length 48: BGP Update Message (2), length: 48 Withdrawn routes: 4.4.4.4/32 5.5.5.5/32 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 End-of-Rib Marker (empty NLRI) 61 17:16:48.787979 IP (tos 0xc0, ttl 1, id 35917, offset 0, flags [DF], proto TCP (6), length 52) 1.0.4.2.179 > 1.0.4.1.34883: Flags [.], cksum 0x90ff (correct), ack 247, win 57, options [nop,nop,TS val 667580847 ecr 667580847], length 0 62 17:16:50.013864 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.0.2 tell 1.0.0.1, length 28 63 17:16:50.013955 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.0.2 is-at 02:01:00:01:00:00, length 28 64 17:16:50.013999 IP (tos 0xc0, ttl 1, id 51208, offset 0, flags [DF], proto TCP (6), length 60) 1.0.0.1.33993 > 1.0.0.2.179: Flags [S], cksum 0x737c (correct), seq 2237510377, win 29200, options [mss 1460,sackOK,TS val 667581153 ecr 0,nop,wscale 9], length 0 65 17:16:50.014051 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) 1.0.0.2.179 > 1.0.0.1.33993: Flags [S.], cksum 0x6285 (correct), seq 60517262, ack 2237510378, win 28960, options [mss 1460,sackOK,TS val 667581154 ecr 667581153,nop,wscale 9], length 0 66 17:16:50.014085 IP (tos 0xc0, ttl 1, id 51209, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.1.33993 > 1.0.0.2.179: Flags [.], cksum 0x0239 (correct), ack 1, win 58, options [nop,nop,TS val 667581154 ecr 667581154], length 0 67 17:16:50.014154 IP (tos 0xc0, ttl 1, id 51210, offset 0, flags [DF], proto TCP (6), length 101) 1.0.0.1.33993 > 1.0.0.2.179: Flags [P.], cksum 0xc88a (correct), seq 1:50, ack 1, win 58, options [nop,nop,TS val 667581154 ecr 667581154], length 49: BGP Open Message (1), length: 49 Version 4, my AS 1, Holdtime 180s, ID 0.0.0.1 Optional parameters, length: 20 Option Capabilities Advertisement (2), length: 18 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) 32-Bit AS Number (65), length: 4 4 Byte AS 1 Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 68 17:16:50.014191 IP (tos 0xc0, ttl 255, id 4461, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.2.179 > 1.0.0.1.33993: Flags [.], cksum 0x0209 (correct), ack 50, win 57, options [nop,nop,TS val 667581154 ecr 667581154], length 0 69 17:16:50.016103 IP (tos 0xc0, ttl 1, id 4462, offset 0, flags [DF], proto TCP (6), length 107) 1.0.0.2.179 > 1.0.0.1.33993: Flags [P.], cksum 0x1b21 (correct), seq 1:56, ack 50, win 57, options [nop,nop,TS val 667581154 ecr 667581154], length 55: BGP Open Message (1), length: 55 Version 4, my AS 23456, Holdtime 180s, ID 0.0.1.1 Optional parameters, length: 26 Option Capabilities Advertisement (2), length: 24 Multiprotocol Extensions (1), length: 4 AFI IPv4 (1), SAFI Unicast (1) Route Refresh (2), length: 0 Graceful Restart (64), length: 2 Restart Flags: [none], Restart Time 300s 32-Bit AS Number (65), length: 4 4 Byte AS 2764334674 Multiple Paths (69), length: 4 AFI IPv4 (1), SAFI Unicast (1), Send/Receive: Receive 70 17:16:50.016174 IP (tos 0xc0, ttl 1, id 51211, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.1.33993 > 1.0.0.2.179: Flags [.], cksum 0x01d1 (correct), ack 56, win 58, options [nop,nop,TS val 667581154 ecr 667581154], length 0 71 17:16:50.016211 IP (tos 0xc0, ttl 1, id 4463, offset 0, flags [DF], proto TCP (6), length 71) 1.0.0.2.179 > 1.0.0.1.33993: Flags [P.], cksum 0xfda3 (correct), seq 56:75, ack 50, win 57, options [nop,nop,TS val 667581154 ecr 667581154], length 19: BGP Keepalive Message (4), length: 19 72 17:16:50.016237 IP (tos 0xc0, ttl 1, id 51212, offset 0, flags [DF], proto TCP (6), length 71) 1.0.0.1.33993 > 1.0.0.2.179: Flags [P.], cksum 0xfda2 (correct), seq 50:69, ack 56, win 58, options [nop,nop,TS val 667581154 ecr 667581154], length 19: BGP Keepalive Message (4), length: 19 73 17:16:50.058022 IP (tos 0xc0, ttl 1, id 51213, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.1.33993 > 1.0.0.2.179: Flags [.], cksum 0x01a0 (correct), ack 75, win 58, options [nop,nop,TS val 667581165 ecr 667581154], length 0 74 17:16:50.058072 IP (tos 0xc0, ttl 1, id 4464, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.2.179 > 1.0.0.1.33993: Flags [.], cksum 0x01a1 (correct), ack 69, win 57, options [nop,nop,TS val 667581165 ecr 667581154], length 0 75 17:16:50.058122 IP (tos 0xc0, ttl 1, id 51214, offset 0, flags [DF], proto TCP (6), length 139) 1.0.0.1.33993 > 1.0.0.2.179: Flags [P.], cksum 0x3bd3 (correct), seq 69:156, ack 75, win 58, options [nop,nop,TS val 667581165 ecr 667581165], length 87: BGP Update Message (2), length: 68 Origin (1), length: 1, Flags [T]: Incomplete AS Path (2), length: 6, Flags [T]: 1 Next Hop (3), length: 4, Flags [T]: 1.0.0.1 Updated routes: 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 4.4.4.4/32 5.5.5.5/32 Keepalive Message (4), length: 19 76 17:16:50.058139 IP (tos 0xc0, ttl 1, id 4465, offset 0, flags [DF], proto TCP (6), length 71) 1.0.0.2.179 > 1.0.0.1.33993: Flags [P.], cksum 0xfd67 (correct), seq 75:94, ack 69, win 57, options [nop,nop,TS val 667581165 ecr 667581165], length 19: BGP Keepalive Message (4), length: 19 77 17:16:50.058175 IP (tos 0xc0, ttl 1, id 51215, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.1.33993 > 1.0.0.2.179: Flags [.], cksum 0x012b (correct), ack 94, win 58, options [nop,nop,TS val 667581165 ecr 667581165], length 0 78 17:16:50.058200 IP (tos 0xc0, ttl 1, id 4466, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.2.179 > 1.0.0.1.33993: Flags [.], cksum 0x012c (correct), ack 156, win 57, options [nop,nop,TS val 667581165 ecr 667581165], length 0 79 17:16:50.059057 IP (tos 0xc0, ttl 1, id 31534, offset 0, flags [DF], proto TCP (6), length 124) 1.0.3.1.35169 > 1.0.3.2.179: Flags [P.], cksum 0x2740 (correct), seq 230:302, ack 88, win 58, options [nop,nop,TS val 667581165 ecr 667580847], length 72: BGP Update Message (2), length: 72 Origin (1), length: 1, Flags [T]: Incomplete AS Path (2), length: 10, Flags [T]: 2764334674 1 Next Hop (3), length: 4, Flags [T]: 1.0.3.1 Updated routes: 4.4.4.4/32 5.5.5.5/32 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 80 17:16:50.059158 IP (tos 0xc0, ttl 1, id 20413, offset 0, flags [DF], proto TCP (6), length 52) 1.0.3.2.179 > 1.0.3.1.35169: Flags [.], cksum 0xf67d (correct), ack 302, win 57, options [nop,nop,TS val 667581165 ecr 667581165], length 0 81 17:16:50.059211 IP (tos 0xc0, ttl 1, id 32537, offset 0, flags [DF], proto TCP (6), length 133) 1.0.4.1.34883 > 1.0.4.2.179: Flags [P.], cksum 0x26a1 (correct), seq 247:328, ack 82, win 58, options [nop,nop,TS val 667581165 ecr 667580847], length 81: BGP Update Message (2), length: 81 Origin (1), length: 1, Flags [T]: Incomplete AS Path (2), length: 6, Flags [T]: 23456 1 Next Hop (3), length: 4, Flags [T]: 1.0.4.1 AS4 Path (17), length: 10, Flags [OT]: 2764334674 1 Updated routes: 4.4.4.4/32 5.5.5.5/32 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 82 17:16:50.059258 IP (tos 0xc0, ttl 1, id 35918, offset 0, flags [DF], proto TCP (6), length 52) 1.0.4.2.179 > 1.0.4.1.34883: Flags [.], cksum 0x8e32 (correct), ack 328, win 57, options [nop,nop,TS val 667581165 ecr 667581165], length 0 83 17:16:50.059271 IP (tos 0xc0, ttl 1, id 7409, offset 0, flags [DF], proto TCP (6), length 133) 1.0.2.2.42741 > 1.0.2.1.179: Flags [P.], cksum 0x0ff7 (correct), seq 94:175, ack 225, win 58, options [nop,nop,TS val 667581165 ecr 667580847], length 81: BGP Update Message (2), length: 81 Origin (1), length: 1, Flags [T]: Incomplete AS Path (2), length: 6, Flags [T]: 23456 1 Next Hop (3), length: 4, Flags [T]: 1.0.2.2 AS4 Path (17), length: 10, Flags [OT]: 2764334674 1 Updated routes: 4.4.4.4/32 5.5.5.5/32 1.1.1.1/32 2.2.2.2/32 3.3.3.3/32 84 17:16:50.101992 IP (tos 0xc0, ttl 1, id 19335, offset 0, flags [DF], proto TCP (6), length 52) 1.0.2.1.179 > 1.0.2.2.42741: Flags [.], cksum 0x787b (correct), ack 175, win 57, options [nop,nop,TS val 667581176 ecr 667581165], length 0 85 17:17:00.407659 IP (tos 0xc0, ttl 1, id 4467, offset 0, flags [DF], proto TCP (6), length 73) 1.0.0.2.179 > 1.0.0.1.33993: Flags [P.], cksum 0xedd8 (correct), seq 94:115, ack 156, win 57, options [nop,nop,TS val 667583752 ecr 667581165], length 21: BGP Notification Message (3), length: 21, Cease (6), subcode Other Configuration Change (6) 86 17:17:00.407721 IP (tos 0xc0, ttl 1, id 51216, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.1.33993 > 1.0.0.2.179: Flags [.], cksum 0xecdf (correct), ack 115, win 58, options [nop,nop,TS val 667583752 ecr 667583752], length 0 87 17:17:00.407840 IP (tos 0xc0, ttl 1, id 4468, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.2.179 > 1.0.0.1.33993: Flags [F.], cksum 0xecdf (correct), seq 115, ack 156, win 57, options [nop,nop,TS val 667583752 ecr 667583752], length 0 88 17:17:00.408010 IP (tos 0xc0, ttl 1, id 51217, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.1.33993 > 1.0.0.2.179: Flags [F.], cksum 0xecdd (correct), seq 156, ack 116, win 58, options [nop,nop,TS val 667583752 ecr 667583752], length 0 89 17:17:00.408059 IP (tos 0xc0, ttl 1, id 4469, offset 0, flags [DF], proto TCP (6), length 52) 1.0.0.2.179 > 1.0.0.1.33993: Flags [.], cksum 0xecde (correct), ack 157, win 57, options [nop,nop,TS val 667583752 ecr 667583752], length 0 90 17:17:00.444510 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.0.1 tell 192.168.201.17, length 28 91 17:17:00.444552 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.0.1 is-at da:b0:33:db:52:8f, length 28 @ 1.1.1.1 log @Import tcpdump-4.99.4 (last was 4.9.3) Friday, April 7, 2023 / The Tcpdump Group Summary for 4.99.4 tcpdump release Source code: Fix spaces before tabs in indentation. Updated printers: LSP ping: Fix "Unused value" warnings from Coverity. CVE-2023-1801: Fix an out-of-bounds write in the SMB printer. DNS: sync resource types with IANA. ICMPv6: Update the output to show a RPL DAO field name. Geneve: Fix the Geneve UDP port test. Building and testing: Require at least autoconf 2.69. Don't check for strftime(), as it's in C90 and beyond. Update config.{guess,sub}, timestamps 2023-01-01,2023-01-21. Documentation: man: Document TCP flag names better. Thursday, January 12, 2023 / The Tcpdump Group Summary for 4.99.3 tcpdump release Updated printers: PTP: Use the proper values for the control field and print un-allocated values for the message field as "Reserved" instead of "none". Source code: smbutil.c: Replace obsolete function call (asctime) Building and testing: cmake: Update the minimum required version to 2.8.12 (except Windows). CI: Introduce and use TCPDUMP_CMAKE_TAINTED. Makefile.in: Add the releasecheck target. Makefile.in: Add "make -s install" in the releasecheck target. Cirrus CI: Run the "make releasecheck" command in the Linux task. Makefile.in: Add the whitespacecheck target. Cirrus CI: Run the "make whitespacecheck" command in the Linux task. Address all shellcheck warnings in update-test.sh. Makefile.in: Get rid of a remain of gnuc.h. Documentation: Reformat the installation notes (INSTALL.txt) in Markdown. Convert CONTRIBUTING to Markdown. CONTRIBUTING.md: Document the use of "protocol: " in a commit summary. Add a README file for NetBSD. Fix CMake build to set man page section numbers in tcpdump.1 Saturday, December 31, 2022 / The Tcpdump Group Summary for 4.99.2 tcpdump release Updated printers: BGP: Update cease notification decoding to RFC 9003. BGP: decode BGP link-bandwidth extended community properly. BGP: Fix parsing the AIGP attribute BGP: make sure the path attributes don't go past the end of the packet. BGP: Shutdown message can be up to 255 bytes length according to rfc9003 DSA: correctly determine VID. EAP: fix some length checks and output issues. 802.11: Fix the misleading comment regarding "From DS", "To DS" Frame Control Flags. 802.11: Fetch the CF and TIM IEs a field at a time. 802.15.4, BGP, LISP: fix some length checks, compiler warnings, and undefined behavior warnings. PFLOG: handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all OSes. RRCP: support more Realtek protocols than just RRCP. MPLS: show the EXP field as TC, as per RFC 5462. ICMP: redo MPLS Extension code as general ICMP Extension code. VQP: Do not print unknown error codes twice. Juniper: Add some bounds checks. Juniper: Don't treat known DLT_ types as "Unknown". lwres: Fix a length check, update a variable type. EAP: Fix some undefined behaviors at runtime. Ethernet: Rework the length checks, add a length check. IPX: Add two length checks. Zephyr: Avoid printing non-ASCII characters. VRRP: Print the protocol name before any GET_(). DCCP: Get rid of trailing commas in lists. Juniper: Report invalid packets as invalid, not truncated. IPv6: Remove an obsolete code in an always-false #if wrapper. ISAKMP: Use GET_U_1() to replace a direct dereference. RADIUS: Use GET_U_1() to replace a direct dereference. TCP: Fix an invalid check. RESP: Fix an invalid check. RESP: Remove an unnecessary test. Arista: Refine the output format and print HwInfo. sFlow: add support for IPv6 agent, add a length check. VRRP: add support for IPv6. OSPF: Update to match the Router Properties registry. OSPF: Remove two unnecessary dereferences. OSPF: Add support bit Nt RFC3101. OSPFv3: Remove two unnecessary dereferences. ICMPv6: Fix output for Router Renumbering messages. ICMPv6: Fix the Node Information flags. ICMPv6: Remove an unused macro and extra blank lines. ICMPv6: Add a length check in the rpl_dio_print() function. ICMPv6: Use GET_IP6ADDR_STRING() in the rpl_dio_print() function. IPv6: Add some checks for the Hop-by-Hop Options header IPv6: Add a check for the Jumbo Payload Hop-by-Hop option. NFS: Fix the format for printing an unsigned int PTP: fix printing of the correction fields PTP: Use ND_LCHECK_U for checking invalid length. WHOIS: Add its own printer source file and printer function MPTCP: print length before subtype inside MPTCP options ESP: Add a workaround to a "use-of-uninitialized-value". PPP: Add tests to avoid incorrectly re-entering ppp_hdlc(). PPP: Don't process further if protocol is unknown (-e option). PPP: Change the pointer to packet data. ZEP: Add three length checks. Add some const qualifiers. Building and testing: Update config.guess and config.sub. Use AS_HELP_STRING macro instead of AC_HELP_STRING. Handle some Autoconf/make errors better. Fix an error when cross-compiling. Use "git archive" for the "make releasetar" process. Remove the release candidate rcX targets. Mend "make check" on Solaris 9 with Autoconf. Address assorted compiler warnings. Fix auto-enabling of Capsicum on FreeBSD with Autoconf. Treat "msys" as Windows for test exit statuses. Clean up some help messages in configure. Use unified diff by default. Remove awk code from mkdep. Fix configure test errors with Clang 15 CMake: Prevent stripping of the RPATH on installation. AppVeyor CI: update Npcap site, update to 1.12 SDK. Cirrus CI: Use the same configuration as for the main branch. CI: Add back running tcpdump -J/-L and capture, now with Cirrus VMs. Remove four test files (They are now in the libpcap tests directory). On Solaris, for 64-bit builds, use the 64-bit pcap-config. Tell CMake not to check for a C++ compiler. CMake: Add a way to request -Werror and equivalents. configure: Special-case macOS /usr/bin/pcap-config as we do in CMake. configure: Use pcap-config --static-pcap-only if available. configure: Use ac_c_werror_flag to force unknown compiler flags to fail. configure: Use AC_COMPILE_IFELSE() and AC_LANG_SOURCE() for testing flags. Run the test that fails on OpenBSD only if we're not on OpenBSD. Source code: Fix some snapend-changing routines to protect against pointer underflow. Use __func__ from C99 in some function calls. Memory allocator: Update nd_add_alloc_list() to a static function. addrtoname.c: Fix two invalid tests. Use more S_SUCCESS and S_ERR_HOST_PROGRAM in main(). Add some comments about "don't use GET_IP6ADDR_STRING()". Assign ndo->ndo_packetp in pretty_print_packet(). Add ND_LCHECKMSG_U, ND_LCHECK_U, ND_LCHECKMSG_ZU and ND_LCHECK_ZU macros. Update tok2strbuf() to a static function. netdissect.h: Keep the link-layer dissectors names sorted. setsignal(): Set SA_RESTART on non-lethal signals (REQ_INFO, FLUSH_PCAP) to avoid corrupting binary pcap output. Use __builtin_unreachable(). Fail if nd_push_buffer() or nd_push_snaplen() fails. Improve code style and fix many typos. Documentation: Some man page cleanups. Update the print interface for the packet count to stdout. Note that we require compilers to support at least some of C99. Update AIX and Solaris-related specifics. INSTALL.txt: Add doc/README.*, delete the deleted win32 directory. Update README.md and README.Win32.md. Update some comments with new RFC numbers. Wednesday, June 9, 2021 by gharris Summary for 4.99.1 tcpdump release Source code: Squelch some compiler warnings ICMP: Update the snapend for some nested IP packets. MACsec: Update the snapend thus the ICV field is not payload for the caller. EIGRP: Fix packet header fields SMB: Disable printer by default in CMake builds OLSR: Print the protocol name even if the packet is invalid MSDP: Print ": " before the protocol name ESP: Remove padding, padding length and next header from the buffer DHCPv6: Update the snapend for nested DHCPv6 packets OpenFlow 1.0: Get snapend right for nested frames. TCP: Update the snapend before decoding a MPTCP option Ethernet, IEEE 802.15.4, IP, L2TP, TCP, ZEP: Add bounds checks ForCES: Refine SPARSEDATA-TLV length check. ASCII/hex: Use nd_trunc_longjmp() in truncation cases GeoNet: Add a ND_TCHECK_LEN() call Replace ND_TCHECK_/memcpy() pairs with GET_CPY_BYTES(). BGP: Fix overwrites of global 'astostr' temporary buffer ARP: fix overwrites of static buffer in q922_string(). Frame Relay: have q922_string() handle errors better. Building and testing: Rebuild configure script when building release Fix "make clean" for out-of-tree autotools builds CMake: add stuff from CMAKE_PREFIX_PATH to PKG_CONFIG_PATH. Documentation: man: Update a reference as www.cifs.org is gone. [skip ci] man: Update DNS sections Solaris: Fix a compile error with Sun C Wednesday, December 30, 2020, by mcr@@sandelman.ca, denis and fxl. Summary for 4.99.0 tcpdump release CVE-2018-16301: For the -F option handle large input files safely. Improve the contents, wording and formatting of the man page. Print unsupported link-layer protocol packets in hex. Add support for new network protocols and DLTs: Arista, Autosar SOME/IP, Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch Architecture, OpenFlow 1.3, Precision Time Protocol (PTP), SSH, WHOIS, ZigBee Encapsulation Protocol (ZEP). Make protocol-specific updates for: AH, DHCP, DNS, ESP, FRF.16, HNCP, ICMP6, IEEE 802.15.4, IPv6, IS-IS, Linux SLL, LLDP, LSP ping, MPTCP, NFS, NSH, NTP, OSPF, OSPF6, PGM, PIM, PPTP, RADIUS, RSVP, Rx, SMB, UDLD, VXLAN-GPE. User interface: Make SLL2 the default for Linux "any" pseudo-device. Add --micro and --nano shorthands. Add --count to print a counter only instead of decoding. Add --print, to cause packet printing even with -w. Add support for remote capture if libpcap supports it. Display the "wireless" flag and connection status. Flush the output packet buffer on a SIGUSR2. Add the snapshot length to the "reading from file ..." message. Fix local time printing (DST offset in timestamps). Allow -C arguments > 2^31-1 GB if they can fit into a long. Handle very large -f files by rejecting them. Report periodic stats only when safe to do so. Print the number of packets captured only as often as necessary. With no -s, or with -s 0, don't specify the snapshot length with newer versions of libpcap. Improve version and usage message printing. Building and testing: Install into bindir, not sbindir. autoconf: replace --with-system-libpcap with --disable-local-libpcap. Require the compiler to support C99. Better detect and use various C compilers and their features. Add CMake as the second build system. Make out-of-tree builds more reliable. Use pkg-config to detect libpcap if available. Improve Windows support. Add more tests and improve the scripts that run them. Test both with "normal" and "x87" floating-point. Eliminate dependency on libdnet. FreeBSD: Print a proper error message about monitor mode VAP. Use libcasper if available. Fix failure to capture on RDMA device. Include the correct capsicum header. Source code: Start the transition to longjmp() for packet truncation handling. Introduce new helper functions, including GET_*(), nd_print_protocol(), nd_print_invalid(), nd_print_trunc(), nd_trunc_longjmp() and others. Put integer signedness right in many cases. Introduce nd_uint*, nd_mac_addr, nd_ipv4 and nd_ipv6 types to fix alignment issues, especially on SPARC. Fix many C compiler, Coverity, UBSan and cppcheck warnings. Fix issues detected with AddressSanitizer. Remove many workarounds for older compilers and OSes. Add a sanity check on packet header length. Add and remove plenty of bounds checks. Clean up pcap_findalldevs() call to find the first interface. Use a short timeout, rather than immediate mode, for text output. Handle DLT_ENC files *not* written on the same OS and byte-order host. Add, and use, macros to do locale-independent case mapping. Use a table instead of getprotobynumber(). Get rid of ND_UNALIGNED and ND_TCHECK(). Make roundup2() generally available. Resync SMI list against Wireshark. Fix many typos. @ text @@ 1.1.1.1.2.1 log @Sync with HEAD @ text @d1 3 a3 3 1 2019-04-11 17:16:39.743518 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.2.1 tell 1.0.2.2, length 28 2 2019-04-11 17:16:39.743599 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.2.1 is-at e2:c3:b4:8e:87:60, length 28 3 2019-04-11 17:16:39.743662 IP (tos 0xc0, ttl 1, id 7400, offset 0, flags [DF], proto TCP (6), length 60) d5 1 a5 1 4 2019-04-11 17:16:39.743720 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d7 1 a7 1 5 2019-04-11 17:16:39.743766 IP (tos 0xc0, ttl 1, id 7401, offset 0, flags [DF], proto TCP (6), length 52) d9 1 a9 1 6 2019-04-11 17:16:39.744246 IP (tos 0xc0, ttl 1, id 7402, offset 0, flags [DF], proto TCP (6), length 107) d24 1 a24 1 7 2019-04-11 17:16:39.744347 IP (tos 0xc0, ttl 255, id 19329, offset 0, flags [DF], proto TCP (6), length 52) d26 1 a26 1 8 2019-04-11 17:16:39.744506 IP (tos 0xc0, ttl 1, id 19330, offset 0, flags [DF], proto TCP (6), length 95) d36 1 a36 1 9 2019-04-11 17:16:39.744560 IP (tos 0xc0, ttl 1, id 7403, offset 0, flags [DF], proto TCP (6), length 52) d38 1 a38 1 10 2019-04-11 17:16:39.744600 IP (tos 0xc0, ttl 1, id 19331, offset 0, flags [DF], proto TCP (6), length 71) d41 1 a41 1 11 2019-04-11 17:16:39.744633 IP (tos 0xc0, ttl 1, id 7404, offset 0, flags [DF], proto TCP (6), length 52) d43 1 a43 1 12 2019-04-11 17:16:39.744742 IP (tos 0xc0, ttl 1, id 7405, offset 0, flags [DF], proto TCP (6), length 71) d46 1 a46 1 13 2019-04-11 17:16:39.745302 IP (tos 0xc0, ttl 1, id 19332, offset 0, flags [DF], proto TCP (6), length 147) d59 1 a59 1 14 2019-04-11 17:16:39.747791 IP (tos 0xc0, ttl 1, id 7406, offset 0, flags [DF], proto TCP (6), length 71) d62 1 a62 1 15 2019-04-11 17:16:39.747859 IP (tos 0xc0, ttl 1, id 19333, offset 0, flags [DF], proto TCP (6), length 71) d65 1 a65 1 16 2019-04-11 17:16:39.789886 IP (tos 0xc0, ttl 1, id 7407, offset 0, flags [DF], proto TCP (6), length 52) d67 3 a69 3 17 2019-04-11 17:16:39.973548 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.3.1 tell 1.0.3.2, length 28 18 2019-04-11 17:16:39.973652 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.3.1 is-at 02:01:00:01:00:00, length 28 19 2019-04-11 17:16:39.973684 IP (tos 0xc0, ttl 1, id 15676, offset 0, flags [DF], proto TCP (6), length 60) d71 1 a71 1 20 2019-04-11 17:16:39.973736 IP (tos 0xc0, ttl 64, id 38566, offset 0, flags [DF], proto TCP (6), length 40) d73 3 a75 3 21 2019-04-11 17:16:40.228227 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.4.1 tell 1.0.4.2, length 28 22 2019-04-11 17:16:40.228290 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.4.1 is-at 02:01:00:01:00:00, length 28 23 2019-04-11 17:16:40.228315 IP (tos 0xc0, ttl 1, id 62340, offset 0, flags [DF], proto TCP (6), length 60) d77 1 a77 1 24 2019-04-11 17:16:40.228362 IP (tos 0xc0, ttl 64, id 37983, offset 0, flags [DF], proto TCP (6), length 40) d79 1 a79 1 25 2019-04-11 17:16:41.765508 IP (tos 0xc0, ttl 1, id 31524, offset 0, flags [DF], proto TCP (6), length 60) d81 1 a81 1 26 2019-04-11 17:16:41.765624 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d83 1 a83 1 27 2019-04-11 17:16:41.765672 IP (tos 0xc0, ttl 1, id 31525, offset 0, flags [DF], proto TCP (6), length 52) d85 1 a85 1 28 2019-04-11 17:16:41.765953 IP (tos 0xc0, ttl 1, id 31526, offset 0, flags [DF], proto TCP (6), length 107) d100 1 a100 1 29 2019-04-11 17:16:41.766003 IP (tos 0xc0, ttl 255, id 20406, offset 0, flags [DF], proto TCP (6), length 52) d102 1 a102 1 30 2019-04-11 17:16:41.766223 IP (tos 0xc0, ttl 1, id 20407, offset 0, flags [DF], proto TCP (6), length 101) d114 1 a114 1 31 2019-04-11 17:16:41.766257 IP (tos 0xc0, ttl 1, id 31527, offset 0, flags [DF], proto TCP (6), length 52) d116 1 a116 1 32 2019-04-11 17:16:41.766325 IP (tos 0xc0, ttl 1, id 20408, offset 0, flags [DF], proto TCP (6), length 71) d119 1 a119 1 33 2019-04-11 17:16:41.766382 IP (tos 0xc0, ttl 1, id 31528, offset 0, flags [DF], proto TCP (6), length 52) d121 1 a121 1 34 2019-04-11 17:16:41.766407 IP (tos 0xc0, ttl 1, id 31529, offset 0, flags [DF], proto TCP (6), length 71) d124 1 a124 1 35 2019-04-11 17:16:41.767217 IP (tos 0xc0, ttl 1, id 20409, offset 0, flags [DF], proto TCP (6), length 71) d127 1 a127 1 36 2019-04-11 17:16:41.809917 IP (tos 0xc0, ttl 1, id 31530, offset 0, flags [DF], proto TCP (6), length 52) d129 1 a129 1 37 2019-04-11 17:16:41.910018 IP (tos 0xc0, ttl 1, id 31531, offset 0, flags [DF], proto TCP (6), length 140) d141 1 a141 1 38 2019-04-11 17:16:41.953948 IP (tos 0xc0, ttl 1, id 20410, offset 0, flags [DF], proto TCP (6), length 52) d143 1 a143 1 39 2019-04-11 17:16:41.953985 IP (tos 0xc0, ttl 1, id 31532, offset 0, flags [DF], proto TCP (6), length 71) d146 1 a146 1 40 2019-04-11 17:16:41.954030 IP (tos 0xc0, ttl 1, id 20411, offset 0, flags [DF], proto TCP (6), length 52) d148 1 a148 1 41 2019-04-11 17:16:44.004905 IP (tos 0xc0, ttl 1, id 32529, offset 0, flags [DF], proto TCP (6), length 60) d150 1 a150 1 42 2019-04-11 17:16:44.005000 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d152 1 a152 1 43 2019-04-11 17:16:44.005041 IP (tos 0xc0, ttl 1, id 32530, offset 0, flags [DF], proto TCP (6), length 52) d154 1 a154 1 44 2019-04-11 17:16:44.005158 IP (tos 0xc0, ttl 1, id 32531, offset 0, flags [DF], proto TCP (6), length 107) d169 1 a169 1 45 2019-04-11 17:16:44.005201 IP (tos 0xc0, ttl 255, id 35912, offset 0, flags [DF], proto TCP (6), length 52) d171 1 a171 1 46 2019-04-11 17:16:44.005349 IP (tos 0xc0, ttl 1, id 35913, offset 0, flags [DF], proto TCP (6), length 95) d181 1 a181 1 47 2019-04-11 17:16:44.005380 IP (tos 0xc0, ttl 1, id 32532, offset 0, flags [DF], proto TCP (6), length 52) d183 1 a183 1 48 2019-04-11 17:16:44.005420 IP (tos 0xc0, ttl 1, id 35914, offset 0, flags [DF], proto TCP (6), length 71) d186 1 a186 1 49 2019-04-11 17:16:44.005454 IP (tos 0xc0, ttl 1, id 32533, offset 0, flags [DF], proto TCP (6), length 52) d188 1 a188 1 50 2019-04-11 17:16:44.005544 IP (tos 0xc0, ttl 1, id 32534, offset 0, flags [DF], proto TCP (6), length 71) d191 1 a191 1 51 2019-04-11 17:16:44.006416 IP (tos 0xc0, ttl 1, id 35915, offset 0, flags [DF], proto TCP (6), length 71) d194 1 a194 1 52 2019-04-11 17:16:44.006470 IP (tos 0xc0, ttl 1, id 32535, offset 0, flags [DF], proto TCP (6), length 176) d208 1 a208 1 53 2019-04-11 17:16:44.049939 IP (tos 0xc0, ttl 1, id 35916, offset 0, flags [DF], proto TCP (6), length 52) d210 3 a212 3 54 2019-04-11 17:16:44.757924 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.2.2 tell 1.0.2.1, length 28 55 2019-04-11 17:16:44.757956 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.2.2 is-at 02:01:00:01:00:00, length 28 56 2019-04-11 17:16:48.787086 IP (tos 0xc0, ttl 1, id 19334, offset 0, flags [DF], proto TCP (6), length 100) d222 1 a222 1 57 2019-04-11 17:16:48.787130 IP (tos 0xc0, ttl 1, id 7408, offset 0, flags [DF], proto TCP (6), length 52) d224 1 a224 1 58 2019-04-11 17:16:48.787715 IP (tos 0xc0, ttl 1, id 31533, offset 0, flags [DF], proto TCP (6), length 100) d234 1 a234 1 59 2019-04-11 17:16:48.787775 IP (tos 0xc0, ttl 1, id 20412, offset 0, flags [DF], proto TCP (6), length 52) d236 1 a236 1 60 2019-04-11 17:16:48.787882 IP (tos 0xc0, ttl 1, id 32536, offset 0, flags [DF], proto TCP (6), length 100) d246 1 a246 1 61 2019-04-11 17:16:48.787979 IP (tos 0xc0, ttl 1, id 35917, offset 0, flags [DF], proto TCP (6), length 52) d248 3 a250 3 62 2019-04-11 17:16:50.013864 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.0.2 tell 1.0.0.1, length 28 63 2019-04-11 17:16:50.013955 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.0.2 is-at 02:01:00:01:00:00, length 28 64 2019-04-11 17:16:50.013999 IP (tos 0xc0, ttl 1, id 51208, offset 0, flags [DF], proto TCP (6), length 60) d252 1 a252 1 65 2019-04-11 17:16:50.014051 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d254 1 a254 1 66 2019-04-11 17:16:50.014085 IP (tos 0xc0, ttl 1, id 51209, offset 0, flags [DF], proto TCP (6), length 52) d256 1 a256 1 67 2019-04-11 17:16:50.014154 IP (tos 0xc0, ttl 1, id 51210, offset 0, flags [DF], proto TCP (6), length 101) d268 1 a268 1 68 2019-04-11 17:16:50.014191 IP (tos 0xc0, ttl 255, id 4461, offset 0, flags [DF], proto TCP (6), length 52) d270 1 a270 1 69 2019-04-11 17:16:50.016103 IP (tos 0xc0, ttl 1, id 4462, offset 0, flags [DF], proto TCP (6), length 107) d285 1 a285 1 70 2019-04-11 17:16:50.016174 IP (tos 0xc0, ttl 1, id 51211, offset 0, flags [DF], proto TCP (6), length 52) d287 1 a287 1 71 2019-04-11 17:16:50.016211 IP (tos 0xc0, ttl 1, id 4463, offset 0, flags [DF], proto TCP (6), length 71) d290 1 a290 1 72 2019-04-11 17:16:50.016237 IP (tos 0xc0, ttl 1, id 51212, offset 0, flags [DF], proto TCP (6), length 71) d293 1 a293 1 73 2019-04-11 17:16:50.058022 IP (tos 0xc0, ttl 1, id 51213, offset 0, flags [DF], proto TCP (6), length 52) d295 1 a295 1 74 2019-04-11 17:16:50.058072 IP (tos 0xc0, ttl 1, id 4464, offset 0, flags [DF], proto TCP (6), length 52) d297 1 a297 1 75 2019-04-11 17:16:50.058122 IP (tos 0xc0, ttl 1, id 51214, offset 0, flags [DF], proto TCP (6), length 139) d310 1 a310 1 76 2019-04-11 17:16:50.058139 IP (tos 0xc0, ttl 1, id 4465, offset 0, flags [DF], proto TCP (6), length 71) d313 1 a313 1 77 2019-04-11 17:16:50.058175 IP (tos 0xc0, ttl 1, id 51215, offset 0, flags [DF], proto TCP (6), length 52) d315 1 a315 1 78 2019-04-11 17:16:50.058200 IP (tos 0xc0, ttl 1, id 4466, offset 0, flags [DF], proto TCP (6), length 52) d317 1 a317 1 79 2019-04-11 17:16:50.059057 IP (tos 0xc0, ttl 1, id 31534, offset 0, flags [DF], proto TCP (6), length 124) d329 1 a329 1 80 2019-04-11 17:16:50.059158 IP (tos 0xc0, ttl 1, id 20413, offset 0, flags [DF], proto TCP (6), length 52) d331 1 a331 1 81 2019-04-11 17:16:50.059211 IP (tos 0xc0, ttl 1, id 32537, offset 0, flags [DF], proto TCP (6), length 133) d344 1 a344 1 82 2019-04-11 17:16:50.059258 IP (tos 0xc0, ttl 1, id 35918, offset 0, flags [DF], proto TCP (6), length 52) d346 1 a346 1 83 2019-04-11 17:16:50.059271 IP (tos 0xc0, ttl 1, id 7409, offset 0, flags [DF], proto TCP (6), length 133) d359 1 a359 1 84 2019-04-11 17:16:50.101992 IP (tos 0xc0, ttl 1, id 19335, offset 0, flags [DF], proto TCP (6), length 52) d361 1 a361 1 85 2019-04-11 17:17:00.407659 IP (tos 0xc0, ttl 1, id 4467, offset 0, flags [DF], proto TCP (6), length 73) d364 1 a364 1 86 2019-04-11 17:17:00.407721 IP (tos 0xc0, ttl 1, id 51216, offset 0, flags [DF], proto TCP (6), length 52) d366 1 a366 1 87 2019-04-11 17:17:00.407840 IP (tos 0xc0, ttl 1, id 4468, offset 0, flags [DF], proto TCP (6), length 52) d368 1 a368 1 88 2019-04-11 17:17:00.408010 IP (tos 0xc0, ttl 1, id 51217, offset 0, flags [DF], proto TCP (6), length 52) d370 1 a370 1 89 2019-04-11 17:17:00.408059 IP (tos 0xc0, ttl 1, id 4469, offset 0, flags [DF], proto TCP (6), length 52) d372 2 a373 2 90 2019-04-11 17:17:00.444510 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.0.1 tell 192.168.201.17, length 28 91 2019-04-11 17:17:00.444552 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.0.1 is-at da:b0:33:db:52:8f, length 28 @ 1.1.1.2 log @Import tcpdump-4.99.5, previous was 4.99.4 Friday, August 30, 2024 / The Tcpdump Group Summary for 4.99.5 tcpdump release Refine protocol decoding for: Arista: Use the test .pcap file from pull request #955 (HwInfo). BGP: Fix an undefined behavior when it tries to parse a too-short packet. CARP: Print the protocol name before any GET_(). CDP: only hex-dump unknown TLVs in verbose mode. DHCP: parse the SZTP redirect tag. DHCPv6: client-id/server-id DUID type 2 correction; parse the user class, boot file URL, and SZTP redirect options; add DUID-UUID printing (RFC6355). DNS: Detect and correctly handle too-short URI RRs. EAP: Assign ndo_protocol in the eap_print() function. ESP: Don't use EVP_add_cipher_alias() (fixes building on OpenBSD 7.5). Frame Relay (Multilink): Fix the Timestamp Information Element printing. ICMPv6: Fix printing the Home Agent Address Discovery Reply Message. IEEE 802.11: no need for an element ID in the structures for IEs, make the length in the IE structures a u_int, include the "TA" field while printing Block Ack Control frame. IP: Enable TSO (TCP Segmentation Offload) support; fix printing invalid cases as invalid, not truncated; use ND_ICHECKMSG_ZU() to test the header length. IPv6: Fix printing invalid cases as invalid, not truncated; use ND_ICHECKMSG_U() to print an invalid version. IPv6: Fix invalid 32-bit versus 64-bit printouts of fragment headers. ISAKMP: Fix printing Delete payload SPI when size is zero. Kerberos: Print the protocol name, remove a redundant bounds check. lwres: Fix an undefined behavior in pointer arithmetic. OpenFlow 1.0: Fix indentation of PORT_MOD, improve handling of some lengths, and fix handling of snapend. TCP: Test ports < 1024 in port order to select the printer. UDP: Move source port equal BCM_LI_PORT to bottom of long if else chain. UDP: Test ports < 1024 in port order to select the printer. LDP: Add missing fields of the Common Session Parameters TLV and fix the offset for the A&D bits. NFLOG: Use correct AF code points on all OSes. NFS: Avoid printing non-ASCII characters. OSPF: Pad TLVs in LS_OPAQUE_TYPE_RI to multiples of 4 bytes. OSPF: Update LS-Ack printing not to run off the end of the packet. OSPF6: Fix an undefined behavior. pflog: use nd_ types in struct pfloghdr. PPP: Check if there is some data to hexdump. PPP: Remove an extra colon before LCP Callback Operation. Use the buffer stack for de-escaping PPP; fixes CVE-2024-2397; Note: This problem does not affect any tcpdump release. PTP: Fix spelling of type SIGNALING, Parse major and minor version correctly, Print majorSdoId field instead of just the first bit. RIP: Make a couple trivial protocol updates. RPKI-Router: Refine length and bounds checks. RX: Use the "%Y-%m-%d" date format. smbutil.c: Use the "%Y-%m-%d" date format. SNMP: Fix two undefined behaviors. Text protocols: Fix printing truncation if it is not the case. ZEP: Use the "%Y-%m-%d" date format. ZMTP: Replace custom code with bittok2str(). User interface: Print the supported time stamp types (-J) to stdout instead of stderr. Print the list of data link types (-L) to stdout instead of stderr. Use symmetrical quotation characters in error messages. Update --version option to print 32/64-bit build and time_t size. Improve error messages for invalid interface indexes specified with -i. Support "3des" as an alias for "des_ede3_cbc" even if the crypto library doesn't support adding aliases. Source code: tcpdump: Fix a memory leak. child_cleanup: reap as many child processes as possible. Ignore failures when setting the default "any" device DLL to LINUX_SLL2. Fix for backends which doesn't support capsicum. Update ND_BYTES_BETWEEN() macro for better accuracy. Update ND_BYTES_AVAILABLE_AFTER() macro for better accuracy. Introduce new ND_ICHECK*() macros to deduplicate more code. Skip privilege dropping when using -Z root on --with-user builds. Add a nd_printjn() function. Make nd_trunc_longjmp() not static inline. Include from netdissect.h. Remove init_crc10_table() and the entourage. Initialize tzcode early. Capsicum support: Fix a 'not defined' macro error. Update the "Error converting time" tests for packet times. Fix warnings when building for 32-bit and defining _TIME_BITS=64. Free interface list just before exiting where it wasn't being freed. Building and testing: Add a configure option to help debugging (--enable-instrument-functions). At build time require a proof of suitable snprintf(3) implementation in libc (and document Solaris 9 as unsupported because of that). Makefile.in: Add two "touch .devel" commands in the releasecheck target. Autoconf: Get --with-user and --with-chroot right. Autoconf: Fix --static-pcap-only test on Solaris 10. Autoconf: Add some warning flags for clang 13 or newer. Autoconf: Update config.{guess,sub}, timestamps 2024-01-01. Autoconf: Add autogen.sh, remove configure and config.h.in and put these generated files in the release tarball. Autoconf: Update the install-sh script to the 2020-11-14.01 version. configure: Apply autoupdate 2.69. CMake: improve the comment before project(tcpdump C). Do not require vsnprintf(). tests: Use the -tttt option, by default, for the tests. Autoconf, CMake: Get the size of a void * and a time_t. Fix propagation of cc_werr_cflags() output. Makefile.in: Fix the depend target. mkdep: Exit with a non-zero status if a command fails. Autoconf: use V_INCLS to update the list of include search paths. Autoconf: don't put anything before -I and -L flags for local libpcap. Autoconf, CMake: work around an Xcode 15+ issue. Autoconf, CMake: use pkg-config and Homebrew when looking for libcrypto. Fix Sun C invocation from CMake. mkdep: Use TMPDIR if it is set and not null. Add initial support for building with TinyCC. Makefile.in: Use the variable MAKE instead of the make command. Makefile.in: Add instrumentation configuration in releasecheck target. Make various improvements to the TESTrun script. Untangle detection of pcap_findalldevs(). Autoconf: don't use egrep, use $EGREP. Autoconf: check for gethostbyaddr(), not gethostbyname(). Autoconf, CMake: search for gethostbyaddr() in libnetwork. Make illumos build warning-free. Documentation: Fixed errors in doc/README.Win32.md and renamed it to README.windows.md. Make various improvements to the man page. Add initial README file for Haiku. Make various improvements to CONTRIBUTING.md. @ text @d1 3 a3 3 1 2019-04-11 17:16:39.743518 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.2.1 tell 1.0.2.2, length 28 2 2019-04-11 17:16:39.743599 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.2.1 is-at e2:c3:b4:8e:87:60, length 28 3 2019-04-11 17:16:39.743662 IP (tos 0xc0, ttl 1, id 7400, offset 0, flags [DF], proto TCP (6), length 60) d5 1 a5 1 4 2019-04-11 17:16:39.743720 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d7 1 a7 1 5 2019-04-11 17:16:39.743766 IP (tos 0xc0, ttl 1, id 7401, offset 0, flags [DF], proto TCP (6), length 52) d9 1 a9 1 6 2019-04-11 17:16:39.744246 IP (tos 0xc0, ttl 1, id 7402, offset 0, flags [DF], proto TCP (6), length 107) d24 1 a24 1 7 2019-04-11 17:16:39.744347 IP (tos 0xc0, ttl 255, id 19329, offset 0, flags [DF], proto TCP (6), length 52) d26 1 a26 1 8 2019-04-11 17:16:39.744506 IP (tos 0xc0, ttl 1, id 19330, offset 0, flags [DF], proto TCP (6), length 95) d36 1 a36 1 9 2019-04-11 17:16:39.744560 IP (tos 0xc0, ttl 1, id 7403, offset 0, flags [DF], proto TCP (6), length 52) d38 1 a38 1 10 2019-04-11 17:16:39.744600 IP (tos 0xc0, ttl 1, id 19331, offset 0, flags [DF], proto TCP (6), length 71) d41 1 a41 1 11 2019-04-11 17:16:39.744633 IP (tos 0xc0, ttl 1, id 7404, offset 0, flags [DF], proto TCP (6), length 52) d43 1 a43 1 12 2019-04-11 17:16:39.744742 IP (tos 0xc0, ttl 1, id 7405, offset 0, flags [DF], proto TCP (6), length 71) d46 1 a46 1 13 2019-04-11 17:16:39.745302 IP (tos 0xc0, ttl 1, id 19332, offset 0, flags [DF], proto TCP (6), length 147) d59 1 a59 1 14 2019-04-11 17:16:39.747791 IP (tos 0xc0, ttl 1, id 7406, offset 0, flags [DF], proto TCP (6), length 71) d62 1 a62 1 15 2019-04-11 17:16:39.747859 IP (tos 0xc0, ttl 1, id 19333, offset 0, flags [DF], proto TCP (6), length 71) d65 1 a65 1 16 2019-04-11 17:16:39.789886 IP (tos 0xc0, ttl 1, id 7407, offset 0, flags [DF], proto TCP (6), length 52) d67 3 a69 3 17 2019-04-11 17:16:39.973548 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.3.1 tell 1.0.3.2, length 28 18 2019-04-11 17:16:39.973652 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.3.1 is-at 02:01:00:01:00:00, length 28 19 2019-04-11 17:16:39.973684 IP (tos 0xc0, ttl 1, id 15676, offset 0, flags [DF], proto TCP (6), length 60) d71 1 a71 1 20 2019-04-11 17:16:39.973736 IP (tos 0xc0, ttl 64, id 38566, offset 0, flags [DF], proto TCP (6), length 40) d73 3 a75 3 21 2019-04-11 17:16:40.228227 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.4.1 tell 1.0.4.2, length 28 22 2019-04-11 17:16:40.228290 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.4.1 is-at 02:01:00:01:00:00, length 28 23 2019-04-11 17:16:40.228315 IP (tos 0xc0, ttl 1, id 62340, offset 0, flags [DF], proto TCP (6), length 60) d77 1 a77 1 24 2019-04-11 17:16:40.228362 IP (tos 0xc0, ttl 64, id 37983, offset 0, flags [DF], proto TCP (6), length 40) d79 1 a79 1 25 2019-04-11 17:16:41.765508 IP (tos 0xc0, ttl 1, id 31524, offset 0, flags [DF], proto TCP (6), length 60) d81 1 a81 1 26 2019-04-11 17:16:41.765624 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d83 1 a83 1 27 2019-04-11 17:16:41.765672 IP (tos 0xc0, ttl 1, id 31525, offset 0, flags [DF], proto TCP (6), length 52) d85 1 a85 1 28 2019-04-11 17:16:41.765953 IP (tos 0xc0, ttl 1, id 31526, offset 0, flags [DF], proto TCP (6), length 107) d100 1 a100 1 29 2019-04-11 17:16:41.766003 IP (tos 0xc0, ttl 255, id 20406, offset 0, flags [DF], proto TCP (6), length 52) d102 1 a102 1 30 2019-04-11 17:16:41.766223 IP (tos 0xc0, ttl 1, id 20407, offset 0, flags [DF], proto TCP (6), length 101) d114 1 a114 1 31 2019-04-11 17:16:41.766257 IP (tos 0xc0, ttl 1, id 31527, offset 0, flags [DF], proto TCP (6), length 52) d116 1 a116 1 32 2019-04-11 17:16:41.766325 IP (tos 0xc0, ttl 1, id 20408, offset 0, flags [DF], proto TCP (6), length 71) d119 1 a119 1 33 2019-04-11 17:16:41.766382 IP (tos 0xc0, ttl 1, id 31528, offset 0, flags [DF], proto TCP (6), length 52) d121 1 a121 1 34 2019-04-11 17:16:41.766407 IP (tos 0xc0, ttl 1, id 31529, offset 0, flags [DF], proto TCP (6), length 71) d124 1 a124 1 35 2019-04-11 17:16:41.767217 IP (tos 0xc0, ttl 1, id 20409, offset 0, flags [DF], proto TCP (6), length 71) d127 1 a127 1 36 2019-04-11 17:16:41.809917 IP (tos 0xc0, ttl 1, id 31530, offset 0, flags [DF], proto TCP (6), length 52) d129 1 a129 1 37 2019-04-11 17:16:41.910018 IP (tos 0xc0, ttl 1, id 31531, offset 0, flags [DF], proto TCP (6), length 140) d141 1 a141 1 38 2019-04-11 17:16:41.953948 IP (tos 0xc0, ttl 1, id 20410, offset 0, flags [DF], proto TCP (6), length 52) d143 1 a143 1 39 2019-04-11 17:16:41.953985 IP (tos 0xc0, ttl 1, id 31532, offset 0, flags [DF], proto TCP (6), length 71) d146 1 a146 1 40 2019-04-11 17:16:41.954030 IP (tos 0xc0, ttl 1, id 20411, offset 0, flags [DF], proto TCP (6), length 52) d148 1 a148 1 41 2019-04-11 17:16:44.004905 IP (tos 0xc0, ttl 1, id 32529, offset 0, flags [DF], proto TCP (6), length 60) d150 1 a150 1 42 2019-04-11 17:16:44.005000 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d152 1 a152 1 43 2019-04-11 17:16:44.005041 IP (tos 0xc0, ttl 1, id 32530, offset 0, flags [DF], proto TCP (6), length 52) d154 1 a154 1 44 2019-04-11 17:16:44.005158 IP (tos 0xc0, ttl 1, id 32531, offset 0, flags [DF], proto TCP (6), length 107) d169 1 a169 1 45 2019-04-11 17:16:44.005201 IP (tos 0xc0, ttl 255, id 35912, offset 0, flags [DF], proto TCP (6), length 52) d171 1 a171 1 46 2019-04-11 17:16:44.005349 IP (tos 0xc0, ttl 1, id 35913, offset 0, flags [DF], proto TCP (6), length 95) d181 1 a181 1 47 2019-04-11 17:16:44.005380 IP (tos 0xc0, ttl 1, id 32532, offset 0, flags [DF], proto TCP (6), length 52) d183 1 a183 1 48 2019-04-11 17:16:44.005420 IP (tos 0xc0, ttl 1, id 35914, offset 0, flags [DF], proto TCP (6), length 71) d186 1 a186 1 49 2019-04-11 17:16:44.005454 IP (tos 0xc0, ttl 1, id 32533, offset 0, flags [DF], proto TCP (6), length 52) d188 1 a188 1 50 2019-04-11 17:16:44.005544 IP (tos 0xc0, ttl 1, id 32534, offset 0, flags [DF], proto TCP (6), length 71) d191 1 a191 1 51 2019-04-11 17:16:44.006416 IP (tos 0xc0, ttl 1, id 35915, offset 0, flags [DF], proto TCP (6), length 71) d194 1 a194 1 52 2019-04-11 17:16:44.006470 IP (tos 0xc0, ttl 1, id 32535, offset 0, flags [DF], proto TCP (6), length 176) d208 1 a208 1 53 2019-04-11 17:16:44.049939 IP (tos 0xc0, ttl 1, id 35916, offset 0, flags [DF], proto TCP (6), length 52) d210 3 a212 3 54 2019-04-11 17:16:44.757924 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.2.2 tell 1.0.2.1, length 28 55 2019-04-11 17:16:44.757956 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.2.2 is-at 02:01:00:01:00:00, length 28 56 2019-04-11 17:16:48.787086 IP (tos 0xc0, ttl 1, id 19334, offset 0, flags [DF], proto TCP (6), length 100) d222 1 a222 1 57 2019-04-11 17:16:48.787130 IP (tos 0xc0, ttl 1, id 7408, offset 0, flags [DF], proto TCP (6), length 52) d224 1 a224 1 58 2019-04-11 17:16:48.787715 IP (tos 0xc0, ttl 1, id 31533, offset 0, flags [DF], proto TCP (6), length 100) d234 1 a234 1 59 2019-04-11 17:16:48.787775 IP (tos 0xc0, ttl 1, id 20412, offset 0, flags [DF], proto TCP (6), length 52) d236 1 a236 1 60 2019-04-11 17:16:48.787882 IP (tos 0xc0, ttl 1, id 32536, offset 0, flags [DF], proto TCP (6), length 100) d246 1 a246 1 61 2019-04-11 17:16:48.787979 IP (tos 0xc0, ttl 1, id 35917, offset 0, flags [DF], proto TCP (6), length 52) d248 3 a250 3 62 2019-04-11 17:16:50.013864 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.0.2 tell 1.0.0.1, length 28 63 2019-04-11 17:16:50.013955 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.0.2 is-at 02:01:00:01:00:00, length 28 64 2019-04-11 17:16:50.013999 IP (tos 0xc0, ttl 1, id 51208, offset 0, flags [DF], proto TCP (6), length 60) d252 1 a252 1 65 2019-04-11 17:16:50.014051 IP (tos 0xc0, ttl 255, id 0, offset 0, flags [DF], proto TCP (6), length 60) d254 1 a254 1 66 2019-04-11 17:16:50.014085 IP (tos 0xc0, ttl 1, id 51209, offset 0, flags [DF], proto TCP (6), length 52) d256 1 a256 1 67 2019-04-11 17:16:50.014154 IP (tos 0xc0, ttl 1, id 51210, offset 0, flags [DF], proto TCP (6), length 101) d268 1 a268 1 68 2019-04-11 17:16:50.014191 IP (tos 0xc0, ttl 255, id 4461, offset 0, flags [DF], proto TCP (6), length 52) d270 1 a270 1 69 2019-04-11 17:16:50.016103 IP (tos 0xc0, ttl 1, id 4462, offset 0, flags [DF], proto TCP (6), length 107) d285 1 a285 1 70 2019-04-11 17:16:50.016174 IP (tos 0xc0, ttl 1, id 51211, offset 0, flags [DF], proto TCP (6), length 52) d287 1 a287 1 71 2019-04-11 17:16:50.016211 IP (tos 0xc0, ttl 1, id 4463, offset 0, flags [DF], proto TCP (6), length 71) d290 1 a290 1 72 2019-04-11 17:16:50.016237 IP (tos 0xc0, ttl 1, id 51212, offset 0, flags [DF], proto TCP (6), length 71) d293 1 a293 1 73 2019-04-11 17:16:50.058022 IP (tos 0xc0, ttl 1, id 51213, offset 0, flags [DF], proto TCP (6), length 52) d295 1 a295 1 74 2019-04-11 17:16:50.058072 IP (tos 0xc0, ttl 1, id 4464, offset 0, flags [DF], proto TCP (6), length 52) d297 1 a297 1 75 2019-04-11 17:16:50.058122 IP (tos 0xc0, ttl 1, id 51214, offset 0, flags [DF], proto TCP (6), length 139) d310 1 a310 1 76 2019-04-11 17:16:50.058139 IP (tos 0xc0, ttl 1, id 4465, offset 0, flags [DF], proto TCP (6), length 71) d313 1 a313 1 77 2019-04-11 17:16:50.058175 IP (tos 0xc0, ttl 1, id 51215, offset 0, flags [DF], proto TCP (6), length 52) d315 1 a315 1 78 2019-04-11 17:16:50.058200 IP (tos 0xc0, ttl 1, id 4466, offset 0, flags [DF], proto TCP (6), length 52) d317 1 a317 1 79 2019-04-11 17:16:50.059057 IP (tos 0xc0, ttl 1, id 31534, offset 0, flags [DF], proto TCP (6), length 124) d329 1 a329 1 80 2019-04-11 17:16:50.059158 IP (tos 0xc0, ttl 1, id 20413, offset 0, flags [DF], proto TCP (6), length 52) d331 1 a331 1 81 2019-04-11 17:16:50.059211 IP (tos 0xc0, ttl 1, id 32537, offset 0, flags [DF], proto TCP (6), length 133) d344 1 a344 1 82 2019-04-11 17:16:50.059258 IP (tos 0xc0, ttl 1, id 35918, offset 0, flags [DF], proto TCP (6), length 52) d346 1 a346 1 83 2019-04-11 17:16:50.059271 IP (tos 0xc0, ttl 1, id 7409, offset 0, flags [DF], proto TCP (6), length 133) d359 1 a359 1 84 2019-04-11 17:16:50.101992 IP (tos 0xc0, ttl 1, id 19335, offset 0, flags [DF], proto TCP (6), length 52) d361 1 a361 1 85 2019-04-11 17:17:00.407659 IP (tos 0xc0, ttl 1, id 4467, offset 0, flags [DF], proto TCP (6), length 73) d364 1 a364 1 86 2019-04-11 17:17:00.407721 IP (tos 0xc0, ttl 1, id 51216, offset 0, flags [DF], proto TCP (6), length 52) d366 1 a366 1 87 2019-04-11 17:17:00.407840 IP (tos 0xc0, ttl 1, id 4468, offset 0, flags [DF], proto TCP (6), length 52) d368 1 a368 1 88 2019-04-11 17:17:00.408010 IP (tos 0xc0, ttl 1, id 51217, offset 0, flags [DF], proto TCP (6), length 52) d370 1 a370 1 89 2019-04-11 17:17:00.408059 IP (tos 0xc0, ttl 1, id 4469, offset 0, flags [DF], proto TCP (6), length 52) d372 2 a373 2 90 2019-04-11 17:17:00.444510 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 1.0.0.1 tell 192.168.201.17, length 28 91 2019-04-11 17:17:00.444552 ARP, Ethernet (len 6), IPv4 (len 4), Reply 1.0.0.1 is-at da:b0:33:db:52:8f, length 28 @